UPDATE — SOLVED (workaround found, with an assist from Claude) I'd been throwing this at Claude Code for a while with Opus 4.8 on max effort and it kept dead-ending at "beta bug, file Feedback and wait." Retried with the new Fable 5 model and it diagnosed and fixed it end-to-end in one session. After ruling out the usual suspects (re-download, reboot, runFirstLaunch, images.plist rebuild, clock, disk space), it found the real error: xcrun simctl runtime verify <image-uuid> → Signature verification failed: -67054 "a sealed resource is missing or invalid" So the new arm64-only "patchable cryptex" delivery path is what's broken on this beta — the runtime content itself is fine. It then noticed the MobileAsset download contains a plain .dmg inside it, and feeding that to the old staged-disk-image pipeline bypasses the broken path entirely: xcrun simctl runtime add /System/Library/AssetsV2/com_apple_MobileAsset_iOSSimulatorRuntime/<hash>.asset/AssetData/Restore/<file>.dmg Result: runtime registers as Verified, the full iOS 27 device fleet auto-creates, and an iPhone 17 Pro sim boots fine. The watchOS 27 runtime had the identical bug — same fix via com_apple_MobileAsset_watchOSSimulatorRuntime. (The APFS clone means it uses ~no extra disk. The old broken cryptex image stays listed as "Unusable - Cryptex Mount Preferred" — harmless; delete it by UUID if a reboot ever regresses the registration.) Honestly impressed — Opus 4.8 on max effort couldn't crack this after multiple attempts, but Fable 5 went from "simulator won't show up" to root-causing a cryptex code-signing failure and finding a working bypass in one session. FB filed with the -67054 error so Apple can fix the patchable path.