diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 4a1af5cd..a5c459ff 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -71,6 +71,16 @@ jobs:
           security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
           security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/productsign
+          # ── 私钥存在性检查（R88 根因：p12 仅证书链无私钥 → SecItemCopyMatching item not found）──
+          # 有效签名 p12 应报 "1 identity imported"（含私钥）；仅证书链报 "N certificates imported"。
+          # find-identity 0 valid + 私钥数 0 → p12 无签名身份，签名必失败，明确报错而非 cryptic 错误。
+          KEY_COUNT="$(security dump-keychain /tmp/ci.keychain 2>&1 | grep -c 'class: 0x0000000F' || true)"
+          IDENTITY_COUNT="$(security find-identity -v -p codesigning /tmp/ci.keychain 2>/dev/null | grep -c 'valid identities found' || true)"
+          echo "诊断: keychain 私钥数=${KEY_COUNT}, find-identity 输出行数=${IDENTITY_COUNT}"
+          if [ "$KEY_COUNT" = "0" ]; then
+            echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（import 仅导入证书链，无私钥）。请从钥匙串导出含私钥的 p12：Keychain Access → 右键证书 → 导出 → 格式 p12（勾选包含私钥），然后 base64 更新 GitHub secret。"
+            exit 1
+          fi
           # set-key-partition-list 语法：[-S partition-list] [-k password] [match-options] [keychain]
           # -s = Match keys that can sign（匹配可签名私钥，必须显式提供才能定位项目）；
           # -S 后跟分区 ID 列表；-k 后跟 keychain 密码。