Hi Ziqiao, thanks! Tried both suggestions: (1) visible NotificationInfo (alertBody + shouldBadge + category, dropped shouldSendContentAvailable) and (2) CKModifySubscriptionsOperation. Both still fail identically: CKError 12 / BAD_REQUEST / "attempting to create a subscription in a production container", 0 subscriptions. Full results + server RequestUUIDs are in my detailed reply below. Is this the known server-side issue?

thanks! Tried both suggestions: (1) visible NotificationInfo (alertBody + shouldBadge + category, dropped shouldSendContentAvailable) and (2) CKModifySubscriptionsOperation. Both still fail identically: CKError 12 / BAD_REQUEST / "attempting to create a subscription in a production container", 0 subscriptions. Full results + server RequestUUIDs are in my detailed reply below. Is this the known server-side issue?

followup point #2 (Security Roles): checked Schema → Security Roles. GuardianRequest and GuardianResponse grant Read via _world, Create via _icloud, Write via _creator — a standard public-DB config. The Read permission query subscriptions need is present, so Security Roles don't appear to be the cause.