diff --git a/docs/apple-account-migration-runbook.html b/docs/apple-account-migration-runbook.html
index a99237b..0ef91a2 100644
--- a/docs/apple-account-migration-runbook.html
+++ b/docs/apple-account-migration-runbook.html
@@ -92,16 +92,14 @@
 <h3>1.1 记下 Team ID</h3>
 <p>Membership details → <b>Team ID</b> → 发我。</p>
 
-<h3>1.2 注册 4 个 App ID（Identifiers）</h3>
-<p>Certificates, IDs &amp; Profiles → <b>Identifiers</b> → ＋ → App IDs → App。逐个建：</p>
+<h3>1.2 注册 2 个 App ID（Identifiers）</h3>
+<p>Certificates, IDs &amp; Profiles → <b>Identifiers</b> → ＋ → App IDs → App。因 iOS/macOS 现共用同一 Bundle ID 字符串,<strong>只需 2 个唯一 App ID</strong>（各覆盖两端）：</p>
 <table>
 <tr><th>Description</th><th>Bundle ID（Explicit）</th><th>勾选的 Capabilities</th></tr>
-<tr><td>Pangolin macOS</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin macOS PacketTunnel</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin iOS</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions</td></tr>
-<tr><td>Pangolin iOS PacketTunnel</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
+<tr><td>Pangolin（主 app）</td><td><code>com.yanmeiai.pangolin</code></td><td>App Groups、Network Extensions、<strong>System Extension</strong></td></tr>
+<tr><td>Pangolin PacketTunnel（扩展）</td><td><code>com.yanmeiai.pangolin.PacketTunnel</code></td><td>App Groups、Network Extensions</td></tr>
 </table>
-<p class="small">iOS 与 macOS 主 app 共用同一字符串 <code>com.yanmeiai.pangolin</code>——App ID 允许跨平台同串（一个 App ID 记录即可对两端生效）。若后台不让重复建，建一个即可，两端工程都指它。</p>
+<p class="small"><strong>主 app 三个能力缺一不可</strong>——尤其 <b>System Extension</b>：macOS 主 app 靠 <code>com.apple.developer.system-extension.install</code> 装载 sysext,少了它 Developer ID profile 不含该权限,构建报「Provisioning profile doesn't include the System Extension capability」。改了 App ID 能力后,相关 profile 会变 Invalid,须去 Profiles 重新 Generate + Download。扩展 App ID 只需 Network Extensions + App Groups。</p>
 
 <h3>1.3 创建 App Group</h3>
 <p>Identifiers → 右上下拉切到 <b>App Groups</b> → ＋ → 填 <code>group.com.yanmeiai.pangolin</code>（Description 随意）。回到上面 4 个 App ID，编辑其 <b>App Groups</b> capability → Configure → 勾上这个 group。</p>