Rewrite TODO.md sentence by sentence (closes #135)

Rewrites `TODO.md` from scratch for
#135, by the rules applied to
`README.md` in #140. It is the
project's own task list, so every completed step keeps its date, its
issue or branch and every fact that the old entry recorded, in short
sentences, with lists as bullets. An entry superseded later says so in
one sentence.

`TODO.md` records history, so its entries were not corrected against the
code. The 2026-10-17 release-rule entry is known to be stale. One product
name in the 2026-10-15 entry is replaced by a description.

This file carries the `TODO.md` entry of
#140 word for word, so the
conflict once that merges is resolved by taking this file whole.

Model: fable-5-1

README.md

@@ -461,17 +461,26 @@ exclude, is not on a persistent filesystem (see "Rules for the walk"), or, with
 `-x`, is on a different filesystem than that operand, because that operand's
 walk does not enter such a directory and so does not reach it.
 
-An operand that is a symlink (never followed, not even as an operand), socket,
-FIFO, or device node, or a directory named `.zfs`, is not scanned. `scan` prints
-a one-line warning naming the path and what it is, counts it as skipped, and
-drops it from the scanned operands before reading the database. Another operand
-beneath it is still scanned. The records stored beneath it are not deleted: they
-are treated like any other record outside the scanned operands. If it lies under
-another operand, they are under that operand instead, and are treated like any
-other record there. This is not an error: a scan whose every operand is dropped
-walks nothing and exits 0. An operand that is not on a persistent filesystem
-(see "Rules for the walk") is dropped the same way. The line `scan` prints for
-it is not a warning, though, and it is not counted as skipped.
+An operand is not scanned when it is:
+
+- a symlink, which `scan` never follows, not even as an operand;
+- a socket, FIFO or device node;
+- at or inside a directory named `.zfs`.
+
+An operand reached through a symlink into a `.zfs` directory is not scanned
+either.
+
+This holds even when the operand lies under another operand. `scan` prints a
+one-line warning naming the path and what it is, counts it as skipped, and drops
+it from the scanned operands before reading the database. An operand beneath a
+symlink operand is still scanned. The records stored beneath the dropped operand
+are not deleted: they are treated like any other record outside the scanned
+operands. If it lies under another operand, they are under that operand instead,
+and are treated like any other record there. This is not an error: a scan whose
+every operand is dropped walks nothing and exits 0. An operand that is not on a
+persistent filesystem (see "Rules for the walk") is dropped the same way. The
+line `scan` prints for it is not a warning, though, and it is not counted as
+skipped.
 
 `scan` synchronizes the database with the filesystem state under the scanned
 operands:
@@ -633,10 +642,10 @@ Rules for the walk:
   is accepted: the database mirrors what the latest scan could actually verify.
   The exception is an operand dropped before the database was read, whose record
   counts as outside the scanned operands.
-- A file or directory removed before the scan reaches it is not an error. The
-  scan prints no line for it and does not count it as skipped. That holds in the
-  walk, and in the hash phase for a file removed since the walk. Such a path
-  gets no record, and the records an earlier scan left at or below it are
+- A file or directory removed while the scan runs is not an error. The scan
+  prints no line for it and does not count it as skipped. A path gone when the
+  walk reaches it gets no record. A file gone when the hash phase opens it gets
+  none either. The records an earlier scan left at or below such a path are
   deleted.
 
 Concurrency: the walk phase, which also stats files, and the hash phase each use
@@ -837,9 +846,9 @@ A scan has four phases (`[1/4] load`, `[2/4] walk`, `[3/4] hash`,
 - `load` counts the records first, then reads them against that count. While the
   count runs, the display says it is counting the records.
 - `walk` has no exact total. Its estimate is the number of records the last scan
-  left under the operands, known once `load` is done and shown with a `~`. Once
-  the walk passes the estimate, or when there are no such records, as on a first
-  scan, the time remaining is unknown.
+  left under the operands, known once `load` is done and shown with a `~`. The
+  time remaining is unknown once the walk passes the estimate, and when there
+  are no such records, as on a first scan.
 - `hash` and `update` have exact totals. Only files that actually need hashing
   appear in the hash total, so its time remaining is meaningful.
 
