Team-scoped keys introduce the ability to restrict your token authentication keys to either development or production environments. Topic-specific keys in addition to environment isolation allow you to associate each key with a specific Bundle ID streamlining key management. For detailed instructions on accessing these features, read our updated documentation on establishing a token-based connection to APNs.

Both Photos and Lightroom are able to detect when a card reader has been plugged into an iPhone or iPad and a card exists with the correct DCIM format (from a digital camera). I have been unable to find the API that allows an application to do this (except using the standard file import function and making the user navigate to the card). ChatGPT tells me that Photos and Lightroom use a private API that is not made available to normal developers. Does anyone know if this is true - or if not then how to detect that a card is present using Swift?

Hello! I'm trying to implement an editor app (macOS) that allows the user to write code, which will be compiled and executed, showing the result in the editor window. Imagine it like SwiftUI previews, but the graphic output is created with Metal, not SwiftUI. I found that IOSurface can be used to share that kind of data over XPC, so I would not have to rely on the private NSRemoteView. However, I'm confused if it is, at all, possible for my editor app to connect to an XPC Service, that was NOT bundled with it (but compiled by it at runtime). I succeeded to launch an XPC service defined as: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.myteam.myproject.service</string> <key>MachServices</key> <dict> <key>com.myteam.myproject.service</key> <true/> </dict> <key>Program</key> <string>/Path/to/service/run_my_service.sh</string> </dict> </plist> But the call to let connection = NSXPCConnection(machServiceName: "com.myteam.myproject.service") let proxy = connection.remoteObjectProxyWithErrorHandler { error in continuation.resume(throwing: error) } as? MyServiceProtocol fails with "The connection to service named com.myteam.myproject.service was invalidated: Connection init failed at lookup with error 3 - No such process." I have added <key>com.apple.security.temporary-exception.mach-lookup.global-name</key> <array> <string>com.myteam.myproject.service</string> </array> to my entitlements. Since the tutorials I followed are quite old, I'm wondering if support for something like this was dropped at some point. Thanks for any advice!

My software installs a privileged daemon using the SMAppService api. After removing the executables and recompiling the software I sometimes find that it needs to be registered again. After doing this, i.e. ensuring the application is properly registered and enabled in Login Items & Extensions the helper is not run when initiated from XPC. SMAppService.status has returned .enabled, and there is a valid job dictionary for the helper. I check the job dictionary with a function called updatePenaltyBoxStatus() that was given to me by a friend but I think originated from Apple. If I logoff (or reboot), login again, manually open Login Items & Extensions to check registration, then retry the application, it works. I don't mind doing this but it is probably a bit much for a lot of my users. Is there a reliable way to do this programatically? Here is my Swift translation of updatePenaltyBoxStatus. I fetch the job dictionary with SMJobCopyDictionary() prior to calling isInPenaltyBox(). I also had to write C wrapper functions for the WIFEXITED and WIFEXITSTATUS macros. func isInPenaltyBox(_ dict: Dictionary<String, Any>?) -> Bool { guard let jobDict = dict else { // If the helper was in the penalty box, unregistering it doesn't change that. So don't override a previous helperInPenaltyBox value return m_penalty_box } if let lastExitStatusObj = jobDict["LastExitStatus"] as? NSNumber { let lastExitStatus = lastExitStatusObj.intValue if wifexited(Int32(lastExitStatus)) == 0 { // It might've stopped or exited due to a signal or whatever. // Regardless, it didn't meet our criteria for winding up in the penalty box. m_penalty_box = false } // Now get the exit status and check for `EX_CONFIG`. let status = wexitstatus(Int32(lastExitStatus)) let newInPenaltyBox = status == EX_CONFIG if m_penalty_box != newInPenaltyBox { Logger.instance.log( "Penalty box change: " + m_ident + " old: " + String(m_penalty_box) + " new: " + String(newInPenaltyBox)) } m_penalty_box = newInPenaltyBox } return m_penalty_box }

Hi, is there any ETA on when we can see support for nested virtualization in MacOS VMs? Running Docker specifically would be nice.

I've seen a number of similar posts from other network system extension developers reporting kernel panics on M5 devices in macOS. These kernel panics occur when network system extensions are enabled and are not observed on earlier mac platforms or versions of macOS. Reference: https://developer.apple.com/forums/thread/821372 In this post, it appears like Apple is aware of a problem as noted by Kevin Elliott in versions of macOS. Do we know if there is any way to work around this problem (short of not enabling a network filter) until a fix is available?

