We run a live App Clip used by cafes in Saudi Arabia. Customers scan a QR code at the counter to follow their order. Some customers stay on the blurred loading screen for about a minute, then get App Clip Unavailable. One cafe reported more than five cases in its first days, and I watched another happen at a cafe today, on an iPhone showing 5G with Low Power Mode on. Try Again did nothing when we tested it, and a new scan opened the clip at once. I reproduced it in 1 of 6 fresh downloads on an iPhone 17 Pro Max (build 23F84) on mobile data. The log shows: appstored starts the download from iosapps.itunes.apple.com over HTTP/1.1 on IPv6, with timeouts(60.0, 604800.0). TCP and TLS succeed and the request is sent. 71 ms later a TCP RST arrives with a stale sequence number, and the stack drops it as out of window. Retransmits go unanswered. response_bytes=0, then NSURLErrorDomain -1001 after 60.4 s. The install is cancelled, with no second attempt. A parallel HTTP/3 request finished in 414 ms, so the network was up. The clip is about 0.7 MB, and both App Clip experiences are published. Today I got the same stall without an iPhone. A Mac on an iPhone hotspot on STC mobile (AS39386) ran curl, opening a fresh HTTP/1.1 connection each time: iosapps.itunes.apple.com: IPv6 17 of 231 stalled, IPv4 0 of 89 stalled updates.cdn-apple.com: IPv6 5 of 60 stalled, IPv4 0 of 60 stalled www.apple.com, on a different CDN: IPv6 0 of 115 stalled, IPv4 0 of 85 stalled Each stall looks the same: TCP and TLS finish, the request goes out, and no response byte comes back. The stalls hit many edge addresses. One edge, frmrs1-vip-bx-005, answers on both 2a01:b740:a11:f000::203 and 17.253.122.203, and it stalled on IPv6 only, so this looks like the IPv6 path rather than a bad node. This is one SIM over 17 minutes, and I haven't tested other carriers yet. Repro from a Mac on an STC mobile hotspot: for i in {1..60}; do curl -6 --http1.1 -s -o /dev/null -m 10 -I -w '%{http_code} %{time_starttransfer}\n' https://iosapps.itunes.apple.com/; sleep 4; doneMy questions: Is there anything a developer can do to avoid this or recover from it? Is this a known issue with IPv6 to Apple's edge from Saudi mobile networks? Could someone from the App Clips or edge network team look at FB25380604? It stops real customers at the counter, so it's urgent for us.

