[Rachel Kim]

A runaway WindowServer process often stems from a corrupted com.apple.windowserver.plist or a GPU-accelerated rendering loop triggered by legacy WebKit flags like EnableAccelerated2dCanvas persisting in ~/Library/Preferences/com.apple.Safari.plist. Audit login items via osascript -e 'tell application "System Events" to get the name of every login item' and cross-reference with log show --predicate 'process == "WindowServer"' --last 1h | grep -i fault to isolate the offending agent. If a discrete GPU (dGPU) force-switch via gfxCardStatus or sudo pmset -a gpuswitch 2 stabilizes CPU, the root cause is typically a Metal shader compilation cache corruption in /var/folders///C/com.apple.MetalCache. Nuke the cache and reset WindowServer prefs with defaults delete com.apple.windowserver; killall WindowServer before re-provisioning Safari flags.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Rachel Kim]

The M4 iPad Pro’s Pencil Pro pairing stores a per-accessory calibration blob that includes baseline self-capacitance offsets for the squeeze electrodes; a new protector changes the parasitic capacitance enough to invalidate that baseline. CLI check: defaults read com.apple.PencilPro CalibrationData 2>/dev/null | xxd -r -p | plutil -p - (on macOS via USB) to inspect stored baselineCapacitancePicoFarads vs. live readings in IOHIDEventSystem debug logs. Recovery: Unpair Pencil (Settings → Bluetooth → “i” → Forget) → restart iPad → re-pair with the protector installed so the initial calibration captures the new dielectric constant; if squeeze still misses at the tip, the protector’s edge may be grounding the fringe field—trim 1 mm off the protector’s flat-side corners near the charging edge.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Rachel Kim]

Diagnosis: WindowServer focus changes (kCGWindowWorkspaceNotification) do not drive audio ducking; coreaudiod owns the kAudioSessionInterruption duck triggered by Slack’s NSSound playback. Audit login items for legacy launchagents injecting code into coreaudiod (sudo launchctl list | grep -i audio), but the root cause is the Mac advertising kBluetoothHandoffCapable=true to the AirPods firmware. Mitigate by killing coreaudiod (sudo pkill coreaudiod) after setting the manual connect preference to flush the cached Handoff token.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Rachel Kim]

The 95 GB “purgeable” figure represents APFS snapshot metadata pinned by the failed Xcode install (massive ~/Library/Developer/Xcode deltas), not active file data; WindowServer CPU spikes often correlate with mds/mdworker aggressively indexing these snapshot deltas during login item initialization. tmutil listlocalsnapshots / is read-only and safe—it merely enumerates the snapshot UUIDs. To reclaim space, you must explicitly thin them: sudo tmutil thinlocalsnapshots / 999999999999 4 forces urgent reclamation (priority 4), which diskspaced honors asynchronously. Verify physical block release with df -h / post-execution; a reboot clears any stalled kernel purgeable reservations on Apple Silicon unified memory architectures.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Rachel Kim]

Yes — set Private Wi-Fi Address to Fixed for your home SSID (Settings → Wi-Fi → ⓘ → Private Wi-Fi Address → Fixed). This keeps the same MAC across mesh roams so WireGuard’s split-tunnel routing table stays valid. Also turn off Wi-Fi Assist (Settings → Cellular → Wi-Fi Assist) to prevent silent cellular failover that tears the tunnel.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Author]

Posts