In the last few weeks 5 users have reported my workout watch app being unable to read health data despite the permissions being enabled in the iPhone Settings app. This has been a common complaint over the years and is usually fixed by disabling the permissions; rebooting both devices; and then enabling them again. This usually nudges iOS into sending the permissions to watchOS. However that procedure doesn't work for these users, all of whom are using watchOS 10.6.2. They are using various versions of iOS 18 or 26 so it seems to be a problem with that version of watchOS, which users are usually limited to because their hardware won't support anything more up to date. It seems that unpairing and re-pairing the watch can fix the problem but not always. I looked around and it seems that other apps are having the same problem: https://www.reddit.com/r/runna/comments/1rhhs2n/runna_wont_start_an_outdoor_run_on_apple_watch/ Does anyone know a way to fix this? My current advice is to repeatedly unpair / re-pair until it works, which isn't really practical! Thanks in advance.

After an app update replaces our extension with the new version, the XPC connection between the app and the extension fails to work roughly 20% of the time. Once it's broken, it stays broken — our reconnect/retry logic doesn't recover it, stopping and starting the extension doesn't recover it, and the only thing that fixes it is a full machine restart. This obviously isn't ideal. I've seen a few other threads describing the same or a very similar issue: https://developer.apple.com/forums/thread/728063 https://developer.apple.com/forums/thread/779395 https://developer.apple.com/forums/thread/742992 On a broken upgrade cycle, when we run: sudo launchctl print system/NetworkExtension.com.company.example.app.filter.5.5.0.2248 the endpoints entry is missing from the output entirely. On a working upgrade cycle, the same command shows endpoints = {} is present. So it looks like our XPC service isn't actually getting registered with launchd in the broken case. We've tried various changes to our connection logic, but nothing prevents the issue — random upgrades still end up broken with no obvious cause. Is there a known way to recover the XPC registration without requiring a machine restart?