@@ -913,8 +922,8 @@ Additional requirements:
 - On a terminal, a phase with an exact total ends its line with its percent and
   a bar 10 columns wide. This percent takes the place of the line's own. The bar
   stays at the terminal's right edge, so it does not move as the line grows or
-  shrinks. Every phase has an exact total once it has counted what it will do,
-  except these:
+  shrinks. A phase with nothing to do shows no bar. Every phase has an exact
+  total once it has counted what it will do, except these:
     - `scan`'s `walk`;
     - the `open` phase of `report` and `trees`;
     - both phases of `info`.
@@ -926,23 +935,22 @@ Additional requirements:
     ```
 
 - On a terminal no line reaches the terminal's last column, however narrow the
-  terminal is. A line too wide for the terminal first loses its bar. Next it
-  loses whichever of these it shows: its rate, the words of a stalled phase, or
-  what the phase is waiting for. The other four parts are kept whole:
+  terminal is. A line too wide for the terminal first loses whichever of these
+  it shows: its rate, the words of a stalled phase, or what the phase is waiting
+  for. The other four parts are kept whole:
     - the phase and its place;
     - the progress;
     - the elapsed time;
     - the time remaining.
 
-    The line is cut short at the terminal's edge only when those four alone are
-    too wide, and then the end of the time remaining is lost first. That happens
-    hours into a scan of millions of files, on a terminal narrower than about 75
-    columns. On an 80-column terminal, the stalled line of the example above
-    keeps its words. Where the words and the time remaining do not both fit, as
-    at millions of files and times in hours, the words give way. A terminal made
-    narrower while a phase runs gets the same: the next draw erases the line
-    within the new width and fits the line to it, and the display goes on
-    redrawing in place.
+    The line loses its bar only when those four and the bar do not fit. It is
+    cut short at the terminal's edge only when those four alone are too wide,
+    and then the end of the time remaining is lost first. That happens hours
+    into a scan of millions of files, on a terminal narrower than about 75
+    columns. On a terminal 100 columns wide, the stalled line of the example
+    above keeps its words and its bar. The next draw fits the line to a terminal
+    made narrower while a phase runs. It erases the old line within the new
+    width, and the display goes on redrawing in place.
 
 - When stderr is not a terminal (a pipe, a file, `/dev/null`), do not emit ANSI
   redraws: print the line the moment each phase starts, every 5 seconds while it

main_test.go

@@ -928,24 +928,21 @@ func TestRunScanWalksOperandUnderSymlinkOperand(t *testing.T) {
 }
 
 func TestRunScanSkipsZFSOperand(t *testing.T) {
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
-
 	zfs := filepath.Join(t.TempDir(), ".zfs")
-	snapshot := filepath.Join(zfs, "snapshot", "hourly")
-	f := writeFile(t, snapshot, "f", pattern(1, 10))
+	f := writeFile(t, zfs, "snapshot/hourly/f", pattern(1, 10))
 
-	// An operand beneath a .zfs directory is walked, because it is not
-	// itself named .zfs.
-	scanOK(t, snapshot)
+	// No scan records a file inside a .zfs directory, so the record
+	// beneath the operand is written straight into the database.
+	path := seedDatabase(t, []scanRec{{size: 10, path: f}})
+	t.Setenv(databaseEnv, path)
 
 	assertOperandSkipped(t, path, zfs, ".zfs directory", f)
 }
 
 // assertOperandSkipped scans operand alone and checks that it is skipped
 // as kind: a warning naming it, one skip in the summary, exit 0, and the
-// record for kept, which an earlier scan stored beneath operand, still
-// in the database at dbPath.
+// record for kept, stored beneath operand before this scan, still in the
+// database at dbPath.
 func assertOperandSkipped(t *testing.T, dbPath, operand, kind,
 	kept string,
 ) {
@@ -974,6 +971,121 @@ func assertOperandSkipped(t *testing.T, dbPath, operand, kind,
 	recordByPath(t, dbRecords(t, db), kept)
 }
 
