Hello,
I may have found a technically working concept related to activation-state behavior on iOS 26.2 and possibly below.
When trying to launch an app through Shortcuts on an activation-locked device, SpringBoard returns an error involving SBMainWorkspace, saying the device is “not activated yet.”
After looking into it, it seems SpringBoard checks a setup/activation-related state to determine whether the device should stay in Setup Assistant or continue to the Home Screen.
In theory, if that state could be changed, the device might boot into the Home Screen and allow apps to open. However, this would likely be only a partial bypass. iCloud services would still not work, and it would not remove Activation Lock from the device.
This may only be possible on iOS 26.2 and below, depending on available exploit chains such as the remaining darksword/dyld-related vulnerability, possibly CVE-2026-20700, which could allow limited file-system changes.
I am not fully sure if this has already been researched or discovered, but I wanted to share the idea and see if anyone else has looked into SpringBoard’s setup-completion checks or activation-state handling.