macOS 26.5.1 (25F80) on j715ap: stock Asahi step2 never reaches stub 1TR (yellow / rootvp not authenticated / pairing (17))

[stefanopineda]

This is an observation + repro on unsupported hardware (M4 / j715ap / T8132). It is not a request to allowlist j715ap or to merge installer enablement. Asking whether the stub-picker path or a complete-second-OS path is the intended step2 recipe on macOS 26.x.

Not the same failure as #404 / #407 (BYErrorDomain Code=112 “Preserved restore bundle in preboot is missing” at bless --setBoot on already-supported chips). This machine never reached that bless-time Code 112; step2 failed earlier, at the picker / pairing.

Hardware

MacBook Air 15" M4, Mac16,13 / j715ap / T8132 0x8132 / board 0x2E, host 26.5.1 (25F80). Same SoC class as an M4 mini that already has an authorized stub; this is a 26.x picker / pairing failure, not “T8132 cannot take fuOS.”

What stock step2 does here

Stock Asahi step2 on this machine never shows the boot picker for the 2.5 GB stub:

• Hold-power 1TR is the recoveryOS of the default boot OS. bputil -nc / kmutil configure-boot need 1TR paired to that VGID. Macintosh HD 1TR is easy and the wrong pairing (pairing (17)).
• Blessing the incomplete stub as default makes 26.5.1 verify it as macOS. Verify fails → yellow “The version of macOS on the selected disk needs to be reinstalled.” Selecting the stub as OS → XNU panic rootvp not authenticated after mounting @bsd_init.c:979.
• .IAPhysicalMedia ProductVersion 12.1 / 00A191 (upstream) and rewritten 26.5.1 / 25F80 are both ignored on an APFS OS volume group. Hide SystemVersion / Preboot restore plists does not make IAPM win. Hiding Preboot boot/.../kernelcache made Recovery say “Unable to verify startup disk.”
• A separate APFS “Finish Installation” volume (IAPM only, not an OS VG) still hits verify-startup-disk if involved in bless.
• Reduced (smb0=1) on the stub does not skip that picker/SSV check. Bless-stub-as-default after Reduced is still yellow.

Escape from yellow every time: Startup Disk → Macintosh HD, never Recovery / Reinstall.

Catch-22

Apple Silicon since macOS 12:

• bputil -nc (Permissive) and kmutil configure-boot (fuOS / coih) require 1TR paired to that OS’s VGID.
• Hold-power 1TR is the recoveryOS of the default boot OS.
• Unpaired recovery (Macintosh HD’s 1TR) cannot Permissive-downgrade another VGID. SEP: pairing (17).

On this 26.5.1 machine, adding:

• A 2.5 GB stub is Full Security, no SSV, no fuOS.
• Making it default makes iBoot verify it as macOS before showing the picker.
• Verify fails → yellow. Booting it as OS → XNU panic rootvp not authenticated after mounting @bsd_init.c:979.
• So: need stub as default to get its 1TR; stub as default cannot show 1TR.

Asahi’s .IAPhysicalMedia trick (hide SystemVersion, picker launches Finish Installation.app inside the stub’s already-running 1TR) assumes the picker appears. It does not.

Knob chart

Legend: Dead = reproduced, do not retry. Undone = reverted. Open = not tried. Trap = looks like the Asahi docs, actually worse.

