Unified LiveContainer + SideStore v3.1.0

Unified LiveContainer + SideStore v3.1.0

This release publishes the newest verified combined LC+SS artifact: builder 6515874, from successful macOS CI 37158730837. LiveContainer remains the product UI; the embedded SideStore service retains upstream authentication, signing, provisioning, source persistence and installation operations.

Artifact identity: the IPA is unchanged from that verified candidate. Its in-app Build Diagnostics intentionally still say Combined LC+SS v3.0.3-rc and show builder 65158743. The public release/tag is v3.1.0. The IPA has not been rebuilt, edited or relabeled as a later builder commit.

Fixed in this release — included code corrections

• Status and operation UI: Home has an explicit Reload Status control, separate from Refresh All. Operations display truthful backend phase labels; progress is bounded to 0–100%, with completed operations at 100%. Structured failures retain useful request/stage context and meaningful recovery guidance.
• Local IPA presentation and reuse: direct root-host picker presentation, durable staging ownership and terminal cleanup address first-selection presentation and reuse after failure. Install and source-download inputs continue into SideStore's existing pipeline. The release includes a focused upstream parent/extension identifier correction, and safer provisioning diagnostics. The remaining same-file install issue is described below.
• Sources: remove the same-context duplicate check that mistook a newly fetched unsaved Source for an existing persisted one. Successful add requires a saved source verified from fresh authoritative state. Added/already-added results are distinct. The Add Source flow has explicit cancellation and keyboard dismissal; old preview responses cannot overwrite a newer or cancelled edit session.
• Auth and state ownership: prompt/session/request correlation, duplicate-submit prevention, cancellation invalidation, authoritative account reconciliation and snapshot/direct-mutation ordering. Typed authentication failures are preserved instead of guessing a wrong password from a repeated prompt. Interactive answers use a narrowly scoped transient XPC route to the admitted service/session/prompt; no persistent shared-Keychain prompt-answer dependency or automatic answer replay. Upstream SignInOperation/SideSign remain the auth implementation.
• App Group/runtime storage: actual signed group selection is carried into the embedded runtime. Recovery-storage errors distinguish unavailable storage from malformed records; clear is restricted to eligible records, idempotent on disappearance, and verified before releasing recovery hold. These are package/code checks; a third-party re-sign can change effective entitlements.
• JIT-Less integration: Setup and Health forward to LiveContainer's canonical certificate setup/diagnose flow. Read-only certificate facts use LC's existing parser rather than a competing Security parser. Imported-copy presence, identity mismatch, revoked and unknown states remain distinct. Manual import invalidates older pending writers; certificate changes invalidate stale setup observations. iOS 26+ setup completeness includes observed JIT-Less readiness.
• Lifecycle and preferences: focused upstream Dead10cc backport registers both application and extension background notifications. Guest-return handling and preference boundaries retain separate ownership. These code changes do not establish survival or persistence on every device.
• Headless cleanup: legacy SideStore screens/controllers, source/account/settings presentation, presenter adapters and UI resources are excluded from the production backend target. Backend requirements such as Anisette models and connection configuration are extracted from UI dependencies. Package inspection finds no storyboards/nibs in this IPA. Required backend assets, localizations, App Intent adapters and signing/transport dependencies remain.

Evidence and acceptance limits

The exact released SHA passed 920 macOS repository tests with zero skips, required native certificate tests, generated-source/idempotence checks, simulator layout validation, iOS SDK host/backend builds and uploaded-artifact verification. Download verification independently matched the raw IPA, builder/run provenance, 30 prepared-source hashes, 15 Mach-O images and 13 preserved matching dSYMs.

Earlier device acceptance in this candidate lineage covers first-attempt local install and recovery, Delete App, Dock, manual refresh paths, Reload Status, source add and source download. A later confirmed installed build (06fbefc1) passed one Refresh All, source add and source download, but failed the test IPA during signing. Those observations are not an exact-65158743 device signoff. Scheduled/long-duration refresh, fresh auth/all 2FA paths, source relaunch/catalog persistence, affected-device lifecycle/preferences and the newest JIT-Less readiness changes remain validation work. A download is not an installation, and a displayed certificate is not proof of valid guest code signing.

Size and package measurements

Measurements are from freshly downloaded published v3.0.2 and the exact v3.1.0 release IPA. Framework totals include nested framework files; they must not be summed with their contained executable/asset rows.

