iOS 27.0.1 guest: photo-save subsystem missing from CFW (no photolibraryd/camerawriterd) — Camera shutter & Safari 'Save Image' do nothing

Environment

• Bundle VPhone.bundle 2.10.1 (vphone-launchpad/Bundles/2.10.1)
• Guest: iOS 27.0.1, model iPhone99,11 (PCC research VM, platformType = vresearch101, OpenAVB/OpenSEP ROMs)
• Bootstrap installed later (roothide), but the problem below reproduces independent of it.

Symptoms

Everything that must write into the Photos library silently does nothing on this guest:

• Camera.app: viewfinder works (virtual camera), shutter gives no feedback and no file ever appears in /var/mobile/Media/DCIM/100APPLE. In SimulatedCamera/vcamcaptured.log a capture attempt ends without writing.
• Safari long-press → "Save Image": nothing saved either.
• A small helper inside an app calling [PHPhotoLibrary performChanges:completionHandler:] with PHAssetCreationRequest + addResourceWithType:fileURL: fails immediately:

  PHPhotosErrorDomain error 3302

  while assetsd logs nothing at all for the failed request window (checked via logs.syslog) — looks like the XPC target doesn't exist.
• services.status reports, for all three, loaded:false running:false (never loaded):
  • com.apple.photolibraryd
  • com.apple.camerawriterd
  • com.apple.mediaassetd

Diagnosis — binaries/plists really absent from the CFW image

Using the file API (files.list / files.find) as root:

• /usr/libexec has no photolibraryd, camerawriterd or mediaassetd (only photosfaced matches *photo*).
• /System/Library/LaunchDaemons has no com.apple.photolibraryd.plist, com.apple.camerawriterd.plist, com.apple.mediaassetd.plist.
• files.find across /System/Library finds no match for *photolibraryd* or *writer*.
• Note on this build daemons that DO work are real files: assetsd runs from /System/Library/Frameworks/AssetsLibrary.framework/Support/assetsd, mediaanalysisd from MediaAnalysis.framework/mediaanalysisd, cameracaptured from /usr/libexec/cameracaptured. So it doesn't look like DSC-resident executables with only plists trimmed — the framework dir itself (PhotoLibraryServices.framework) contains resources but no binary.

Since services.profile "trimmed" disables launchd labels but wouldn't delete plist files and binaries, this looks more like an OS-image trimming step than a service-profile side effect. Result: any PhotoKit write path fails at XPC level before assetsd is involved.

Repro

On any iOS 27.0.1 guest created with the standard firmware pairing:

1. Open Camera.app (virtual camera active), press the shutter.
2. /var/mobile/Media/DCIM/100APPLE stays empty; no error dialog.

Questions

1. Are those photo-write daemons supposed to ship in the CFW image (as real files + LaunchDaemons plists)? If they are intentionally trimmed to save space, is there a supported way to restore them on an existing VM?
2. If they should exist as real files on iOS 27 guests: could this be a patcher bug for that specific firmware pairing?

(Workaround attempted locally: injecting a helper into a normal app and calling PHPhotoLibrary directly — fails with the same 3302, which is how we isolated the missing-daemon cause.)