Hi all, I'm the developer of OV Message, an end-to-end encrypted SMS messaging app already shipped on Google Play (Android, where it natively encrypts SMS content). The iOS port aims to be the default carrier-messaging app, handling SMS, MMS, and RCS through TelephonyMessagingKit with the com.apple.developer.carrier-messaging-app entitlement under the EU programme. While testing the cold-launch flow on iOS 26.x, I've hit a reproducible bug that silently drops the first SMS/MMS/RCS that wakes the app, and I'd like to confirm whether other devs working with this API see the same. The bug When a default carrier-messaging app is force-killed and a message arrives, iOS correctly: Routes the message via CommCenter (IMS in my case — SFR France) Wakes the app in background (state = .background at didFinishLaunchingWithOptions) Acquires a TelephonyMessaging runningboard assertion on the app But CommCenter then pushes the pending message via XPC before the client TMK library has finished registering its messageHandlersByID dictionary. Result: client responds Received unhandled request, server logs TMKXPCError Code=2, message is dropped, never delivered to for await in incomingMessageNotifications. Subsequent messages (with the app warm) work fine. Native log sequence (from idevicesyslog with the Telephony logging profile) T+0.000 CommCenter: SMS arrives via IMS (k3GPP) T+0.003 CommCenter: Default app is set to com.example.app T+0.004 CommCenter: Attempting to launch and acquire process assertion T+0.083 CommCenter: Notifying SMS message received, target: bundleID=... T+0.085 CommCenter(TMK): There are no client connections matching, pending message [~125 ms — app boots] T+0.128 App(TMK): Configuring connection T+0.128 App(TMK): Pinging remote end T+0.130 CommCenter(TMK): Received new connection from PID T+0.130 CommCenter(TMK): New incoming connection, flushing pending messages (1) ← server flushes T+0.130 App(TMK): Received unhandled request ← client not ready T+0.131 CommCenter(TMK): Failed to send pending message: TMKXPCError Code=2 T+0.132 App(TMK): Registered for IncomingMessageNotification (smsReceived) ← ~2 ms too late The race window between Pinging remote end (client) and Registered for IncomingMessageNotification (client) is 2–7 ms across my measurements. CommCenter considers the connection ready as soon as the ping completes, but the client library populates messageHandlersByID slightly after, so the dispatch fails. Minimal reproduction I built a ~50-line Swift app to confirm this isn't specific to OV Message. UIKit AppDelegate, single for await in TelephonyMessagingSession.shared.smsService.incomingMessageNotifications started in didFinishLaunchingWithOptions. No SwiftUI, no other modules, no Darwin notifications. Just TMK. Steps: Build & install on iPhone iOS 26.x with carrier-messaging-app entitlement (auto-provisioned in iOS 26) Settings → Apps → Default Messaging → select the test app Force-kill, then send 2 SMS in rapid succession from another phone Wait 30 s, open the app — log shows only the 2nd SMS Same result: the 1st SMS is gone. I've reproduced this consistently dozens of times. Source code (Swift + xcodegen project.yml): https://gist.github.com/ovmessage/fbc529292a65222191bec6ce5e5a4275 What I've tried Task.detached(priority: .userInitiated) to decouple the for await from main thread scheduling — no effect (race is internal to TMK lib, before our scheduling) Pre-fetching cellularServices synchronously — no effect Subscribing MMS + RCS in parallel — no effect Direct XPCSession/xpc_connection_create_mach_service to com.apple.commcenter.tmk.xpc — Apple has marked these unavailable on iOS for 3rd-party apps (no public way to bypass the lib) I've also done runtime introspection of the TMK framework via Mirror, which confirms the architecture: a single XPCConnection.messageHandlersByID dict shared by smsReceived, mmsReceived, rcsReceivedNotification — all four entries (incl. serviceStatusNotification) are populated after the XPC ping. So the same race affects SMS, MMS, and RCS equally. Suggested fixes (Apple-side) Either: Server (CommCenter): defer flushing pending messages until the client confirms its handlers are registered (extra XPC handshake message) Client (TelephonyMessagingKit): register messageHandlersByID entries before sending Pinging remote end, so they exist when the server starts flushing Buffer client-side: cache messages received before handler registration completes, dispatch on attach Filed in Feedback Assistant FB[YOUR_FB_NUMBER_HERE] Question for fellow devs If you're also building with carrier-messaging-app entitlement (Beeper, Google Messages on iOS, anyone in the EU programme), can you confirm whether you see the same race? Especially interested in whether: It happens with non-IMS carriers (mine is SFR France, IMS-routed via SIP) iOS 26.1 / 26.2 changed the timing Anyone has found a workaround I haven't tried Thanks.

I'm a first time developer, relying heavily on Claude Agent. In my app, I'm using CloudKit to sync data between devices, but after a migration something got corrupted and syncing is no longer working. I'm using SwiftData with NSPersistentCloudKitContainer. I'm using Xcode 26.4.1 on a Mac mini. I'm testing my app on the same Mac mini, running Tahoe 26.4.1 as well as an iPad 12.9 running iPadOS 26.3.1 and an iPhone running iOS 18.7.8. Sync stopped after a cachedTotal property was added to a SwiftData model, which triggered a backfill migration that wrote to all records simultaneously across multiple devices. This was followed by an iCloud sign-out/sign-in on the Mac. Here’s a summary of everything I’ve tried already: Reset All Data on all devices multiple times Deleted and reinstalled the app on all devices Deleted the CloudKit zone twice Force-deleted local SQLite store files to clear change tokens Zone and subscription both appear correct in the dashboard Change token updates when data is written (confirming uploads work) No data propagates to other devices in any direction Uploads appear to succeed (change token changes) but imports never fire on any device. In other words, writes work, reads don’t. Is there a way to fully reset the CloudKit container's production private database for a TestFlight app, or is there a way to diagnose why imports are not firing despite a valid zone and subscription?