Measure (bytes)	v3.0.2	v3.1.0	Change
Raw IPA	38,736,104	25,122,692	−13,613,412 (−35.14%)
Uncompressed IPA / Payload	93,685,618	70,908,470	−22,777,148 (−24.31%)
LiveContainer executable	149,984	149,984	0 (0.00%)
LiveContainerSwiftUI executable	14,527,000	19,912,832	+5,385,832 (+37.07%)
Embedded SideStore executable	42,843,584	26,823,872	−16,019,712 (−37.39%)
SideStoreApp.framework, including nested resources	64,902,419	35,610,649	−29,291,770 (−45.13%)
SideStore Assets.car	14,638,056	2,684,408	−11,953,648 (−81.66%)
All Assets.car files	18,149,048	6,195,400	−11,953,648 (−65.86%)
Localizations	520,573	520,573	0 (0.00%)
Storyboards/nibs	307,761	0	−307,761 (−100.00%)

Raw IPA: 23.958866 MiB (v3.0.2: 36.941628 MiB). The total raw reduction is 12.982761 MiB / 35.14%. No CPU, memory, startup or runtime-speed improvement is claimed without measurements. Host UI growth is shown explicitly.

Known issues / pending validation

Embedded SideStore / LiveProcess on some iOS 27.0.1 devices

Some users report operation=connect, stage=extensionLaunch, NSCocoaErrorDomain before confirmed SideStore readiness. Older diagnostics sometimes show 3587: investigation proved v3.0.2 could synthesize Cocoa 3587 when the extension callback returned no request UUID, so 3587 alone is not proof of an executable-load rejection. The released 6515874 artifact still contains that synthetic 3587 path. Other attempts show code 3. Their relationship and exact physical root cause remain unresolved.

The newer development branch has bounded nested launch diagnostics, but those changes are not included in this IPA and have not passed native validation. Do not delete SideStore data, reset pairing or change Apple account/certificates solely because of this launch failure. No specific iOS or installer defect is established.

App ID capacity / Developer Portal result 9120

Device evidence identified appIDRegistration with HTTP 200 and application-level result 9120: the Apple-side App ID creation limit, potentially encountered while registering extensions. The released pin recognizes the older typed result 37; the explicit alternate-9120 mapping and its improved guidance are not shipped here. This release may still show the generic developer-portal rejection for 9120. Immediate retry or changing certificates does not create App ID capacity.

Other open acceptance work

• #30 source update parity remains open; the conditional Apps Update action is not proof that every catalog-installed app discovers and performs the required update.
• #31/#32 real Apple authentication and trusted-device/SMS/voice delivery require affected-device acceptance.
• #33/#34 guest background survival and host/guest preferences require independent affected-device tests.
• #35 intermittent and scheduled/long-duration refresh remains open. One successful Refresh All is not that acceptance.
• #37 same-file installation remains open; the App ID quota finding does not resolve every reported install failure.
• #38 add has passed isolated reported physical testing; another reporter still reports failure. The original affected-device flow, catalog opening and persistence across relaunch still need acceptance.
• #39 JIT-Less readiness/refresh and guest code-signature validity remain open; genuine revocation is never suppressed or claimed repaired by copying a certificate.
• #40 cancellation is implemented and covered by state/layout checks; keyboard-open device acceptance is still pending.
• Cellular-only refresh remains unsupported/unverified (#3); broader device compatibility remains tracked in #1.

Implemented later but not included

Development builder 54eb199044311193dc5a70d39f4c646218804336 includes the alternate 9120 typed mapping (bf1bb0eb) and improved launch diagnostics. Its CI run 37192627005 failed before compilation because the official pinned LiveContainer source repository was unavailable/returning 404. No IPA was produced for that builder.

This source-access problem affects reproduction/build/validation of the next candidate. The installed v3.1.0 IPA does not require GitHub to be online to run. Source/catalog downloads may naturally require their own network service.

Download, integrity and upgrade

• Asset...

Unified LiveContainer + SideStore v3.0.2

Unified LiveContainer + SideStore v3.0.2

Maintenance release in the v3 unified product line.

