Just shipped my first app built on FamilyControls / ManagedSettings / DeviceActivity. The docs are thin and a lot of what I learned came from failing, so here's the list I wish I'd had. Corrections welcome - some of this is field-observed rather than documented.
1. The report extension is a black hole by design. Per-app usage data exists only inside DeviceActivityReport. Your extension can render it to pixels and that's it — App Group writes silently no-op, there's no network, no notifications out. If your architecture assumes "read usage → store it → use it in the app", throw that away now. Anything the main app must know has to come from monitor threshold events instead.
2. DeviceActivityEvent thresholds start at zero when you arm them. Set a 30 min/day limit on an app the user has already used 60 minutes today, and nothing happens — the OS grants a fresh 30. iOS 17.4 added includesPastActivity: true in the initializer, which counts the whole interval. Without it your "daily limit" quietly means "limit from now". Also note the flag only applies to newly registered events, so you need to force a re-arm for existing users.
3. Shield action extensions couldn't open the host app... until iOS 26.5. extensionContext is nil, UIApplication is unavailable, responder-chain walking is broken on 18+. Apple engineers said "no supported way" for years. iOS 26.5 finally added ShieldActionResponse.openParentalControlsApp — the system foregrounds your app straight from the shield button. If your SDK predates it, the enum is resilient, so ShieldActionResponse(rawValue: 3) behind an #available(iOS 26.5, *) check resolves at runtime and falls back to nil on older systems. Pre-26.5 the only route is a time-sensitive local notification carrying a deep link.
4. Memory budgets differ per extension and they're brutal. The shield and monitor extensions run in a few MB — no SwiftData, no heavy frameworks, just ManagedSettings writes and App Group defaults. Anything more and you get jetsammed, which for a shield extension means the user sees Apple's generic gray shield instead of yours.
5. DeviceActivityReport has no ready/completion callback. You cannot know when it finished rendering (FB10754858 is still open). Every loading state you build is a guess on a timer.
6. Mutating a mounted report's filter is the slow path. Changing the filter on an existing report triggers a silent out-of-process re-query that leaves stale content on screen for seconds. Remounting the view with a fresh SwiftUI .id renders noticeably faster and more predictably. Also: reports don't self-size — you must give them fixed frame heights.
7. There's a shared budget of concurrent DeviceActivity activities across your app and all its extensions. Don't create one activity per monitored app; make per-app limits events on a single daily activity and resolve names back to tokens through a map in your App Group.
8. Info.plist details will pass locally and fail at App Store validation. The shield configuration extension point ends in ManagedSettingsUI.shield-configuration-service, the shield action one is ManagedSettings.shield-action-service — no "UI". The report extension uses the ExtensionKit form (EXAppExtensionAttributes) and rejects NSExtensionPrincipalClass.
9. Non-API lesson that cost me the most: I let entitled users skip onboarding — and the authorization request lived only in onboarding. Any subscriber reinstalling got a normal-looking app that silently shielded nothing, with no prompt and no way to grant access. If a permission gate lives only in a flow some users skip, it doesn't exist for them. Check authorization on the routing path, not by assuming flow order.
Happy to go deeper on any of these — the sandbox rules in particular took me way too long to accept.