Filing this for engineering visibility and to ask whether the observed behavior matches expected M5 Pro DCP architecture. FB22701284 contains full sysdiagnose and supporting data. Hardware Configuration MacBook Pro 16-inch (Mac17,8) M5 Pro chip, 18-core CPU 64GB unified memory (highest M5 Pro memory tier) 1TB SSD macOS Tahoe 26.4.1 (build 25E253) AppleDCP-1041.100.97~429-t605xdcp.RELEASE Display Configuration Two identical LG UltraGear 27GM950B monitors: 27" Mini LED panels, native 5120x2880 DisplayPort 2.1 UHBR20 (80 Gbps capable) 165Hz native refresh, HDR-capable Connection topology (all third-party display software removed for clean test): Mac TB5 port 1 → Silkland DP80 USB-C cable (VESA-certified) → Monitor #1 USB-C input Mac TB5 port 2 → Silkland DP80 USB-C cable (VESA-certified) → Monitor #2 USB-C input DisplayLink Manager fully uninstalled No dock, no MST hub, no signal converters Apple Specification Context Per the MacBook Pro user guide, M5 Pro supports dual displays at 5K@120Hz (support.apple.com/guide/macbook-pro/apd8cdd74f57/mac), with the documented instruction to "connect the display with the highest resolution first." Observed Behavior Solo connection (either monitor) Either monitor in isolation: 5120x2880 @ 144Hz, Maximum Source Bandwidth 27,400 Mbps, 10-bit, HDR enabled. Dual connection (BetterDisplay 4.3.3 diagnostic) Monitor on dispext0@B0000000: 5120x2880 @ 144Hz, Maximum Source Bandwidth: 27,400 Mbps, HDR enabled Monitor on dispext1@90000000: Degraded from native 5K, Maximum Source Bandwidth: 13,700 Mbps, HDR disabled The 27,400/13,700 split is deterministic and follows connection order. Hardware substitution (cables, ports, monitor positions) confirmed the allocation follows position in connection order, not specific hardware. Each monitor achieves full 27,400 Mbps when solo. Per-pipe budget structure exposed in BetterDisplay 4.3.3 Recent BetterDisplay versions expose allocation limits in display reports: Allocation limits - horizontal: 3360, 3840 pixels HiDPI (6720, 7680 pixels LoDPI) Allocation limits - vertical: 2304 pixels HiDPI (4608 pixels LoDPI) This matches the per-sub-pipe budget structure documented in third-party M5 Max DCP firmware analysis, where M5 Max shows MaxSrcRectWidthForPipe = (6720, 7680, 7680, 7680). M5 Pro appears to expose only two values (6720, 7680). WindowServer assertion failure WindowServer crash on 2026-05-16 with assertion failure in the function calculating per-pipe maximum source rectangle widths: Thread 16 Crashed: com.apple.coreanimation.render-server CA::WindowServer::AppleDisplay::max_src_rect_width_by_pipes(unsigned char) const + 92 CA::WindowServer::AppleDisplay::max_src_rect_pixels() const + 60 CA::WindowServer::Server::get_display_info() + 1812 Exception: EXC_CRASH (SIGABRT), Abort trap 6. This is the same function third-party DCP firmware analysis identifies as governing the per-sub-pipe budget calculation. Reference to Existing Thread Apple CoreOS DTS Engineer Kevin Elliott in thread 814201 (https://developer.apple.com/forums/thread/814201) described M5 MacBook Pro display architecture: "Driving the display at 240Hz require both of the two display 'pipes' and the system ends up allocating both pipes to the first monitor it discovers. That prevents it from lighting up the second monitor, as there isn't currently any way for software to shift allocations of display pipes between machines." That thread addressed a single-display 4K@240Hz scenario where the second display failed to initialize. The underlying allocation mechanism (first-come-first-served pipe assignment, no dynamic reallocation) appears consistent with the dual-display configuration I'm observing, with the manifestation differing (both displays initialize but the second is bandwidth-constrained rather than absent). Specific Technical Questions Is the 27,400/13,700 Mbps asymmetric allocation observed on dual 5K configurations the expected manifestation of the two-pipe architecture described in thread 814201, or a distinct allocation policy specific to dual-display scenarios? The advertised dual 5K@120Hz capability requires approximately 28 Gbps per stream. The observed allocation appears insufficient to drive both displays at this specification simultaneously. Is there a configuration approach that allows both displays to receive adequate bandwidth allocation? Multiple sources document that M5 Max has more display engine output channels than M5 Pro. Is the architectural difference between M5 Pro and M5 Max sub-pipe count (per the BetterDisplay allocation limits and third-party firmware analysis) the underlying explanation for the differential dual-display capability? The WindowServer assertion failure in max_src_rect_width_by_pipes() — is this a known edge case for dual high-bandwidth display configurations on M5 Pro, or should this be filed as a separate issue from the bandwidth allocation behavior? Supporting Data Available BetterDisplay 4.3.3 diagnostic reports for both monitors WindowServer crash report (2026-05-16) ioreg output showing DCP unit assignments sysdiagnose attached to FB22701284 Happy to provide additional FB tickets with focused diagnostic captures if specific data would help engineering investigation.

Filed as FB24069273. Sandbox POST /inApps/v1/notifications/test consistently returns 404 {"errorCode":4040007} for our app (Apple ID 6765662617), although GET /v1/apps via the App Store Connect API confirms both subscriptionStatusUrl and subscriptionStatusUrlForSandbox are set (V2). With the same JWT, sandbox POST /inApps/v1/notifications/history returns 200 with an empty history — so the key and app resolve correctly. No organic sandbox notifications have ever been delivered, despite active TestFlight sandbox subscription activity. Exhausted remediations (4040007 persists after each, with 30-60+ minute waits): Re-saving the URLs in the App Store Connect UI (two locales) Deleting and re-adding the Sandbox URL PATCH /v1/apps setting the sandbox URL + version V2 twice, with two different valid endpoints (verified by GET each time) Removing the Sandbox URL entirely to rely on the documented Production fallback Deleting BOTH URLs, waiting a full hour, and re-creating them from scratch Testing with both an App Store Connect team key and a freshly generated In-App Purchase key — identical results Endpoints are publicly reachable (HTTPS, TLS 1.2+, port 443). Production App Store Server API returns 401, which we understand is expected for an app not yet released. This looks like a desync between App Store Connect metadata and the notification delivery registry consulted by the test-notification endpoint. Any help would be appreciated.