A. Accessory files on the stub (from macOS)

#	Knob	What we set	Result	Status
A1	.IAPhysicalMedia ProductVersion	Upstream 12.1 / 00A191 as shipped	Picker ignores installer media; treats stub as OS	Dead
A2	Same, rewritten 26.5.1 / 25F80	Match running OS	Still ignored. Stub is an APFS OS volume group; 26.5.1 classifies OS first	Dead
A3	Hide System SystemVersion.plist (prepare_for_step2)	Asahi stock	Necessary for installer-media path if picker honors IAPM. Here picker never does	Trap
A4	Hide Preboot restore/SystemVersion.plist + RestoreVersion.plist + restore kernelcache	Hypothesis: picker reads Preboot restore as “real 26.5.1”	Did not make IAPM win. Stub still listed as OS	Dead / undone
A5	Hide Preboot boot/.../kernelcache	Stop XNU boot if stub is clicked	Made verify worse. Recovery: “Unable to verify startup disk” after auth	Dead / undone (restored)
A6	Copy IAPM onto Preboot VGID	Picker might look there	iSCPreboot copy SIP-blocked. Preboot copy did not change picker	Dead
A7	Mach-O step2_launcher + ad-hoc codesign + richer Info.plist	26 might refuse shebang app	Irrelevant: app never launched	Dead
A8	APFSIOC_VOL_BOOTABLE fsctl	macOS 27 visibility flag	Already 1 on 26.5.1. Not the yellow cause	Dead
A9	Disable stub IAPM, restore all hidden files	Undo A3–A6 so stub looks like an OS again	Restored. Still cannot 1TR the stub	Undone

B. Extra installer volume (non-OS)

#	Knob	What we set	Result	Status
B1	256 MB APFS Finish Installation after stub, Recovery still last	Only IAPM 26.5.1/25F80 + Finish Installation.app. step2.sh finds stub by VGID	Picker treated it as a startup disk. Auth then Unable to verify startup disk	Dead
B2	Hide stub kernelcache so only installer volume is clickable	Combined with B1	Verify of default/selected volume still failed	Dead / undone
B3	Delete installer GPT slice	Remove fake disk from picker	GPT back to ISC / HD / stub / free / Recovery last	Done
B4	FAT32 installer volume (Asahi: IAPM works on FAT32)	Never created	Open. APFS B1 failed; FAT32 cannot look like an APFS OS VG. Does not solve pairing: with Macintosh HD default, IAPM would launch the app inside Macintosh HD 1TR → still pairing (17)	Open / low value

C. Who is default boot

#	Knob	What we set	Result	Status
C1	bless --setBoot --mount on the stub from macOS	Asahi stock after stage1	Default = stub. Next boot (hold or not) → yellow, no three-icon picker	Dead (reproduced 3 times)
C1b	Same bless after Reduced (smb0: 1) from Macintosh HD 1TR	Hypothesis: yellow was Full Security verify; Reduced might show picker	Yellow again. Reduced does not skip iBoot verify of an incomplete OS	Dead
C2	Same bless from Macintosh HD 1TR Terminal	Thought Recovery bless would be cleaner	Same yellow, no picker	Dead
C3	Startup Disk → Macintosh HD (yellow escape)	Required to get macOS back	Works	Live
C4	Hold Option + Always Use on the stub at picker	Apple Help “set default startup volume”	Not tried. Would set stub default then auto-restart → predicted yellow/panic. Do not	Open / predicted dead

D. What you click on the three-icon picker (Macintosh HD default)

Picker does appear when Macintosh HD is default: stub | Macintosh HD | gear.

#	Knob	Result	Status
D1	Continue on the stub	iBoot2 loads stub XNU. Panic rootvp not authenticated after mounting @bsd_init.c:979. Falls back to Macintosh HD login + “restarted because of a problem”	Dead
D2	Hold Option + Continue on the stub	Same as D1. Option on this row does not mean paired recovery	Dead
D3	Continue on Macintosh HD	Boots macOS. Useless for step2	Dead
D4	Gear, then Continue	Macintosh HD 1TR. User list with no “Select a volume to recover” on this machine. Confirmed twice	Live path into wrong recovery
D5	Gear, then Option-click stub on “select a volume to recover”	That screen never appears (gear → user list directly). Cannot execute	Dead (UI missing)

E. Inside Macintosh HD 1TR (gear → admin auth → 4 tiles)

bputil -d on the stub VGID from this recovery: OS Type: one true recoveryOS, OS Pairing Status: Not Paired.