+// TestRunScanSkipsOperandInsideZFS scans a directory inside a .zfs
+// directory, first alone and then under another operand. Each time it
+// is warned about and counted as skipped, and nothing in it is walked.
+// The other operand is scanned as usual.
+func TestRunScanSkipsOperandInsideZFS(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := t.TempDir()
+	hourly := filepath.Join(dir, ".zfs", "snapshot", "hourly")
+	writeFile(t, hourly, "f", pattern(1, 10))
+	f := writeFile(t, dir, "f", pattern(2, 10))
+
+	warning := "walk " + hourly + ": skipping operand inside a .zfs directory\n"
+
+	for _, tc := range []struct {
+		operands []string
+		summary  string
+	}{
+		{
+			[]string{hourly},
+			"scan: 0 files seen (0 added, 0 updated, 0 removed, " +
+				"0 unchanged), 1 skipped\n",
+		},
+		{
+			[]string{dir, hourly},
+			"scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+				"0 unchanged), 1 skipped\n",
+		},
+	} {
+		stderr := scanOK(t, tc.operands...)
+		if !strings.Contains(stderr, warning) ||
+			!strings.Contains(stderr, tc.summary) {
+			t.Errorf("scan %q: stderr = %q, want %q and %q", tc.operands,
+				stderr, warning, tc.summary)
+		}
+	}
+
+	db, err := openDB(path, reportParams)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() { _ = db.Close() })
+
+	if got := recordPaths(dbRecords(t, db)); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
+// TestRunScanSkipsOperandThroughSymlinkIntoZFS scans snaps/daily, where
+// snaps is a symlink to pool/.zfs/snapshot. The operand is warned about
+// by the path given, counted as skipped, and not walked.
+func TestRunScanSkipsOperandThroughSymlinkIntoZFS(t *testing.T) {
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	dir := t.TempDir()
+	writeFile(t, dir, "pool/.zfs/snapshot/daily/f", pattern(1, 10))
+
+	snaps := filepath.Join(dir, "snaps")
+
+	err := os.Symlink(filepath.Join(dir, "pool", ".zfs", "snapshot"), snaps)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	daily := filepath.Join(snaps, "daily")
+	stderr := scanOK(t, daily)
+
+	warning := "walk " + daily + ": skipping operand inside a .zfs directory\n"
+	summary := "scan: 0 files seen (0 added, 0 updated, 0 removed, " +
+		"0 unchanged), 1 skipped\n"
+
+	if !strings.Contains(stderr, warning) ||
+		!strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q and %q", stderr, warning, summary)
+	}
+}
+
+// TestRunScanWalksOperandThroughSymlink scans data/daily, where data is
+// a symlink to a directory outside any .zfs directory. The operand is
+// scanned as usual, and its file is recorded by the path given.
+func TestRunScanWalksOperandThroughSymlink(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := t.TempDir()
+	writeFile(t, dir, "pool/data/daily/f", pattern(1, 10))
+
+	data := filepath.Join(dir, "data")
+
+	err := os.Symlink(filepath.Join(dir, "pool", "data"), data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	daily := filepath.Join(data, "daily")
+	stderr := scanOK(t, daily)
+
+	summary := "scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+		"0 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+
+	db, err := openDB(path, reportParams)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() { _ = db.Close() })
+
+	recordByPath(t, dbRecords(t, db), filepath.Join(daily, "f"))
+}
+
 func TestRunReportSucceeds(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)

progress.go

@@ -217,27 +217,13 @@ func (p *progress) draw() {
 	}
 
 	if p.width == nil {
-		fmt.Fprintln(os.Stderr, p.line(now, math.MaxInt, true))
+		fmt.Fprintln(os.Stderr, p.line(now, math.MaxInt, false))
 
 		return
 	}
 
 	width := p.width()
-	room := width - spinnerMargin
-	text := p.line(now, room, true)
-
-	// A phase with an exact total ends its text with its percent and bar
-	// when its whole line, without the percent the bar shows, fits beside
-	// them: the bar gives way before any part of the line. The line is
-	// padded to the room the bar leaves it, so the bar stays at the
-	// terminal's right edge however long the line is. A total of 0 leaves
-	// the bar nothing to fill.
-	if p.total > 0 && !p.estimate {
-		line := p.line(now, math.MaxInt, false)
-		if len(line) <= room-barColumns {
-			text = fmt.Sprintf("%-*s%s", room-barColumns, line, p.percentBar())
-		}
-	}
+	text := p.line(now, width-spinnerMargin, true)
 
