This page classifies Messages and IM notification-like names by the delivery mechanism that is currently supported by local evidence.
Evidence classes:
- Verified: launchd declares the notification as a launch trigger, or the symbol name explicitly carries a delivery mechanism such as
DistributedorDarwin. - Inferred: naming and surrounding framework context strongly suggest a mechanism, but no observer or log proof has confirmed delivery.
- Unclassified: exported notification constants exist, but the first pass has not proven how they are delivered.
Raw captures:
research/Messages/notifications/sdk-notification-symbols-macos-27.0.txtresearch/Messages/notifications/launchd-notification-triggers-macos-26.5.2.txtresearch/Messages/notifications/notifyutil-probes-macos-26.5.2.txtresearch/Messages/notifications/runtime-string-constants-imcore-macos-26.5.2.jsonresearch/Messages/notifications/runtime-string-constants-imdpersistence-macos-26.5.2.jsonresearch/Messages/notifications/observer-app-open-macos-26.5.2.json
Environment:
- active OS: macOS 26.5.2 build 25F84
- SDK comparison: macOS 27.0 SDK from
/Applications/Xcode-beta.app
Important limitation: this macOS notifyutil does not support a list-all operation. Targeted notifyutil -g probes returned 0 for real-looking keys and for a random control key, so those probes are not proof that a notification exists or has an active publisher.
Verified with the local spelunk notification-observe helper, which registers selected Darwin notify and distributed-notification names for a bounded duration and records notification names/timestamps only, not payload values.
During a six-second observation window while opening Messages in the background, these watches registered successfully and observed zero events:
- Darwin notify:
com.apple.idstransfers.idslaunchnotification - Darwin notify:
com.apple.imautomatichistorydeletionagent.prefchange - distributed notification center:
IMMessageSentDistributedNotification
Interpretation: app activation alone did not post the watched names during this capture. This is narrow negative evidence only; it does not rule out posts during send, receive, transfer, account login, history deletion preference changes, or notification response flows.
Verified with the local spelunk string-constants helper, which loads a framework image read-only and resolves selected exported NSString constant globals with dlsym.
| Symbol | Runtime value |
|---|---|
IMMessageSentDistributedNotification |
IMMessageSentDistributedNotification |
IMAccountActivatedNotification |
__kIMAccountActivatedNotification |
IMAccountLoggedInNotification |
__kIMAccountLoggedInNotification |
IMAccountLoggedOutNotification |
__kIMAccountLoggedOutNotification |
IMAccountLoginStatusChangedNotification |
__kIMAccountLoginStatusChangedNotification |
IMAccountRegistrationStatusChangedNotification |
__kIMAccountRegistrationStatusChangedNotification |
IMChatMessageReceivedNotification |
__kIMChatMessageReceivedNotification |
IMChatMessageSendFailedNotification |
__kIMChatMessageSendFailedNotification |
IMChatRegistryMessageSendingNotification |
__kIMChatRegistryMessageSendingNotification |
IMChatRegistryMessageSentNotification |
__kIMChatRegistryMessageSentNotification |
IMChatUnreadCountChangedNotification |
__kIMChatUnreadCountChangedNotification |
IMFileTransferCreatedNotification |
__kIMFileTransferCreatedNotification |
IMFileTransferUpdatedNotification |
__kIMFileTransferUpdatedNotification |
IMFileTransferFinishedNotification |
__kIMFileTransferFinishedNotification |
IMDaemonWillConnectNotification |
__kIMDaemonWillConnectNotification |
IMDaemonDidConnectNotification |
__kIMDaemonDidConnectNotification |
IMDaemonDidDisconnectNotification |
__kIMDaemonDidDisconnectNotification |
IMDaemonConnectionLostNotification |
__kIMDaemonConnectionLostNotification |
IMServiceDidConnectNotification |
ServiceDidConnect |
IMServiceDidDisconnectNotification |
ServiceDidDisconnect |
IMCloudKitFetchedSyncStatsNotification |
IMCloudKitFetchedSyncStatsNotification |
IMCollaborationNoticesDidChangeNotification |
__kIMCollaborationNoticesDidChangeNotification |
IMNicknameDidChangeNotification |
__kIMNicknameDidChangeNotification |
IMPinnedConversationsDidChangeNotification |
__kIMPinnedConversationsDidChangeNotification |
Resolved from /System/Library/PrivateFrameworks/IMDPersistence.framework/IMDPersistence:
| Symbol | Runtime value |
|---|---|
IMDPersistenceServiceResettingNotification |
IMDPersistenceServiceResettingNotification |
IMDSMSFailedToSendNotification |
__kIMDSMSFailedToSendNotification |
IMDSMSMarkAsReadCompletedNotification |
__kIMDSMSMarkAsReadCompletedNotification |
The same runtime pass did not resolve these SDK-observed names as exported NSString globals from the loaded IMDPersistence image: IMDMessageRecordRetractNotification, IMDNotificationsPostNotification, IMDNotificationsPostUrgentNotification, IMDNotificationsRetractNotification, IMDNotificationsUpdatePostedNotification, IMDChatRegistryAddedChatNotification, IMDFileTransferCreatedNotification, IMDFileTransferUpdatedNotification, and IMDSMSMessageSentNotification.
