Our (sandboxed, distributed through the Mac App Store) app can optionally run as a CLI tool, to allow users to use it in scripts and other automation contexts. One of the usecases involves being a wrapper for the ssh command, but the ssh binary is not able to enable raw mode for stdin due to a sandbox violation (bug report). As a reduced example, I've created https://github.com/mihaip/sandboxed-cli-test, which has a minimal C program that uses tcsetattr to set attributes on stdin. That fails, and sandboxd logs to the console Sandbox: SandboxedCLI(30110) deny(1) file-ioctl /dev/ttys012. If I disable sandboxing on the binary then it works as expected. Looking through the sandbox profiles on /System/Library/Sandbox/Profiles, I'm not seeing cases where file-ioctl is enabled on /dev/tty. Are we out of luck, or is there a workaround?

Title: Supported macOS PID reservation for an exited but unreaped direct child I'm designing a process-lifecycle experiment on Apple silicon, initially targeting macOS 26.7.2 (build 25G332). A trusted parent directly launches a foreground child using posix_spawn(). The parent remains alive, exclusively owns reaping, preserves child exit status, and never sets SIGCHLD to SIG_IGN or enables SA_NOCLDWAIT. The parent may send kill(child_pid, SIGKILL) before obtaining the child's terminal status through waitpid(). POSIX.1-2008 §3.295 describes the PID as the last resource released when a process's lifetime ends. Section 4.13 prohibits PID reuse before that lifetime ends. Could Apple DTS clarify the supported macOS contract for this sequence? If the child exits immediately before the kill() call but remains unreaped, is its PID guaranteed not to be reassigned to another process while the original parent retains exclusive reaping authority? Does this guarantee apply to a child created through posix_spawn() on current Apple silicon macOS releases? Are there documented exceptions beyond automatic status disposal, competing reapers and parent termination? What result should the parent expect when kill() targets an already-exited but unreaped child? The design serialises signaling and reaping, and never signals the numeric PID after status consumption. This question concerns identity-safe signal targeting, not whether successful kill() establishes termination. The latter is separately verified using waitpid(). I'm seeking a supported API contract rather than empirical observations or private kernel implementation details. Thank you.

Apple Support directed me to the Developer Forums for this API-contract question. I am implementing conservative, read-only ACL classification for existing files and directories. I need to distinguish an absent ACL from unavailable or incomplete ACL information. Ambiguous results are currently rejected. The measurements below were taken on macOS 26.5, build 25F71, Apple Silicon (arm64), on APFS. Method I tested eight newly created objects: a regular file and a directory in each of four preparation states: Fresh: no ACL setter, deletion or normalization was performed. Explicit-empty ACL preparation. One DENY entry. One ALLOW entry. “Fresh” describes preparation only; I am not assuming it independently proves ACL absence. Each object remained open through preparation and two observations using the same file descriptor. Each observation performed: acl_get_fd_np(fd, ACL_TYPE_EXTENDED) fgetattrlist() requesting ATTR_CMN_RETURNED_ATTRS | ATTR_CMN_EXTENDED_SECURITY, with FSOPT_REPORT_FULLSIZE and without FSOPT_PACK_INVAL_ATTRS. Errno was cleared immediately before each query and captured immediately afterward. Descriptor/path identity and metadata stability were checked. Returned lengths, attribute bitmaps and applicable reference/payload bounds were validated. Observations Results matched between the two observations and between regular files and directories: Preparationacl_get_fd_np resultfgetattrlist returnEXTENDED_SECURITY returnedReturned filesec ACE countAttribute-buffer lengthFreshNULL, errno ENOENT0NoN/A32 bytesExplicit-emptyNULL, errno ENOENT0Yes076 bytesOne DENY entryNon-NULL, errno 00Yes1100 bytesOne ALLOW entryNon-NULL, errno 00Yes1100 bytesWhen the getter returned NULL, ACL validation and enumeration were not performed; their results are N/A, not measured zeros or an empty entry list. When EXTENDED_SECURITY was omitted, its payload fields were unavailable. I did not interpret default buffer values as returned ACL information. An actually returned zero-entry record is distinct from omission. No NOACL sentinel was observed in this experiment. Question For a valid descriptor referring to an existing APFS object, what is the supported interpretation of: acl_get_fd_np(fd, ACL_TYPE_EXTENDED) returning NULL with ENOENT; and fgetattrlist() succeeding while omitting ATTR_CMN_EXTENDED_SECURITY from the returned attribute bitmap? In particular: Can this combination establish ACL absence under documented conditions, or must it remain classified as unavailable/ambiguous information? How should the observed NULL/ENOENT with an actually returned zero-entry ACL record be interpreted? If these results cannot establish absence, which supported read-only, descriptor-based API or verification sequence should be used? What guarantees and limitations apply regarding macOS versions, filesystem support and genuine retrieval failures? I reviewed the acl_get(3) documentation but could not find a clear explanation of this valid-descriptor ENOENT case: https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/acl_get.3.html I am seeking the supported API contract, not asserting an OS defect or vulnerability. I do not want to set, delete or normalize ACLs on the objects being inspected, or treat an ambiguous result as success.

