Research / compatibility data last verified

Primary sourceBuild-specific
TROUBLESHOOT / 38

MAC INCIDENT / MESSAGE-FIRST

Match the exact Mac message before you change a security setting.

An unidentified developer, a damaged app, a malware warning, a read-only file and a real crash are five different incidents. Verify the owner copy, preserve the first message and change only the layer that failed.

DIRECT ANSWER

Do not use xattr until source, path and warning class are known.

Start with the exact owner release and an intact app in /Applications. Open normally once. For an unidentified app, Apple offers a per-app Open Anyway decision. For a damaged app, re-download and verify first. For “will damage your computer,” delete and stop. If the app already opened, diagnose file access or the product process—not Gatekeeper.

FIRST SAFE DECISION
UNIDENTIFIED
Verify → per-app Open Anyway
DAMAGED
Delete → re-download → verify
WILL DAMAGE
Delete → no override
READ-ONLY
Record source + destination paths
CRASH
Preserve report → product incident
Verify the owner source first →

FIVE LAUNCH STATES

Similar-looking dialogs carry different evidence.

Use the words macOS actually showed. Do not summarize every blocked launch as “damaged.”

  1. 01 / CONFIRMDownloaded from the Internet

    Expected first-open source decision.

    NO TERMINAL REQUIRED
  2. 02 / DECIDECannot verify developer

    Per-app exception only after verification.

    RISK REMAINS
  3. 03 / REVERIFYDamaged or modified

    Integrity comes before metadata removal.

    DO NOT ASSUME FALSE POSITIVE
  4. 04 / DELETEWill damage / malware

    Hard stop; do not force the process open.

    NO OVERRIDE
  5. 05 / REPORTQuit unexpectedly

    The app launched; preserve the crash.

    NOT GATEKEEPER

EXACT-SIGNAL LEDGER

The first line decides the layer.

Apple owns the security-dialog meaning. Owner instructions define the app path. Issues document one observed product environment.

Exact signalLayer / proofFirst safe actionDo not infer
M01“Downloaded from the Internet. Are you sure?”
First-open consent

macOS is asking whether this was an intentional download.

Match owner, release and filename; choose Open only if expected.

Do not run Terminal for a normal confirmation.

M02“Developer cannot be verified” / “Apple cannot check…”
Gatekeeper / notarization

The app is not verified through Apple’s normal developer/notarization path.

Verify the owner copy, attempt once, then make Apple’s per-app Open Anyway decision.

Do not disable Gatekeeper globally.

M03“App is damaged and can’t be opened”
Integrity before metadata

Apple says signed code may be modified, corrupted or tampered with.

Delete and re-download the exact owner archive; verify its digest where published.

Do not declare it a false positive from the wording alone.

M04“Will damage your computer” / known malware
Malware or revoked authorization

Apple treats this as stronger than an unidentified-developer warning.

Delete the copy and preserve the exact message/source for the owner.

Never use Open Anyway, xattr, sudo or SIP changes.

M05“Quit unexpectedly” / EXC_BAD_ACCESS
Application runtime

The process launched and then crashed.

Preserve the crash report, exact package, Mac architecture and macOS build.

Repeated quarantine removal cannot diagnose a crash.

M06xattr: No such file
Command target / bundle name

The command path does not resolve to that app.

Check the fully expanded .app name and exact /Applications path.

Adding sudo cannot create a missing path.

M07xattr: Operation not permitted
Authorization or managed policy

The requested metadata change was denied.

Stop; confirm ownership, management and the exact file before any further change.

Do not escalate to recursive flags, root or disabled SIP.

M08MobileGestalt / “Macintosh HD is read only”
App path, selected file or product destination

One write/copy operation chose a location it could not use.

Record both paths; use an intact app in /Applications and a deliberate local working copy.

Do not change startup-disk permissions.

M09“type Null is not a subtype of type String”
Product file processing

Issue #357 records the type failure after common permission guesses did not help.

Preserve release, architecture, macOS build, plist origin and exact message.

Do not repeat Full Disk Access, xattr or sudo as a universal fix.

M10Select does nothing / white page / unsupported plist
File selection, parsing or UI

The file was selected but a usable parsed state was not proven.

Keep the original; verify exact-device provenance and transfer completeness, then save the first parser log.

Do not edit the original or substitute another device’s plist.

M11App disappears or crashes after Apply
Product / Apply command

Launch authorization and file selection were already passed; restore success is unknown.

Do not Apply again; preserve the last log, phone state and crash report.

