diff --git a/auto-setup.ps1 b/auto-setup.ps1
index c4afc0d..73ef933 100644
--- a/auto-setup.ps1
+++ b/auto-setup.ps1
@@ -860,26 +860,31 @@ function New-DesktopShortcuts {
         $newLnk = "$desktop\启动Bookworm.lnk"
         $shortcut = $shell.CreateShortcut($newLnk)
         $shortcut.TargetPath = $pwshExe
-        $shortcut.Arguments = "-NoLogo -NoExit -File `"$claudePs1`" --dangerously-skip-permissions"
+        # v3.0.11 P0 修复: 显式 -ExecutionPolicy Bypass 防 LTSC/组策略 AllSigned 拒绝未签名 npm shim
+        $shortcut.Arguments = "-NoLogo -NoExit -ExecutionPolicy Bypass -File `"$claudePs1`" --dangerously-skip-permissions"
         $shortcut.WorkingDirectory = $env:USERPROFILE
         $shortcut.Description = "Bookworm Smart Assistant (v3.0.11 直调架构)"
         if (Test-Path $iconPath) { $shortcut.IconLocation = "$iconPath,0" }
         $shortcut.Save()
 
-        # ── 5. 自验证: 读回 .lnk 确认 Target/Args 写入完整 ──
+        # ── 5. 自验证: 读回 .lnk 确认 4 项均写入完整 ──
         $verify = $shell.CreateShortcut($newLnk)
-        if ($verify.TargetPath -ne $pwshExe) {
-            Log-Fail "启动.lnk 自验证失败: TargetPath 不匹配 ($($verify.TargetPath) vs $pwshExe)"
+        $checks = @{
+            "TargetPath = pwshExe"                  = ($verify.TargetPath -eq $pwshExe)
+            "Arguments 含 claude.ps1 字面路径"      = ($verify.Arguments -match [regex]::Escape("`"$claudePs1`""))
+            "Arguments 含 --dangerously-skip-perms" = ($verify.Arguments -match "--dangerously-skip-permissions")
+            "Arguments 含 -ExecutionPolicy Bypass"  = ($verify.Arguments -match "-ExecutionPolicy Bypass")
+        }
+        $failed = $checks.GetEnumerator() | Where-Object { -not $_.Value } | ForEach-Object { $_.Key }
+        if ($failed) {
+            Log-Fail "启动.lnk 自验证失败 (项: $($failed -join ', '))"
+            Log-Fail "  实际 Target: $($verify.TargetPath)"
+            Log-Fail "  实际 Args  : $($verify.Arguments)"
             Remove-Item $newLnk -Force -EA SilentlyContinue
-            Show-MsgBox "桌面快捷方式自验证失败 (Target 不匹配). 已删除避免坏快捷方式. 请重跑安装器." "v3.0.11 自验证失败" "OK" "Error"
+            Show-MsgBox "桌面快捷方式自验证失败:`n$(($failed | ForEach-Object { '  - ' + $_ }) -join "`n")`n`n已删除坏 lnk. 请重跑安装器." "v3.0.11 自验证失败" "OK" "Error"
             return
         }
-        if ($verify.Arguments -notmatch [regex]::Escape("-File `"$claudePs1`"")) {
-            Log-Fail "启动.lnk 自验证失败: Arguments 不含 claude.ps1 路径"
-            Remove-Item $newLnk -Force -EA SilentlyContinue
-            return
-        }
-        Log-OK "启动Bookworm.lnk 创建并自验证通过"
+        Log-OK "启动Bookworm.lnk 创建并通过 4 项自验证"
 
         # ── 6. 迁移清理老 lnk (v3.0.3 及以前的 Bookworm.lnk) ──
         $oldLnk = "$desktop\Bookworm.lnk"
diff --git a/install.ps1 b/install.ps1
index e324cb1..8353e75 100644
--- a/install.ps1
+++ b/install.ps1
@@ -216,7 +216,8 @@ function New-DesktopShortcuts {
         $shell = New-Object -ComObject WScript.Shell
         $shortcut = $shell.CreateShortcut($lnkPath)
         $shortcut.TargetPath = $pwshExe
-        $shortcut.Arguments = "-NoLogo -NoExit -File `"$claudePs1`" --dangerously-skip-permissions"
+        # v3.0.11 P0 修复: -ExecutionPolicy Bypass 防 LTSC/AllSigned 拒绝未签名 npm shim
+        $shortcut.Arguments = "-NoLogo -NoExit -ExecutionPolicy Bypass -File `"$claudePs1`" --dangerously-skip-permissions"
         $shortcut.WorkingDirectory = $env:USERPROFILE
         $shortcut.Description = "Bookworm Smart Assistant (v3.0.11 直调)"
         $iconPath = Join-Path $bootDir "bookworm-desktop.ico"
@@ -224,12 +225,16 @@ function New-DesktopShortcuts {
         if (Test-Path $iconPath) { $shortcut.IconLocation = "$iconPath,0" }
         $shortcut.Save()
 
-        # 自验证
+        # 自验证 (4 项)
         $verify = $shell.CreateShortcut($lnkPath)
-        if ($verify.TargetPath -eq $pwshExe -and $verify.Arguments -match [regex]::Escape($claudePs1)) {
-            Write-Host "  [OK] 桌面快捷方式已创建: 启动Bookworm.lnk → pwsh + claude.ps1" -ForegroundColor Green
+        $okTarget = $verify.TargetPath -eq $pwshExe
+        $okPath   = $verify.Arguments -match [regex]::Escape($claudePs1)
+        $okPerm   = $verify.Arguments -match "--dangerously-skip-permissions"
+        $okBypass = $verify.Arguments -match "-ExecutionPolicy Bypass"
+        if ($okTarget -and $okPath -and $okPerm -and $okBypass) {
+            Write-Host "  [OK] 桌面快捷方式已创建并通过 4 项自验证" -ForegroundColor Green
         } else {
-            Write-Host "  [!] 桌面快捷方式自验证失败" -ForegroundColor Yellow
+            Write-Host "  [!] 桌面快捷方式自验证失败 (Target=$okTarget Path=$okPath Perm=$okPerm Bypass=$okBypass)" -ForegroundColor Yellow
             Remove-Item $lnkPath -Force -EA SilentlyContinue
         }
     } catch {