Reported environment: macOS Monterey 12.7.6 (build 21H1320), Intel, APFS. The filesystem type of the relevant volume and exact installed implementation have not been independently reverified. I need a supported, read-only way to distinguish an absent filesystem ACL, an explicit zero-entry ACL, and unavailable/unsupported/invalid/incomplete ACL evidence while retaining an open descriptor to the object. One retained observation: an existing empty regular file was opened read-only with O_NOFOLLOW and O_CLOEXEC. Path and descriptor metadata matched the expected identity, owner, mode and link count before and after the call. Exactly one acl_get_fd_np(fd, ACL_TYPE_EXTENDED) call returned NULL. Errno was cleared immediately before the call and immediately captured afterward as ENOENT. Descriptor closure succeeded. This observation does not establish ACL absence or identify the internal error path. File creation and private mode are not treated as proof of no ACL. I have not tested fgetattrlist on this host, created ACL fixtures for this inquiry, or established volume ACL capability results. Apple's published Libc-1507.100.9 source shows the fstatx_np/filesec property path, and xnu-8020.140.41 shows mode-dependent extended-security attribute packing. I am treating those as version-specific implementation evidence, not as confirmation of the installed implementation or a complete supported API contract. For this reported configuration: Which supported descriptor-bound API sequence and checked preconditions distinguish these three states? A contract applicable to Monterey and the relevant filesystem is sufficient; I am not asking for a guarantee across every macOS version or filesystem. Does NULL/ENOENT from acl_get_fd_np have a supported ACL-absence meaning under specified conditions? Can an explicit zero-entry ACL produce the same result, and how should it be distinguished? With fgetattrlist requesting ATTR_CMN_RETURNED_ATTRS and ATTR_CMN_EXTENDED_SECURITY, can an omitted security returned bit ever establish absence rather than unavailable evidence? Do legacy packing or a valid filesystem capability result supply a supported distinction? Please specify the applicable conditions. Does successful fstatx_np followed by filesec_query_property for FILESEC_ACL reporting an unset property distinguish absence from an unavailable observation? When a complete, valid security record is returned, what is the supported interpretation of KAUTH_FILESEC_NOACL versus an explicit entry count of zero? Is this representation intended for application-level absence verification? Please identify applicable documentation or supported technical guidance, including failure/unknown handling. Genuine retrieval errors must remain errors, and ambiguous or incomplete evidence must remain unknown. I do not want to infer success from an error, omitted attribute, invalid default or empty display, or modify an object's permissions/ACL to establish its prior state. References consulted: Apple's ACL getter manual Apple Libc-1507.100.9 ACL getter source Apple xnu-8020.140.41 attribute manual

An app built with Xcode 27.1 for a macOS 15 deployment target called Logger.isEnabled(type:). In the SDK's swiftinterface the method sits under Logger's @available(macOS 11.0, ...) with no availability of its own, so it compiled without a warning. On macOS 15.6.1, libswiftos.dylib doesn't export it, and dyld stopped the app at launch: Symbol not found: _$s2os6LoggerV9isEnabled4typeSbSo0a5_log_E2_ta_tF Expected in: /usr/lib/swift/libswiftos.dylibThe macOS 15.5 SDK's libswiftos.tbd doesn't list the symbol and the 27 SDK does. I haven't checked macOS 26. Switching to OSLog.isEnabled(type:) fixed it. Which macOS version first exports this symbol? Write-up: https://yardlet.app/blog/logger-isenabled-macos-15.html