Major changes from v3.0.1

• Fully headless SideStore backend: no normal flow opens or renders
  SideStore UI. Authentication runs as a host-driven state machine with a
  guided sign-in and two-factor flow over the existing upstream
  SignInOperation. No second auth stack.
• Host-owned SideStore management UI: certificates, developer services,
  pairing, connection, Anisette, SideSign, installation options, health,
  backups with account export/import, SideJIT, update channel,
  diagnostics, logs, and experimental features.
• Setup Assistant: host-owned onboarding checklist covering device,
  pairing, Apple account, network, Background App Refresh, schedule, and
  a verified test refresh. Setup Complete requires pairing, signed-in
  team, acceptable network and tunnel, available Background App Refresh,
  enabled schedule, and a refresh verified in the current session.
• Service-readiness and structured diagnostics: structured failures are
  preserved end to end instead of being double-wrapped, with correlated
  startup, auth, operation, and setup markers.
• Refresh Manager uses normal navigation instead of sheet presentation;
  Home status rows are tappable; Settings sections are relevance-ordered
  with Build Candidate at the bottom.
• New persistent Multitasking setting "Start Dock Collapsed": applied
  once at dock creation, off by default. Independent from "Hide Collapsed
  Dock" and Guest Controls.
• Manual refresh taps that coalesce onto a running refresh now report
  visibly instead of staying silent; first-launch notification permission
  prompt with plain-language explanation.

Download and installation

• LiveContainer-SideStore-AutoRefresh.ipa

Sign with your own Apple account using a compatible installer. Update over
the existing same-team, same-identifier installation; do not delete
LiveContainer first. Existing v3 users upgrade in place with SideStore and
LiveContainer data preserved: Core Data, account and login state, Keychain,
certificates, teams, pairing, sources, installed apps, refresh history,
guest data, settings, and LiveProcess configuration. No database reset,
sign-out, pairing deletion, or Keychain reset is part of the upgrade.

Limitations and device-validation status

• Free Apple Account / Personal Team, pairing file, Developer Mode, Wi-Fi,
  and official unmodified App Store LocalDevVPN with a compatible local
  route, as with v3.0.1.
• Deployment targets are unchanged; optional newer APIs are
  availability-guarded. App Intents require iOS 16+.
• iOS may delay or omit background tasks. A deadline, submitted request,
  task launch, or installation handoff is not proof of completed refresh.
• Physical-device validation so far covers sign-in, install/update/refresh
  flows, and background behavior on limited devices. Broader
  account/device configurations are not yet proven. Issue #18 (Apple ID
  503/429 reports on other setups) remains open pending evidence from
  affected users. Do not treat CI success as physical-device proof.

Provenance

• Builder commit: 35c6c28c98e7261afe6049a133a9ae542d666d57
• LiveContainer: 12377cf3b91d51739a33f14a302e5f522b238593
• Embedded SideStore: ff25922e5c13ccfafd83bda5092910d848ebd409
• SideSign: a731c0d5a9a6617c7b385ae493e07ffb7f81cd5d (GSA fix 35993d7
  verified present in the prepared build tree by test)
• minimuxer: 98c3c79982f813878e922ab42f9545314a700f0c
• idevice: ebd7dadfc55d1c4facee3d11ecf5b28e20548b57
• jktcp: e674e1eee6d5943e13b1eba0bd24a9dd0b2fa020
• CI: livecontainer-build.yml run 35518324344 completed successfully:
  190 repository tests passed, 512 layout measurements passed, host and
  embedded builds passed, transport checks passed, IPA packaging and
  identity checks passed.
  https://github.com/NRG-Wardog/sidestore-auto-refresh/actions/runs/35518324344
• In-app identity: Combined LC+SS v3.0.2
• IPA size: 38736104 bytes
• IPA SHA-256: 5AAB622EB91CA9007BD4A29E5AD8FEB90791AC8EBB1AB7393022A1C7474CA02E

Unified LiveContainer + SideStore v3.0.1

Unified LiveContainer + SideStore v3.0.1

This is the next maintenance release in the v3 unified product line.

Improvements

• Improved Account & Signing navigation
• Redesigned guided 2FA flow (choose delivery method, then enter the code)
• Improved certificate/signing navigation
• Improved Home navigation and tappable status rows
• Refresh Manager now uses normal navigation instead of the previous sheet presentation
• Settings sections reorganized for clearer navigation (Device, Apps & Data, Services, Diagnostics)
• Build Candidate (product/build identity) moved to the bottom of Settings
• Improved handling of signed-out/account-required screens (they now link to Sign In)
• Stability improvements to the v3 service integration
• Existing automatic/manual refresh and state-preservation behavior retained

Upgrade

Existing v3 users should be able to upgrade in place while preserving their SideStore and LiveContainer data when installed with the same expected identifiers/signing configuration. No app deletion, database reset, sign-out, pairing deletion, or Keychain reset is part of the upgrade.

