Enrolling a used Mac mini that arrived two macOS versions behind

The machine was fine. Sixteen gigabytes, an Apple M4, a clean wipe. It was also on macOS 15.6.1, and the Xcode we ship to every customer will not launch below 26.2. Here is how to tell, and the parts of the upgrade that are not obvious. At the end is the list we now run before paying for a used Mac.

Read the minimum off Xcode itself

Do not guess from release notes. Xcode declares its floor in its own property list.

$ /usr/libexec/PlistBuddy -c "Print :LSMinimumSystemVersion" \
    /Applications/Xcode.app/Contents/Info.plist
26.2

A machine below that enrolls cleanly and then fails the first customer build. Our enrollment script now checks this before doing anything else, and refuses with the exact command to fetch a newer release.

Software Update only shows the newest major

From macOS 15, System Settings offered macOS 27 and nothing else. The older majors still exist. You have to ask for them by name, from the command line.

$ softwareupdate --list-full-installers
* Title: macOS 27 Golden Gate, Version: 27.0, Build: 26A428
* Title: macOS Tahoe,          Version: 26.7, Build: 25G229
* Title: macOS Tahoe,          Version: 26.6.2 ...
* Title: macOS Sequoia,        Version: 15.8 ...

$ softwareupdate --fetch-full-installer --full-installer-version 26.7

The list is model dependent, so run it on the machine in question. On ours only 27 was offered, so we took 27 on purpose rather than by default. That distinction matters on a fleet.

Before you take a new major on a fleet machine

Every Homebrew formula we install already had a bottle for the new release. That is why enrollment took the usual time rather than an afternoon of compiling Ruby.

What enrollment verifies before the machine goes on sale

Passing the version check is where the work starts, not where it ends. Before a machine is offered to anyone it has to prove four things, and each is measured rather than assumed.

• A real desktop. A VNC client pulls a framebuffer and counts colours. Over a hundred thousand distinct colours is a desktop. Two is a black screen.
• A real compile. xcrun swiftc builds and runs a binary as the customer account.
• A logged-in session. who shows a console line for the customer account.
• Telemetry flowing. The hub sees the machine, its macOS version and its session in the fleet dashboard.

Ours passed all four on macOS 27. That, and not the version number, is why it is on sale.

The scare that was not a bug

The first two boots after enrollment did not auto-login. On a brand new macOS major, that looks like a regression, and we nearly wrote it up as one. It was not.

The first boot was indexing a freshly copied 3.8 GB Xcode with a load average over 160. The login did not complete in time, and macOS set lastLoginPanic in the loginwindow preferences. That flag makes it skip auto-login on the next boot too. Clearing the latch and rebooting on a settled machine worked, with the same password and the same scripts, at both 8 and 32 characters.

sudo defaults delete /Library/Preferences/com.apple.loginwindow lastLoginPanic
sudo shutdown -r now

What proved it was not the new OS was a control. We ran the same diagnostic command on a healthy machine one major behind and got the same error. That story, and four others like it, is in checks that cannot fail.

What to check when buying a used mini

None of this is specific to CI. It is what you should check before handing over money for any used Mac. We just have more reasons than most to get it right the first time, because the machine goes to a customer within the hour.