Hello ! following up from a related thread (account transfer issue, now resolved: https://developer.apple.com/forums/thread/843546?answerId=911820022), but this is a distinct, new issue so starting fresh as suggested. The extension launches fine, XPC handshake succeeds, and PIR registration completes successfully. But the subsequent NEPIRChecker status check fails every time (retried repeatedly over several minutes, same result each time): PIR status returned error <Error Domain=com.apple.CipherML Code=1100 "Unable to query status due to errors: Error details were logged and redacted." UserInfo={NSLocalizedDescription=Unable to query status due to errors: Error details were logged and redacted., NSUnderlyingError=0x677037cf0 {Error Domain=com.apple.CipherML Code=1800 "Error details were logged and redacted." UserInfo={NSLocalizedDescription=Error details were logged and redacted.}}}>Config being registered (confirmed from the logs): pirServerURL = https://pir.dropbet.app/ pirPrivacyPassIssuerURL = https://pir.dropbet.app/issueBoth endpoints are live and were already validated as part of the original NEURL Filter configuration approval. I've captured a sysdiagnose from the device right when this was happening, so I have that ready to attach to a bug report if useful — just let me know and I'll file one. Any idea what CipherML error 1100/1800 typically indicates?

Hi, We are seeing a reproducible system reboot (appears to be a kernel panic) on MacBook Neo when a third-party USB UVC camera device is opened in Photo Booth. The same setup works on another Apple Silicon Mac running the same OS version. Environment Mac: MacBook Neo, model A3404 macOS: 27.0.1 App used to open the camera: Photo Booth (system app) Device under test: our USB dongle presents a UVC composite device named "Room Camera" (USB Video Class gadget / USB camera backhaul from a room camera) Related hardware: room camera (Focus100) is attached behind an AV receiver/USB hub path, then redirected to the Mac through the dongle as a standard UVC device Our companion Mac app was uninstalled for verification; the reboot still happens, so this does not appear to depend on our app or CMIO camera extension Reproduction steps Connect the dongle to MacBook Neo A3404. Confirm that "Room Camera" is visible as a camera source. Open Photo Booth. Switch the camera source to "Room Camera". Observed result The Mac reboots immediately (100% reproducible on this Neo unit). Expected result Photo Booth should open the UVC stream normally without crashing the system. Control / comparison Same OS version (macOS 27.0.1) on MacBook Pro A3412 (M5): no reboot, camera works. Uninstalling our Mac app does not change the Neo behavior (still reboots). This suggests a host-side issue specific to MacBook Neo when starting this UVC stream (or a Neo USB/UVC host stack sensitivity to our device descriptors / isochronous stream), rather than an application-level bug in our software. Questions Are there known MacBook Neo / macOS 27 issues with external UVC devices that can cause kernel panic when a camera app (Photo Booth / FaceTime / Zoom) starts streaming? Which panic log / sysdiagnose artifacts are most useful for Apple to triage this (and which subsystem tags should we look for, e.g. UVCService / IOUSBHost / AppleUSB)? Are there known stricter UVC descriptor / configuration / bandwidth requirements on Neo versus other Apple Silicon Macs that we should validate on the gadget side? We can provide: panic reports from ~/Library/Logs/DiagnosticReports/ sysdiagnose USB device tree / IORegistry information for the UVC interface a Feedback Assistant report number if recommended Thanks for any guidance.

