[huntharo]

Thanks for disktree. I'm using it to investigate disk usage on my Mac, where a read-only administrator scan found a 49.4 GiB Spotlight index.

Whole-disk scans skip /System/Volumes/Data to avoid counting firmlinked files twice. This also excludes the Data volume's private .fseventsd history and .Spotlight-V100 index. Neither store has a named category, and some entry collection failures leave directory totals without an incomplete flag.

This change enters that second Data mount only for these two stores, keeping firmlinked user files excluded. Their sizes come from the existing tree and its allocated-byte and hardlink accounting, and are already included in the scan total. It adds distinct categories and a macOS service-store section that keeps protected stores visible even when no measurable treemap tile exists. Failed or filtered collection displays Unavailable or Incomplete; collection failures also propagate to ancestor totals.

The panel and README explain Full Disk Access, filesystem permissions, administrator-discretionary use of Apple's root-only FSEvents purge API, and Spotlight indexing choices. Full Disk Access does not override Unix ownership. The removal guard refuses direct deletion of either store or its descendants, and internal folders such as Cache inherit the service category without a reclaimable hatch. This feature does not purge history, change indexing, request elevation, or install a privileged helper.

The development PR and detailed collection record are in huntharo/disktree#6.

Actual startup-drive evidence

After granting Terminal Full Disk Access, I ran an authenticated read-only du -sk scan:

Store	Allocated KiB	Allocated bytes	Size
/System/Volumes/Data/.fseventsd	30,240	30,965,760	29.5 MiB
/System/Volumes/Data/.Spotlight-V100	51,839,112	53,083,250,688	49.4 GiB

The built PR application displays the real Spotlight index as 49 GiB, with 2.1 million files, 2,903 directories, the Spotlight index category, and indexing guidance. Its display rounds the size; separate scans of a live index do not establish equality of exact byte counts. mdutil -s /System/Volumes/Data reports indexing enabled.

Before and after

These unmodified native window captures use the same controlled files, allocated-size mode, and window size. Before is base 6c8d4ce; after is head 2ff04ff. The direct-folder comparisons establish classification and access guidance; the Data-volume traversal regression separately verifies inclusion without duplicate aliases.

A readable 128 MiB Spotlight fixture is classified as Other before and Spotlight index with indexing guidance after. Both scans measure the same 128 MiB.

Before	After

A denied FSEvents fixture contains 64 MiB behind Unix permissions. Before, the selection displays 0 B despite its unreadable indicator. After, it displays Unavailable with the category and access guidance. Neither unprivileged scan can measure the hidden contents.

Before	After

Validation

Check	Result
Local cargo xtask ci on macOS at 2ff04ff	Lint passed; 72 app tests, 153 core tests, and 3 packaging tests passed; 2 existing tests ignored
Fork CI	All six checks passed: Linux, macOS, Windows, Linux aarch64, macOS x86_64, Windows aarch64
git diff --check	Passed

Regression coverage includes allocated sizes, hardlinks, restricted Data traversal, permission failures and ancestor completeness, categories, deletion guards, and the real window harness for unavailable/partial figures and blocked removal. APFS clones and snapshots still mean measured file allocation is not guaranteed recoverable space; the guidance states that limitation.

Actual-drive size command and output

$ sudo /usr/bin/du -sk /System/Volumes/Data/.fseventsd /System/Volumes/Data/.Spotlight-V100
30240     /System/Volumes/Data/.fseventsd
51839112  /System/Volumes/Data/.Spotlight-V100

Before the Terminal access grant, the Spotlight command returned Operation not permitted, including with sudo. The unprivileged app captures and that initial failure are preserved in the linked development PR. No service-store files, Unix permissions, indexing settings, or purge history were changed.