Thank you for looking into this. App B has never created any subscription on container A. It only read records from container A's private and shared databases (BirthHandover, PregnancyPhoto, and shared zones), and all of its subscriptions were created on its own container B (two CKDatabaseSubscriptions: "kimito-private-db" and "kimito-shared-db"). So there should be no leftover subscription on container A belonging to App B. What we observe looks more like a device-level push registration for container A that was created while App B still had the entitlement, and that is not being removed after the entitlement was dropped. If it would help, I can build a test version of App B that temporarily includes the container A entitlement, run fetchAllSubscriptions on container A from an affected device, and report what it returns. I can also provide a sysdiagnose from the affected device. Please let me know which would be most useful.