I am trying to test a non-consumable in-app purchase in the Apple sandbox using a development-signed, sandboxed macOS app. The app is launched from Finder rather than from an Xcode scheme. A purchase attempt instead produces a transaction that my diagnostic build identifies as an Xcode test transaction. Environment macOS 27.1; Xcode 27.2 (27B52). StoreKit 2; native Swift code called by an Electron macOS app. The app has an Apple Development signature and a development provisioning profile that includes this Mac. The app uses a fixed app bundle ID and a non-consumable product ID configured in App Store Connect. What I observed After I removed the app’s existing test transaction in Xcode’s transaction manager, the diagnostic app found no current entitlement for the product. I attempted a purchase from the Finder-launched app. There was no Apple account login or purchase confirmation prompt. A new transaction appeared in Xcode’s transaction manager, and the app returned its own verificationFailed error. The diagnostic build later found a verified current entitlement for this product and app bundle whose Transaction.environment was .xcode. The app intentionally rejects Xcode test transactions for production entitlement access. I quit Xcode and launched the app again from Finder. After removing the app’s test transaction, the same result occurred on another purchase attempt. The app’s verificationFailed label is used both when StoreKit returns an unverified result and when my own transaction acceptance checks reject it. Therefore, that label alone does not prove that StoreKit signature verification failed. I have not confirmed an actual Apple sandbox purchase or restore. Earlier automated StoreKitTest work on this machine used the same app product identifier; the current tests use a separate test-only identifier. I do not know whether the earlier tests are related. I do not yet have a focused minimal reproduction project. The app checks the product ID, app bundle ID, non-consumable type, and revocation date; in builds without the test-only flag it also rejects .xcode transactions. Its diagnostics iterate Transaction.currentEntitlements and report .xcode only for a verified matching transaction. Questions What determines whether a development-signed macOS app launched outside Xcode uses Xcode StoreKit testing or the Apple sandbox? What non-destructive checks can identify any remaining Xcode/StoreKitTest configuration associated with this app or process, without deleting unrelated apps’ transactions or resetting shared test data? What is the recommended way to transition this app to an Apple sandbox account and confirm the transaction environment before testing purchase and restore? No account details, receipts, certificates, provisioning profiles, user files, or transaction identifiers are included. I can provide a focused reproduction or additional diagnostics if needed, after preparing them.

Hello, I would like to clarify the best practices and timing for our backend server to transition its main connection to the production App Store Server API. Currently, we are considering the following approach: We plan to switch our backend’s primary API endpoint from Sandbox to Production once our app passes the App Store review and its status changes to "Ready for Sale." Could you please confirm if this timing is standard and correct? Additionally, to handle App Store reviews (which run in the Sandbox environment) and TestFlight tests seamlessly without manual configuration changes, we are planning to implement an automatic fallback mechanism: Our backend always requests the Production App Store Server API first. If it returns a "TransactionNotFound" (e.g., 4040010) error, the backend automatically retries the request using the Sandbox API. Is this automatic fallback from Production to Sandbox considered a safe and recommended practice by Apple, especially for App Store reviews and post-release testing? Any advice or insights on backend transition timing and fallback strategies would be highly appreciated. Thank you!

Hello, I would like to clarify the exact technical behavior of the App Store Server API (V2) and StoreKit under the following two specific scenarios: Case A (Production Account on Sandbox Endpoint): If a user with a production Apple Account attempts to purchase through a build pointing to the Apple Sandbox environment (or Sandbox API), how does the Apple server handle this transaction and its data lifecycle? (Does StoreKit block this at the client-side, or does the API return a specific error code?) Case B (Restoring Cleared Sandbox Data): If a Sandbox tester's purchase history is cleared/deleted on the Apple server, and the app subsequently requests a "Restore Purchase" or queries the App Store Server API using a previously valid transactionID from that account, what specific error code (such as 4040010 TransactionNotFound) or empty response does the Apple server return? I would highly appreciate your confirmation or any technical insights on these behaviors. Thank you!

Hi, During the App Review process, a test purchase was made using what appeared to be a production Apple account. When our app server sent this transactionId to the Production App Store Server API, it returned the error code 4040010 (TransactionIdNotFoundError). To handle this gracefully and prevent review rejections, we are considering implementing a dynamic fallback mechanism on our app server. Specifically, when the Production API returns 4040010, the server will automatically retry the request using the Sandbox App Store Server API URL. Could you please clarify the following points regarding this design? Is it expected behavior for an App Review purchase to return 4040010 on the Production API, and can it be successfully verified by routing it to the Sandbox API? Is this dynamic fallback logic (Production API ➔ if 4040010 ➔ Sandbox API) a recommended and officially supported best practice for handling App Review and TestFlight transactions? Any confirmation or advice from Apple engineers or the community would be greatly appreciated.Thank you.

