diff --git a/AGENTS.md b/AGENTS.md
index e46e09d..574b49b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7879,3 +7879,36 @@ app's version comparison against `sensor.audi_dashboard_app_version` will surfac
 fail silently — the mechanism working as designed — but until the portal steps happen, 44 commits'
 worth of work (Standort/geocoding, consumption calibration, trip-detection rework, the Sheet
 component, the share sheet itself) is built and tested but **not on the phone**.
+
+### Second defect, and it would have failed silently: the app was signed without the group
+
+After the portal work the archive succeeded — and the resulting `.ipa` was **wrong**. Measured on the
+finished bundle rather than trusted: `codesign -d --entitlements :- Payload/App.app` returned only
+`application-identifier`, `team-identifier`, `get-task-allow` — **no**
+`com.apple.security.application-groups`, while the extension had it. The share flow would have
+reported success and the Tanken screen would have stayed empty, with nothing anywhere saying why.
+
+Cause: the pbxproj quotes values inconsistently. `addTarget` writes
+`PRODUCT_BUNDLE_IDENTIFIER = "app.datametric360.teilen";` (quoted); Capacitor's own project has
+`PRODUCT_BUNDLE_IDENTIFIER = app.datametric360;` (bare). The script compared against the quoted form
+for both, so the App target never matched and never got `CODE_SIGN_ENTITLEMENTS`. Now compared
+unquoted; verified on a regenerated project — four `CODE_SIGN_ENTITLEMENTS` (Debug+Release on both
+targets) instead of two.
+
+**Lesson worth keeping: verify entitlements on the built artifact, not on the project file.** The
+archive succeeded either way; only the `.ipa` told the truth.
+
+### Where it stands: portal step 3 is still missing (2026-09-02)
+
+Steps 1 and 2 are done, step 3 is not — proven by decoding the freshly fetched profiles, which is the
+quickest way to check this without the portal:
+
+```
+iOS Team Provisioning Profile: app.datametric360.teilen  | groups: ['group.app.datametric360']
+iOS Team Provisioning Profile: app.datametric360         | groups: []
+```
+
+The extension's App ID carries the group; the **main** App ID `app.datametric360` does not. Until
+App Groups is enabled on it in the portal and `group.app.datametric360` assigned, the archive fails
+with the same entitlement mismatch, now naming target `App` instead of `DataMetric360Share`. The
+delivered `.ipa` therefore still holds at 2026.8.30.8.