Say "skipped" in scan's warnings for skipped paths (closes #170)

A warning for a path the summary counts as skipped now reads
`scan: skipped PATH (REASON)`, naming the path once. This covers
unreadable directories, failed lstats, failed reads and dropped
operands. Each path of a hard-linked file that cannot be read gets its
own line, since each is counted. Lines for paths left out on purpose
(`--exclude`, default excludes, filesystems that are not persistent)
now read `scan: left out PATH (...)`, so a search for `scan: skipped`
finds only the counted paths.

Model: opus-5-5

Makefile

@@ -4,7 +4,7 @@ export CGO_ENABLED = 0
 
 BINARY := sfdupes
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
-LDFLAGS := -X main.Version=$(VERSION)
+LDFLAGS := -X sneak.berlin/go/sfdupes/internal/sfdupes.Version=$(VERSION)
 
 .PHONY: sfdupes build bootstrap setup test lint fmt fmt-check check docker hooks clean
 
@@ -14,7 +14,7 @@ LDFLAGS := -X main.Version=$(VERSION)
 # Default target: build the binary. Phony so go build (which has its
 # own build cache) always decides what to recompile.
 sfdupes:
-	go build -ldflags "$(LDFLAGS)" -o $(BINARY)
+	go build -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/sfdupes
 
 build: sfdupes
 

TODO.md

@@ -1,559 +1,33 @@
 # Workflow
 
-- take an issue from the `1.0.0` milestone on the tracker; work not yet on the
-  tracker gets filed as an issue first
-- branch from `next`
-- do the work, with tests, in small focused commits
-- record it at the top of Completed Steps (`TODO.md` changes in the same commit
-  as the work)
-- push the branch and open a PR against `next` whose title ends with
-  ` (closes #N)`
-- an independent review gates each merge to `next`; every finding is addressed
-  or explicitly rebutted on the PR
-- only the owner merges `next` to `main`
+- Take an issue from the `1.0.0` milestone on the tracker. Work that is not on
+  the tracker yet is filed as an issue first.
+- Branch from `next`.
+- Do the work, with tests, in small focused commits.
+- Delete Next Step from `TODO.md`, in the same commit as the work.
+- Push the branch and open a PR against `next`. Its title ends with
+  ` (closes #N)`.
+- An independent review gates each merge to `next`. Every finding is addressed
+  or rebutted on the PR.
+- Only the owner merges `next` into `main`.
 
 # Status
 
-- pre-1.0
-- the Gitea tracker is authoritative for the pre-1.0 backlog: the open issues
-  under the `1.0.0` milestone are what remains before the tag, and this file
-  records history and process, not the queue
+- Pre-1.0.
+- The tracker is authoritative for the pre-1.0 backlog. The open issues under
+  the `1.0.0` milestone are what remains before the tag.
 