 	// Before each draw the library erases its line with as many spaces as
 	// the widest line it has drawn. A display gets a new one when the
@@ -442,20 +428,24 @@ func (p *progress) finish() {
 //
 //	[3/4] hash: [1234/5000] 25%, 300 files/s, elapsed 4s, remain 13s
 //
-// where "files" is the phase's unit, without the percent when percent
-// is false, as before the bar, which shows its own. A phase with no
-// total shows the items done instead, or what it waits for. The rate is
-// that since the first draw in drawn, and the time remaining comes from
-// the rate since the count started. Once no item has been completed for
-// stallTime, the rate, which would read 0, gives way to the word
-// "stalled" and where the phase waits, as "stalled disk/db".
+// where "files" is the phase's unit. A phase with no total shows the
+// items done instead, or what it waits for. The rate is that since the
+// first draw in drawn, and the time remaining comes from the rate since
+// the count started. Once no item has been completed for stallTime, the
+// rate, which would read 0, gives way to the word "stalled" and where
+// the phase waits, as "stalled disk/db".
+//
+// When bar is true, as on a terminal, a phase with an exact total ends
+// the line with its percent and bar, in place of the percent after its
+// count. A total of 0 leaves the bar nothing to fill.
 //
 // The phase and its place, the progress, the elapsed time and the time
-// remaining are kept whole. A line wider than room leaves out the rate,
-// the words of a stalled phase, or what the phase waits for; only if it
-// is still wider is it cut at room. Every part is ASCII, so its length
-// is its width in columns. p.mu must be held.
-func (p *progress) line(now time.Time, room int, percent bool) string {
+// remaining are kept whole. A line wider than room first leaves out the
+// rate, the words of a stalled phase, or what the phase waits for. Next
+// it leaves out the bar. Only if it is still wider is it cut at room.
+// Every part but the bar is ASCII, so its length is its width in
+// columns. p.mu must be held.
+func (p *progress) line(now time.Time, room int, bar bool) string {
 	elapsed := now.Sub(p.start).Round(time.Second)
 
 	// head and tail hold the parts kept whole; extra, between them, is
@@ -470,7 +460,7 @@ func (p *progress) line(now time.Time, room int, percent bool) string {
 		rate := perSecond(p.count-since.count, now.Sub(since.at))
 		average := perSecond(p.count, now.Sub(p.rateStart))
 
-		head = p.label + ": " + p.itemsDone(percent) + ", "
+		head = p.label + ": " + p.itemsDone(true) + ", "
 		extra = fmt.Sprintf("%.0f %s/s, ", rate, p.unit)
 		tail = fmt.Sprintf("elapsed %s, remain %s", elapsed, p.remain(average))
 
@@ -479,6 +469,26 @@ func (p *progress) line(now time.Time, room int, percent bool) string {
 		}
 	}
 
+	if bar && p.total > 0 && !p.estimate {
+		// Beside the bar, which shows the percent, the count shows none.
+		// The line is padded to the room the bar leaves it, so the bar
+		// stays at room's right edge however long the line is.
+		beside := room - barColumns
+		barHead := p.label + ": " + p.itemsDone(false) + ", "
+
+		switch {
+		case len(barHead+extra+tail) <= beside:
+			return fmt.Sprintf("%-*s%s", beside, barHead+extra+tail,
+				p.percentBar())
+		case len(barHead+tail) <= beside:
+			return fmt.Sprintf("%-*s%s", beside, barHead+tail, p.percentBar())
+		}
+
+		// The bar gives way. The rate, or the words of a stalled phase,
+		// gave way before it and stay out.
+		extra = ""
+	}
+
 	full, kept := head+extra+tail, head+tail
 
 	switch {

progress_test.go

@@ -163,7 +163,7 @@ func TestProgressLine(t *testing.T) {
 		tc.p.start, tc.p.rateStart, tc.p.lastItem = ago, ago, now
 		tc.p.drawn = []drawnCount{{at: ago}}
 