Do not relabel this as a Gatekeeper problem.

10-FACT MAC INCIDENT ROUTER

Stop at the earliest unproven layer.

This form cannot inspect the Mac or phone. It protects source and administrator boundaries before recommending a launch, file or product route.

Runs only in this browser. No Terminal, Finder, USB, file, account or network access.

WAITING / 10 FACTSMAC / UNCLASSIFIED

PROOF / NO FIRST MESSAGE

Describe the incident before changing the Mac.

The result will separate owner source, administrative authority, Gatekeeper, bundle path, file access and product errors.

  1. Keep the first exact dialog or error.
  2. Do not stack permission changes.
REDACTED INCIDENT LINE

Generated after routing.

Review Mac setup

OWNER XATTR BOUNDARY

One command target; four gates before it.

The owner publishes xattr -c for the app bundle. That changes extended metadata; it does not certify the download or repair product code.

  1. 01

    Owner source

    The ZIP resolves to the exact straight-tamago release asset—not a mirror or source archive.

  2. 02

    Fresh integrity check

    Re-download a damaged copy; match the owner digest when the release publishes one.

  3. 03

    Stable app path

    The full bundle is expanded in /Applications; confirm its exact name.

  4. 04

    Allowed warning class

    Never apply the fallback to “will damage your computer” or known-malware wording.

EXACT-BUNDLE FORMSxattr -c "/Applications/misakaX.app"

xattr -c "/Applications/misaka26.app"

Use only the line matching the verified app name. A successful command proves only that the requested metadata operation completed.

DO NOT ADD
  • sudo or root launch
  • recursive -r or wildcards
  • /Applications as the target
  • global spctl or SIP changes
Owner macOS instruction

READ-ONLY / FILE ACCESS

Record every path before changing a permission.

A read-only string tells you which operation failed only when the complete message and both source/destination paths are preserved.

01 / BUNDLE

Where did the app launch?

Use the intact bundle in /Applications. ZIP previews, external volumes and randomized locations add a separate path variable.

02 / INPUT

Where is the working plist?

Keep the original untouched. Use an identical local working copy from the connected target and record its path class.

03 / CONSENT

Which location did macOS protect?

Files & Folders consent for Desktop, Documents, Downloads, iCloud or removable media is narrower than Full Disk Access.

04 / DESTINATION

Where did the app try to copy?

The error can expose an internal product path. Preserve it; do not redirect or change Macintosh HD ownership.

05 / PRODUCT

Did the same error survive the baseline?

If source, app path and a verified local file are proven, report the exact release/environment instead of adding privileges.

OWNER-REPOSITORY INCIDENTS

Six reports; six bounded observations.

Open and closed are tracker states. Neither proves current reproduction, frequency or a maintainer-confirmed fix.

I01CLOSED

Legacy read-only destination

MisakaX issue #12 · macOS · “Macintosh HD is read only”

EVIDENCE
Users discussed /Applications; a collaborator later marked the issue fixed. No single maintainer explanation was published.
SAFE ROUTE
Use current owner bytes and preserve exact paths; never inherit the community sudo command.
Read owner issue
I02OPEN

File selected; no next state

misaka26 issue #34 · Mac reports · no response / white page

EVIDENCE
A commenter captured an unsupported-plist parser exception, while other users reported path changes. The thread does not establish one cause for every report.
SAFE ROUTE
Keep the original, prove an exact-device complete working copy and record the first parser log without changing USB or Gatekeeper.
Read owner issue
I03OPEN

Null type during plist copy

misaka26 issue #357 · 1.6 · Intel · Ventura 13.x

EVIDENCE
Applications placement, re-download, quarantine removal and Full Disk Access were already tried; the error remained.
SAFE ROUTE
Treat it as a reproducible product/file-processing incident, not proof that more permission is needed.
Read owner issue
I04OPEN

Native ARM launch crash

misaka26 issue #30 · 26.1.2 · M4 · macOS 26.0.1

EVIDENCE
The crash report names ARM-64 native execution and EXC_BAD_ACCESS after the app process launched.
SAFE ROUTE
Preserve the crash report and exact release; do not diagnose it as Rosetta or Gatekeeper from the symptom.
Read owner issue
I05CLOSED

Historical Intel package paths

misaka26 issue #25 · earlier Nov 2025 x86_64 distribution

EVIDENCE
The reporter named missing helper/resources in that package. Closure does not prove the current archive has the same defect.
SAFE ROUTE
Use the unchanged current owner ZIP; never copy ARM resources or download individual helpers.
Read owner issue
I06CLOSED

App vanished after Apply

misaka26 issue #12 · Apply clicked · no warning shown

EVIDENCE
The process disappearance was reported, but restore success and device outcome were not established.
SAFE ROUTE
Stop after the first crash, record the phone state and route it as an Apply incident.
Read owner issue

PROJECT-LAYER REPORT

Keep the exception; remove the identity.