 # Next Step
 
-- take the next issue from the `1.0.0` milestone on the tracker:
-  https://git.eeqj.de/sneak/sfdupes/milestone/17 — the milestone is the source
-  of truth for what is left before 1.0.0. Individual issues are deliberately not
-  restated here; a copy in this file drifts out of date the moment the tracker
-  moves
-
-# Completed Steps
-
-- an operand under another is walked on its own when a directory between them,
-  the inner operand included, is named `.zfs` or is a symlink. The walk of the
-  outer operand does not reach it then. `scan` now records the files below it
-  and no longer deletes their records (2026-10-26,
-  https://git.eeqj.de/sneak/sfdupes/issues/142)
-
-- a file or directory removed while the scan runs is not an error, in the walk
-  or in the hash phase. The scan prints no line for it and does not count it as
-  skipped. When the first of several hard links to a file is gone, the hash
-  phase reads the next one instead. On a terminal every progress display starts
-  with the spinner, the hash phase's included. A phase with an exact total ends
-  its line with its percent and a 10-column bar at the terminal's right edge,
-  which no longer moves as the line's length changes. A line too wide for the
-  terminal now loses its rate before its bar. The time remaining is labelled
-  `remain`, not `eta` (2026-10-26, https://git.eeqj.de/sneak/sfdupes/issues/133)
-
-- the `head`, `tail` and `content` columns are BLOBs, each holding the raw 32
-  bytes of a SHA-256, half the size of the hex text they held. The hashes stay
-  raw from the hash phase through the database to `report` and `trees`. Reading
-  a record whose hash is not 32 bytes is an error (2026-10-26,
-  https://git.eeqj.de/sneak/sfdupes/issues/134)
-
-- the hash phase gives every file the walk records three hashes: `head` and
-  `tail`, the SHA-256 of its first and last 64 KiB, and `content`, the SHA-256
-  of the whole file under 100 MiB and of 1 MiB at each gigabyte from 100 MiB up.
-  The 10 MiB and 50 MiB thresholds, the size census, the records stored without
-  hashes and the content phase are gone, so a scan has four phases and a rescan
-  reads only new and changed files. `info` no longer counts the records with
-  hashes, since every record has them (2026-10-25,
-  https://git.eeqj.de/sneak/sfdupes/issues/132)
-
-- re-vendor `REPO_POLICIES.md` and the four scripts that pass `CACHEBUST` from
-  `sneak/prompts` `next` at `0653579`: in the `lint`, `test` and `builder`
-  stages of the `Dockerfile` the module download, and in `builder` the
-  system-package install, now come before `ARG CACHEBUST`, so Docker keeps them
-  until the base image, the install line, `go.mod` or `go.sum` changes, and
-  every step that lints, tests or compiles still comes after it;
-  `golangci-lint run` also keeps golangci-lint's cache. README says the same
-  (2026-10-18, https://git.eeqj.de/sneak/sfdupes/issues/109)
-
-- releases until 1.0 are `v0.0.N` tags on `main`'s tip, so
-  `go install sneak.berlin/go/sfdupes@latest` installs `main`'s tip once it has
-  passed the build; README "Install" says so, says what `@main` and `v0.0.1`
-  give, and how to check an installed binary. `go.mod` retracts `v0.0.1`, the
-  early build without a database. When the linker set no version,
-  `sfdupes --version` prints the main module's version that Go recorded in the
-  binary, the tag or the pseudo-version of a `go install` build, and `dev` only
-  when neither is known (2026-10-17,
-  https://git.eeqj.de/sneak/sfdupes/issues/116)
-
-- `scan` creates the database's directory where the database path leads: the
-  path with its last element cut off as text, never cleaned, so a `..` after a
-  symlinked directory is followed through the symlink, as when the file is
-  opened. With `SFDUPES_DATABASE=/srv/link/../new/db.sqlite` and `/srv/link` a
-  symlink to `/data/x`, it creates `/data/new` and the database in it, where it
-  used to create `/srv/new` and then fail (2026-10-17,
-  https://git.eeqj.de/sneak/sfdupes/issues/119)
-
-- `scan` never records its own database: once the database and its `.lock` file
-  are open, it notes the device and inode of the database file, its `-wal` and
-  `-shm` files and its `.lock` file, and the walk passes over a file with one of
-  them wherever the operands reach it, through a symlinked directory included,
-  printing no line and counting nothing. A record an earlier scan left for one
-  of them is deleted (2026-10-17, https://git.eeqj.de/sneak/sfdupes/issues/115)
-
-- `scan` never records or reads anything that is not on a persistent filesystem
-  (`tmpfs`, `proc`, `sysfs` and the other kernel or memory-backed types),
-  matched by the device ID of each such filesystem, listed as the scan starts
-  from `/proc/self/mountinfo` on Linux and the mounted-filesystem list on macOS,
-  however the walk or the content phase reaches it; no flag turns that off.
-  Below an operand, its walk does not enter the default excludes either, so
-  `sfdupes scan /` skips the kernel's view of the running system and the
-  temporary directories: on Linux `/proc`, `/sys`, `/dev`, `/run`, `/tmp` and
-  `/var/tmp`, on macOS `/dev`, `/private/tmp`, `/private/var/tmp`,
-  `/private/var/vm`, `/System/Volumes/VM` and `/System/Volumes/Data`, and a
-  Windows list, not used yet. An operand at or inside a default exclude is still
-  walked. The scan prints a line for each path it leaves out, without counting
-  it as skipped, and the records there count as outside the scanned operands, as
-  for `-x`. `--no-default-excludes` turns off the default excludes only, and
-  `scan --help` lists them (2026-10-17,
-  https://git.eeqj.de/sneak/sfdupes/issues/124)
-
-- the rate a progress display shows covers the items completed over the last 5
-  seconds, or since the line before when stderr is not a terminal, so it falls
-  to 0 while nothing completes, and a burst after a wait no longer reads as a
-  steady rate of over 1,000 files a second; the ETA still comes from the phase's
-  average. Once no item has completed for 10 seconds, the word `stalled` and
-  where the phase waits take the rate's place, as `stalled disk/db`: `disk`,
-  `db`, `out` for stdout or `cpu`, or two of them for a phase that may wait on
-  either, each phase giving its word where it is defined. A line too wide for
-  the terminal loses its bar first, then its rate or those words, so the phase,
-  progress, elapsed time and ETA stay whole. On an 80-column terminal, at counts
-  like those of README's example, the content phase's checks and reads lose
-  those words at most times in minutes, and every other phase keeps them
-  whenever the elapsed time and the ETA are both in minutes. The content phase's
-  last partial batch is now written under a display of its own (2026-10-16,
-  https://git.eeqj.de/sneak/sfdupes/issues/125)
-
-- new subcommand `info` prints the database's details on stdout, one per line as
-  a name, a tab and the value: its path and where it came from, the sizes of the
-  database file and of its `-wal` file when there is one, when the database file
-  was last changed, the schema version, the number of records, how many have
-  head and tail hashes and how many a content hash, and the sizes of all records
-  added up. It opens the database as `report` does, and shows two phases on
-  stderr, `[1/2] open` and `[2/2] count`; the schema version and the counts come
-  from one read-only transaction, the counts from one query (2026-10-16,
-  https://git.eeqj.de/sneak/sfdupes/issues/117)
-
-- `report` shows its work on stderr in two phases, `[1/2] open` and
-  `[2/2] read`, with the progress display `scan` and `trees` use, from the
-  moment it starts until the summary line: `open` says it is opening the
-  database, also while it waits on a busy one; `read` counts the records, then
-  reads them against that count in signature order, which SQLite takes from the
-  `files_signature` index without sorting, so the first record comes at once.
-  `report` forms the duplicate groups itself, holding only those of the size it
-  is reading, and writes them ordered by first path before it reads the next
-  size. stdout and the summary line are unchanged, and SQLite no longer needs a
-  temporary file to sort in (2026-10-16,
-  https://git.eeqj.de/sneak/sfdupes/issues/114)
-
-- `trees` shows its work on stderr in four phases, `[1/4] open`, `[2/4] read`,
-  `[3/4] group` and `[4/4] write`, each with the progress display `scan` uses,
-  from the moment it starts until the summary line: `open` says it is opening
-  the database, also while it waits on a busy one; `read` counts the records,
-  then reads them against that count; `group` counts the directories it groups,
-  and `write` the groups it writes. A display's rate names what its phase
-  counts: files, records, directories or groups. stdout and the summary line are
-  unchanged. When stdout and stderr are the same file, as one terminal is, none
-  of stdout's lines shares a line with the display; when they are not, the
-  display keeps being drawn while stdout waits on a slow reader (2026-10-16,
-  https://git.eeqj.de/sneak/sfdupes/issues/113)
-
-- each `scan` phase's progress display names the phase and its place among the
-  five, as `[2/5] walk`, from the moment it starts, with its progress, elapsed
-  time and ETA: `load` counts the records first, the walk's total is estimated
-  from the records under the operands, and the content phase counts the records
-  it checks from SQLite's grouping alone, then says it is searching the database
-  until the first one is returned. On a terminal a phase with an exact total
-  draws its line followed by the library's bar, and any other a spinner followed
-  by the line; every display is drawn again several times a second. No line
-  reaches the terminal's last column, however narrow, also after the terminal is
-  made narrower during a phase: a line too wide leaves out its rate, then its
-  bar, keeping the phase, progress, elapsed time and ETA whole, and is cut short
-  only when those alone do not fit, as below about 70 columns late in a large
-  scan. In plain mode the line is printed every 5 seconds whether or not an item
-  completed (2026-10-16, https://git.eeqj.de/sneak/sfdupes/issues/112)
-
-- `scan`, `report` and `trees` first print a line on stderr naming the database
-  they use, as an absolute path, and whether that path is the default or comes
-  from `SFDUPES_DATABASE`; `scan` says when the database is new. README
