[huntharo]

Whole-disk scans skipped /System/Volumes/Data to avoid counting firmlinked files twice. This also excluded the Data volume's private .fseventsd history and .Spotlight-V100 index. Some entry collection failures left directory totals without an incomplete flag.

The scanner now enters that second Data mount only for these two stores. Their sizes come from the existing tree and its allocated-byte and hardlink accounting; they are already included in the scan total. Distinct categories and a macOS service-store section identify the data and keep unreadable stores visible even when there is no measurable treemap tile. Failed or filtered collection displays Unavailable or Incomplete, with guidance for existing Full Disk Access, filesystem permissions, and directory-selection capabilities.

The panel and README explain administrator-discretionary use of Apple's root-only FSEvents purge API and Spotlight indexing choices. The README records the installed SDK's POSIX-seconds cutoff contract and distinguishes mdutil -X from disabling indexing. The removal guard refuses direct deletion of these stores and their contents. This feature does not purge history, change indexing, request elevation, or install a helper.

Validation on macOS:

Check	Result
cargo xtask ci: rustfmt and workspace Clippy with -D warnings	Passed
App tests, including the real window harness for unavailable/partial figures and blocked removal	71 passed
Core tests, including allocated bytes, hardlinks, restricted Data traversal, permission failures, categories, and removal guards	141 passed; 2 existing tests ignored
Packaging task tests	3 passed
git diff --check	Passed

The permission regression now checks the actual access-denied branch and verifies that unknown contents affect ancestor totals. APFS clone sharing and snapshots still mean measured file allocation is not a guaranteed amount of recoverable space; the guidance states this limitation. No live lab machines were modified.

Visual evidence

These are native macOS window captures of unmodified app builds: before is base commit 6c8d4ce, and after is PR head 2ff04ff. Both use the same fixture files, the same 1440 × 900 window, allocated-size mode, and unprivileged access. These are direct folder scans, not a scan of real system service stores; whole-disk Data-volume inclusion and de-duplication are covered by the regression tests described above.

Readable Spotlight store. The fixture contains a 96 MiB search index and 32 MiB of metadata. Both builds measure 128 MiB. Before, its contents are classified as Other. After, they are identified as Spotlight index, and the panel explains indexing and Search Privacy choices.

Before	After

Unreadable FSEvents store. The fixture holds 64 MiB of event data, with directory access denied by Unix permissions. Before, the selection displays 0 B despite the unreadable indicator. After, it displays Unavailable, identifies FSEvents history, explains the administrator-discretionary purge option, and clarifies that Full Disk Access does not override filesystem permissions. Neither build can measure the denied contents; the screenshot does not claim the hidden 64 MiB was collected.

Before	After

Only the controlled fixture's permissions were changed for this reproduction. No live service stores, indexing settings, purge APIs, or privileged helpers were modified.

Actual startup-drive evidence — October 14, 2026

The operator ran a read-only authenticated du -sk scan of the real Data-volume stores after granting Terminal Full Disk Access. The latest supplied output reports both paths without an error:

Actual store	Allocated KiB (du -k)	Allocated bytes	Human-readable size
/System/Volumes/Data/.fseventsd	30,240	30,965,760	29.5 MiB
/System/Volumes/Data/.Spotlight-V100	51,839,112	53,083,250,688	49.4 GiB

mdutil -s /System/Volumes/Data independently reports Indexing enabled. Its status query does not measure the index. These figures are file allocation from the operator's actual drive, not the fixture values above, APFS container totals, snapshot totals, or guaranteed reclaimable space. FSEvents is live history: an earlier supplied scan reported 30,092 KiB; the latest reading above is 30,240 KiB.

Actual Spotlight scan in disktree

The operator launched the built PR application from the authorized Terminal and supplied this unmodified PwrSnap capture of the completed scan of /System/Volumes/Data/.Spotlight-V100. The app displays 49 GiB, 2.1 million files, and 2,903 directories, identifies the selection as Spotlight index, and presents indexing and Search Privacy guidance. The completion line shows approximately 17 seconds for the scan.

The app's rounded 49 GiB display is consistent with the independent du reading of 49.4 GiB above. These captures do not assert equality of exact byte counts from separate scans of a changing live index. The original unprivileged app captures below remain evidence of the denied-access behavior.

Authenticated measurement capture

This native Terminal window capture contains the operator's actual command and output, including the initial Spotlight denial and the subsequent successful scan after the access grant. It has not been modified to insert measurements.

$ sudo /usr/bin/du -sk /System/Volumes/Data/.fseventsd /System/Volumes/Data/.Spotlight-V100
30240     /System/Volumes/Data/.fseventsd
51839112  /System/Volumes/Data/.Spotlight-V100

Original unprivileged app captures

These native disktree captures use PR head 2ff04ff and the same real paths, with the assistant process's unprivileged access. The directories exist and are owned by root: .fseventsd is mode 0700, and .Spotlight-V100 is mode 0710. Both original app scans were denied; Unavailable correctly represents their unknown contents. The later operator measurement does not retroactively give this process access, and the app screenshots have not been altered to display it.

Actual FSEvents store, unprivileged	Actual Spotlight store, unprivileged

Initial denied collection, before the successful authenticated scan

$ /usr/bin/du -sk /System/Volumes/Data/.fseventsd
du: /System/Volumes/Data/.fseventsd: Permission denied
(exit 1)

$ /usr/bin/du -sk /System/Volumes/Data/.Spotlight-V100
du: /System/Volumes/Data/.Spotlight-V100: Operation not permitted
(exit 1)

$ /usr/bin/sudo -n /usr/bin/du -sk <each store>
sudo: a password is required
(exit 1; no authentication prompt was initiated)

$ sudo /usr/bin/du -sk /System/Volumes/Data/.fseventsd /System/Volumes/Data/.Spotlight-V100
30092     /System/Volumes/Data/.fseventsd
du: /System/Volumes/Data/.Spotlight-V100: Operation not permitted

No real service-store files, permissions, indexing settings, or purge history were changed. The operator granted Terminal Full Disk Access to perform the read-only measurement. No privileged helper was installed.

[huntharo]

Continuing this contribution in upstream PR tobi#104. Closing this development PR; its evidence and discussion remain linked from the upstream PR.