Testing

CI on the release commit verified: 156 repository tests passed, 512 simulator layout measurements passed across phone/tablet suites, Swift parsing and full host/embedded builds passed, transport verification passed, and the packaged IPA passed structure/architecture/identity checks (arm64, LiveProcess and embedded SideStore present, no credentials packaged).

Physical-device testing so far covers one device with successful sign-in. Broader account/device configurations are not yet proven — in particular, Issue #18 (Apple ID 503/429 reports on other setups) remains open pending evidence from affected users, and background-refresh behavior still needs on-device validation.

Provenance

• Builder commit: 6f0a144936c789bd7557d93ecf752888fddbb256
• LiveContainer: 12377cf3b91d51739a33f14a302e5f522b238593
• Embedded SideStore: ff25922e5c13ccfafd83bda5092910d848ebd409
• SideSign: a731c0d5a9a6617c7b385ae493e07ffb7f81cd5d (contains GSA fix 35993d7)
• minimuxer: 98c3c79982f813878e922ab42f9545314a700f0c
• idevice: ebd7dadfc55d1c4facee3d11ecf5b28e20548b57
• jktcp: e674e1eee6d5943e13b1eba0bd24a9dd0b2fa020
• Build: https://github.com/NRG-Wardog/sidestore-auto-refresh/actions/runs/35419528113
• IPA SHA-256: A8A783D4FB6D29FAA449024872F1C56755351F9593349C6BC10B9CD76FE16311

Unified LiveContainer + SideStore v3.0.0

Unified LiveContainer + SideStore v3.0.0

For installation, download only the .ipa file.

build-evidence.zip contains the five original verification files unchanged. It is optional and is not needed to install or run the app. GitHub's Source code archives are for developers, not iPhone installation.

One app experience, instead of switching between two separate interfaces.

v3 brings Home, Apps, Sources, Refresh, and Settings into one navigation structure. Normal SideStore operations are available inside the unified app, without entering the old SideStore tab bar and then returning to LiveContainer.

Maintainer's note: I know the interface still over-explains some things. There is room to simplify the wording, but the overall flow makes much more sense now and is working well. The goal is to make the app easier to use while keeping useful status and error information visible.

What changed

• Unified navigation, app library, source browsing, and account/signing access. SideStore remains responsible for its database, Keychain, authentication, signing, and installation; LiveContainer remains responsible for guests and their runtime.
• Corrected the startup bookmark trap from the first v3 preview. Storage preparation and service startup are explicit, and startup failures return structured errors instead of force-unwrapping a failed bookmark.
• Service connection is separate from refresh. Loading status no longer uses the misleading __v3_connect refresh sentinel.
• Issue #24: transport, RSD, lockdownd, and device-query failures preserve their stage and error code instead of being reported indiscriminately as invalid pairing.
• Issue #25: corrected zero-height Grid cells, with layout checks for phone and tablet widths. List, Grid, and Compact List retain the existing LCAppLayoutStyle and LCShowAppLabels preferences.
• Upstream GSA authentication fix integrated through the pinned LiveContainerSupport source and its SideSign dependency, rather than a separate header backport.
• Manual/scheduled refresh, history, verification, Guest Return, Start Collapsed, and custom Return colors are retained. Uncertain refresh outcomes are not silently treated as success or blindly retried.

Installation and upgrade

Download LiveContainer-SideStore-AutoRefresh.ipa below. Import this exact file into a compatible installer such as iLoader. Keep the required app extensions, including LiveProcess.

To upgrade, keep the same signing identity and application identifiers. Do not delete the existing app or reset its database, pairing, or guest data as a routine upgrade step.

In v3, use Settings > Account and Signing for authentication. Complete pairing and LocalDevVPN setup, then run and verify a manual refresh before enabling the schedule.

Requirements and limitations

• The supported same-device refresh path still needs Wi-Fi, valid pairing for this device, and the separate official LocalDevVPN app with appropriate network configuration.
• Background refresh timing is controlled by iOS and may be delayed. A scheduled request is not proof of a completed refresh. Check the last verified refresh before signing expires.
• Cellular-only refresh is experimental.
• Integrating the upstream GSA fix does not establish that every Apple login failure or HTTP 429 response is resolved.

Exact package and build evidence

This release promotes the existing preview.2 candidate unchanged. It does not rebuild, re-sign, or replace the IPA. The upstream in-app version can still display 3.8.9; use the builder revision to identify this package.