-  "Database" says when `scan` writes each file (2026-10-16,
-  https://git.eeqj.de/sneak/sfdupes/issues/111)
-
-- re-vendor the canonical files and model scripts from `sneak/prompts` `next` at
-  `e3f79c4`: golangci-lint v2.14.0; lint and test are phases of the `Dockerfile`
-  that write no image, and `make test` runs the suite under the race detector,
-  so `Dockerfile.lint`, `script/verify-lint-image-pin` and `make test-race` are
-  gone; every `docker build` in `script/` passes a new `CACHEBUST` value, which
-  every stage of the `Dockerfile` declares first, so every `RUN` step runs on
-  every build, while the steps that compile keep Go's build cache and the tests
-  run with `-count=1`; prettier runs on the host, from the node and yarn
-  `script/bootstrap` installs, so the `prettier` and `markdown` stages are gone
-  and the build stage installs `git` and `make` itself; a new push cancels the
-  workflow's older run on the same branch, and a run stops after 20 minutes;
-  `.claude/settings.json` is deleted (2026-10-15,
-  https://git.eeqj.de/sneak/sfdupes/issues/95). Since
-  https://git.eeqj.de/sneak/sfdupes/issues/109 the module download in `lint`,
-  `test` and the build stage, and the install of `git` and `make` in the build
-  stage, come before `ARG CACHEBUST`, and Docker keeps them between builds;
-  every step that lints, tests or compiles still runs on every build
-
-- with `-x`, an operand under another operand is walked on its own instead of
-  being dropped when a directory from it (from its directory, for a regular
-  file) up to but not including that operand is on a different filesystem than
-  that operand, whose walk then cannot reach it, and the records of files gone
-  from below it are deleted (2026-10-14,
-  https://git.eeqj.de/sneak/sfdupes/issues/106)
-
-- with `-x`, `scan` keeps the records below a directory on another filesystem
-  under its operand, and counts their sizes in the size census, instead of
-  deleting them (2026-10-14, https://git.eeqj.de/sneak/sfdupes/issues/99)
-
-- the hash and content phases open each file without blocking and check that it
-  is still a regular file, so one replaced by a FIFO or device node after it was
-  statted is warned about and skipped instead of hanging the scan (2026-10-14,
-  https://git.eeqj.de/sneak/sfdupes/issues/100)
-
-- the scan lock file is named from the database's path with symlinks resolved,
-  after `scan` creates the database file if it is missing, so a scan through a
-  symlink to the database fails while another scan holds the lock (2026-10-14,
-  https://git.eeqj.de/sneak/sfdupes/issues/101)
-
-- on a terminal, a warning for the last file of a phase no longer erases the
-  phase's finished bar: the bar is drawn again below the warning (2026-10-14,
-  https://git.eeqj.de/sneak/sfdupes/issues/102)
-
-- `scan` records mtime to the nanosecond, as whole seconds in `mtime` plus
-  `mtime_nsec`, and compares it at that resolution, so a same-size rewrite
-  within the same second is re-hashed (2026-10-07,
-  https://git.eeqj.de/sneak/sfdupes/issues/12)
-
-- cut the narration from `TODO.md` Completed Steps and from the comments in
-  `script/`, `Dockerfile` and `Dockerfile.lint` (gone since
-  https://git.eeqj.de/sneak/sfdupes/issues/95); §Workflow now branches from and
-  merges to `next` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/49)
-
-- `make test-race` ran the test suite under the race detector in a cgo-enabled
-  container, outside `make check` (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/18). Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 `make test` itself runs the suite
-  under the race detector, in the `Dockerfile`'s Debian-based `test` phase, and
-  `make test-race` is gone
-
-- a bare `docker build .` failed, naming `script/cibuild` and `script/docker`,
-  rather than serve the gates from cache (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/39). Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 a bare build succeeds, as
-  `REPO_POLICIES.md` requires, and may serve the gates from cache; the builds in
-  `script/` pass a new `CACHEBUST` value, so theirs always run
-
-- `make fmt` and `make fmt-check` run prettier over all Markdown, and CI checks
-  it; all Markdown reformatted (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/19)
-
-- `script/lint` writes no image, so a run no longer leaves an untagged one
-  behind (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/48)
-
-- tests cover a missing database, `scan` keeping stdout empty, its skip warning,
-  the `report` and `trees` summary lines, and every subcommand going through
-  `runE` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/16)
-
-- `.golangci.yml` replaced with the current canonical copy, which uses
-  `gomodguard_v2`, so lint no longer prints a deprecation warning (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/26)
-
-- a test fails when either `hashWorker` cancellation check in `scan.go` is
-  removed (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/83)
-
-- a database path holding `?`, `#` or `%` opens exactly the file it names
-  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/55)
-
-- `scan` rejects `--workers` below 1 as a usage error instead of running
-  single-threaded (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/10)
-
-- a test fails when either walk cancellation check in `scan.go` is removed
-  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/81)
-
-- test that `scan` refuses a database with another schema version (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/64)
-
-- correct four inaccurate comments in `cancel_test.go` and rename
-  `walkCancelInFlightDirs` to `walkCancelInFlightFiles` (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/33)
-
-- test the `-x` filesystem-boundary rules in `subdirJob` (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/17)
-
-- `scan` creates the schema in one transaction; a version-0 database with a
-  `files` table is refused with a clear schema-version error (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/11)
-
-- README documents install, Docker, a daily cron scan and how to read and check
-  the reports (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/54)
-
-- the `Dockerfile` build stage kept the Go module cache out of `builder`'s home
-  and copied the sources with `--chown`, so no `chown -R` walked them
-  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/43). Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 there is no `builder` user and
-  nothing changes owner: the build stage only compiles, as root, and the tests
-  run as `nobody` in the `test` phase
-
-- `--version` prints `sfdupes VERSION` to stdout; README documents it and
-  `--help` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/15)
-
-- `scan` stops cleanly on `SIGINT` or `SIGTERM`: commits what it has hashed,
-  deletes nothing more, exits 1 (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/5)
-
-- `report` and `trees` stream the records instead of holding them all in memory;
-  the schema gains the `files_signature` index (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/14)
-
-- progress prints at once on a non-terminal, uses a real terminal test, and
-  prints warnings through a spinner instead of racing its redraw (2026-10-03,
-  https://git.eeqj.de/sneak/sfdupes/issues/13)
-
-- warn about and skip symlink, socket, FIFO, device and `.zfs` operands, keeping
-  the records beneath them (2026-10-03,
-  https://git.eeqj.de/sneak/sfdupes/issues/9)
-
-- `scan` holds a lock on a lock file beside the database for its whole run, so a
-  second `scan` fails at once with exit 1 (2026-10-03,
-  https://git.eeqj.de/sneak/sfdupes/issues/53)
-
-- test stdout write failures in `report` and `trees`; README states that
-  `| head` ends sfdupes by `SIGPIPE` and `>&-` writes to `/dev/null`
-  (2026-10-03, https://git.eeqj.de/sneak/sfdupes/issues/30)
-
-- `report` and `trees` open the database read-only, and `scan` leaves it out of
-  WAL mode, so reading needs only read access (2026-10-03, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/8)
-
-- escape tabs, newlines, carriage returns and backslashes in report, trees and
-  warning paths; the root directory's path is `/` (2026-10-03,
-  https://git.eeqj.de/sneak/sfdupes/issues/7)
-
-- stamp the git tag or short commit in a plain `docker build .` instead of `dev`
-  (2026-10-02, branch `next`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/67): `.dockerignore` sends `.git`
-  without `.git/config`; the build stage stamps the `VERSION` build argument,
-  else `git describe --tags --always`, and fails if the context carries `.git`
-  and the version is still empty, `dev` or `unknown`. CI checks out the full
-  history (`fetch-depth: 0`) so it stamps the same value as `make build`.
-
-- replace the 1 KiB end-window sampling with the head/tail plus content-hash
-  ladder (2026-09-22, branch `next`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/61); README "Duplicate detection"
-  documents every rung. A file under 10 MiB is hashed in full, and its `head`,
-  `tail` and `content` all hold that hash. A larger file gets only its 64 KiB
-  `head` and `tail` in the hash phase; the content phase, after the update
-  phase, reads it for `content` (the whole file below 50 MiB, gigabyte-spaced 1
-  MiB samples at or above) only when its size, `head` and `tail` match another
-  record's from this scan or an earlier one, and never reads a file gone or
-  changed since its record was written. `report` and `trees` leave out any
-  record without a `content` hash. The `content` column is part of the version 1
-  schema.
-
-- remove the dead `files.dat` references from `Makefile`, `.gitignore` and
-  `.dockerignore` (2026-09-21, branch `next`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/22)
-
-- fix the lint-image pin comments and `FROM` form in `Dockerfile` and
-  `Dockerfile.lint` (2026-08-10, branch `next`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/25): both pins became the policy
-  `# image:vX.Y.Z, YYYY-MM-DD` comment over a bare `FROM image@sha256:...`,
-  without the false `(Debian-based)` note or the tag. Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 the `Dockerfile`'s `lint` phase
-  holds the only golangci-lint pin, in that form, so `Dockerfile.lint` and
-  `script/verify-lint-image-pin`, which compared the two pins, are gone.
-