A report is useful when it reproduces one boundary without exposing the device, account, recovery file or private home-folder name.

EXAMPLE / REDACTEDproduct: misaka26 1.6 Unstable · owner ZIP
digest: owner value matched
Mac: Intel · macOS Ventura 13.x + build recorded
app: intact /Applications/misaka26.app
first launch state: OPEN
Finder / one target: PASS
working plist: local copy · same target · contents NOT SHARED
first product signal: Failed to copy plist / Null → String
previous changes: owner exact-app xattr only
Apply / restore: NOT STARTED / NOT PROVEN
device state: normal
CLASSIFICATION / PRODUCT FILE-PROCESSING INCIDENT

Keep

Release, owner filename/digest result, Chip/Processor, macOS build, app-path class, exact exception, stage and non-identifying runtime filenames.

Remove

Serial, UDID, ECID, IMEI, Apple Account, passcode, backup password, MobileGestalt contents and identifying user paths.

Apple: share selected Console reports

MAC ERROR FAQ

Gatekeeper, xattr, read-only files and crashes.

Each answer keeps launch security, file consent and product behavior separate; no answer asks for a blanket security override.

How do I fix “MisakaX is damaged and can’t be opened” on Mac?

Treat it as an integrity question first. Delete that copy, download the exact Mac ZIP from the owner release and verify the published digest when one exists. Expand the complete app into /Applications. Only then decide whether the owner’s exact-app xattr fallback is appropriate; the warning itself does not prove a harmless quarantine false positive.

Is “app is damaged” the same as “developer cannot be verified”?

No. Apple says damaged or modified code may be corrupted or tampered with. An unidentified or unnotarized developer warning means Apple cannot complete its normal verification. The second has a documented per-app Open Anyway decision; the first requires integrity checks before any override.

What does “Apple cannot check MisakaX for malicious software” mean?

macOS cannot verify the app through its normal developer and notarization path. Confirm the owner repository, release, exact asset and archive integrity first. If you knowingly accept the remaining risk, Apple provides a per-app Open Anyway path.

How do I use Open Anyway for MisakaX?

Try to open the verified app from /Applications once. Then open System Settings → Privacy & Security, scroll to Security, choose Open Anyway and authenticate. Apple warns that overriding security for unchecked software can expose the Mac and personal data.

Why is the Open Anyway button missing?

Apple says it is available for about one hour after you try to open the app. Confirm you attempted the exact verified .app, then reopen Privacy & Security. If the Mac is managed or you do not control administration, contact the administrator instead of bypassing policy.

Does right-click → Open do the same thing as Open Anyway?

Both can be part of a deliberate per-app launch decision, but the current Apple procedure documents the Privacy & Security Open Anyway control after an attempted launch. Neither converts an unknown mirror or malware warning into a trusted app.

What if macOS says MisakaX will damage my computer?

Delete the copy and do not override it. Apple associates that wording with malicious content or revoked authorization, which is not the unidentified-developer state. Do not use xattr, sudo, Open Anyway, disabled Gatekeeper or disabled SIP to force it.

Can xattr prove that the MisakaX download is safe?

No. xattr changes extended metadata on the target; it does not verify ownership, integrity, code quality, device compatibility or safety. Establish the owner release and archive evidence before changing metadata.

What does the owner’s xattr command do?

The owner publishes xattr -c for the exact app bundle when addressing Mac permission issues. The -c operation clears extended attributes on that target. Because it removes provenance/security metadata, it is an explicit trust decision—not a routine command to run before seeing a real message.

What exact xattr command applies to MisakaX or misaka26?

After confirming the actual expanded app name in /Applications, the narrow forms are xattr -c "/Applications/misakaX.app" and xattr -c "/Applications/misaka26.app". Use only the one matching your verified bundle. The owner instruction does not add sudo, recursive flags or a wildcard.

What is the difference between xattr -c and xattr -r?

The owner command shown for these apps uses -c against one app bundle. This page does not add a recursive -r sweep. Recursion expands the changed target set and makes the security decision harder to audit.