I am evaluating the supported macOS C XPC lifecycle for a separately installed system-domain Mach service. This is a design/documentation question, not a reported crash or a tested OS-specific failure. Please identify applicable macOS/SDK versions and public API guarantees; no installed SDK capability is being assumed. The threat model includes an unprivileged process running as the worker's user. The OS and privileged administrator are trusted. Executables and role assignments would require independently protected approval. Matching a code signature alone is not intended to grant an issuer role. Two API boundaries affect whether the service can be authorized before activation: Binding an actual launch instance to protected enrollment. Is there a supported public API or enforceable launch-environment constraint that can distinguish an instance launched through an approved system-domain job/enrollment from direct invocation of the same approved executable? The required distinction is the actual job/executable launch transaction before service activation, not a process-provided label, PID/PPID lookup, copied install record, or signature alone. If launch constraints can enforce only a narrower property, what exactly is that property and its minimum supported version? If no public mechanism provides the stronger binding, confirmation of that limit would be useful. This question does not assume an XPC peer requirement can establish job origin or issuer authority. Disposing of a newly owned inactive connection after setup failure. Suppose xpc_connection_create_mach_service returns a caller-owned inactive client or listener, but preactivation policy setup then fails, for example xpc_connection_set_peer_code_signing_requirement returns an error. What is the documented safe cleanup sequence if transport activation has not been authorized? The xpc_connection_activate documentation warns that last-release of a created inactive connection is undefined. The cancellation documentation describes asynchronous unwinding, but I have not found an explicit exception for last-release of a never-activated, canceled object. Does a supported cancel/release sequence exist? If activation is required even for disposal, what effects can that cleanup activation cause and what guarantees apply? I am asking about a newly created owned object, not an incoming borrowed peer that a listener can reject by canceling and returning. Relevant references already consulted: https://developer.apple.com/documentation/xpc/xpc_connection_activate(_:) https://developer.apple.com/documentation/xpc/xpc_connection_cancel(_:) https://developer.apple.com/documentation/xpc/xpc_connection_set_event_handler(::) https://developer.apple.com/forums/thread/837286 (received-message checking versus initial outgoing delivery) An API reference, versioned contract, or explicit statement that either guarantee is unavailable would help determine the safe supported boundary. I am not requesting private APIs or a workaround that treats a caller assertion as authorization.

I'm developing a macOS app using a Network Extension Packet Tunnel Provider. The System Extension activates successfully, but NETunnelProviderManager.saveToPreferences() consistently fails with permission denied. Environment macOS virtual machine running under UTM Host app and embedded Packet Tunnel System Extension signed with Developer ID App notarization verified successfully System Extension status: [activated enabled] Packet Tunnel has com.apple.security.app-sandbox=true and com.apple.security.network.client=true Host app has the Network Extension entitlement Reproduction Launch the installed, notarized HostApp. Call NETunnelProviderManager.loadAllFromPreferences(). No manager matching the Packet Tunnel provider bundle identifier is found. Create a NETunnelProviderManager. Configure NETunnelProviderProtocol with the Packet Tunnel provider bundle identifier and a server address. Set localizedDescription and isEnabled = true. Call saveToPreferences(). Observed result On October 30, 2026, the following events were recorded: 11:25:32.643 PROTOTYPE_MANAGER_CREATED 11:25:32.643 PREFERENCES_LOADED 11:25:32.643 PROTOTYPE_VPN_AUTH_SKIPPED 11:25:32.646 Saving configuration ... with existing signature (null) 11:25:33.766 NEConfigurationErrorDomain Code=10 "permission denied" 11:25:33.766 NEVPNErrorDomain Code=5 "permission denied"The app never reaches startVPNTunnel(). What I've already checked Developer ID code signing verification succeeds. Notarization and stapler validation succeed. The System Extension is activated and enabled. The failure reproduces both with and without created.loadFromPreferences() before saving. An explicit VPN authorization step is disabled in these reproduction runs. Questions What conditions can cause NEConfigurationErrorDomain Code=10 when a newly created NETunnelProviderManager is saved? Are there additional signing, entitlement, authorization, or configuration requirements for a Developer ID-distributed macOS Packet Tunnel app? Which NetworkExtension or nehelper diagnostics would help identify the specific permission check that fails? Is there any known difference in this behavior when running under macOS virtualization? I can provide a minimal reproduction project, sanitized logs, entitlement output, and a sysdiagnose privately if necessary. Thank you for your guidance.

I’m seeking authoritative documentation on the lifecycle and integrity significance of files under mapped/ in an encrypted macOS sparsebundle using backing-store version 2. Six regular files, each 2,048 bytes, were verified under mapped/ in the sparsebundle package before attachment. After a normal detach, those six files were absent from the disposable image’s package. The source backup retains all six. Additional band-level checks have not established the significance of this change. It remains unclear whether this is expected lifecycle behavior or has integrity implications. No data corruption has been proven, and these observations do not establish that the removal was safe. What purpose do mapped/ entries serve specifically in backing-store version 2? Can writable attachment or normal detach legitimately remove these entries while retaining the corresponding band data? Under which documented conditions, if any, is their removal safe? Could missing entries affect logical block addressing or data integrity even when the corresponding band files remain present? What supported, non-destructive, read-only validation can establish whether the image remains logically consistent? Pointers to authoritative Apple documentation or an applicable backing-store v2 implementation reference would be appreciated.