-		if got := tc.p.line(now, math.MaxInt, true); got != tc.want {
+		if got := tc.p.line(now, math.MaxInt, false); got != tc.want {
 			t.Errorf("line = %q, want %q", got, tc.want)
 		}
 	}
@@ -198,39 +198,40 @@ func TestLineFitsRoom(t *testing.T) {
 	}
 
 	cases := []struct {
-		p       *progress
-		room    int
-		percent bool
-		want    string
+		p    *progress
+		room int
+		bar  bool
+		want string
 	}{{
-		p: hash, room: 60, percent: true,
+		p: hash, room: 60,
 		want: "[3/4] hash: [20/100] 20%, 2 files/s, elapsed 10s, remain 40s",
 	}, {
-		p: hash, room: 59, percent: true,
+		p: hash, room: 59,
 		want: "[3/4] hash: [20/100] 20%, elapsed 10s, remain 40s",
 	}, {
-		p: hash, room: 48, percent: true,
+		p: hash, room: 48,
 		want: "[3/4] hash: [20/100] 20%, elapsed 10s, remain 40",
 	}, {
-		// Before the bar, which shows the percent.
-		p: hash, room: 60, percent: false,
-		want: "[3/4] hash: [20/100], 2 files/s, elapsed 10s, remain 40s",
+		// The bar shows the percent.
+		p: hash, room: 74, bar: true,
+		want: "[3/4] hash: [20/100], 2 files/s, elapsed 10s, remain 40s" +
+			"  20% |██        |",
 	}, {
-		p: load, room: 43, percent: true,
+		p: load, room: 43,
 		want: "[1/4] load: elapsed 10s, remain unknown",
 	}, {
-		p: stalled, room: 68, percent: true,
+		p: stalled, room: 68,
 		want: "[3/4] hash: [20/100] 20%, stalled disk/db, elapsed 50s, " +
 			"remain 3m20s",
 	}, {
-		p: stalled, room: 67, percent: true,
+		p: stalled, room: 67,
 		want: "[3/4] hash: [20/100] 20%, elapsed 50s, remain 3m20s",
 	}}
 
 	for _, tc := range cases {
-		if got := tc.p.line(now, tc.room, tc.percent); got != tc.want {
-			t.Errorf("line(%d, %t) = %q, want %q",
-				tc.room, tc.percent, got, tc.want)
+		if got := tc.p.line(now, tc.room, tc.bar); got != tc.want {
+			t.Errorf("line(%d, %t) = %q, want %q", tc.room, tc.bar, got,
+				tc.want)
 		}
 	}
 }
@@ -256,14 +257,14 @@ func TestSetTotalStartsRate(t *testing.T) {
 	clock.Add(5 * time.Second)
 
 	want := "[1/4] load: [0/100] 0%, 0 files/s, elapsed 25s, remain unknown"
-	if got := p.line(clock.Now(), math.MaxInt, true); got != want {
+	if got := p.line(clock.Now(), math.MaxInt, false); got != want {
 		t.Errorf("line = %q, want %q", got, want)
 	}
 
 	clock.Add(5 * time.Second)
 
 	want = "[1/4] load: [0/100] 0%, stalled db, elapsed 30s, remain unknown"
-	if got := p.line(clock.Now(), math.MaxInt, true); got != want {
+	if got := p.line(clock.Now(), math.MaxInt, false); got != want {
 		t.Errorf("line = %q, want %q", got, want)
 	}
 
@@ -273,7 +274,7 @@ func TestSetTotalStartsRate(t *testing.T) {
 	}
 
 	want = "[1/4] load: [20/100] 20%, 2 files/s, elapsed 30s, remain 40s"
-	if got := p.line(clock.Now(), math.MaxInt, true); got != want {
+	if got := p.line(clock.Now(), math.MaxInt, false); got != want {
 		t.Errorf("line = %q, want %q", got, want)
 	}
 }
@@ -595,31 +596,32 @@ func TestTerminalLinesKeepTimeRemaining(t *testing.T) {
 	}
 }
 
-// TestTerminalStalledLines draws every phase's line on an 80-column
-// terminal once the phase has stalled, its last item done 42 seconds
-// before. At an ordinary scan's counts and times, 12345 of 45678 items
-// done four and a half minutes in, the line shows where the phase waits
-// whole, beside the phase, progress, elapsed time and time remaining.
-// At a large scan's, 1234567 of 9876543 two and a half hours in, those
-// four still show whole, as the words give way first where they do not
-// fit.
+// TestTerminalStalledLines draws every phase's line once the phase has
+// stalled, its last item done 42 seconds before. At an ordinary scan's
+// counts and times, 12345 of 45678 items done four and a half minutes
+// in, on a terminal 100 columns wide, the line shows where the phase
+// waits whole, beside the phase, progress, elapsed time and time
+// remaining. At a large scan's, 1234567 of 9876543 two and a half hours
+// in, on an 80-column terminal, those four still show whole, as the
+// words give way first where they do not fit.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestTerminalStalledLines(t *testing.T) {
 	stderr := captureStderr(t)
 