-- run all linting in Docker via `Dockerfile.lint` and `script/lint` (2026-08-10,
-  branch `next`, closes https://git.eeqj.de/sneak/sfdupes/issues/46): per the
-  owner ruling the linter is never installed on a host, and
-  `golangci-lint config verify` runs before `golangci-lint run`.
-  `script/bootstrap` stopped installing or pinning the linter, and
-  `script/verify-linter-pin` was retired. Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 both commands run in the
-  `Dockerfile`'s `lint` phase, which `script/lint` builds alone and the build
-  stage depends on through `COPY --from=lint /src/go.sum /dev/null`;
-  `Dockerfile.lint` and `script/verify-lint-image-pin` are gone. Nothing inside
-  an image build may run docker, so the phase calls `golangci-lint` directly.
-
-- install the Docker build stage's prerequisites by running `script/bootstrap`
-  instead of `apk add --no-cache make` inline (2026-08-09, branch
-  `dockerfile-bootstrap`, closes https://git.eeqj.de/sneak/sfdupes/issues/42),
-  with `script/verify-linter-pin` failing the build unless the linter copied
-  from the lint stage was the version `script/bootstrap` pinned. Builds then
-  took up to 5m14s cold, mostly in a `chown -R` of the module cache, filed as
-  https://git.eeqj.de/sneak/sfdupes/issues/43. Since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 the build stage installs `git` and
-  `make` with `apk add --no-cache` and only compiles; the `lint` and `test`
-  phases are the gates
-- bust the Docker layer cache for the gate steps, so `script/cibuild` and
-  `script/docker` cannot report a green they did not earn (2026-08-09, branch
-  `cibuild-cache-bust`, closes https://git.eeqj.de/sneak/sfdupes/issues/32): the
-  `Dockerfile` copies the tree before its gates, so on an unchanged tree Docker
-  served them from cache and the build exited 0 having run nothing. The fix was
-  a `CHECK_EPOCH` build argument; since
-  https://git.eeqj.de/sneak/sfdupes/issues/95 every `docker build` in `script/`
-  passes a new `CACHEBUST` value instead, which every stage of the `Dockerfile`
-  declares before every step that lints, tests or compiles. Run as root, the
-  tests fail `TestScanHardlinkRunFailsTogether`, because root reads through the
-  `chmod(0)` the test relies on, so the `test` phase runs them as `nobody`
-- check the installed golangci-lint version in `script/bootstrap` instead of
-  only its presence (2026-08-09, branch `bootstrap-version-check`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/24): the version lives only in
-  `GOLANGCI_LINT_VERSION`, with the `go install` module ref derived from it, and
-  any installed version that is not the pin — older, newer, absent or
-  unparseable — is reinstalled. `go install` writes into `GOBIN` (or
-  `GOPATH/bin`) while `make lint` runs the first `golangci-lint` on `PATH`, so
-  bootstrap re-reads the effective version after installing and, on a mismatch,
-  prints both paths and both versions and exits non-zero; it does not reorder
-  `PATH` or delete anyone's binary. The `--version` call keeps its stderr and is
-  bounded by `timeout(1)` where that exists. `git`, `make` and `go` keep
-  presence-only checks. Verified by bootstrapping this host from v2.10.1 to
-  v2.12.2 and again to a no-op, and by stub runs of the script under `dash`
-  covering a thirteen-input version-parse matrix, a shadowed install that must
-  exit non-zero, an install destination not on `PATH`, `GOBIN` set, and a wedged
-  binary that must hit the timeout; `make check` and `make lint` are clean at
-  v2.12.2, so v2.10.1 was not hiding any findings on `main`
-- unwind the hash worker pool on the error path (2026-08-09, branch
-  `hash-pool-cleanup`, closes https://git.eeqj.de/sneak/sfdupes/issues/6): the
-  pool is now an owned, context-aware `hashPool`: every blocking send in the
-  feeder and the workers selects on `ctx.Done()`, `jobs` is closed on every path
-  out, and `hashPhase` defers `pool.stop()`, which cancels and then drains
-  `results` until the last goroutine has exited — draining is what frees a
-  worker already parked on a send. `ctx` is threaded from `cmd.Context()`
-  through `runScan`, `syncScan`, both worker pools and the whole database layer,
-  as the first parameter everywhere. The walk pool gets the same treatment plus
-  a `ctx.Err()` guard after the walk: a cancelled walk yields a partial size
-  census, and every file it never reached looks vanished to the update phase.
-  That phase's own `BeginTx` also fails on the cancelled context before deleting
-  anything, but the guard is the barrier that still holds once an interrupted
-  scan may commit what it has. Tests drive `run(scan)` against a database whose
-  insert trigger aborts and assert that the scan fails instead of hanging and
-  that `runtime.NumGoroutine()` polls back to its pre-scan baseline; others
-  cancel a scan part-way through the walk, deterministically, by counting its
-  own consultations of `ctx.Done()`, and assert that it stops at the guard
-  holding a partial census and a still-populated record index, with every record
-  intact. Direct tests of `sendEvent`, the walk workers, `dispatchDirs`,
-  `feedHashJobs`, `hashWorker` and `hashPhase` cover the remaining cancellation
-  branches of both pools
-- guarantee the database is closed on every fatal exit path (2026-08-09, branch
-  `db-close-on-fatal`, closes https://git.eeqj.de/sneak/sfdupes/issues/4):
-  `fatalf` and its `os.Exit(1)` are gone, so the deferred `db.Close()` — and
-  with it the SQLite WAL checkpoint — now actually runs when a subcommand fails;
-  `runScan`, `runReport`, `runTrees`, `loadRecords` and `resolveRoots` return
-  errors instead. The single exit point is `run` in `main.go`: it maps a
-  `fatalError` (anything a subcommand returned) to exit 1 and cobra's own
-  argument and flag errors to exit 2, which keeps a runtime failure from being
-  reported as a usage error or printing the usage text. New `main_test.go`
-  drives the CLI in-process and asserts the exit codes from README §Error
-  handling plus the stdout/stderr split, including that a fatal error raised
-  after the database is open leaves no `-wal`/`-shm` sidecar behind for `scan`,
-  `report` or `trees`
-- update golangci-lint to v2.12.2 with the canonical config (2026-08-09, branch
-  `golangci-v2.12.2`, merged as `38a01bd`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/3): bumped the pinned linter in the
-  `Dockerfile` lint stage and `script/bootstrap` from v2.12.1 to v2.12.2, and
-  replaced `.golangci.yml` with the canonical file — the linter settings (`lll`,
-  `funlen`, `cyclop`, `dupl` thresholds) now live under `linters.settings` per
-  the v2 schema, so they are actually applied; no new lint findings surfaced
-- convert Makefile targets to scripts-to-rule-them-all `script/` entrypoints
-  like the other managed repos (2026-07-26, commit `3abeacf`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/1): all 12 `script/` entrypoints
-  exist (`bootstrap`, `setup`, `projectname`, `test`, `lint`, `fmt`,
-  `fmt-check`, `check`, `docker`, `cibuild`, `precommit`, `install-precommit`)
-  and every Makefile target is now a thin shim over them
-- make the binary the default Make target (2026-07-24, branch
-  `make-default-target`): plain `make` now builds `sfdupes` (previously it ran
-  `check` plus `build`); `make build` remains as an alias
-- scan-wide phases, concurrent operands, batched updates (2026-07-24, branch
-  `scan-wide-phases`): all operands seed the shared walk pool and every pass
-  runs once over the whole scan, so totals and ETAs are scan-global; the
-  per-operand walk/hash/update cycles and their stderr announcements are gone;
-  the update pass commits in batched transactions — the filesystem is
-  authoritative and the database an eventually-consistent reflection, so
-  scan-level atomicity is not required
-- split the stat pass back out of the walk (2026-07-24, branch
-  `parallel-phases`): phases are strictly sequential again — walk, stat, hash,
-  update per operand — with parallelism only inside each phase; the walk
-  enumerates paths with per-directory workers and the stat pass lstats them with
-  per-file workers, restoring the exact total/ETA stat bar
-- announce each operand on stderr before its passes (2026-07-24, branch
-  `scan-operand-progress`): with per-operand walk/hash/update cycles, a
-  multi-operand run (e.g. `scan /srv/*`) showed pass totals that looked like the
-  whole run's
-- parallel walk (2026-07-24, branch `parallel-walk`): the walk pass was a single
-  goroutine and took hours at ~20M files on a busy pool (observed: 22M files in
-  4h on a ZFS server); it is now a per-directory worker-pool traversal that
-  records size/mtime during the walk (folding away the separate stat pass,
-  halving metadata I/O), and each `PATH` operand commits in its own transaction
-  so an interrupted scan keeps completed operands
-
-- persistent scan database (2026-07-24, branch `persistent-database`): `scan`
-  now maintains a SQLite database (`modernc.org/sqlite`, pure Go, cgo stays
-  disabled) keyed by absolute path that survives between runs — a rescan hashes
-  only new or changed files (by mtime/size), deletes records for files vanished
-  from under the scanned operands, and leaves records outside them untouched, so
-  `scan` can be cronned daily; `report` and `trees` read the database (no
-  positional arguments) instead of a scan stream. Database at
-  `/var/lib/sfdupes/db.sqlite`, overridable via `SFDUPES_DATABASE`; WAL
-  journaling plus a single-transaction update keep a report run during a scan
-  safe
-- add the `origin` remote (`git@git.eeqj.de:sneak/sfdupes.git`), tag `v0.0.1`,
-  and push `main` plus tags (2026-07-23)
-- `scan` CLI rework (2026-07-23, branch `scan-required-paths`): required
-  `PATH...` operands via cobra flags replacing the `/srv` `-root` default; new
-  `-x`/`--one-file-system` flag (GNU convention) to stop at filesystem
-  boundaries, which are crossed by default
-- bring the repo into full policy compliance (2026-07-23, branch
-  `repo-policy-compliance`; checklist below)
-- `git init` with README-only first commit; code baseline committed on `main`
-  (2026-07-22)
-- implement `scan`, `report`, and `trees` subcommands (pre-git history)
+- Take the next issue from the `1.0.0` milestone,
+  https://git.eeqj.de/sneak/sfdupes/milestone/17. The issues are not restated
+  here, because a copy drifts as soon as the tracker moves.
 