Hello, I am evaluating a fail-safe architecture for a macOS application that would run a single Linux virtual machine using Apple's Virtualization.framework. My main concern is what happens if the process owning the VZVirtualMachine instance hangs, crashes, or becomes unresponsive while the VM is running. According to the public API documentation, stop(completionHandler:) can stop a VM, but the operation must be performed through the owning VZVirtualMachine instance and its associated dispatch queue. I would appreciate clarification on three questions: Independent termination: Is there a documented, supported way for a separate watchdog process to identify and forcibly terminate an existing VM when its owning process or dispatch queue is unresponsive? Owner termination: If the operating system terminates the process owning the VZVirtualMachine instance, is termination of the associated VM guaranteed? Is there a documented upper bound on the time required? Resource cleanup: Is there a supported mechanism for an independent process to verify that the VM has terminated and that its associated host resources have been released, rather than relying solely on a callback from the original owner? I am considering a dedicated VM-owner process supervised through launchd/XPC, but I do not want to assume that restarting or terminating the owner provides guarantees that the framework does not document. This is an architectural investigation only. No production VM or autonomous workload has been started. Any references to official documentation or recommended architectural patterns would be greatly appreciated. Thank you.

We maintain a macOS product whose installer uses custom InstallerSection plugin bundles to show configuration panes during install. Starting with macOS 27 beta 6, all of our plugins stopped loading in Installer.app — the panes never appear and the install fails because our preinstall step depends on data the panes collect. The exact same .pkg works on macOS 26.6, and per thread 842811 the same bundles were fine on 27 betas 1–4(I have tested it from beta 6 onwards). While investigating we found what looks like the underlying cause, and it's reproducible by hand. THE FINDING During a failing install, look inside the extracted plugin bundle while the Installer window is still open: ls -la /private/tmp/com.apple.installer*/.bundle/Contents/ That layout fails code-signature validation. You can reproduce the failure manually, no Installer involved: codesign -vvv "/private/tmp/com.apple.installer"*/.bundle → .bundle: Too many levels of symbolic links WHAT THE SYSTEM LOGS SHOW amfid rejects the plugin executable: /private/tmp/com.apple.installerXXXXXX/.bundle/Contents/MacOS/ not valid: Error Domain=AppleMobileFileIntegrityError Code=-420 "The signature on the file is invalid" with repeated "UNIX error exception: 62" (errno 62 = ELOOP, too many levels of symbolic links) in backtraces through BundleDiskRep::component → SecStaticCode::component → validateNonResourceComponents → staticValidateCore, and "Code failed basic validity check (error: 100062)". For a Developer ID–signed plugin the kernel then treats it as fatal: AMFI: When validating /private/tmp/com.apple.installerXXXXXX/.bundle/Contents/MacOS/: The code contains a Team ID, but validating its signature failed. mac_vnode_check_signature: ... code signature validation failed fatally check_signature[pid: N]: error = 1 The plugin is never dlopen'd and the pane never appears. QUESTIONS Is there a way to get Installer to deploy the bundle with real files — or any other workaround? Note : I have Filed via Feedback Assistant as FB24601496; this overlaps FB24415432 / thread https://developer.apple.com/forums/thread/842811, which we've cross-referenced I have experienced this issue on latest Beta 8 build also -27.0 Beta (26A5425a)

PLEASE ADDRESS ASAP: Muse is #1 on the App Store and Facebook is one of the most blocked apps for Screen Time. This is affecting a vast number of people. Description: When a user blocks the Facebook app in any screen time app, iOS automatically blocks Meta's Muse app too. Every single time. There is no way for the user or the developer to prevent it, allowlist it, or even detect that it happened. Muse shows Apple's generic blocked-app "Restricted" screen instead of the screen time app's own design, so the user cannot tell who blocked it or why. This is the worst possible combination of apps: Facebook is one of the most-blocked app across screen time apps. Muse ("Muse from Meta") is currently the #1 app on the App Store. A huge and fast-growing number of users block Facebook and silently lose the world's most popular new app. Muse launched Sept 8, 2026 and adoption is still climbing -- the affected population grows every day. There is NO workaround whatsoever: Users cannot allowlist Muse: it does not appear in Settings > Screen Time > Always Allowed. Developers cannot prevent it: the Screen Time API offers no opt-out; the extra block is applied by iOS itself. Developers cannot detect it: Muse's token (listed separately in FamilyActivityPicker) corresponds to no real identity anywhere else. Developers cannot customize it: their ShieldConfiguration is never consulted -- Muse gets Apple's generic shield UI. Users cannot even block Muse on purpose: shielding Muse's own token is a silent no-op. Screen Time usage statistics are also wrong -- Muse usage is recorded as "Facebook." This Screen Time bug renders screen time apps effectively unusable if users want to block Facebook and use Muse, which is extremely common. How can we get this addressed as soon as possible? Feedback Assistant ticket: https://feedbackassistant.apple.com/feedback/25019832

