Plain-English guides to what your Mac is actually doing — SSD wear and real SMART data, battery, thermals and fans, and how to verify an app's privacy for yourself. Honest, local-first, and never a scare tactic.
After the 2025 Tahoe launch the forums filled with complaints of heat, high CPU and battery drain in the days that followed. What the 2025 threads document is the complaint wave itself; a separate Apple Communities answer puts the named background work at “maybe a few hours or days”, and how long the symptoms last was never measured. macOS 27 also adds documented changes worth knowing before you click Upgrade: MacRumors reports it runs on Apple silicon only, and Howard Oakley reports it no longer restores Rosetta 2 automatically. What’s normal, what actually changes, and a four-step pre-upgrade checklist.
The process named deleted is macOS’s purgeable-space daemon: it listens for low-space events and asks a registry of 27 services — Photos, Spotlight, Time Machine, iCloud — to purge, caches first and snapshots last. The top-ranking page describes a different phenomenon entirely; here’s the real mechanism, why sudo purge doesn’t touch purgeable storage, and the two documented cases where a utility app caused the very CPU storm people blame on the daemon.
One Photos library keeps five daemons busy, and the pages that rank for this name blur them — some even hand photolibraryd the face-recognition job Apple’s man pages give to photoanalysisd. Who actually does what, the launchd contracts you can read yourself, the second Photos library that holds your Messages media, and how to tell which one is working.
dasd is the Duet Activity Scheduler: it decides when your Mac runs backups, security scans and cleanups — at least 701 activities submitted during ~72 seconds of one boot, per Howard Oakley’s July 2026 analysis. On the macOS 26.6 Mac I measured it stayed near 16 MB across three samples; the 10–70 GB horror stories are a dated, sourced Golden Gate beta bug. What one real Mac looked like, what the known wave is, and how to check yours.
The field guide to the hundreds of processes a healthy Mac runs — 30+ processes mapped by family (Photos, iCloud, Spotlight, security, scheduling), the burst-vs-plateau pattern that tells routine deferred work from the cases worth investigating, and a four-step way to investigate any name in Activity Monitor. Links every per-daemon deep-dive.
The canonical field guide to how a Mac SSD actually wears — Data Units Written, TBW, Percentage Used, swap and APFS copy-on-write — with a real dated NVMe reading off my own Mac (34.1 → 34.9 TB in ten days, still 2% used). Apple publishes no TBW, host writes aren’t flash writes, and no honest tool gives a failure date. One map that links every SSD deep-dive.
bird is Apple’s per-user iCloud Drive daemon — “Documents in the Cloud.” It rarely works alone: one iCloud Drive sync can light up fileproviderd (the broker), bird (iCloud Drive documents) and cloudd (CloudKit) at once. High CPU usually means a sync in progress; the honest test is whether Finder shows progress, not a magic percentage. Attribute it by watching Finder’s iCloud Status and the network trend — never force-quit the daemon.
mobileassetd is Apple’s system daemon for downloading MobileAsset packages — Siri voices, keyboard and dictation languages, dictionaries, fonts and on-device models — stored in /System/Library/AssetsV2. High CPU, network or data after an update is usually a legitimate download; judge it by whether the activity trends down, not by a made-up percentage. Deleting AssetsV2 or disabling SIP is the wrong direction.
tccd is Apple’s Transparency, Consent, and Control daemon — the privacy broker behind every “would like to access your camera” prompt. High CPU is a clue to trace to the app that keeps asking, not a malware verdict, and when one app’s remembered decision is implicated, the supported targeted step is a tccutil reset — never editing the OS-protected TCC.db.
Docker Desktop stores its Linux containers, images and volumes in one sparse disk image, and people read its provisioned cap, its occupied space, Docker’s own data, and the SSD write counter as if they were one number. They answer four different questions — and only one spends endurance. Pruning frees space; it never un-writes.
“Chrome wrote 100 GB” is almost never one thing. It hides six independent writers — cache, per-site storage, session recovery, extensions, profile databases, and swap — each with a different cause and a different honest fix. Attribute the subsystem before you touch it; disabling the cache can write more.
kernel_task tops Activity Monitor’s Disk tab and everyone blames the kernel. But that row is an accounting endpoint that can absorb the whole system’s low-level work — swap, journaling, cache flushes and driver I/O are possible contributors — and Apple publishes no breakdown. Here’s the falsifiable chain: counter → device → trigger → trend.
Nobody can honestly give you a failure date — but two dated NVMe readings, the Percentage Used slope, and explicit uncertainty produce something genuinely useful: a conditional wear trend instead of a fake countdown. With the real arithmetic, a worked example, and why the “SSD life” calculators lie.
Swap Used is a live allocation gauge, not a wear odometer. The 2021 M1 scare started with startling device-write totals, blamed swap — and left a habit of reading the gauge as the odometer. How macOS memory actually works (compression first, in RAM), and how to measure whether swap matters on your Mac.
