Keep records on other filesystems under an operand with -x (closes #99)

With -x the walk does not enter a directory on another filesystem than
its operand, but the update phase still deleted every record below it.
A separate scan of a filesystem mounted under the operand therefore lost
its records on every -x scan and re-hashed its whole tree.

The walk now sends an event naming each directory it declines this way,
and the walk phase treats the records below those directories like
records outside the operands: they are not deleted, and their sizes join
the size census. README "scan mode" and "Rules for the walk" state the
rule.

Model: opus-5-5

README.md

@@ -447,6 +447,11 @@ operands:
   a `content` hash is read for one, wherever it lies, once its size, `head`, and
   `tail` match another record's. If that file is gone or has changed since its
   record was written, the record is left as it is.
+- With `-x`, a record below a directory the walk did not enter because that
+  directory is on another filesystem than its operand counts as outside the
+  scanned operands: it is not deleted, and its size joins the size census. A
+  filesystem mounted under an operand can therefore be scanned on its own
+  schedule into the same database.
 
 `scan` runs **four sequential phases over the whole scan**. Parallelism lives
 inside each phase; batched database writes begin during the hash phase:
@@ -513,7 +518,9 @@ Rules for the walk:
 - Filesystem boundaries are crossed by default. With `-x` (long form
   `--one-file-system`, following the GNU `du`/`rsync` convention), never descend
   into a directory on a different filesystem than its `PATH` operand; each
-  operand is bounded by its own filesystem.
+  operand is bounded by its own filesystem. The records below such a directory
+  count as outside the scanned operands, as described in "`scan` mode" above:
+  they are not deleted, and their sizes join the size census.
 - On any per-path error (permission denied, file vanished between passes,
   unreadable): print a one-line warning to stderr, skip the path, and continue.
   Per-file errors never abort the run; the final summary reports how many were

TODO.md

@@ -29,6 +29,10 @@
 
 # Completed Steps
 
+- with `-x`, `scan` keeps the records below a directory on another filesystem
+  under its operand, and counts their sizes in the size census, instead of
+  deleting them (2026-10-14, https://git.eeqj.de/sneak/sfdupes/issues/99)
+
 - the hash and content phases open each file without blocking and check that it
   is still a regular file, so one replaced by a FIFO or device node after it was
   statted is warned about and skipped instead of hanging the scan (2026-10-14,

scan.go

@@ -391,15 +391,26 @@ func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 // (the content phase may still fill in its content hash). It returns
 // the new-or-changed files and the unchanged files whose records lack
 // hashes; both remain candidates until the census decides whether
-// their sizes are shared.
+// their sizes are shared. A record below a directory -x did not enter
+// counts as outside the roots: it is not deleted, and its size joins
+// the census.
 func (s *scanState) walkPhase(
 	events <-chan walkEvent,
 ) ([]fileRec, []fileRec) {
 	prog := newProgress("walk", -1)
 
-	var changed, unhashed []fileRec
+	var (
+		changed, unhashed []fileRec
+		otherFSDirs       []string
+	)
 
 	for ev := range events {
+		if ev.otherFSDir != "" {
+			otherFSDirs = append(otherFSDirs, ev.otherFSDir)
+
+			continue
+		}
+
 		if ev.fail {
 			s.st.skipped++
 
@@ -429,6 +440,14 @@ func (s *scanState) walkPhase(
 
 	prog.finish()
 
+	for path, old := range s.existing {
+		if underAnyRoot(path, otherFSDirs) {
+			delete(s.existing, path)
+
+			s.sizes = append(s.sizes, old.size)
+		}
+	}
+
 	return changed, unhashed
 }
 
@@ -866,16 +885,20 @@ type dirJob struct {
 }
 
 // walkEvent is one walk result delivered to the walk phase: a regular
-// file's statted record, or a warning when fail is set.
+// file's statted record, a warning when fail is set, or, when
+// otherFSDir is set, a directory -x did not enter because it is on
+// another filesystem than its operand.
 type walkEvent struct {
-	rec  fileRec
+	rec        fileRec
-	warn string
+	warn       string
-	fail bool
+	fail       bool
+	otherFSDir string
 }
 