Hi there! My claim is that ManagedSettingsStore.TokenExpiryMessage API family doesn't work properly. I'm curious if that's only me, or others have also found it confusing, or non-working? I haven't found much public discussion about it, so this is the start of it. There are multiple confusing scenarios from my playing with it, but the simplest example is that ~30% of my apps NEW users get the ".tokensDidExpire" as soon as they approve Screen Time Permissions. Note that they haven't even seen the FamilyActivityPicker! FB23391495 is the feedback. Apple dev responded, but it didn't give confidence that my bug report was deemed correct (which can be fair!). However, it's current status is "Potential fix identified - For a future OS update," so maybe there is something to it. The API is likely quite difficult to get right, so I am happy to provide feedback on potential implementation so it's 100% solid.

Family Controls: Can Screen Time performance determine StoreKit promotional-offer eligibility? I'm developing an iOS app that helps individuals reduce recreational screen time. The app would use DeviceActivityMonitor to evaluate whether users meet their own screen-time goals. Users who succeed could redeem a discounted one-month subscription through StoreKit promotional offers. The calculation would occur locally on the user's device. No raw usage data, app names, or browsing history would be transmitted. Two questions: Is it permissible under the Family Controls framework's data-use restrictions to use on-device activity outcomes to determine eligibility for a discount on the same app's subscription? Can the resulting discount tier or promotional-offer identifier be sent to our server solely to authorize the StoreKit offer, without violating those restrictions? I'd appreciate clarification from Apple staff about this specific use case before implementing it.

I'm having an issue on my standalone watchOS app where the settings to adjust notifications does not appear anywhere on the iPhone or the Watch. I have successfully requested notifications access from the user and have successfully displayed a local notification to them. However, if the user ever decides to revoke my notification access (or if they deny originally and want to change), the settings pane for notifications does not appear anywhere. I've looked in the following places: On the watch in Settings > Notifications, however it looks like you can no longer edit per app notification settings directly on the watch (none of the installed apps on my watch appear in here). The only options are settings like "tap to show full notification" and "announce notifications" which affect all notifications (Why not? Especially for apps that don't have a iPhone companion app?). On the iPhone in the Watch app (the app you set up your watch in), in Watch > Notification. My app does not appear anywhere in there. On the iPhone in the iPhone Settings app, in Settings > Notifications. My app does not appear anywhere in there. On the iPhone in the iPhone Settings app, in Settings > Apps. My app does not appear anywhere in there I've tried: Adding capabilities in Signing & Capabilities for Push Notification, Time-Sensitive Notifications and Communication Notifications Building the app for release instead of debug My app also requires location access and has successfully appeared in the settings pane directly on the watch in Settings > Privacy & Security > Location Services, however notification settings do not appear anywhere. I have created a stripped down test app to try and that also does not work. This test code successfully asks the user for permission and (from a button in ContentView), successfully schedules a notification and displays it to the user when they're not in the app. Here's the code for my NotificationManager: import UserNotifications class NotificationManager: NSObject, ObservableObject, UNUserNotificationCenterDelegate { static let shared = NotificationManager() @Published var hasAuthorisation = false private override init() { super.init() UNUserNotificationCenter.current().delegate = self requestAuthorisation() } func requestAuthorisation() { UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .sound]) { authorised, error in DispatchQueue.main.async { if let error = error { print("Error requesting notifications: \(error.localizedDescription)") } self.hasAuthorisation = authorised } } } func scheduleNotification(title: String, body: String, timeInterval: TimeInterval) { let content = UNMutableNotificationContent() content.title = title content.body = body content.sound = .default let trigger = UNTimeIntervalNotificationTrigger(timeInterval: timeInterval, repeats: false) let request = UNNotificationRequest(identifier: UUID().uuidString, content: content, trigger: trigger) UNUserNotificationCenter.current().add(request) { error in if let error = error { print("Error scheduling notification: \(error.localizedDescription)") } else { print("Notification scheduled successfully.") } } } } This issue has persisted across two iPhones (recently upgraded) and the watch was wiped when connecting to the new iPhone. Am I missing some code? Am I missing some flag I need to set in my project somewhere? Please can someone with an Apple Watch try this code in a standalone watchOS app and see if the notifications pane appears anywhere for them? I've contacted Apple DTS, but they're taking a while to respond.