Why does xattr say “No such file” for misakaX.app?

The path or bundle name is wrong, or the ZIP is not fully expanded there. Inspect /Applications in Finder and copy the exact .app name. A misakaX.app path will not find misaka26.app. Do not add sudo; privilege cannot fix a nonexistent path.

What should I do when xattr says “Operation not permitted”?

Stop instead of escalating. Confirm the app source, exact target, Mac ownership and whether management policy controls the setting. Preserve the command and response. Recursive flags, root, disabled SIP or global security changes would widen the incident without proving the cause.

Should I run MisakaX with sudo or as root?

No. Legacy issue comments suggested it, but it is not the owner’s current installation procedure. A closed desktop app running as root receives far broader access. Put the intact app in /Applications and diagnose the exact file or product layer instead.

Should I disable Gatekeeper with spctl for MisakaX?

No. Use a verified source and Apple’s per-app decision. A global Gatekeeper disable changes protection for unrelated software and is not required by the owner’s command.

Should I disable System Integrity Protection to open MisakaX?

No. Neither the owner installation nor Apple’s per-app Open Anyway route requires disabling SIP. A launch or read-only error is not evidence that system protection should be removed.

Can I clear quarantine from every app in /Applications?

No. Target only the exact verified app when the owner fallback and your risk decision apply. A wildcard or /Applications-wide metadata change affects unrelated software and destroys useful provenance evidence.

Why should MisakaX be moved to /Applications?

The current misaka26 owner workflow explicitly uses /Applications, and the complete bundle should run from a stable local path rather than a ZIP, temporary preview or external read-only location. Legacy read-only reports also mention improvement after moving it, but that does not prove one cause for every read-only error.

Can I run MisakaX directly from the ZIP or Downloads?

Do not run inside the archive or a temporary preview. Expand the entire .app and move it to /Applications before diagnosing it. Downloads can also be subject to file-access consent, while a partial bundle can create missing-resource errors.

What is macOS App Translocation and does it cause the MisakaX error?

Apple explains that Gatekeeper can run some downloaded apps from randomized read-only locations. That makes bundle location relevant, but it does not prove App Translocation caused your exact error. Use the owner’s /Applications route and preserve the actual paths from the first log.

How do I fix “Macintosh HD is read only” when selecting MobileGestalt?

Confirm the app is the intact owner bundle in /Applications and the selected plist is a working copy in an ordinary local folder you control. Record the exact source and destination paths. If the matched release still fails, report the product/file operation; do not change startup-disk ownership or run the app as root.

Does a read-only message mean my Mac disk is broken?

No. It proves only that one attempted operation could not write to its chosen location. It does not identify disk hardware failure or justify changing Macintosh HD permissions. Preserve the full message and both paths.

Should I use the original MobileGestalt file while troubleshooting?

Keep the first extraction untouched as recovery evidence. Diagnose with an identical working copy from the same target. Do not edit, rename unpredictably or replace it with another device’s plist.

Can MobileGestalt stay on iCloud Drive or an external USB drive?

Those locations add their own availability, volume and macOS consent variables. For diagnosis, keep the original safe and use an identical working copy in a deliberate local folder you control. A writable USB result alone does not prove the app’s internal destination works.

What is the difference between Files & Folders and Full Disk Access?

Files & Folders controls specific protected locations such as Desktop, Documents, Downloads and removable/network volumes. Full Disk Access exposes all files, other-app data, Time Machine data and administrative settings. They are different scopes.

Does MisakaX require Full Disk Access?

The owner does not publish it as a universal requirement. Respond to a specific, understood Files & Folders request when necessary. Do not grant Full Disk Access to guess at a bundle-location, type or product error.

Should I change permissions with chmod or Finder Get Info?

First use Finder Get Info only to observe the actual owner and Sharing & Permissions state of the specific file or folder. This page does not prescribe recursive chmod or ownership changes. A product error can persist even when broad access was already granted.

What does “type Null is not a subtype of type String” mean in misaka26?

Treat it as a product/file-processing exception. Issue #357 records it on misaka26 1.6, Intel and Ventura after /Applications placement, re-download, quarantine removal and Full Disk Access. That one report does not establish a universal cause or fix.

How do I fix “Failed to copy the plist file” in misaka26?

Preserve the complete paired message. Confirm exact-device provenance, a complete local working copy, owner release, architecture and macOS build. If it includes the Null type exception after those checks, report the product incident instead of adding more permission overrides.

