Tinderbox 11.8.0 (b808) on macOS 26.5.2 (25F84): closing ANY document window crashes 100% of the time — SIGSEGV in -[MapItemScribe drawRect:] during the CA transaction commit right after window teardown (use-after-free / pointer authentication failure). Reproduces with a brand-new untitled document containing a single note. Started immediately after updating from macOS 26.5.1 to 26.5.2; the same Tinderbox build ran fine for 10 days on 26.5.1. Save always completes before the crash, so no data loss. Crash log below (from the fresh-document repro). Hardware: Mac Studio M2 Ultra.
Process: Tinderbox 11 [71474]
Version: 11.8.0 (b808)
Code Type: ARM-64 (Native)
OS Version: macOS 26.5.2 (25F84)
Date/Time: 2026-07-15 11:16:05.3148 +0800
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x616dc567eefcce06 -> 0x00004567eefcce06 (possible pointer authentication failure)
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 Tinderbox 11 -[MapItemScribe drawRect:] + 264
1 Tinderbox 11 -[MapItemView drawRect:] + 72
2 AppKit 0x564498
3 AppKit 0x5644c0
4 AppKit 0x52a398
5 AppKit 0x52a9b4
6 AppKit _NSViewDrawRect + 132
7 AppKit -[NSView _recursive:displayRectIgnoringOpacity:inContext:stopAtLayerBackedViews:] + 1084
8 AppKit -[NSView(NSLayerKitGlue) _drawViewBackingLayer:inContext:drawingHandler:] + 536
9 AppKit -[NSViewBackingLayer drawInContext:] + 56
10 AppKit 0x587024
11 AppKit 0x587c84
12 AppKit 0x622f4c
13 AppKit 0x6233a0
14 AppKit -[NSViewBackingLayer display] + 1284
15 QuartzCore CA::Layer::display_if_needed(CA::Transaction*) + 784
16 QuartzCore CA::Context::commit_transaction(CA::Transaction*, double, double*) + 620
17 QuartzCore CA::Transaction::commit() + 648
18 AppKit __62+[CATransaction(NSCATransaction) NS_setFlushesWithDisplayLink]_block_invoke + 272
19 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 36
20 CoreFoundation __CFRunLoopDoObservers + 648
21 CoreFoundation __CFRunLoopRun + 764