When I query, an existing database with over 10,000 records from an Objective C app (i.e. CKQueryOperation) I get only N x 100 records returned where N varies each time between 0 and about 10 (i.e. never more than 1000 records and always an even multiple of 100). When I do a “Query Records” on the CloudKit Dashboard I get a similar number of pages of records downloaded (i.e. 0-10). If I tap “Query Records” multiple times I will get more pages of records until the full 10,000 are downloaded. This had been working fine until recently, both from the app and the Dashboard. There are multiple Record Types in the database. Only one Record Type is erroring. The other Record Types continue to work both from the app and the Dashboard. In particular, the Users Record Type has many many records and they all download to many pages with a single tap of “Query Records”. I have posted this to the Feedback Assistant under FB22358865. Here is my code: NSPredicate *predicate =[NSPredicate predicateWithFormat:@"modificationDate>%@",dateLastSynched]; CKRecordType theRecordName=[NSString stringWithString:@"Notices”]; // I also try this for @“Links” and @“Messages” and @“EventMessages" CKQuery *query = [[CKQuery alloc] initWithRecordType:theRecordName predicate:predicate]; CKQueryOperation *theOperation=[[CKQueryOperation alloc] initWithQuery:query]; [self startAQueryOperation:(CKQueryOperation *)theOperation theName:(NSString *)recordName]; -(void)startAQueryOperation:(CKQueryOperation *)theOperation theName:(NSString *)recordName{ theOperation.recordFetchedBlock=^(CKRecord *theRecord){ NSLog(@"XXXjust downloaded a %@",recordName); }; theOperation.queryCompletionBlock=^(CKQueryCursor *theCursor, NSError *error){ if(error){ NSLog(@"XXXerror %@",error); } if(theCursor){ CKQueryOperation *anotherOperation=[[CKQueryOperation alloc] initWithCursor:theCursor]; [self startAQueryOperation:anotherOperation theName:recordName]; } }; CKDatabase *publicDatabase = [[CKContainer defaultContainer] publicCloudDatabase]; [publicDatabase addOperation:theOperation]; } When I run this code in the app I get no “XXXerror” from the NSLogs. I get the expected number of “XXXjust downloaded a” EventMessages (435) and Messages (594) and Links (15) but I get varying amounts, 100 or 400 or 500 “xxjust downloaded a” for the Notices when I should get 10,118 records. Thinking that 10,000 records is too much, if I alter “dateLastSynched” for Notices I still get only 100 or 200, not the expected number. Note that the number is always a multiple of 100. This seems to be consistent with the typical number of records I get on the CloudKit dashboard each time I tap “Query Records”.

How does an app bind a custom display name to a sidebar Favorites entry pointing at a NSFileProviderDomain mount, while preserving the FP extension's icon? Inserting the volume URL directly via LSSharedFileListInsertItemURL keeps the icon but uses the volume's default name. Inserting an alias-bookmark file or symlink to the volume with a custom filename gives the custom name but drops the icon to the generic alias glyph. Since other apps seem to have achieved this, I wonder what's missing in order to get it working. I've dropped a lot of work into this already and tried so many things but none has been working. What's complicating things is that working with plugins are easy to get wrong – the old plugin might not be correctly unloaded so you get stale behaviour etc. I've already spent more time with this than I'd care to admit. Since LSSharedFileListInsertItemURL is deprecated it's natural that setting the name/icon is getting ignored, but there's clearly a way to make it work. For apps that have this working I did the following test: Change the name - icon stays the same Restart Finder - icon now becomes a generic icon Change the name back to the original Restart Finder - icon reverts to the "proper" icon. Apart from this I've been able to verify that aliases produced by my app has the same data as apps with this working. Any hints would be greatly appreciated.

I'm building a macOS safari extension and porting its functionality from a chrome extension. The chrome extension uses native messaging hosts to communicate with another process using IPC and holding a persistent connection. To use the same functionality in Safari, I understand that will need to use the handler to communicate it to the containing app, and the app will have to hold the persistent IPC connection. My question derives from that concept: should the app be running in a long-lived state? And if so, how can I ensure that app be running 100% of the time. Also is there any way I can control it's lifecycle with the Safari browser's lifecycle? I will not be using XPC here, but a different UDS to make the connection. Also in addition to that, what would you recommend the best approach is the communicate between the extension and it's handler? -> should it be again a UDS or userDefaults +darwin notification be enough? Also I wouldn't want the inter-message relayed between components to be dropped, is there a fault tolerant architecture you would recommend?

