Ok, this seemed to do it for me.         persistentContainer = NSPersistentContainer(name: "DataModel")         let description = persistentContainer.persistentStoreDescriptions.first         description?.setOption(true as NSNumber, forKey: NSPersistentHistoryTrackingKey)         persistentContainer.loadPersistentStores { description, error in             if let error = error {                 fatalError("\(error)")             }         } I have a different class for CloudKit but I presume I could combine them more than I have. I finally found this answer.

No onDemandRules are set up. I just filed FB9970916.

(Sorry for the frequent comments.) If I sudo launchctl kickstart it, same behaviour. If I go into SysPrefs>Network and click on the Connect button, it works. Which is very similar to what I asked to begin with.

... no log messages, and my CLI program to try to connect to it via XPC hangs.

Oh! It did come back this time. But with absolutely no log messages. And it took more than 2 minutes.

The kill -9 just once. I just now did kill -9 $pid ; sleep 120 and I'll see what's going on. What information would be most useful in a bug report?

Ok, I just verified: I did a kill -9 $pid, and waited 30 seconds. Nothing in /var/log/system.log, and it didn't come back until I went into SysPrefs > Network, selected my now-disconnected VPN, and clicked on "Connect". I tested this on 21E230. Before clicking on "Connect," I did a ps to see if it had been started; it didn't show up.

Ok, so I am not doing anything wrong. 😄 (And yes, it's a subclass of NETransparentProxyProvider.) I already have logs when the subclass init's; I'll try adding one to main as well. And I'll also try waiting a moderate amount of time. Thank you! I feel much better because I wasn't missing something obvious!

Ok. There ended up being multiple instantiations of my NETransparentProxyProvider subclass. The first one, which was causing the problems, still had an XPC listener, and the anonymous XPC connection. In stopProxy, I added code to nil out the invalidation handler, invalidate them, and then set them to nil just for good measure. I must still be missing something, because I added a deinit method that logged it, and it's not being called. sigh. But! That is how it was being set to nil despite my observing it. I am much less frustrated now.

Ok. In stopProxy, I think I need to invalidate all of the XPC connections and listeners.

Ah ha! Although I don't know how to deal with this yet. There are two distinct instantiations of my class! When stopProxy is called the first time... the object still has things going on. When the the VPN is reconnected, it creates a new one. Let's see what I can do with this information!

Yes. Or a daemon (which is what we're using). I have the daemon send an anonymous listener to the extension's NEMachService port.

I did confirm, at least, that it keeps the same pid, although it calls init multiple times.

I wrote a really stupid ObjC class to post notifications. (And then ran into this wonderful fact: I couldn't use the method names I wanted, because Swift decided they'd been renamed due to NotificationCenter. Is this a bug?) Then I added some C code to the daemon and voila, NOTIFICATIONS. As always thank you Quinn!

Is there a sample or set of documentation for using that in Swift? (I'm still very, ahem, fuzzy on using-C-from-Swift.)