Hello , Can anyone assist me on this issue ? i have an IOS testflight build from Replit that crashes the moment I click to connect to the Apple Health Kit. I have uploaded multiple crash logs to replit, gemini , and copilot to problem solve but so far no luck . Any insight is greatly appreciated! Mike

Hello, I am Ahmed Hamade, founder of Pixel Ventures LLC, Apple Developer Program Team ID LM3P28DNVQ. I am asking Apple to grant the restricted entitlement com.apple.developer.vfs.snapshot to our team for a macOS backup application named PixelProtect. If this is not the right channel, please tell me where to send the request. PixelProtect backs up a whole Mac volume. It keeps one primary backup set on a local disk and a replica of that same set in cloud storage, protects both copies against deletion, and supports recovery. We built it for people whose AI coding agents can delete data. We need snapshots for three reasons. First, files change while a backup runs, so the backup must read from one point in time to copy a consistent state. Second, snapshots let us keep local restore points without copying the data again. Third, Time Machine takes local snapshots for the same purpose. The only alternative today is tmutil localsnapshot, whose snapshots the system manages and ages out, so we could not keep restore points of our own. We would use fs_snapshot_create, fs_snapshot_list, fs_snapshot_delete and fs_snapshot_mount. We do not use fs_snapshot_revert. Restores copy files out of a mounted snapshot. Only our privileged helper calls these functions. It runs as root, is registered with SMAppService, and is packaged as an app-like bundle (planned App ID ai.pixelventures.pixelprotect.daemon) so it can embed a provisioning profile. The main app (ai.pixelventures.pixelprotect) and our command line tool send requests to the helper and do not call these functions. We limit use as follows. Snapshots are created only on volumes the user chose to back up. The user controls how long snapshots are kept. The helper deletes only snapshots it created, which carry our own name prefix, and only under the user's retention rules or an action the user confirms. PixelProtect is signed with our Developer ID Application certificate, uses the hardened runtime, is notarized, and is distributed outside the Mac App Store to Pixel Ventures clients. It is not sandboxed, because a whole-volume backup reads the whole volume. It has no public marketing page yet, so a product description is attached. Please enable the entitlement for Team ID LM3P28DNVQ for development and for Developer ID distribution, or tell me what further information you need. I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested Thank you, Ahmed Hamade Founder, Pixel Ventures LLC Team ID LM3P28DNVQ I tried the code-level support request form and it requires a sample project, so I am asking here as the form suggested

I’m building an iPhone app that aligns live heart-rate readings with a video recording. I’m looking for a supported way to receive a fresh AirPods Pro 3 BPM estimate about once per second during an active session. I tested with an iPhone 16 running iOS 27.2 and AirPods Pro 3. A minimal test app starts an HKWorkoutSession on the iPhone, collects heart rate with HKLiveWorkoutBuilder, and records the source timestamp of each distinct reading. With both .other / .indoor and .running / .outdoor, the median spacing between readings was about five seconds. Querying HealthKit afterward returned the same in-take readings. Is that cadence expected for third-party apps? Is there a documented API, workout configuration, or capability that Apple makes available to third-party developers for receiving fresh AirPods Pro 3 BPM estimates at about 1 Hz? My requirement is for a new estimate from the AirPods at that cadence. Polling more frequently or interpolating between readings would not meet it.