 // startWalk seeds every root into the shared walk worker pool and
 // returns the event stream: one record per regular file, one warning
-// event per per-path error. The channel is closed when the walk
+// event per per-path error, and one event per directory -x did not
+// enter. The channel is closed when the walk
 // completes, and also when ctx is cancelled — every goroutine in the
 // pool abandons its blocking send in that case, so the consumer sees a
 // truncated but properly terminated stream instead of a stalled one.
@@ -1144,7 +1167,8 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 // subdirJob applies the descent rules to directory p: never enter
 // .zfs (ZFS snapshot pseudo-dirs would list every file once per
 // snapshot), and with -x never enter a directory on a different
-// filesystem than its operand.
+// filesystem than its operand, sending an event that names it so the
+// scan keeps the records below it.
 func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	parent dirJob, oneFS bool, events chan<- walkEvent,
 ) (dirJob, bool) {
@@ -1168,6 +1192,8 @@ func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	}
 
 	if dev, ok := deviceOfInfo(info); ok && dev != parent.rootDev {
+		sendEvent(ctx, events, walkEvent{otherFSDir: p})
+
 		return dirJob{}, false
 	}
 

scan_test.go

@@ -997,7 +997,7 @@ func dirEntryFor(t *testing.T, dir, name string) fs.DirEntry {
 }
 
 // callSubdirJob runs subdirJob against e under parent, collecting any
-// warning events it emits (subdirJob emits at most one).
+// events it emits (subdirJob emits at most one).
 func callSubdirJob(t *testing.T, p string, e fs.DirEntry,
 	parent dirJob, oneFS bool,
 ) (dirJob, bool, []walkEvent) {
@@ -1075,8 +1075,15 @@ func TestSubdirJobOneFilesystem(t *testing.T) {
 				t.Fatalf("accepted = %v, want %v", ok, tc.wantOK)
 			}
 
-			if len(evs) != 0 {
+			// A refused descent names the directory, so the scan keeps
-				t.Fatalf("unexpected events: %+v", evs)
+			// the records below it.
+			var wantEvs []walkEvent
+			if !ok {
+				wantEvs = []walkEvent{{otherFSDir: sub}}
+			}
+
+			if !slices.Equal(evs, wantEvs) {
+				t.Fatalf("events = %+v, want %+v", evs, wantEvs)
 			}
 
 			// The accepted job must carry the operand's device down, or -x
@@ -1128,6 +1135,84 @@ func TestSubdirJobStatError(t *testing.T) {
 	}
 }
 
+// TestScanOneFilesystemKeepsOtherFilesystemRecords checks that with -x a
+// record below a directory the walk does not enter, because it is on
+// another filesystem than its operand, counts as outside the operands:
+// it is not deleted, and its size joins the size census. The record of
+// a gone file that is not below that directory is still deleted, even
+// when its path begins with the directory's name. The walk starts from
+// an operand device that no directory here is on, so no second real
+// filesystem is needed; the phases after it run as runPhases runs them.
+func TestScanOneFilesystemKeepsOtherFilesystemRecords(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+
+	// A scan without -x records the file below mnt, and mnt2, which is
+	// beside mnt, not below it.
+	mounted := writeFile(t, dir, "mnt/f", pattern(1, 100))
+	gone := writeFile(t, dir, "mnt2", pattern(3, 50))
+	syncTree(t, db, dir)
+
+	err := os.Remove(gone)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The same size as mnt/f, so it is hashed only if mnt/f's size is
+	// in the census.
+	added := writeFile(t, dir, "added", pattern(2, 100))
+
+	info, err := os.Lstat(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dev, ok := deviceOfInfo(info)
+	if !ok {
+		t.Skip("platform exposes no device id")
+	}
+
+	ctx := t.Context()
+	s := &scanState{db: db}
+
+	err = s.loadIndex(ctx, []string{dir})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jobs, subdirs, events := startWalkWorkers(ctx, 2, true)
+	root := dirJob{path: dir, rootDev: dev + 1, rootDevOK: true}
+	dispatchDirs(ctx, []dirJob{root}, jobs, subdirs)
+
+	changed, unhashed := s.walkPhase(events)
+	s.partition(changed, unhashed)
+
+	err = s.hashPhase(ctx, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = s.updatePhase(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	recs := dbRecords(t, db)
+	recordByPath(t, recs, mounted)
+
+	if recordByPath(t, recs, added).head == "" {
+		t.Errorf("%s not hashed: the census lacks the size of %s",
+			added, mounted)
+	}
+
+	if slices.Contains(recordPaths(recs), gone) {
+		t.Errorf("record for %s kept: the file is gone and not below mnt",
+			gone)
+	}
+}
+
 // buildSmokeTree recreates the README smoke-test filesystem layout
 // with deterministic content and returns the tree root.
 func buildSmokeTree(t *testing.T) string {