I have simple non-consumable IAPs set up for an app on macOS. Testing in development with a local .storekit configuration file, everything works as expected. Testing in development with a remote Sandbox, everything also seems to work fine. Product names and prices fetch correctly, I am able to make purchases with a Sandbox account (both US and UK). Once I upload a build into TestFlight, IAPs no longer work. The tester would download the Beta app from TestFlight. They open a license manager and can see all the product names, descriptions and prices are pulled from Apple servers correctly (with the correct local currency as well!). So far so good. When trying to purchase any of the IAP, the following error appears: This is TestFlight so testers are using their real Apple ID. My understanding is that they should continue using their production credentials and a TestFlight Sandbox would be configured behind the scenes automatically. This error always says the users cannot purchase from a US store and must switch to [whatever user’s actual store location is] store. For example, my account is based in the UK, has got a UK billing address and a UK payment method, and the error tells me to switch to the UK store. People in Canada get a similar error - you must switch from the US store to Canadian. The error makes no sense, the account is already in the desired country. Clicking on the “Change Store” button opens the App Store app and displays another error: “Cannot Connect to App Store”. Clicking Retry just results in this errors showing again and again. Clicking OK takes us back to the failed IAP purchase and the final error message appears: “Purchase Error - Unable to Complete Request”. Things I’ve done / checked: IAPs are configured in App Store Connect and available for all regions prices are set for all regions in App Store Connect IAP name and description localisation in English (UK) IAP status is Ready to Submit, I don’t think I can go past that unless I make a production release (which I can’t until we fix the problem) IAP capabilities added in xcode the problem is not account, machine, or location dependent - every beta tester testing my app on TestFlight has the same issue, they each use a different account and have accounts in different countries double checked the App Store account location in the App Store settings - it is definitely matching the store this error is asking to switch to application exits at startup with error 173 if app receipt cannot be found - this one was suggested by the review team, I could not really find any documentation for it review team also suggested I should add com.apple.security.network.client to enable IAP connectivity. I did add that to one of the builds and it did not help. I am not really convinced this is necessary Any suggestions on what to check and what to try? I have run out of ideas.

Two physical iPhones on public iOS 27.2 (24B119), using separate adult US Apple Accounts, produce different results from the Declared Age Range framework under a BR country classification. Device A displays the mandatory Brazil-sharing notice, does not accept Never in the native selector, and returns an 18+ range to a real request with ageGates:18. Device B accepts Never after the update. The same local checker receives declinedSharing with no age bounds. Never remains checked afterward. The checker invokes requestAgeRange even when regulatory eligibility is false; it does not synthesize a refusal locally. Device logs indicate normal flow, without a sandbox override. Selected diagnostics show US billing countries for App Store, Music and iCloud on both devices and BR detected on both. Their separate age-assurance classifications differ: BR with account eligibility true on A, versus unset with account eligibility false on B. Unset is not being treated as US. The captures were made on different dates, and identical account histories and management payloads have not been established. Both devices are supervised. No location simulation or network filter was active during B's test. For developers handling these API results, what documented account or device criterion explains this difference? What supported diagnostic and correction path is available when the native sharing control is unavailable on one device but effective on another under the same detected country? The detailed comparison has been supplied privately through Feedback Assistant. This question concerns the public framework's behavior and supported remediation; it does not assume US billing country alone creates an exemption.

On iOS 27.2, triggering RunSystemShortcutIntent from a Home Screen widget leaves all buttons in that widget unresponsive when the action does not navigate away from the current screen. Toggling the flashlight is a simple example. Steps to reproduce Add an interactive Home Screen widget with a button that uses RunSystemShortcutIntent. Trigger an action that stays on the current screen, such as toggling the flashlight. Try tapping the same button and other buttons in the affected widget. None respond. Swipe to another Home Screen page, then swipe back. The buttons respond again. Expected behavior Once the action finishes, the widget should remain responsive to subsequent taps without requiring the user to navigate away and return. Impact Based on my observations, this issue affects all apps that provide interactive widgets when the reproduction conditions above are met. A single routine system shortcut action leaves every button in the affected widget unresponsive, making important features effectively unavailable. For products built around interactive widgets, this blocks core functionality until the user switches Home Screen pages and returns. I have submitted this through Feedback Assistant: FB25377135. Given the impact on all apps that provide interactive widgets under these conditions, please prioritize investigation and a fix. Has anyone else reproduced this behavior on iOS 27.2? A consistent distinguishing symptom is that simply swiping to another Home Screen page and back restores responsiveness to all buttons in the affected widget.