Our iPad application uses authenticated accounts in our own service. Before enabling access for a member receiving an assigned subscription, we need to establish that the actual assigned Apple member authorized enrollment into the intended account in our service. The unresolved case is another authenticated application account presenting forwarded, genuinely Apple-signed member transaction or app transaction evidence. We need to understand the supported verification boundary that prevents possession of that evidence from being sufficient to acquire another member's access. Personal purchase ownership will remain separate from assigned-member access. Proposed flow for review: The app obtains AppTransaction and the assigned Transaction directly from StoreKit and checks both against the current device using the documented device-verification procedure. It then proposes an App Attest assertion over the exact evidence and a server-issued challenge associated with the authenticated application account. The proposed client method accepts no forwarded JWS input. Our server would separately authenticate the service session and verify the attestation, assertion, Apple-signed evidence, current assignment and subscription lifecycle before granting access. Is this composition supported for authenticating assigned-member enrollment? Specifically, may the server rely on the direct StoreKit capture and local device checks within the attested app to establish that the same Apple member authorized the intended application-account association? What connects the StoreKit member/device verification, the App Attest key and the intended account, so that a valid assertion over forwarded authentic evidence would not be sufficient? Please identify the required server validation and trust assumptions, or an additional supported API/protocol if the proposal is insufficient. We also need to understand recovery after reinstall or an application-account switch, and the applicable Sandbox, TestFlight and Production support. Matching identifiers or a first successful claim must not transfer another member's access. What we have checked: The StoreKit deviceVerification documentation describes checking whether a transaction belongs to the device. The App Attest server-validation guide describes attestation, assertions, one-time challenges and per-user/device key association. We have not found an explicit assigned-member enrollment contract covering their composition. The closest existing discussions are "Scoping App Attest keys to an appTransactionID" and "Is keying off Storekit's AppTransactionID a valid pattern for storing keys?" They discuss key organization for anonymous users; they do not resolve this assigned-member enrollment question. This is an API and trust-contract clarification. A focused, newly authored sample was supplied privately to DTS. It contains no customer records, credentials, captured transaction evidence or production source. The sample was prepared using Xcode 27.0 on macOS 27.0.1 and targets iOS/iPadOS with the iOS 27 SDK. Swift syntax and project-file parsing passed, but it has not been compiled, signed, installed or device-tested. The default app displays the question; it invokes no StoreKit, App Attest, purchase, enrollment or network calls. We have not enabled assigned-member grants or claimed a reproduced Apple defect. References: https://developer.apple.com/documentation/storekit/transaction/deviceverification https://developer.apple.com/documentation/devicecheck/validating-apps-that-connect-to-your-server https://developer.apple.com/videos/play/wwdc2026/391/ https://developer.apple.com/documentation/appstoreserverapi/get-customer-groups https://developer.apple.com/forums/thread/833174 https://developer.apple.com/forums/thread/831468

I'm developing a watchOS app for Watch Ultra 2 that implements water detection using CMSubmersionManager. I would like to make it appear in the Auto-Launch settings menu, but my app is not appearing in the settings (Settings &gt; General &gt; Auto-Launch &gt; When Submerged &gt; Selected App).... What additional steps should I take to make this work? Environment Device: Watch Ultra 2 watchOS: 11.2 Xcode: 16.0 Implementation I have implemented the following as per documentation: Added the Shallow Depth and Pressure capability and Entitlement. Added the "Shallow Depth and Pressure" capability Confirmed entitlement "com.apple.developer.submerged-shallow-depth-and-pressure" was automatically added Note: I initially thought I should use "com.apple.developer.submerged-depth-and-pressure" (without "-shallow") since I'm targeting a maximum depth of 6 meters, but this resulted in compilation errors. ref: https://developer.apple.com/forums/thread/740083 ref: https://developer.apple.com/forums/thread/735296 Added NSMotionUsageDescription and WKBackgroundModes &lt;key&gt;NSMotionUsageDescription&lt;/key&gt; &lt;string&gt;Required for water detection&lt;/string&gt; &lt;key&gt;WKBackgroundModes&lt;/key&gt; &lt;array&gt; &lt;string&gt;underwater-depth&lt;/string&gt; &lt;/array&gt; According to the documentation: "It also adds your app to the list of apps that the system can autolaunch when the wearer submerges the watch." What additional steps are needed to make the app appear in Auto-Launch settings? Has anyone successfully implemented this feature?