-	// drawStalled draws the display params describes as it starts and
-	// once more as it ends, with count of total items done elapsed into
-	// the phase, and returns what the terminal shows.
-	drawStalled := func(params progressParams, total, count int64,
-		elapsed time.Duration,
+	// drawStalled draws the display params describes on a terminal width
+	// columns wide as it starts and once more as it ends, with count of
+	// total items done elapsed into the phase, and returns what the
+	// terminal shows.
+	drawStalled := func(params progressParams, width int, total,
+		count int64, elapsed time.Duration,
 	) string {
 		before := len(stderr())
 		clock := &testClock{now: time.Now()}
 		params.total = total
 
 		// No timed draws come between the two.
-		p := startProgress(params, func() int { return 80 }, time.Hour,
+		p := startProgress(params, func() int { return width }, time.Hour,
 			clock.Now)
 
 		clock.Add(elapsed - 42*time.Second)
@@ -651,16 +653,19 @@ func TestTerminalStalledLines(t *testing.T) {
 			approx = "~"
 		}
 
-		shown := drawStalled(params, 45678, 12345,
+		// The percent is in the line, or beside the bar.
+		shown := drawStalled(params, 100, 45678, 12345,
 			4*time.Minute+30*time.Second)
-		want := params.label + ": [12345/" + approx + "45678] 27%, stalled " +
-			params.stalledOn + ", elapsed 4m30s, remain 12m9s"
-
-		if !strings.Contains(shown, want) {
-			t.Errorf("terminal shows %q, want %q", shown, want)
+		for _, want := range []string{
+			params.label + ": [12345/" + approx + "45678]",
+			", stalled " + params.stalledOn + ", elapsed 4m30s, remain 12m9s",
+		} {
+			if !strings.Contains(shown, want) {
+				t.Errorf("terminal shows %q, want %q", shown, want)
+			}
 		}
 
-		shown = drawStalled(params, 9876543, 1234567, 150*time.Minute)
+		shown = drawStalled(params, 80, 9876543, 1234567, 150*time.Minute)
 		for _, want := range []string{
 			params.label + ": [1234567/" + approx + "9876543] 12%, ",
 			", elapsed 2h30m0s, remain 17h30m0s",
@@ -738,9 +743,12 @@ func TestTerminalLinesStartWithSpinner(t *testing.T) {
 
 // TestTerminalBarStaysAtRightEdge draws the hash phase's display two
 // and a half hours in, at two counts whose lines differ in length, on
-// terminals 110 and 120 columns wide. Its bar must start the same number
-// of columns from the terminal's right edge each time: a line that grows
-// or shrinks, as its time remaining does, never moves the bar.
+// terminals 110 and 120 columns wide. The bar is partly filled at the
+// first count and full at the second. It must start the same number of
+// columns from the terminal's right edge each time, and end the same
+// number of columns from it: a line that grows or shrinks, as its time
+// remaining does, never moves the bar, and nor do the bar's filled
+// cells.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestTerminalBarStaysAtRightEdge(t *testing.T) {
@@ -751,7 +759,8 @@ func TestTerminalBarStaysAtRightEdge(t *testing.T) {
 
 	widths := []int{110, 120}
 	counts := []int64{1234567, 9876543}
-	fromEdge := make([]int, 0, len(widths)*len(counts))
+	startFromEdge := make([]int, 0, len(widths)*len(counts))
+	endFromEdge := make([]int, 0, len(widths)*len(counts))
 
 	for _, width := range widths {
 		for _, count := range counts {
@@ -762,14 +771,96 @@ func TestTerminalBarStaysAtRightEdge(t *testing.T) {
 				t.Fatalf("terminal %d wide shows %q, want a bar", width, shown)
 			}
 
-			fromEdge = append(fromEdge,
+			// The bar ends with the last "|".
+			throughBar := shown[:strings.LastIndex(shown, "|")+1]
+
+			startFromEdge = append(startFromEdge,
 				width-utf8.RuneCountInString(beforeBar))
+			endFromEdge = append(endFromEdge,
+				width-utf8.RuneCountInString(throughBar))
 		}
 	}
 