 # Future Steps
 
-- possible later features (explicitly out of scope per README): full-content
-  verification of candidates, removal-script helpers
+- Possible later features, out of scope per README, are a byte-for-byte check of
+  candidates and helper scripts for removal.
 
-# Repo Policy Compliance
+# Accepted Divergences
 
-Audited 2026-07-22 against `REPO_POLICIES.md` (2026-07-06), the existing repo
-checklist, and the Go styleguide. Code is already gofmt-clean, so no standalone
-formatting commit is needed.
-
-- [x] `.gitignore` missing — the compiled `sfdupes` binary and `files.dat` sit
-      untracked in the tree; needs OS/editor/Go artifacts plus secrets patterns
-- [x] `.editorconfig` missing
-- [x] `LICENSE` missing and README has no License section (MIT assumed from
-      house convention — user to confirm)
-- [x] `REPO_POLICIES.md` missing from repo root
-- [x] `.golangci.yml` missing (install canonical copy); code must then pass
-      `make lint` (150 findings fixed; `make lint` is clean)
-- [x] `Makefile` lacks required targets `test`, `lint`, `fmt`, `fmt-check`,
-      `docker`, `hooks`; `check` currently depends on `build`, which writes the
-      binary (`make check` must not modify files)
-- [x] no tests — `go test ./...` has nothing to run; policy requires real tests
-      with a 30-second timeout and the conditional `-v` rerun pattern (suite
-      covers parsing, grouping, digests, suppression, hashing, and the scan
-      pipeline; 64% coverage)
-- [x] `Dockerfile` missing — Go multistage with hash-pinned images: fail-fast
-      lint stage, build stage running `make check`
-- [x] `.dockerignore` missing
-- [x] `.gitea/workflows/check.yml` missing (`docker build .` on push, checkout
-      action pinned by commit SHA)
-- [x] README lacks required sections: Description first line
-      (name/purpose/category/license/author), Getting Started, Rationale, TODO,
-      License, Author
-- [x] README non-goal "no git repository setup and no CI" is stale now that the
-      repo is under git with CI
-- [x] pre-commit hook not installed (`make hooks` once the target exists)
-
-Accepted divergences (no action):
-
-- flat single-package layout with `.go` files in the repo root — fine for a
-  small single-binary tool per the Go styleguide; the tracker audit agrees
+None.

cmd/sfdupes/main.go

@@ -0,0 +1,31 @@
+// Command sfdupes quickly identifies candidate duplicate files across
+// very large filesystems without reading every byte of every file.
+// Files are considered duplicates when their sizes are equal and they
+// agree on three SHA-256 hashes: of the first 64 KiB, of the last 64
+// KiB, and of the content. The content hash covers the whole file under
+// 100 MiB, and 1 MiB at each gigabyte at 100 MiB or more, so a large
+// file is never read in full. scan maintains a persistent SQLite
+// database of file signatures that the other subcommands read. The
+// database is SFDUPES_DATABASE, or by default /var/lib/sfdupes/db.sqlite
+// for root and sfdupes/db.sqlite in the XDG state directory for any
+// other user.
+//
+// Usage:
+//
+//	sfdupes scan [--workers N] [-x] [--no-default-excludes] PATH...
+//	sfdupes report > dupes.tsv
+//	sfdupes trees > dupetrees.tsv
+//	sfdupes info
+//	sfdupes dwim
+//	sfdupes --version
+//
+// See README.md for the complete specification.
+package main
+
+import (
+	"os"
+
+	"sneak.berlin/go/sfdupes/internal/sfdupes"
+)
+
+func main() { os.Exit(sfdupes.Main()) }

go.mod

@@ -3,6 +3,8 @@ module sneak.berlin/go/sfdupes
 go 1.25.7
 
 require (
+	github.com/adrg/xdg v0.5.3
+	github.com/rivo/uniseg v0.4.7
 	github.com/schollz/progressbar/v3 v3.19.1
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/sys v0.46.0
@@ -18,7 +20,6 @@ require (
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -1,3 +1,5 @@
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
 github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

internal/sfdupes/cancel_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // cancels the unexported runScan and hashWorker
 
 import (
 	"context"
@@ -358,8 +358,9 @@ func TestRunScanInterrupted(t *testing.T) {
 	stderr := captureStderr(t)
 	dir := buildSmokeTree(t)
 
-	err := runScan(t.Context(), []string{dir}, walkCancelWorkers, false,
-		false)
+	opts := scanOptions{workers: walkCancelWorkers}
+
+	err := runScan(t.Context(), []string{dir}, opts)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -382,8 +383,7 @@ func TestRunScanInterrupted(t *testing.T) {
 	go func() {
 		defer close(done)
 
-		err = runScan(cancelledContext(t), []string{dir}, walkCancelWorkers,
-			false, false)
+		err = runScan(cancelledContext(t), []string{dir}, opts)
 	}()
 
 	awaitReturn(t, done, "runScan")
@@ -410,8 +410,7 @@ func TestRunScanInterrupted(t *testing.T) {
 			got, before)
 	}
 
-	err = runScan(t.Context(), []string{dir}, walkCancelWorkers, false,
-		false)
+	err = runScan(t.Context(), []string{dir}, opts)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -437,7 +436,7 @@ func TestRunScanInterruptedMidHash(t *testing.T) {
 	dir := buildWalkCancelTree(t)
 
 	err := runScan(newWalkClock(hashCancelAtDone), []string{dir},
-		walkCancelWorkers, false, false)
+		scanOptions{workers: walkCancelWorkers})
 	if !errors.Is(err, errInterrupted) {
 		t.Fatalf("runScan interrupted mid-hash = %v, want %v",
 			err, errInterrupted)

