NetworkExtension URL Filter stops during startup only in TestFlight (NEAgentURLFilterErrorDomain Code=3, NEMembershipCheckerErrorDomain Code=3)

Hi Apple Developer Support / community,

I am seeing a URL filter startup failure only in TestFlight builds. The same code path works in development and Ad Hoc builds.

App setup:

• Host app bundle id: com.expleo.protectus.filter.main
• URL filter control extension bundle id: com.expleo.protectus.filter.main.buf
• Extension point: com.apple.networkextension.url-filter-control
• Using NEURLFilterManager / NEURLFilterControlProvider on iOS 26.x
• App Group and network extension entitlements are configured on host + extension

Observed behavior:

• Extension process starts successfully (pid created)
• Status changes to starting
• Then updatePrefilterWithCompletionHandler runs
• Immediately after, plugin transitions to stopping with error 3
• System retries in a loop

Key logs:

• Error Domain=NEAgentURLFilterErrorDomain Code=3
• Failed to startFilter <Error Domain=NEMembershipCheckerErrorDomain Code=3>
• NEPIRChecker start block reports:
  • Error Domain=com.apple.CipherML Code=1100
  • Underlying Error Domain=com.apple.CipherML Code=1800
  • Message says details are redacted

Example sequence:

• NEURLFilterPlugin ... started with pid ...
• status changed to starting
• updatePrefilterWithCompletionHandler enter
• acceptAgentClients enter
• setStatus:error ... NEAgentURLFilterErrorDomain Code=3
• status changed to stopping with error 3
• extension disposed / teardown
• repeats

Important detail:

• This failure is reproducible in TestFlight only.
• Same code and configuration works in development and Ad Hoc builds.

What we already checked:

• Extension launches and is discovered correctly by neagent
• App/extension bundle identifiers are correct
• App group and network extension entitlements are present in source and archive checks
• We tested startup gating around local bloom/prefilter readiness
• We still get NEMembershipCheckerErrorDomain Code=3 with CipherML 1100/1800 in TestFlight

Questions:

1. Is NEMembershipCheckerErrorDomain Code=3 in this startup path known to indicate PIR membership/status validation failure in distribution context?
2. Are there TestFlight-specific prerequisites or server-side requirements for PIR/CipherML path that differ from development/Ad Hoc?
3. Is there any supported way to get non-redacted diagnostic details for CipherML 1100/1800 (beyond sysdiagnose submission)?
4. Are there recommended fail-open/fail-closed startup patterns when PIR status is temporarily unavailable?

If needed, I can provide:

• Full sysdiagnose timestamped bundle
• Exact iOS version and device model
• Repro steps from clean install
• Full log stream around NEPIRChecker and NEURLFilterPlugin transitions

Thanks in advance.