-	if slices.Min(fromEdge) != slices.Max(fromEdge) {
+	if slices.Min(startFromEdge) != slices.Max(startFromEdge) {
 		t.Errorf("bar starts %v columns from the right edge, want the same "+
-			"every time", fromEdge)
+			"every time", startFromEdge)
+	}
+
+	if slices.Min(endFromEdge) != slices.Max(endFromEdge) {
+		t.Errorf("bar ends %v columns from the right edge, want the same "+
+			"every time", endFromEdge)
+	}
+}
+
+// TestTerminalRateGivesWayBeforeBar draws the hash phase's display two
+// and a half hours in. On a terminal 90 columns wide the line fits
+// beside the bar without its rate, but not with it: the bar is drawn
+// and the rate is not. On a terminal 85 columns wide the line does not
+// fit beside the bar even without its rate: neither is drawn, though
+// the rate would fit where the bar was.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalRateGivesWayBeforeBar(t *testing.T) {
+	stderr := captureStderr(t)
+	params := progressParams{
+		label: scanPhase("hash"), unit: scanUnit, total: 9876543,
+	}
+
+	shown := lastFrame(drawLate(stderr, params, 90, 1234567))
+	if !strings.Contains(shown, "% |") || strings.Contains(shown, "files/s") {
+		t.Errorf("terminal 90 wide shows %q, want the bar and no rate", shown)
+	}
+
+	shown = lastFrame(drawLate(stderr, params, 85, 1234567))
+	if strings.Contains(shown, "% |") || strings.Contains(shown, "files/s") {
+		t.Errorf("terminal 85 wide shows %q, want neither bar nor rate", shown)
+	}
+}
+
+// TestTerminalSpinnerTurnsBesideBar draws the hash phase's display, its
+// bar partly filled, several times on a terminal 120 columns wide. The
+// spinner must turn at every draw. A filled cell of the bar takes one
+// column but three bytes. A line measured in bytes would seem too wide
+// for the terminal, and every draw would start the display over, its
+// spinner included.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalSpinnerTurnsBesideBar(t *testing.T) {
+	stderr := captureStderr(t)
+	params := progressParams{
+		label: scanPhase("hash"), unit: scanUnit, total: 9876543,
+	}
+
+	// No timed draws: the test draws.
+	p := startProgress(params, func() int { return 120 }, time.Hour,
+		time.Now)
+
+	p.mu.Lock()
+	p.count = 1234567
+	p.mu.Unlock()
+
+	const draws = 4
+
+	spinners := make([]string, 0, draws)
+
+	for range draws {
+		before := len(stderr())
+
+		p.draw()
+
+		spinner, _, _ := strings.Cut(lastFrame(stderr()[before:]), " ")
+		spinners = append(spinners, spinner)
+	}
+
+	p.finish()
+
+	for i := 1; i < len(spinners); i++ {
+		if spinners[i] == spinners[i-1] {
+			t.Errorf("spinners at successive draws are %q, want each to "+
+				"differ from the one before", spinners)
+
+			break
+		}
 	}
 }
 
@@ -797,7 +888,7 @@ func TestTerminalNarrowedRedrawsInPlace(t *testing.T) {
 			progressParams{
 				label: scanPhase("hash"), unit: scanUnit, total: 9876543,
 			},
-			90,
+			80,
 		},
 	}
 

scan.go

@@ -383,7 +383,8 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 ) error {
 	// Types and filesystems are checked before pruning so that an
 	// operand under a dropped one is still scanned, not dropped as lying
-	// under it.
+	// under it, and so that an operand inside a .zfs directory gets its
+	// warning even when it lies under another operand.
 	roots = pruneRoots(s.walkableRoots(roots, rules), oneFS, rules,
 		deviceOfPath)
 