Hello, I am developing Partance, a native iOS/iPadOS application for planning trips and keeping a personal travel journal. The application already generates PDF souvenir albums containing the user’s photographs, captions and journal entries. Before adding static maps, I would like to identify official Apple guidance covering the intended use. Proposed feature The user would explicitly choose to include: one overview map showing the locations represented in their album; smaller maps accompanying individual journal entries. The maps would be generated using MKMapSnapshotter, with markers added by the application. The marker coordinates come from the user’s photographs already stored in their journal, rather than from saved Apple geocoding or search results. This would not be an offline-navigation feature, a downloadable map collection, a map database or a substitute mapping service. Personal use of the resulting PDF Each participant in a trip has their own personal journal and generates their own album. The resulting PDF: is intended as a personal souvenir, not for sale, publication or public distribution; may be retained indefinitely in Partance until the user explicitly deletes it; may also be saved in Files or transferred to the user’s own computer; may be printed at home or uploaded to a commercial photo-book printing service solely to manufacture the user’s personal physical album. Intermediate map images could be deleted after PDF generation. However, the map images embedded in the PDF would remain part of the user’s album. Documentation and uncertainty Apple’s archived “Location and Maps Programming Guide,” under “Creating a Snapshot of a Map,” explicitly describes using MKMapSnapshotter to implement printing: https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/LocationAwarenessPG/MapKit/MapKit.html However, Attachment 6 of the Apple Developer Program License Agreement, particularly sections 2.1, 2.3 and 2.5, leaves me uncertain about retaining the generated images permanently inside a personal PDF: https://developer.apple.com/support/terms/apple-developer-program-license-agreement/ My questions are: Is there official Apple guidance confirming whether this specific use is permitted, including indefinite retention of the personal PDF? Is there a documented distinction between retaining map data as an application cache and retaining a snapshot within a user-generated document? What attribution, logos or legal notices must accompany the maps in the PDF and printed album, including any requirements relating to Apple’s data providers? Does using a commercial printing service solely to produce the user’s personal photo book require any additional permission? If these questions cannot be answered here, which Apple team or contact channel should handle them? I have already submitted a request through Apple’s Rights and Permissions form and received an automatic acknowledgement only. The map-export feature has not been implemented. I am seeking an official documentation reference or the appropriate Apple contact, rather than asking other developers to provide a legal opinion. Thank you for your help.

Hi, We are the developers of Morning Call (https://morningcall.info), and we believe we may have identified an AlarmKit / system UI bug on iPhone. We can reproduce the same behavior not only in our app, but also in Apple’s official AlarmKit sample app, which strongly suggests this is a framework or system-level issue rather than an app-specific bug. Demonstration Video of producing zombie Live Activity https://www.youtube.com/watch?v=cZdF3oc8dVI Related Thread https://developer.apple.com/forums/thread/812006 https://developer.apple.com/forums/thread/817305 https://developer.apple.com/forums/thread/807335 Environment iPhone with Dynamic Island Alarm created using AlarmKit Device is unlocked when the alarm begins alerting Steps to reproduce Schedule an AlarmKit alarm. Wait for the alarm to alert while the device is unlocked. The alarm appears in Dynamic Island. Instead of tapping the intended stop or dismiss button, swipe the Dynamic Island presentation away. Expected result The alarm should be fully dismissed. The Live Activity should be removed. No empty UI should remain in Dynamic Island. Actual result The assigned AppIntent runs successfully. Our app code executes as expected. AlarmKit appears to stop the alarm correctly. However, an empty “zombie” Live Activity remains in Dynamic Island indefinitely. The user cannot clear it through normal interaction. Why this is a serious user-facing issue This is not just a cosmetic issue for us. From the user’s perspective, it looks like a Live Activity is permanently stuck in Dynamic Island. More importantly: Force-quitting the app does not remove it Deleting the app does not remove it In practice, many users conclude that our app has left a broken Live Activity running forever We receive repeated user complaints saying that the Live Activity “won’t go away” Because the remaining UI appears to be system-owned, users often do not realize that the only reliable recovery is to restart the phone. Most users do not discover that workaround on their own, so they instead assume the app is severely broken. Cases where the zombie state disappears Rebooting the phone Waiting for the next AlarmKit alert, then pressing the proper stop button on that alert Additional observations Inside our LiveActivityIntent, calling AlarmManager.shared.stop(id:) reports that the alarm has already been stopped by the system. We also tried inspecting Activity<AlarmAttributes<...>>.activities and calling end(..., dismissalPolicy: .immediate), but in this state no matching activity is exposed to the app. This suggests that the alarm itself has already been stopped, but the system-owned Live Activity UI is not being cleaned up correctly after the swipe-dismiss path. Why this does not appear to be an app logic issue The intent is invoked successfully. The alarm stop path is reached. The alarm is already considered stopped by the system. The remaining UI appears to be system-owned. The stuck UI persists even after our own cleanup logic has run. The stuck UI also survives app force-quit and app deletion.