Inference: SDK symbol scanning can surface names that are not directly resolvable as live exported NSString globals by dlsym on this OS image. Treat those unresolved names as weaker evidence until a dyld-cache metadata pass or runtime caller evidence explains their representation.
These names are verified from launchd plists as notify-triggered or launch-event-triggered surfaces:
| Name | Owner | Evidence | Meaning |
|---|---|---|---|
com.apple.private.IMCore.LoggedIntoHSA2 |
com.apple.imagent |
LaunchEvents entry |
Auth/account state can wake imagent. The plist names the event but does not expose payload shape. |
com.apple.imautomatichistorydeletionagent.prefchange |
com.apple.imautomatichistorydeletionagent |
com.apple.notifyd.matching trigger |
Preference changes can wake the automatic history deletion agent. |
com.apple.idstransfers.idslaunchnotification |
com.apple.imcore.imtransferagent |
com.apple.notifyd.matching trigger |
IDS transfer activity can wake the IM transfer agent. |
Related verified mach services:
com.apple.aps.imagentcom.apple.corespotlight.daemon.messagescom.apple.imagent.cache-deletecom.apple.imagent.desktop.authcom.apple.madrid-idswakecom.apple.madrid.lite-idswakecom.apple.usernotifications.delegate.com.apple.iChatcom.apple.usernotifications.delegate.com.apple.MobileSMScom.apple.imtransferservices.IMTransferAgent
Verified launchd notify triggers:
com.apple.imautomatichistorydeletionagent.prefchangecom.apple.idstransfers.idslaunchnotification
com.apple.private.IMCore.LoggedIntoHSA2 is verified as a launch event in com.apple.imagent.plist, but the plist key is not under com.apple.notifyd.matching; treat it as a launch-event surface rather than a confirmed notifyd matching key until lower-level launchd evidence classifies it.
Verified by exported symbol naming, not by an observed post:
IMMessageSentDistributedNotification
Inference: the Distributed suffix likely means an NSDistributedNotificationCenter-style cross-process notification. A future observer pass should confirm the exact notification name string and payload behavior.
Unclassified exported constants include large account, chat, transfer, daemon, and CloudKit families:
- account lifecycle:
IMAccountActivatedNotification,IMAccountLoggedInNotification,IMAccountLoggedOutNotification,IMAccountLoginStatusChangedNotification,IMAccountRegistrationStatusChangedNotification - chat lifecycle:
IMChatMessageReceivedNotification,IMChatMessageSendFailedNotification,IMChatRegistryMessageSendingNotification,IMChatRegistryMessageSentNotification,IMChatRegistryDidRegisterChatNotification,IMChatRegistryDidUnregisterChatNotification - chat state:
IMChatUnreadCountChangedNotification,IMChatParticipantsDidChangeNotification,IMChatPropertiesChangedNotification,IMChatKeyTransparencyStatusChangedNotification,IMChatAutomaticTranslationChangedNotification - file transfer:
IMFileTransferCreatedNotification,IMFileTransferUpdatedNotification,IMFileTransferFinishedNotification,IMFileTransferRejectedNotification,IMFileTransferRemovedNotification - daemon/service:
IMDaemonWillConnectNotification,IMDaemonDidConnectNotification,IMDaemonDidDisconnectNotification,IMDaemonConnectionLostNotification,IMServiceDidConnectNotification,IMServiceDidDisconnectNotification - CloudKit/sync:
IMCloudKitFetchedSyncStatsNotification,IMCloudKitFetchedSyncDebuggingInfoNotification,IMRunAllCloudKitEventNotification - collaboration/nicknames/pinning:
IMCollaborationNoticesDidChangeNotification,IMNicknameDidChangeNotification,IMPinnedConversationsDidChangeNotification
Inference: most plain *Notification exported constants are probably Foundation notification names used by in-process controllers, daemon clients, or private framework objects. Do not treat them as Darwin notify keys without observer evidence.
Unclassified exported symbols:
IMDMessageRecordRetractNotificationIMDNotificationsPostNotificationIMDNotificationsPostUrgentNotificationIMDNotificationsRetractNotificationIMDNotificationsUpdatePostedNotificationIMDPersistenceServiceResettingNotificationIMDSMSFailedToSendNotificationIMDSMSMarkAsReadCompletedNotificationIMDChatRegistryAddedChatNotificationIMDFileTransferCreatedNotificationIMDFileTransferUpdatedNotificationIMDSMSMessageSentNotification
Inference: the IMDNotifications* names likely relate to notification posting or retraction work performed by daemon or persistence components, but the first pass does not prove whether they are Foundation notification names, XPC message names, user-notification identifiers, or internal constants.
- What exact string value do the remaining unresolved IMD exported names hold, if they exist as constants rather than selectors, Swift metadata, or non-exported data?
- Which plain
IM*Notificationconstants are posted throughNotificationCenter,DistributedNotificationCenter, Darwin notify, XPC callbacks, or private observer abstractions? - Which notification names are visible outside Apple-signed clients, if any?
- Which names are posted by
imagentversusIMDPersistenceAgentversus Messages.app? - What payload keys are present when chat, message, and file-transfer notifications fire in a controlled test-thread flow?