@@ -411,15 +412,15 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 }
 
 // walkableRoots returns the operands the walk can start from: regular
-// files, and directories not named .zfs. Every other operand is warned
-// about, counted as skipped, and dropped. A dropped operand is no
-// longer a root, so the records stored beneath it are treated as if it
-// had not been given: those under no other root count as outside the
-// roots and are not deleted as unverified. An operand on a filesystem
-// in rules that is not persistent is dropped the same way, with a line
-// saying so that is not a warning, and is not counted as skipped. An
-// operand that fails lstat here is kept, and the walk warns about it
-// unless it no longer exists.
+// files, and directories not named .zfs, none of them inside a
+// directory named .zfs. Every other operand is warned about, counted as
+// skipped, and dropped. A dropped operand is no longer a root, so the
+// records stored beneath it are treated as if it had not been given:
+// those under no other root count as outside the roots and are not
+// deleted as unverified. An operand on a filesystem in rules that is not
+// persistent is dropped the same way, with a line saying so that is not
+// a warning, and is not counted as skipped. An operand that fails lstat
+// here is kept, and the walk warns about it unless it no longer exists.
 func (s *scanState) walkableRoots(roots []string, rules walkRules) []string {
 	kept := make([]string, 0, len(roots))
 
@@ -874,9 +875,24 @@ func sendEvent(ctx context.Context, events chan<- walkEvent,
 
 // operandWarning returns the one-line warning for an operand the walk
 // does not start from, naming the path and what it is, or "" for one it
-// does: a regular file, or a directory not named .zfs. Symlinks are
-// never followed, including as operands.
+// does: a regular file, or a directory not named .zfs, that is not
+// inside a directory named .zfs, neither as given nor with its symlinks
+// resolved. Symlinks are never followed, including as operands.
 func operandWarning(root string, fi fs.FileInfo) string {
+	// The walk never enters a .zfs directory, so it starts from nothing
+	// inside one either, not even through a symlink. An operand whose
+	// symlinks cannot be resolved is checked as given.
+	resolved, err := filepath.EvalSymlinks(root)
+	if err != nil {
+		resolved = root
+	}
+
+	if slices.Contains(strings.Split(filepath.Dir(root), "/"), ".zfs") ||
+		slices.Contains(strings.Split(filepath.Dir(resolved), "/"), ".zfs") {
+		return fmt.Sprintf("walk %s: skipping operand inside a .zfs directory",
+			root)
+	}
+
 	var kind string
 
 	switch mode := fi.Mode(); {

scan_test.go

@@ -726,6 +726,65 @@ func TestWalkPassesOverRemovedPaths(t *testing.T) {
 	}
 }
 
+// TestScanWarnsAboutUnreadablePaths checks that a permission error is
+// still warned about and counted as skipped, unlike a removed path. The
+// walk reaches an unreadable directory, and a file in a directory that
+// can be read but not searched. Another such file is an operand.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestScanWarnsAboutUnreadablePaths(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores file permissions")
+	}
+
+	stderr := captureStderr(t)
+	dir := t.TempDir()
+	tree := filepath.Join(dir, "tree")
+	walked := writeFile(t, tree, "unsearchable/f", []byte("x"))
+	operand := writeFile(t, dir, "unsearchable/f", []byte("y"))
+	unreadable := filepath.Join(tree, "unreadable")
+
+	err := os.Mkdir(unreadable, 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	modes := map[string]fs.FileMode{
+		unreadable:            0,
+		filepath.Dir(walked):  0o400,
+		filepath.Dir(operand): 0o400,
+	}
+
+	for p, mode := range modes {
+		err = os.Chmod(p, mode)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// Runs before t.TempDir's own cleanup, which must delete the files.
+		t.Cleanup(func() {
+			//nolint:gosec // removing the files needs the search bit back
+			_ = os.Chmod(p, 0o700)
+		})
+	}
+
+	st := syncTree(t, openTestDB(t), tree, operand)
+	if st != (scanStats{skipped: 3}) {
+		t.Errorf("stats = %+v, want 3 skipped and nothing else", st)
+	}
+
+	got := stderr()
+	for _, warning := range []string{
+		"walk " + unreadable + ": open " + unreadable + ": permission denied\n",
+		"stat " + walked + ": lstat " + walked + ": permission denied\n",
+		"walk " + operand + ": lstat " + operand + ": permission denied\n",
+	} {
+		if !strings.Contains(got, warning) {
+			t.Errorf("stderr = %q, want %q", got, warning)
+		}
+	}
+}
+
 // syncOneFilesystem scans roots into db with -x and returns the scan
 // stats. Every device pruneRoots looks up, and the device each
 // operand's walk compares its subdirectories with, comes from devices