hi so submitted my app 2 weeks ago , still sitting in "waiting for review" 8 emails later. .... not a single word , no relpy to tell me whats happining. As im sure eveyonr did. , we work our hearts out creating the apps , Apple please understsnd how incredibly fustrating this is, please. i begging you , please advise when i will get any communication . i apriciate you may be busy. just tell me that then please.

In Core Spotlight, one can only index content by using title or displayName, and it requires four consecutive characters for indexing. These situations occurred in iOS 17 and 18. In iOS 16, I could not only index content by title or displayName, but also by keyword. Moreover, there was no restriction of requiring four consecutive characters. I could index my app content by simply inputting one character. Here is my code.https://github.com/kritto1/corespotlight-bug-test/tree/main @available(iOS 14, *) func addItemToIndex(_ item: QSpotlightItem) { let attributeSet = CSSearchableItemAttributeSet(contentType: .item) attributeSet.title = item.title attributeSet.displayName = item.title attributeSet.contentDescription = item.contentDescription attributeSet.keywords = item.keywords attributeSet.thumbnailData = item.thumbnailImage attributeSet.contactKeywords = item.keywords attributeSet.supportsNavigation = true let searchableItem = CSSearchableItem(uniqueIdentifier: item.id, domainIdentifier: "com.qunar.iphone.spotlight", attributeSet: attributeSet) searchableItem.expirationDate = .distantFuture CSSearchableIndex.default().indexSearchableItems([searchableItem]) { error in if let error = error { } else { } } } @available(iOS 14, *) func addToSpotlightIndex() { let spotlightHotel = QSpotlightItem( id: "corespotlight_1", title: "查询酒店住宿", contentDescription: "", thumbnailImage: UIImage(named: "img2")?.pngData(), keywords: ["酒店", "住宿"] ) addItemToIndex(spotlightHotel) let spotlightFlight = QSpotlightItem( id: "corespotlight_2", title: "查询和预订机票", contentDescription: "", thumbnailImage: UIImage(named: "img2")?.pngData(), keywords: ["查询", "预订", "机票"] ) addItemToIndex(spotlightFlight) let spotlightSight = QSpotlightItem( id: "corespotlight_3", title: "查询预订门票", contentDescription: "", thumbnailImage: UIImage(named: "img2")?.pngData(), keywords: ["查询", "预订", "门票"] ) addItemToIndex(spotlightSight) }

I’m seeing CLMonitor deliver the same event twice when a CircularGeographicCondition triggers while the app is not running and the system launches it in the background. The two events have the same identifier, state, date and diagnostic data. When the app is in the foreground, I get exactly one event per transition. I've included a minimum example as an attachment. It creates a CLServiceSession and CLMonitor in application(_:didFinishLaunchingWithOptions:) and observes their events. Here is a log from a background launch (trimmed to the relevant fields) 15:34:13.742Z App didFinishLaunchingWithOptions: none 15:34:13.784Z CLServiceSession.Diagnostic(all false) 15:34:13.784Z Started monitor 15:34:13.794Z event: identifier: 0DE4B7F8-..., state: satisfied, date: 15:34:13.559Z 15:34:13.795Z event: identifier: 0DE4B7F8-..., state: satisfied, date: 15:34:13.559ZThe two events are identical (including date) and arrive about 1 ms apart. All diagnostic flags on both the event and the service session are false. What I’ve ruled out / observations Not a repeated state with new diagnostics. The “Monitoring location changes with Core Location” sample project de-duplicates events whose state matches the previous one, noting that the only new information would be in diagnostics. That doesn’t explain this: the diagnostics are all false, the date is identical, and I don’t see the duplicate in the foreground. Scales with condition count. With two overlapping conditions, a single boundary crossing produces four events (two per condition) when launched in the background. The behavior occurs both on a simulator and on a real device The only reference to this behavior I was able to find is this StackOverflow post which was asked when iOS 6 was the latest My questions is: Is this duplicate delivery expected when CLMonitor is created in response to a background launch? Or does this indicate I have something set up incorrectly?