Hi everyone, We are investigating a possible iOS permission state issue after a device previously installed our app through TestFlight and later installed the production version from the App Store using the same Bundle ID. Environment: Device: iPhone 15 iOS version: 26.2.1 App distribution history: The app was previously installed through TestFlight and later installed from the App Store Permissions involved: Camera / Photos Issue: When the user opens the App Store version of the app and tries to access a feature that requires Camera or Photos permission, the iOS permission prompt does not appear as expected. Also, the app does not appear under: Settings > Privacy & Security > Camera or: Settings > Privacy & Security > Photos Because of this, the user cannot manually enable the permission. Another user on iOS was able to grant the permissions normally, so the issue appears to be isolated to the device that previously used the TestFlight build. Expected behavior: When the App Store version requests Camera or Photos permission, iOS should display the permission prompt, or the app should appear under Settings > Privacy & Security > Camera/Photos so the user can manage the permission manually. Actual behavior: The permission prompt does not appear, and the app does not appear in the corresponding privacy permission list. Possible cause: It seems like the device may be preserving or reusing a stale privacy permission state from the previous TestFlight installation, since both the TestFlight build and the App Store build use the same Bundle ID. Steps to reproduce: Install the app through TestFlight. Open the app and trigger a Camera/Photos permission request. Grant or deny the permission. Stop testing or remove the TestFlight version. Install the production version from the App Store using the same Bundle ID. Open the App Store version. Trigger the same Camera/Photos permission request flow. Go to Settings > Privacy & Security > Camera/Photos. The app does not appear, or the permission prompt does not behave as expected. Workarounds attempted or suggested: Close and reopen the app. Restart the iPhone. Delete and reinstall the app from the App Store. Stop testing the app from TestFlight. Reset Location & Privacy settings. Question: Has anyone experienced a similar issue where iOS does not show the permission prompt or does not list the app under Privacy & Security after switching from a TestFlight build to the App Store version with the same Bundle ID? Is there a recommended way to fully clear the previous TestFlight permission state, or should this be reported as a possible iOS/TestFlight permission state bug?

Hello, I have recently started exploring the Apple Wallet extension and have a couple of questions I was hoping you could help clarify: Is there any form of communication between the UI extension and the non-UI extension? From my understanding, the UI extension handles the authorization and simply indicates whether the app approves it or not, without passing additional data. However, the non-UI extension is expected to make calls to the issuer app’s backend, which typically require a token obtained through prior authentication services and may even involve an OTP. Is there a recommended way to share this information between extensions within the Apple Wallet Extension framework, or is using App Groups the only option? Additionally, during the provisioning process, is there any possibility of re-invoking the UI extension if further validation is required? Furthermore, according to the documentation, testing is carried out via TestFlight and in production. Is there any way to test these extensions on a physical device directly from Xcode for debugging purposes, or is TestFlight the only available method? Thank you very much in advance for your time and assistance.

HI, I am using mac os virtuzlation framework for running virtual machines. At prenset i add the shared folders when creating the VzVirtualMachine. Is it possible to add shared folders to running VZVirtualMachine Thannks

Hi all, Our team (D36U48VRGM) holds approved Family Controls (Distribution) entitlement on three bundles, all live on the App Store as part of the same app: com.strategieayoub.quranfocus (main app) com.strategieayoub.quranfocus.ShieldAction com.strategieayoub.quranfocus.ShieldConfiguration We've added a fourth target — a DeviceActivityMonitor extension at com.strategieayoub.quranfocus.DeviceActivityMonitor — to replace our current BGProcessingTaskRequest re-shield path. The BGTaskScheduler approach is unreliable for our use case: iOS routinely runs the task hours late or skips it entirely, leaving users' apps unblocked far past the unlock window we promised. DeviceActivityMonitor's intervalDidEnd callback is the only mechanism Apple provides that fires reliably regardless of app state. The new bundle ID is registered, has Family Controls (Development) provisioned, and intervalDidEnd works correctly during local on-device testing. The blocker is Distribution — Xcode's Signing pane shows: "Bundle identifier is using development only version of Family Controls (Development) capability. Please request access to Family Controls (Distribution) to avoid issues when distributing." Two questions: The previous per-asset Family Controls request form has been replaced with a single account-level form that contains no free-text field where I can specify a bundle ID. How does Apple now expect developers with already-approved teams to attach an additional child bundle to that approval? Phone Developer Support said they cannot make entitlement attachments and pointed me back to the form. Is there a documented escalation path? Thanks for any pointers.