Why does nothing happen after I select MobileGestalt?

A selected file does not prove successful parsing. Keep the original, recheck that the working copy is complete and belongs to the connected target, and preserve the first product log. Do not reset Finder/USB or substitute another plist without evidence.

Why does misaka26 show a white page after choosing Settings?

Issue #34 records a no-response/white-page symptom, but it does not prove one cause. Preserve the exact release, macOS build, architecture, selected-file evidence and first log so support can separate UI state from file parsing.

What does “File is not binary plist or supported version” mean in misaka26?

The parser rejected the selected working copy; this is not a Gatekeeper message. Issue #34 includes that log in one user report, but does not prove every white page has the same cause. Keep the original untouched, verify that a complete exact-device copy was transferred, and preserve the complete parser exception. Do not manually rewrite the original just to make the app accept it.

Does “built for Mac OS X 14.0” mean misaka26 cannot run on my Mac?

Treat it as a component compatibility clue, not a complete diagnosis. Record the exact component path, misaka26 release, Mac architecture, macOS version/build and the next error in the log. A bundle’s declared minimum does not prove every bundled helper works on that OS, and xattr cannot repair a runtime requirement.

What if MisakaX opens and immediately quits unexpectedly?

This is a runtime crash, not an unidentified-developer dialog. Recheck the exact owner archive and release, restart once and preserve the macOS crash report. Do not repeat xattr or Open Anyway after the process already launched.

What is EXC_BAD_ACCESS in a misaka26 crash report?

It is a process crash signal, not a plain permission message. Issue #30 records it on an M4 Mac running the app natively. One report cannot identify a universal fix; keep the exception, release, architecture and macOS build together.

Why does misaka26 disappear after I click Apply?

Treat it as an Apply-stage incident. Do not click Apply again until you know the phone state and preserve the last log/crash report. App disappearance does not prove restore success, no effect or a Gatekeeper block.

Does the old Intel missing-files issue mean misaka26 never works on Intel?

No. Issue #25 described one earlier x86_64 package state and is closed. The current owner archive must be evaluated by its own bytes and exact environment. Historical missing resources are not a permanent architecture verdict.

Can I copy missing files from the ARM folder into x86_64?

Do not repair a release by mixing architecture folders. That changes the owner package and makes later results untraceable. Re-download the unchanged current owner ZIP and report any reproducible missing path.

Finder sees my iPhone but MisakaX does not. Is that a permission error?

Finder visibility proves the cable/Trust side, not the product process or file access. Preserve the working Finder state, verify one target and the exact release, then route the product-detection incident through the Mac guide or general error library.

MisakaX detects the phone but cannot load the plist. What does that prove?

It proves the product reached the device layer, not that the file is valid or accessible. Keep USB/Trust unchanged and diagnose exact-device provenance, transfer completeness, selected-file location and the first parser/copy message.

Can I use these overrides on a managed work Mac?

No. Open Anyway and privacy/security controls may be restricted by an administrator. Do not bypass MDM, endpoint security or organizational policy; use a personally controlled environment or contact IT.

Should I reinstall macOS to fix an app-is-damaged warning?

No. Start with the exact owner asset, integrity, /Applications placement and Apple’s message-specific route. Reinstalling macOS is disproportionate and does not establish that the downloaded package is trustworthy.

What should I include in a Mac MisakaX incident report?

Include product/release, owner URL and filename, available digest result, Mac Chip or Processor, macOS version/build, exact app path, first dialog/error, previous overrides, Finder state, selected-file location class, first product log and whether Apply began.

What should I remove from a macOS crash report before sharing it?

Remove serials, UDID, ECID, IMEI, Apple Account data, passcodes, backup passwords, MobileGestalt contents and identifying home-folder paths. Keep exception types, non-private runtime paths, release, architecture, macOS build and stage.

Does the Mac incident router run Terminal commands or read my files?

No. It only classifies the selections in this browser. It cannot access Terminal, Finder, USB, the app bundle, MobileGestalt, your phone, account or network and uploads nothing.

SOURCE BOUNDARY

Apple defines the warning. The owner defines the app.

Apple security pages explain macOS behavior but do not validate MisakaX. Owner releases provide packages and narrow install instructions. Issue reports remain individual environments.

01

Install the matched Mac release.

macOS guide →
02

Verify owner and package.

Official links →
03

Check the exact-device file.

MobileGestalt →
04

Classify another incident.

Error library →
05

Escalate an Apply outcome.

Apply + verify →