#	Knob	Result	Status
E1	Unquoted path to step2.sh on a volume name with a space	Shell splits on the space	Trap
E2	Quoted path, stub mounted	Script runs. Stops on Not Paired (do not bless from this recovery)	Expected
E3	bputil -nc on the stub VGID (Permissive + disable CTRR)	Admin password accepted. Then BYErrorDomain Code=401 “Failed to create local policy”, underlying com.apple.bootpolicy Code=17 "pairing (17)"	Dead
E4	kmutil configure-boot on the stub from this 1TR	Not run after E3 (would fail the same pairing). From full macOS: configure-boot must be run from macOS Recovery	Dead from macOS; unpaired 1TR predicted dead
E5	Startup Security Utility → Macintosh HD	Unlock works. Accessories “Always Allow”. Irrelevant	—
E6	SSU → stub	Visible as “macOS 26.5.1”. Security Policy grayed: “must be the startup disk”. Accessories Always Allow. Option-click does nothing extra	Dead from this recovery
E7	bputil -g on the stub VGID (Reduced only) from Macintosh HD 1TR	Admin password accepted. Policy update succeeded. Stub local policy: Security Mode Reduced (smb0: 1). coih still absent. Running recovery still Not Paired	PASS (Reduced only)
E8	bputil -k / -s (kexts / disable SSV) from unpaired 1TR	Not tried. -s is Permissive-class; likely pairing (17)	Open / predicted dead

F. Things not tried / later path

#	Knob	Notes	Do not / do
F1	kmutil configure-boot on Macintosh HD	Would replace the macOS kernel	Never
F2	Reinstall macOS / yellow Recovery tile	Firmware drift	Never
F3	DFU revive/restore	Wipes	Not unless owner says so
F4	Double-press power (fallback recoveryOS)	Ordinary recovery, not 1TR	Low value
F5	Installer run from Recovery Terminal (Asahi expert path)	Creates stub already in some recovery; can land Reduced from unpaired. Already had a stub	Open, high cost
F6	Second complete macOS 26.5.1 (25F80) in free space, then 1TR that VGID and kmutil m1n1 there	Hollow stub cannot be default without yellow. A real OS can. Pairing follows the complete volume, not the 2.5 GB stub	This later worked (see below)
F7	Seal/SSV the stub System volume	Would need Apple’s sealer. Cannot fake rootvp auth	Not feasible

Errors, verbatim

Where	Text
Yellow (stub default or stub selected as OS)	“The version of macOS on the selected disk needs to be reinstalled. Use Recovery to reinstall macOS or select another startup disk.”
After auth on fake installer / hollowed stub	“Authentication is required to verify startup disk” → “Unable to verify startup disk”
XNU boot of stub	panic(…): rootvp not authenticated after mounting @bsd_init.c:979 — Darwin 25.5.0 RELEASE_ARM64_T8132, iBoot mBoot-18000.120.36
bputil -nc from Macintosh HD 1TR	BYErrorDomain Code=401 "Failed to create local policy" / com.apple.bootpolicy Code=17 "pairing (17)"
SSU on stub from Macintosh HD 1TR	Security Policy grayed: must be the startup disk
kmutil from full macOS	configure-boot must be run from macOS Recovery

Panic dump not attached (may contain serials). Panic string is quoted above.

What this looks like

1. Stage1 (GPT stub, IPSW 25F80 identity, boot.bin, bless once) worked.
2. 26.5.1 on j715ap does not honor .IAPhysicalMedia on an APFS OS volume group.
3. 26.5.1 will not show the boot picker when the incomplete stub is default; it yellows instead. Still yellow after Reduced (C1b).
4. Macintosh HD 1TR is easy (gear). It is the wrong pairing for bputil -nc / kmutil / SSU Security Policy.
5. Option on the first picker row boots the selected OS (D1/D2). It is not “enter that OS’s recovery.”
6. Hiding Preboot kernelcache (A5) made verify worse.

What later worked here

A complete 26.5.1 (25F80) second OS volume, then 1TR that VGID, Permissive + kmutil configure-boot / coih there (not on Macintosh HD). That is a full OS, not the 2.5 GB stub.

Question

On macOS 26.x, is the intended installer path still “bless stub → picker is already stub 1TR → .IAPhysicalMedia launches step2”, or is a complete second OS (what we had to do) the intended path?

Happy to answer follow-ups. No installer-enablement patch attached.