internal/sfdupes/cli.go

@@ -0,0 +1,451 @@
+// Package sfdupes implements the sfdupes command and the database its
+// subcommands share.
+package sfdupes
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"runtime"
+	"runtime/debug"
+	"slices"
+
+	"github.com/spf13/cobra"
+)
+
+// Exit codes: exitOK is success (even with per-file warnings),
+// exitFatal is a fatal error, exitUsage is a usage error.
+const (
+	exitOK    = 0
+	exitFatal = 1
+	exitUsage = 2
+)
+
+// The subcommand names, as typed on the command line.
+const (
+	cmdScan   = "scan"
+	cmdReport = "report"
+	cmdTrees  = "trees"
+	cmdInfo   = "info"
+	cmdDwim   = "dwim"
+)
+
+// databaseHelp is the paragraph of the root and scan help that names
+// the database (README "Location").
+const databaseHelp = `scan and dwim store what they find in a database file. report,
+trees and info read it. The file is $SFDUPES_DATABASE when that is set
+and not empty. Otherwise root uses /var/lib/sfdupes/db.sqlite. Any other
+user uses sfdupes/db.sqlite in the XDG state directory: $XDG_STATE_HOME,
+or ~/.local/state when that is unset or empty
+(~/Library/Application Support on macOS). An XDG_STATE_HOME that is
+not an absolute path is an error.
+`
+
+// escapesHelp is the paragraph of the report and trees help on how
+// paths are escaped (README "Report output format").
+const escapesHelp = `Four characters in a path are escaped, so each row stays one line:
+
+  \\  a backslash
+  \t  a tab
+  \n  a newline
+  \r  a carriage return
+`
+
+// operandsHelp is the paragraph of the report and trees help on their
+// PATH operands (README "Operands of `report` and `trees`").
+const operandsHelp = `With PATH operands, only the records at or below them are used. A
+relative PATH is joined to the working directory. No PATH is looked up
+on the filesystem, so a symlink in one is not followed.
+`
+
+// reportHelp, treesHelp, infoHelp and dwimHelp follow the one-line
+// summary in the help of their subcommands.
+const (
+	reportHelp = `The report is tab-separated text on stdout: a header line, then one
+row per duplicate file. The columns are:
+
+  first   the path that sorts first, byte by byte, in its group of copies
+  dupe    another copy of that file
+  size    the file's size in bytes
+
+Rows are ordered by size, largest first, then by path.
+
+` + escapesHelp + "\n" + operandsHelp
+
+	treesHelp = `The report is tab-separated text on stdout: a header line, then one
+row per duplicate directory tree. The columns are:
+
+  first      the path that sorts first, byte by byte, in its group of copies
+  dupe       another copy of that tree
+  files      the number of regular files in one copy
+  size       their total size in bytes
+  disk_size  the bytes the dupe copy takes on disk
+
+Rows are ordered by size, largest first, then by path.
+
+` + escapesHelp + "\n" + operandsHelp
+
+	infoHelp = `The details go to stdout, one per line. Each line holds a name and its
+value, separated by a tab:
+
+  database                the path, and where it came from
+  database file size      in bytes, then rounded, as 2147483648 (2.0 GiB)
+  -wal file size          in bytes, then rounded; only if a -wal file exists
+  modified                when the database file last changed, in UTC
+  schema version          the version of the database's layout
+  records                 the number of records
+  size of recorded files  their total size, in bytes, then rounded
+`
+
+	dwimHelp = `dwim runs what "sfdupes scan /" runs with the same flags, then what
+"sfdupes trees" runs. Run it as root, so that the scan can read every
+file. The scan is stored in the database, as scan stores it, so
+"sfdupes trees" prints the report again later.
+`
+)
+
+// errNoSubcommand is returned by the root command when it is invoked
+// without a subcommand. That is a usage error, and the usage text
+// cobra prints for it is the whole message.
+var errNoSubcommand = errors.New("no subcommand")
+
+// errWorkersBelowOne is the usage error for a --workers value below 1.
+var errWorkersBelowOne = errors.New("--workers must be at least 1")
+
+// errEmptyExcludeValue is the usage error for an empty --exclude value,
+// as from --exclude "$DIR" with DIR unset. Taken as a path, it
+// would name the working directory.
+var errEmptyExcludeValue = errors.New("--exclude must not be empty")
+
+// errEmptyOperand is the usage error for an empty PATH operand of
+// report or trees, as from "$DIR" with DIR unset. Taken as a path, it
+// would name the working directory.
+var errEmptyOperand = errors.New("PATH must not be empty")
+
+// Version is the build version, injected at link time via -ldflags
+// (see the Makefile); empty when the linker set none, as for a binary
+// built by go install. buildVersion turns it into what --version prints.
+//
+//nolint:gochecknoglobals // written only by the linker
+var Version string
+
+// buildVersion returns the version that sfdupes --version prints
+// (README "Install"): the version the linker set, when it set one;
+// otherwise the main module's version that Go recorded in the binary,
+// a tag such as v0.0.2 or the pseudo-version of an @main build; and
+// "dev" when neither is known. info is what debug.ReadBuildInfo
+// returns, nil when the binary carries none. Go records "(devel)" for
+// a build that has no version, such as one inside a copy of the source
+// without git.
+func buildVersion(linkerVersion string, info *debug.BuildInfo) string {
+	if linkerVersion != "" {
+		return linkerVersion
+	}
+
+	if info == nil || info.Main.Version == "" ||
+		info.Main.Version == "(devel)" {
+		return "dev"
+	}
+
+	return info.Main.Version
+}
+
+// Main runs the command line in os.Args and returns the process exit
+// code.
+func Main() int {
+	// Once the reader of a stdout pipe has gone, as in "sfdupes report |
+	// head", the Go runtime ends the process with SIGPIPE on the next
+	// write instead of returning an error (README "Error handling").
+	// Registering for SIGPIPE with os/signal would change that.
+	return run(os.Args[1:], os.Stdout, os.Stderr)
+}
+
+// run executes args against the command tree and returns the process
+// exit code. It is the program's single exit point: the subcommands
+// return their errors instead of exiting, so every deferred cleanup —
+// above all closing the database, which checkpoints the SQLite WAL —
+// runs before the process ends. The report, trees, info and dwim
+// subcommands write their data to stdout.
+func run(args []string, stdout, stderr io.Writer) int {
+	// A nil slice makes cobra fall back to os.Args, which would let a
+	// test binary's own flags reach the command tree.
+	if args == nil {
+		args = []string{}
+	}
+
+	root := newRootCommand(stdout, stderr)
+	root.SetArgs(args)
+
+	err := root.Execute()
+
+	var fatal fatalError
+
+	switch {
+	case err == nil:
+		return exitOK
+	case errors.Is(err, errInterrupted):
+		// The interrupted scan has printed its own line.
+		return exitFatal
+	case errors.As(err, &fatal):
+		// The command ran and failed: a runtime error, reported
+		// without the usage text that a usage error gets.
+		_, _ = fmt.Fprintf(stderr, "sfdupes: %v\n", err)
+
+		return exitFatal
+	default:
+		// A usage error, which cobra has already reported on stderr.
+		return exitUsage
+	}
+}
+
+// newRootCommand builds the command tree. Everything on stdout is
+// machine-readable data, the version line included; all human-facing
+// output (help, usage, errors) goes to stderr.
+func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
+	var showVersion bool
+
+	printVersion := runE(func(context.Context, []string) error {
+		info, _ := debug.ReadBuildInfo()
+
+		_, err := fmt.Fprintf(stdout, "sfdupes %s\n",
+			buildVersion(Version, info))
+		if err != nil {
+			return fmt.Errorf("write stdout: %w", err)
+		}
+
+		return nil
+	})
+
+	root := &cobra.Command{
+		Use:   "sfdupes",
+		Short: "Find candidate duplicate files by size and head/tail/content SHA-256",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if showVersion {
+				return printVersion(cmd, args)
+			}
+
+			// A missing subcommand prints usage and exits 2: cobra
+			// prints the usage text for the returned error, and run
+			// maps everything that is not a fatal error to exit 2.
+			cmd.SilenceErrors = true
+
+			return errNoSubcommand
+		},
+	}
+	root.SetOut(stderr)
+	root.SetErr(stderr)
+	root.CompletionOptions.DisableDefaultCmd = true
+
+	// Cobra's built-in version flag prints through the help writer,
+	// stderr; this one prints to stdout.
+	root.Flags().BoolVarP(&showVersion, "version", "v", false,
+		"print the version to stdout")
+
+	reportCmd := &cobra.Command{
+		Use:   cmdReport + " [PATH...]",
+		Short: "Read the scan database and print the file-level duplicates report",
+		Args:  rejectEmptyOperand,
+		RunE: runE(func(ctx context.Context, args []string) error {
+			return runReport(ctx, args, stdout)
+		}),
+	}
+
+	treesCmd := &cobra.Command{
+		Use:   cmdTrees + " [PATH...]",
+		Short: "Read the scan database and print the duplicate-tree report",
+		Args:  rejectEmptyOperand,
+		RunE: runE(func(ctx context.Context, args []string) error {
+			return runTrees(ctx, args, stdout)
+		}),
+	}
+
+	infoCmd := &cobra.Command{
+		Use:   cmdInfo,
+		Short: "Read the scan database and print its details",
+		Args:  cobra.NoArgs,
+		RunE: runE(func(ctx context.Context, _ []string) error {
+			return runInfo(ctx, stdout)
+		}),
+	}
+
+	root.Long = root.Short + ".\n\n" + databaseHelp
+	reportCmd.Long = reportCmd.Short + ".\n\n" + reportHelp
+	treesCmd.Long = treesCmd.Short + ".\n\n" + treesHelp
+	infoCmd.Long = infoCmd.Short + ".\n\n" + infoHelp
+
+	root.AddCommand(newScanCommand(), reportCmd, treesCmd, infoCmd,
+		newDwimCommand(stdout))
+
+	return root
+}
+
+// scanOptions holds the values of the flags that scan and dwim share:
+// --workers, -x, --no-default-excludes and --exclude.
+type scanOptions struct {
+	workers           int
+	oneFS             bool
+	noDefaultExcludes bool
+	excludePaths      []string
+}
+
+// scanFlagsUsage names the flags that scan and dwim share, for their
+// usage lines.
+const scanFlagsUsage = "[--workers N] [-x] [--no-default-excludes] " +
+	"[--exclude PATH]..."
+
+// addScanFlags adds the flags that scan and dwim share to cmd, which
+// stores their values in opts.
+func addScanFlags(cmd *cobra.Command, opts *scanOptions) {
+	cmd.Flags().IntVar(&opts.workers, "workers", runtime.NumCPU(),
+		"concurrent workers for the walk and hash phases")
+	cmd.Flags().BoolVarP(&opts.oneFS, "one-file-system", "x", false,
+		"do not cross filesystem boundaries")
+	cmd.Flags().BoolVar(&opts.noDefaultExcludes, "no-default-excludes",
+		false, "enter the default excludes, the paths listed above")
+	// A string array, not a slice, so a comma in a path is not a
+	// separator.
+	cmd.Flags().StringArrayVar(&opts.excludePaths, "exclude", nil,
+		"never enter or record `PATH` or anything below it; repeatable")
+}
+
+// check rejects the flag values that are usage errors, before the
+// command runs. It is the PreRunE of scan and dwim.
+func (o *scanOptions) check(cmd *cobra.Command, _ []string) error {
+	err := checkScanWorkers(cmd, o.workers)
+	if err != nil {
+		return err
+	}
+
+	return rejectEmptyExcludeValue(cmd, o.excludePaths)
+}
+
+// newScanCommand builds the scan subcommand. Its help names the
+// database, and lists the default excludes of the system it runs on and
+// the filesystem types it never records anything on.
+func newScanCommand() *cobra.Command {
+	var opts scanOptions
+
+	short := "Walk trees and synchronize the scan database"
+
+	scanCmd := &cobra.Command{
+		Use: cmdScan + " " + scanFlagsUsage + " PATH...",
+		// The Use line already names every flag, so cobra must not
+		// append its generic "[flags]" to it.
+		DisableFlagsInUseLine: true,
+		Short:                 short,
+		Long: short + ".\n\n" + databaseHelp + "\n" +
+			defaultExcludesHelp(runtime.GOOS),
+		Args:    cobra.MinimumNArgs(1),
+		PreRunE: opts.check,
+		RunE: runE(func(ctx context.Context, args []string) error {
+			ctx, stop := interruptContext(ctx)
+			defer stop()
+
+			return runScan(ctx, args, opts)
+		}),
+	}
+	addScanFlags(scanCmd, &opts)
+
+	return scanCmd
+}
+
+// newDwimCommand builds the dwim subcommand, which takes the scan flags
+// with the meaning they have for scan. Its help says what dwim runs,
+// then lists the default excludes and the filesystem types the scan
+// never records anything on.
+func newDwimCommand(stdout io.Writer) *cobra.Command {
+	var opts scanOptions
+
+	short := "Scan /, then print the duplicate-tree report"
+
+	dwimCmd := &cobra.Command{
+		Use:                   cmdDwim + " " + scanFlagsUsage,
+		DisableFlagsInUseLine: true,
+		Short:                 short,
+		Long: short + ".\n\n" + dwimHelp + "\n" +
+			defaultExcludesHelp(runtime.GOOS),
+		Args:    cobra.NoArgs,
+		PreRunE: opts.check,
+		RunE: runE(func(ctx context.Context, _ []string) error {
+			return runDwim(ctx, "/", opts, stdout)
+		}),
+	}
+	addScanFlags(dwimCmd, &opts)
+
+	return dwimCmd
+}
+
+// checkScanWorkers rejects a --workers value below 1. That is a usage
+// error reported in one line: cobra prints the returned message without
+// the usage text, and run exits 2.
+func checkScanWorkers(cmd *cobra.Command, workers int) error {
+	if workers >= 1 {
+		return nil
+	}
+
+	cmd.SilenceUsage = true
+
+	return fmt.Errorf("%w, got %d", errWorkersBelowOne, workers)
+}
+
+// rejectEmptyExcludeValue rejects an empty --exclude value. That
+// is a usage error reported in one line, as for --workers below 1.
+func rejectEmptyExcludeValue(cmd *cobra.Command, excludePaths []string) error {
+	if !slices.Contains(excludePaths, "") {
+		return nil
+	}
+
+	cmd.SilenceUsage = true
+
+	return errEmptyExcludeValue
+}
+
+// rejectEmptyOperand rejects an empty PATH operand of report or trees.
+// That is a usage error reported in one line, as for --workers below 1.
+func rejectEmptyOperand(cmd *cobra.Command, args []string) error {
+	if !slices.Contains(args, "") {
+		return nil
+	}
+
+	cmd.SilenceUsage = true
+
+	return errEmptyOperand
+}
+
+// runE adapts a subcommand implementation, or the version print, to
+// cobra's RunE. Cobra prints the error and the command's usage text for
+// every error RunE returns, but a subcommand that ran and failed has no
+// usage problem to report: both are silenced here, and the error is
+// marked fatal so that run reports it on stderr and exits 1 rather than
+// 2. The command's context is handed to the implementation: cancelling
+// it unwinds the scan's worker pools.
+func runE(
+	fn func(ctx context.Context, args []string) error,
+) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		cmd.SilenceUsage = true
+		cmd.SilenceErrors = true
+
+		err := fn(cmd.Context(), args)
+		if err != nil {
+			return fatalError{err: err}
+		}
+
+		return nil
+	}
+}
+
+// fatalError marks a runtime failure, as opposed to the usage errors
+// cobra itself produces while parsing arguments and flags. Both come
+// out of Execute as plain errors, so the wrapper is what tells run to
+// report this one as "sfdupes: ..." and exit 1.
+type fatalError struct {
+	err error
+}
+
+func (e fatalError) Error() string { return e.err.Error() }
+
+func (e fatalError) Unwrap() error { return e.err }

