Korrektur: auch Ad-hoc-Apps verlangen seit iOS 16 den Entwicklermodus

AGENTS.md

@@ -4695,10 +4695,20 @@ existing `.xcarchive` is enough. Verified afterwards: profile now lists both
 `00008130-001C089E3E8A001C` and `00008140-000229913A0B001C`, still valid to 2027-08-29.
 
 Not used, though the owner offered it: a hand-downloaded `Audi_App.mobileprovision`. It was a
-**development** profile (`get-task-allow: true`) with a **7-day** life, so it would have needed
-Developer Mode on the phone, a development certificate instead of the distribution one, and a
-re-install every week. Its value was diagnostic, not operational — it is what revealed the second
-device.
+**development** profile (`get-task-allow: true`) with a **7-day** life, so it would have needed a
+development certificate instead of the distribution one and a re-install every week. Its value was
+diagnostic, not operational — it is what revealed the second device.
+
+**Developer Mode is required, and ad-hoc does not exempt you from it.** After the profile fix the app
+installed and then refused to launch until Developer Mode was on. Since iOS 16 that applies to apps
+with **Ad Hoc** profiles as well as development ones; only In-House (Enterprise) profiles are exempt,
+and this project has no enterprise account. An earlier note in this section wrongly implied ad-hoc
+avoided it. It is a one-time, per-device step and survives reboots:
+**Einstellungen → Datenschutz & Sicherheit → Entwicklermodus → einschalten → Neustart → nach dem
+Neustart „Einschalten" bestätigen und Code eingeben.** The menu entry only appears once the device
+has been offered such an app, which by then it has. Worth knowing for a project with this security
+posture: Developer Mode loosens the device's debugging restrictions, so it is a deliberate trade for
+being able to sideload at all.
 
 **Still open at end of session:** this Mac is logged out of Tailscale (`BackendState: NeedsLogin`),
 which is moot while Gitea hosts the install (section AJ).