Hello, I am experiencing a specific authorization error on macOS Tahoe when trying to discover all available service types on the local network. While the implementation works perfectly on iOS and macOS Sonoma, it fails on Tahoe with a specific error code. The Issue When calling DNSServiceBrowse with the meta-query string _services._dns-sd._udp, the function immediately returns kDNSServiceErr_NoAuth (-65555). // This call fails on macOS Tahoe DNSServiceErrorType err = DNSServiceBrowse( &ref, 0, kDNSServiceInterfaceIndexAny, "_services._dns-sd._udp", // Meta-query for all services domc, probe_browse_reply, (__bridge void *)self ); Important Findings & Observations Specific Services Work: If I change the service type to a specific one (e.g., _http._tcp or _ssh._tcp) using NWBrowser, it works correctly and returns results. The error only occurs when browsing for _services._dns-sd._udp using DNSServiceBrowse. Local Network Permission: I have confirmed that the Local Network toggle is ON for my app in System Settings > Privacy & Security > Local Network. Entitlements: My app has the com.apple.developer.networking.multicast entitlement. Info.plist: Both NSLocalNetworkUsageDescription and NSBonjourServices (including _services._dns-sd._udp) are properly configured. Sandbox: The issue persists regardless of whether the App Sandbox is enabled (with incoming/outgoing connections) or disabled. Environment Not Working OS: macOS Tahoe 26 Working OS: macOS Sonoma, iOS 26 Question It seems macOS Tahoe has introduced a stricter policy regarding Network Reconnaissance or meta-service browsing. Is there a new requirement or a specific entitlement needed in macOS Tahoe to browse for _services._dns-sd._udp? Any guidance on how to restore this functionality for network utility apps on macOS Tahoe would be greatly appreciated. Best regards.

Hi, Overview I have a SwiftData project which automatically syncs with CloudKit. When I run the app, I see the following error in Xcode logs. Error updating background task request: Error Domain=BGSystemTaskSchedulerErrorDomain Code=3 "(null)" My attempt I can enable Background processing (under Signing & Capabilities > Background modes), but I don't know the BGTaskSchedulerPermittedIdentifiers to add in the Info.plist Questions How can I resolve this? If I should enable background processing, what are the BGTaskSchedulerPermittedIdentifiers to add in Info.plist?

Hello Apple Developer Support / Community, I would like clarification regarding HealthKit observer behavior when comparing a Flutter-based iOS app with a fully native iOS app. We are using HealthKit background delivery with: HKObserverQuery enableBackgroundDelivery HKAnchoredObjectQuery We have observed that in a Flutter-based app, HKObserverQuery callbacks appear to execute multiple times or more frequently than expected for a single data update. In comparison, a native iOS implementation using similar HealthKit logic appears more stable and predictable. We would like to understand the expected platform behavior and whether there are any known considerations from Apple’s perspective. Specific questions: Does iOS treat HealthKit observer delivery differently for apps built with Flutter versus fully native UIKit / Swift apps? Are there known issues where app lifecycle handling, Flutter engine initialization, method channels, isolates, or plugin architecture could cause repeated observer callbacks? Can repeated HKObserverQuery executions occur if queries are registered multiple times during app launches or engine restarts? Does Apple recommend any specific observer management pattern for cross-platform frameworks such as Flutter? From the HealthKit system side, should observer callback frequency be identical regardless of whether the app is Flutter or native, assuming the same iOS code is used? We are trying to determine whether this behavior is due to HealthKit delivery semantics, duplicate observer registration, Flutter lifecycle integration, or framework-related limitations. Any guidance from Apple or developers who have implemented HealthKit successfully in Flutter would be appreciated. Thank you.

Hello Apple Developer Support / Community, I would like clarification regarding HealthKit data access behavior when an iPhone is locked. We are building an app that uses: HKObserverQuery enableBackgroundDelivery HKAnchoredObjectQuery Background execution to sync HealthKit data to our server Our specific question is: When the device is locked with passcode/Face ID protection enabled, can an app launched in the background through HKObserverQuery or other background mechanisms reliably access and read HealthKit data? We would like to understand the expected Apple-supported behavior for the following scenarios: If new HealthKit samples are written while the phone is locked, will HKObserverQuery still trigger immediately? If the observer callback is invoked while locked, can HKAnchoredObjectQuery successfully read the new samples? Is HealthKit data inaccessible while locked due to Data Protection / encrypted store behavior? Should developers expect delivery or data reads to be deferred until the user unlocks the device? We are trying to set correct expectations for background syncing and would appreciate official clarification on whether near real-time HealthKit sync is possible while the device remains locked. Relevant documentation mentions HealthKit store encryption, but we would appreciate direct confirmation for production behavior. Thank you.