internal/sfdupes/cli_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // drives the unexported run
 
 import (
 	"bytes"
@@ -14,12 +14,21 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+
+	"github.com/adrg/xdg"
+	"golang.org/x/sys/unix"
 )
 
 // usageMarker is the first line of cobra's usage text, which a usage
 // error prints and a runtime failure must not.
 const usageMarker = "Usage:"
 
+// helpFlag asks for the help text.
+const helpFlag = "--help"
+
+// workersFlag is the scan and dwim flag that sets the worker count.
+const workersFlag = "--workers"
+
 // TestMain stops the tests at once, saying why, when their temporary
 // directory is not on a persistent filesystem: scan records nothing
 // there (README "Rules for the walk"), so most scan tests would fail
@@ -180,9 +189,9 @@ func capture(t *testing.T, std **os.File) func() string {
 }
 
 // brokenDatabase writes a database that opens cleanly and passes the
-// schema-version check but has no files table, so the first query
-// fails with the database already open: a fatal error on a path that
-// owns an open database. It closes the database the way scan does.
+// schema-version check but has no tables, so the first query fails
+// with the database already open: a fatal error on a path that owns an
+// open database. It closes the database the way scan does.
 func brokenDatabase(t *testing.T) string {
 	t.Helper()
 
@@ -265,8 +274,9 @@ func TestRunFatalAfterOpenClosesDatabase(t *testing.T) {
 			assertFatalOutput(t, stderr.String(), stdout())
 
 			// Proof that the failure happened after the open: only a
-			// query against the opened database can report this.
-			if !strings.Contains(stderr.String(), "no such table: files") {
+			// query against the opened database can report this. Each
+			// subcommand's first query reads totals.
+			if !strings.Contains(stderr.String(), "no such table: totals") {
 				t.Errorf("stderr = %q, want the failure to come from a "+
 					"query on the open database", stderr.String())
 			}
@@ -393,7 +403,7 @@ func TestRunNamesRelativeDatabase(t *testing.T) {
 }
 
 func TestRunUsesDatabaseThroughSymlinkedDirectory(t *testing.T) {
-	// README §Database: the path names the file exactly. With link a
+	// README §Settings: the path names the file exactly. With link a
 	// symlink to the directory real/sub, link/../db.sqlite names
 	// real/db.sqlite, not db.sqlite beside link. Every subcommand must
 	// use that file, relative or absolute, and its first line must name
@@ -550,13 +560,17 @@ func TestRunNamesDefaultDatabase(t *testing.T) {
 	// line.
 	t.Setenv(databaseEnv, "")
 