I'm building a freediving app for Apple Watch Ultra using the shallow depth entitlement (com.apple.developer.submerged-shallow-depth-and-pressure). My app uses WKExtendedRuntimeSession with the underwater-depth background mode, and it works correctly — the session starts, Water Lock activates automatically, and Crown hold water ejection ends the session as expected. However, the app does not appear in Settings > General > Auto-Launch > When Submerged on the watch. Other third-party apps (including one that hasn't been updated in ~2 years and presumably only has the shallow entitlement) do appear in this list. My configuration: WKBackgroundModes: ["underwater-depth", "workout-processing"] WKSupportsAutomaticDepthLaunch: true (Boolean, in watch app Info.plist) Entitlement verified in both the signed binary and provisioning profile watchOS 26.3, Apple Watch Ultra 2 Tested with: development build, TestFlight, and direct Xcode deploy. Watch restarted after each. The app does not appear in any case. The documentation at https://developer.apple.com/documentation/coremotion/accessing-submersion-data states: "Adding the underwater-depth Background Mode capability also adds your app to the list of apps that the system can autolaunch when the wearer submerges the watch." Does auto-depth-launch require the full depth entitlement (com.apple.developer.submerged-depth-and-pressure), or should the shallow entitlement be sufficient? Is there an additional step required for the app to appear in the When Submerged list? Any guidance appreciated.

My app, Morrow (bundle ID com.wakemorrow.Morrow), is an alarm app built on AlarmKit. When its alarm is scheduled for the same minute as an alarm in the Clock app, one or both can stay silent. Apps can't see each other's alarms, so my app can't detect or prevent this. This is bad because users might get no alarm in the morning and sleep in! What I've seen: On October 26, a Clock alarm and my alarm rang in the same second. The full screen alert showed only the Clock alarm, and Stop only reached it. My alarm stayed "alerting" with no sound until that night. On October 29, two of my own alarms in the same minute both stayed silent. A customer reports my alarm never rang on any morning while they had another alarm set at the same time. Expected: both alarms sound, or the second rings after the first is stopped. People rely on alarms to wake up, and many keep a backup alarm. Questions: Is there any supported way for my app to know that another alarm is set for the same time, such as a Clock alarm or one from another app? Even a simple yes or no for a given time would let me warn the person before it happens. If there isn't one, could AlarmKit add it, or could it report when my alarm was silenced by another alarm? Is this silent behavior intended? Is there a supported way to make sure an AlarmKit alarm is heard when another alarm rings in the same minute? I plan to schedule a second alarm about 2 minutes later, and cancel it when the first is stopped. Is that safe and allowed, and will it be heard if the first was silenced? (Not an Ideal fix)

My app, At My Table, has a subscription issue on one TestFlight device. Version: 1.0.0, Build 26 Library: expo-iap 6.4.1 Product: com.atmytable.premium.monthly Affected device: iPhone 15 Plus, iOS 27.0.1 Tapping Subscribe displays Apple’s “You’re currently subscribed” message. However, the app reports zero active subscriptions, no current entitlement, no latest transaction, and zero available purchases. Restore Purchases prompts for Apple sign-in and then fails with: service-error: The operation couldn’t be completed. (SKInternalErrorDomain error 14.) The error persists after restarting the phone and testing separately on Wi-Fi and cellular. Another tester’s iPhone 14 Pro Max, running the same iOS version and TestFlight build, recognizes its active membership and saves changes successfully. What diagnostics would help distinguish a sandbox account or device issue from an integration problem? I have screenshots but do not yet have a minimal native Xcode reproduction.

Hello everyone, I am currently developing a simple driver log book app and I’m hitting a wall regarding a seamless user experience. My goal is very straightforward: I want my app to be notified/triggered in the background as soon as CarPlay is activated or deactivated, so it can automatically start or stop tracking a trip. Even with the official CarPlay entitlement granted, I cannot find a reliable API or workaround to achieve this. It feels like something that should be incredibly simple. I know that Apple Shortcuts (Kurzbefehle) handles this beautifully—the automation triggers for CarPlay work great. However, from an app developer's perspective, this isn't a viable solution for production: The average user will never go through the hassle of manually creating a Shortcut automation just to make the app work. Third-party apps are not allowed to programmatically create or inject these automation triggers for the user. It’s quite disappointing because the OS clearly detects the state perfectly, but doesn't expose a clean way for eligible navigation/driving apps to act on it in the background. Has anyone found a robust workaround for this? Or is there a specific API within the CarPlay framework I am overlooking that allows background execution exactly at the moment of connection/disconnection? Appreciate any insights or feedback!