• Builder: 6bbddd55531ac2497707fce184e5370f76d7991f
• CI: https://github.com/NRG-Wardog/sidestore-auto-refresh/actions/runs/34763923268
• IPA SHA-256: 699f20bd839136b652e30c6c4de1d9237aa79b91437202daf4f8e59684358268
• SideStoreSupport / matching dSYM UUID: C59B7B1F-1CC8-3667-AE90-2514C2F11869
• Embedded SideStore: ff25922e5c13ccfafd83bda5092910d848ebd409
• minimuxer: 98c3c79982f813878e922ab42f9545314a700f0c
• SideSign: a731c0d5a9a6617c7b385ae493e07ffb7f81cd5d
• GSA fix ancestor: 35993d7f68950ce00d6bf1fd0fbcaa7bef51dc9c

Automated evidence covers repository checks, real-renderer simulator layout checks, source builds, transport tests, packaging, and executable verification. The evidence inside build-evidence.zip keeps physical-device acceptance separate; CI is not a substitute for device login/2FA, guest-runtime, or unattended-refresh testing on every supported setup.

v2 and standalone packages are not changed by this release. When reporting a problem, include v3.0.0, the builder revision, your iOS version, and a redacted error or crash report. Never upload pairing files, credentials, private keys, or personally signed IPAs.

SideStore CoreDevice Auto-Refresh v1.0.5

SideStore CoreDevice Auto-Refresh v1.0.5

Stable standalone SideStore release.

Validation

• Tested successfully on iPhone 16 running iOS 26.
• Standalone SideStore only; this is not the combined LiveContainer + SideStore preview.

Build provenance

• Builder commit: fdb6375128d2bff2112c320999a1f52ee94a8321
• GitHub Actions build: 34753420344
• SHA-256: ca8440f929829d9f06cf13aa2034f12e758991a995466a0ee327a3484f618829

Includes the newer SideStore authentication path and the existing CoreDevice auto-refresh functionality.

LiveContainer + SideStore Auto-Refresh v2.1.1

Implements Issue 17 app layouts. Grid actions preserve the established launch, multitasking, context menu, confirmation, and error paths. Verified by the successful combined IPA workflow.

SideStore CoreDevice Auto-Refresh v1.0.4

Implements Issue 17 app layouts. Includes List, Grid, Compact List, persisted label visibility, and immediate layout updates. Verified by the successful standalone IPA workflow.

SideStore CoreDevice Auto-Refresh v1.0.3

SideStore CoreDevice Auto-Refresh v1.0.3

Standalone SideStore update based on SideStore 0.7.0 nightly.

• SideStore upstream: c6f28864dc99ed03ad35f2ca58967247036b7b53
• minimuxer: 9f038e5223a8cacf9d15beae7da6969d617ae1e8
• SideSign: 8385fab56e7bd5aea8110e1b85ab069a71e45ce0
• idevice: ebd7dadfc55d1c4facee3d11ecf5b28e20548b57
• jktcp: e674e1eee6d5943e13b1eba0bd24a9dd0b2fa020
• Builder: 07d52be7a49f6795b82f081ded2ec94eb44d50df
• Includes the newer upstream authentication path used by SideStore 0.7.0.
• Retains LocalDevVPN + Lockdown/CoreDevice transport.
• Retains manual and scheduled auto-refresh, history, verification, retries, and diagnostics.
• Composite pairing records prefer Lockdown/CoreDevice.
• Cellular-only refresh remains experimental.

Install over the existing standalone SideStore if you want to preserve existing app data and configuration.

LiveContainer + SideStore Auto-Refresh v2.1.0

LiveContainer + SideStore Auto-Refresh v2.1.0

Feature release for the combined LiveContainer + embedded SideStore build.

What's new

• Added Start Collapsed under LiveContainer Settings > Guest Controls so the Return control can start as a compact edge tab.
• Added Use Custom Colors with separate Icon Color and Button Background controls.
• Saved guest-control appearance preferences persist across launches.
• Manual long-press collapse and tap-to-expand behavior remain available.
• The collapsed tab stays transparent while using the selected icon color.

Existing refresh functionality

This release retains the v2 refresh stack: native scheduled refresh, manual Refresh SideStore now, refresh history, verification, LocalDevVPN/CoreDevice transport, and embedded SideStore integration.

Cellular-only refresh remains experimental and is not part of this stable release.

Installation

Sign the IPA with your own Apple Account using a compatible installer and install it over the existing matching LiveContainer + SideStore installation.

Do not delete LiveContainer first. Back up important guest data before updating.