A macOS update wakes Spotlight up and mds_stores writes hard for hours. The panic move is to disable Spotlight; the right move is to measure whether the write rate is settling. Normal catch-up trends down — only a stuck loop stays flat-high after the work is done. Here’s how to tell them apart.
Activity Monitor gives you a suspect, not a conviction. To actually name what’s burning your SSD writes, you join four layers — the process, the live file paths (fs_usage), the NVMe device counter, and a baseline — by time, not by matching byte counts. The whole evidence chain, built-in tools plus free smartmontools.
Everyone wants a magic “GB per day” line — but a daily total has no shape. The honest read is three things together: the write rate, your Mac’s own baseline, and the long-term wear slope. With the NVMe counter math and real numbers off my own SSD (34.1 TB written, 2% used).
SMART status not supported on Mac means no usable SMART arrived; a USB bridge can block it. Identify the hardware path, try smartctl, and check other evidence.
It looks like the villain at the top of Activity Monitor, eating 400% CPU. It’s actually the one thing in there protecting your Mac — macOS cooling the chip. Why it’s a symptom (not the cause), why you can’t kill it, and how to find what’s really running hot.
Everyone wants a magic Celsius line, but Apple never published one — the only number it gives is a room-temperature range, not a chip limit. The honest read is the pattern: warm under load then cooling is normal; pinned-hot at idle is a process to find. Why throttling is protection, not a fault.
It’s a legitimate, well-made app — the “is it safe” question is easy. The interesting one is whether you need a cleaner, when modern macOS already manages memory, caches and storage (per Apple’s own docs). A fair take, and why a slow Mac needs a diagnosis, not a deletion.
Maximum Capacity dropped a few points and your stomach sank — but that number is an estimate that wobbles, and a fast early drop is usually normal. What Maximum Capacity and cycle count really mean, what “Service Recommended” says, and the honest short list of when to act.
Close the lid at 100%, open it at 74% — usually the Mac wasn’t really asleep, something kept waking it. What’s normal, why Apple Silicon sleeps differently (no SMC, no hibernatemode tuning), and how to read the exact wake reason with pmset -g assertions.
Your Mac has a built-in health flag for its drive and real wear numbers underneath — but the reassuring “Verified” is the most misunderstood word in the subject. The honest signals, how to read SMART and wear with built-in tools plus smartctl, and why a backup — not a status — is the real protection.
A used MacBook is a great deal or an expensive mistake, and the difference is fifteen minutes with built-in tools. The whole test in order: Activation Lock (the deal-breaker to settle first), serial & coverage, battery cycles, SMART, and a hands-on pass — honest about what each check proves.
Activity Monitor is a good live process monitor — but it shows no temperatures, no fan speed, no SSD wear, no battery health, and no history. The real tools that fill each gap, free first (Stats, coconutBattery) and paid where it’s worth it (iStat Menus, TG Pro), recommended straight.
The fan’s roaring, the beachball won’t quit, the battery says “Service Recommended.” Usually it’s one nameable, fixable thing — not death. How to read each real signal (battery, SSD/SMART, heat, panics, display) with tools already on your Mac, and when to actually worry.
mediaanalysisd is pinning your CPU and com.apple.mediaanalysisd has eaten tens of GB of disk. It’s Apple’s Visual Look Up & Live Text engine — usually a harmless backlog, but since macOS 15.1 a reported bug makes it loop. What it is, and how to calm it.
Fans up, Mac warm, and Activity Monitor blames coreduetd. It’s Apple’s CoreDuet daemon learning your habits for Handoff and suggestions — usually harmless. The one test that tells “busy” from “stuck,” and how to calm it without deleting anything.
A process called searchpartyd is burning CPU and the name sounds like it’s scanning you. It isn’t — it’s Apple’s Find My daemon. Why it spikes, the 30-second Bluetooth test that proves it, and how to calm it without weakening your Mac’s security.
Your Mac’s Storage bar says “System Data: 120 GB” with no button to open it. It’s mostly APFS snapshots, purgeable space and caches — not junk you delete. What it really is, and why deleting things makes it grow.
That process eating your CPU in Activity Monitor is usually Apple’s Photos analyzer — not a virus. Why it spikes, how long it lasts, how to verify it’s genuine, and when to actually worry.
Flash got expensive, so counterfeit SSDs spread. A fake “990 Pro” can ace the label and still crawl at USB-2 speeds and flunk a maker’s check. Here’s what your Mac can actually read — and the honest limits.
Hot Mac, screaming fans — and the app you’d blame is at 2% CPU. The heat is a reported ~4000 git/sec storm billed to syspolicyd and trustd, not the app. The mechanism, and how to spot it.
After a macOS update the battery tanks and everyone blames the battery (or installs a “cleaner”). It’s usually one named process — here’s how to find yours in two minutes, free.
Free space barely moved, the file stayed small, SMART said “OK” — and a local AI tool still wrote a reported 37 TB in three weeks. The forensic walk-through, and why your dashboards never flinched.
CoreGuard