For iLoader, use version 2.3.1 or newer and choose Import IPA for this repository's build.

Provenance

• Builder commit: 2372c3e96132cb06394dafdd9ff74aeca416dd1c
• Combined CI run: 34497164738
• Upstream LiveContainer: 12377cf3b91d51739a33f14a302e5f522b238593
• Embedded SideStore: 10ffa01ecdfe4203a7ad5d7f41c0d5de03bd8abb

The attached SHA256SUMS.txt contains the checksum of the published IPA.

LiveContainer + SideStore Auto-Refresh v2.0.1

LiveContainer + SideStore Auto-Refresh v2.0.1

Patch release correcting false refresh failures caused by guest-signature diagnostics. Related report: Issue #13.

What changed

• A successfully verified refresh is no longer changed to GUEST_SIGNATURE_INVALID solely because an unrelated LiveContainer guest returns false from checkCodeSignature().
• Guest-signature results are advisory and displayed separately from refresh status. A false signature check alone does not establish that the guest cannot launch.
• Diagnostics collect all normal and hidden guests, preserve affected bundle IDs, and distinguish false checks from missing or unreadable executables.
• A verified refresh keeps its successful history result and background-task completion status. Guest warnings do not overwrite the refresh error state. Clean diagnostic results clear previous guest warnings.

Real failures remain failures

Failed installation results, missing/mismatched/incomplete verification manifests, and unverified host replacement are not converted into success. Host profile verification is unchanged.

No changes were made to LocalDevVPN, CoreDevice, pairing, TLS, CDTunnel, RSD, AFC, InstallationProxy, guest signing, bundle identifiers, entitlements, or deployment targets for this fix. All existing LiveContainer extensions and embedded SideStore components are retained.

This release does not include the experimental cellular diagnostics or the separate standalone SideStore staging/startup fixes. Cellular-only refresh remains unsupported.

Installation

Download LiveContainer-SideStore-AutoRefresh-v2.0.1.ipa and sign it with your own Apple account using a compatible installer. Install over your existing same-team, same-identifier LiveContainer installation. Do not delete LiveContainer first. Back up important guest data before updating.

Use Wi-Fi and official LocalDevVPN with the existing valid pairing configuration. Release numbering does not replace upstream application version numbers.

Validation status

• CI: 77 repository tests, 75 passed and 2 skipped. The two skipped startup tests passed locally with the pinned source checkout.
• LiveContainer and embedded SideStore Release builds passed, along with combined-package, runtime-contract and CoreDevice transport verification.
• Regression coverage includes one/multiple false guest checks, missing/unreadable guest executables, warning persistence/clearing, and genuine manifest failures.
• A successful test has been reported on another phone. Confirmation on the originally affected iOS 27 beta device is still pending; this is not a claim of universal iOS 27 compatibility.
• iOS background scheduling remains best-effort. This release does not guarantee unattended execution or guest process retention.

Test the reported issue

1. Confirm your existing guests launch before updating.
2. Install this release over the existing LiveContainer without deleting its data.
3. With Wi-Fi and LocalDevVPN enabled, press Refresh SideStore now in LiveContainer's SideStore refresh settings once.
4. If host replacement requires relaunch, reopen LiveContainer and allow verification to complete. An awaiting-relaunch handoff is not a verified success.
5. Confirm a verified refresh stays successful in status/history. Any guest warning should be separate and name affected bundle IDs.
6. Open every guest named in the warning. Report its launch result alongside GUEST_SIGNATURE_CHECK and GUEST_SIGNATURE_SUMMARY records.
7. Compare embedded SideStore refresh and the existing Shortcut refresh as positive controls.

The decisive reproduction is a guest check returning false while that guest still launches and the verified refresh remains successful. A clean run without a guest warning is useful, but does not reproduce the original false-failure condition. Do not share pairing records, credentials, certificates, or complete private logs.

Provenance

• Builder/tag commit: 348af2d3f4e411f7c02cc225aac20ac4fcc8983a
• Successful CI build 34313715646
• LiveContainer: 12377cf3b91d51739a33f14a302e5f522b238593
• Embedded SideStore: 10ffa01ecdfe4203a7ad5d7f41c0d5de03bd8abb
• IPA size: 37,401,215 bytes.
• SHA-256: 486d8c55810e421d6fa7fda0897832e92d3d3045c52d4ec070e14d80fd92c25e

This is the exact previously built 348af2d guest-diagnostics candidate under a release filename. Its IPA contents were not modified or rebuilt for publication.