-	// Whether scan calls the database new depends on that machine too.
-	scanWant := "scan: database " + defaultDatabasePath + " (default)\n"
+	dbPath, err := defaultDatabasePath(os.Geteuid())
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	_, err := os.Stat(defaultDatabasePath)
+	// Whether scan calls the database new depends on that machine too.
+	scanWant := "scan: database " + dbPath + " (default)\n"
+
+	_, err = os.Stat(dbPath)
 	if errors.Is(err, fs.ErrNotExist) {
-		scanWant = "scan: new database " + defaultDatabasePath +
-			" (default)\n"
+		scanWant = "scan: new database " + dbPath + " (default)\n"
 	}
 
 	missing := filepath.Join(t.TempDir(), "nope")
@@ -567,29 +581,30 @@ func TestRunNamesDefaultDatabase(t *testing.T) {
 	}{
 		cmdScan: {
 			run: func() error {
-				return runScan(t.Context(), []string{missing}, 1, false, false)
+				return runScan(t.Context(), []string{missing},
+					scanOptions{workers: 1})
 			},
 			want: scanWant,
 		},
 		cmdReport: {
 			run: func() error {
-				return runReport(cancelledContext(t), io.Discard)
+				return runReport(cancelledContext(t), nil, io.Discard)
 			},
-			want: "report: database " + defaultDatabasePath + " (default)\n" +
+			want: "report: database " + dbPath + " (default)\n" +
 				reportOpenLine + "\n" + reportOpenLine + "\n",
 		},
 		cmdTrees: {
 			run: func() error {
-				return runTrees(cancelledContext(t), io.Discard)
+				return runTrees(cancelledContext(t), nil, io.Discard)
 			},
-			want: "trees: database " + defaultDatabasePath + " (default)\n" +
+			want: "trees: database " + dbPath + " (default)\n" +
 				treesOpenLine + "\n" + treesOpenLine + "\n",
 		},
 		cmdInfo: {
 			run: func() error {
 				return runInfo(cancelledContext(t), io.Discard)
 			},
-			want: "info: database " + defaultDatabasePath + " (default)\n" +
+			want: "info: database " + dbPath + " (default)\n" +
 				infoOpenLine + "\n" + infoOpenLine + "\n",
 		},
 	}
@@ -616,9 +631,8 @@ func TestRunUsageErrors(t *testing.T) {
 	}{
 		"no subcommand":      {[]string{}, usageMarker},
 		"scan without paths": {[]string{cmdScan}, usageMarker},
-		"report with args":   {[]string{cmdReport, "x"}, usageMarker},
-		"trees with args":    {[]string{cmdTrees, "x"}, usageMarker},
 		"info with args":     {[]string{cmdInfo, "x"}, usageMarker},
+		"dwim with args":     {[]string{cmdDwim, "x"}, usageMarker},
 		"unknown flag":       {[]string{cmdScan, "--nope", "/"}, usageMarker},
 		"unknown subcommand": {[]string{"nope"}, "unknown command"},
 	}
@@ -648,7 +662,7 @@ func TestRunUsageErrors(t *testing.T) {
 }
 
 func TestRunScanRejectsWorkersBelowOne(t *testing.T) {
-	// README §scan mode: --workers below 1 is a usage error reported in
+	// README §Settings: --workers below 1 is a usage error reported in
 	// one line on stderr, before the scan opens the database.
 	for _, workers := range []string{"0", "-1"} {
 		t.Run(workers, func(t *testing.T) {
@@ -657,7 +671,7 @@ func TestRunScanRejectsWorkersBelowOne(t *testing.T) {
 
 			var stdout, stderr bytes.Buffer
 
-			args := []string{cmdScan, "--workers", workers, t.TempDir()}
+			args := []string{cmdScan, workersFlag, workers, t.TempDir()}
 
 			code := run(args, &stdout, &stderr)
 			if code != exitUsage {
@@ -686,9 +700,9 @@ func TestRunScanRejectsWorkersBelowOne(t *testing.T) {
 func TestRunHelp(t *testing.T) {
 	t.Parallel()
 
-	// README §Subcommands: help goes to stderr, exits 0, and leaves
-	// stdout empty.
-	cases := [][]string{{"--help"}, {"-h"}, {cmdScan, "--help"}}
+	// README §Settings: help goes to stderr, exits 0, and leaves stdout
+	// empty.
+	cases := [][]string{{helpFlag}, {"-h"}, {cmdScan, helpFlag}}
 
 	for _, args := range cases {
 		var stdout, stderr bytes.Buffer
@@ -707,14 +721,134 @@ func TestRunHelp(t *testing.T) {
 			t.Errorf("run(%v) stdout = %q, want nothing (data only)",
 				args, got)
 		}
+
+		// README §Location: the help of sfdupes and of scan says where
+		// the database is, and that XDG_STATE_HOME must be an absolute
+		// path.
+		for _, want := range []string{
+			"scan and dwim store", databaseEnv, rootDatabasePath,
+			stateHomeEnv, "~/.local/state", "not an absolute path is an error",
+		} {
+			if !strings.Contains(stderr.String(), want) {
+				t.Errorf("run(%v) stderr = %q, want it to name %q",
+					args, stderr.String(), want)
+			}
+		}
+	}
+
+	// The scan help lists --exclude with its argument.
+	var stdout, stderr bytes.Buffer
+
+	run([]string{cmdScan, "-h"}, &stdout, &stderr)
+
+	if !strings.Contains(stderr.String(), excludeFlag+" PATH") {
+		t.Errorf("scan -h stderr = %q, want %s PATH", stderr.String(),
+			excludeFlag)
+	}
+}
+
+func TestRunScanUsageLine(t *testing.T) {
+	t.Parallel()
+
+	// README §Subcommands shows this usage line for scan, and the help
+	// and the usage error both print it.
+	const want = "\n  sfdupes scan [--workers N] [-x] [--no-default-excludes] " +
+		"[--exclude PATH]... PATH...\n"
+
+	cases := map[string][]string{
+		"help":          {cmdScan, "-h"},
+		"missing paths": {cmdScan},
+	}
+
+	for name, args := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			var stdout, stderr bytes.Buffer
+
+			run(args, &stdout, &stderr)
+
+			if !strings.Contains(stderr.String(), want) {
+				t.Errorf("run(%v) stderr = %q, want the usage line %q",
+					args, stderr.String(), want)
+			}
+		})
+	}
+}
+
+func TestRunHelpDescribesOutput(t *testing.T) {
+	t.Parallel()
+
+	// README §Settings: the help of report, trees, info and dwim says
+	// what each prints. The help of report and trees also explains
+	// their PATH operands. TestRunHelp checks the database paragraph
+	// of the root and scan help.
+	escapes := []string{`\\`, `\t`, `\n`, `\r`}
+	operands := []string{
+		"With PATH operands", "at or below them", "working directory",
+		"No PATH is looked up", "not followed",
+	}
+
+	// The subcommand whose help is printed.
+	cases := []struct {
+		subcommand []string
+		want       []string
+	}{
+		{
+			[]string{cmdReport},
+			slices.Concat([]string{
+				"tab-separated", "\n  first ", "\n  dupe ", "\n  size ",
+				"largest first",
+			}, escapes, operands),
+		},
+		{
+			[]string{cmdTrees},
+			slices.Concat([]string{
+				"tab-separated", "\n  first ", "\n  dupe ", "\n  files ",
+				"\n  size ", "\n  disk_size ", "largest first",
+			}, escapes, operands),
+		},
+		{
+			[]string{cmdInfo},
+			[]string{
+				"\n  database ", "\n  database file size ",
+				"\n  -wal file size ", "\n  modified ",
+				"\n  schema version ", "\n  records ",
+				"\n  size of recorded files ",
+			},
+		},
+		{
+			[]string{cmdDwim},
+			[]string{
+				"sfdupes scan /", "as root", "sfdupes trees", "database",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		var stdout, stderr bytes.Buffer
+
+		args := slices.Concat(tc.subcommand, []string{helpFlag})
+
+		code := run(args, &stdout, &stderr)
+		if code != exitOK {
+			t.Fatalf("run(%v) = %d, want %d", args, code, exitOK)
+		}
+
+		for _, want := range tc.want {
+			if !strings.Contains(stderr.String(), want) {
+				t.Errorf("run(%v) help lacks %q:\n%s",
+					args, want, stderr.String())
+			}
+		}
 	}
 }
 
 func TestRunVersion(t *testing.T) {
 	t.Parallel()
 
-	// README §Subcommands: the version is one line on stdout, with
-	// nothing on stderr, and exits 0.
+	// README §Settings: the version is one line on stdout, with nothing
+	// on stderr, and exits 0.
 	info, _ := debug.ReadBuildInfo()
 
 	for _, arg := range []string{"--version", "-v"} {
@@ -773,8 +907,8 @@ func TestBuildVersion(t *testing.T) {
 func TestRunVersionWriteFailureIsFatal(t *testing.T) {
 	t.Parallel()
 
-	// README §Error handling: a stdout write failure exits 1, reported
-	// in one line on stderr.
+	// README §Error handling: a failed write to stdout is a fatal error,
+	// exit 1, reported on stderr starting with "sfdupes:".
 	var stderr bytes.Buffer
 
 	code := run([]string{"--version"}, failingWriter{}, &stderr)
@@ -796,7 +930,7 @@ func TestRunVersionWriteFailureIsFatal(t *testing.T) {
 func scanFixture(t *testing.T) []string {
 	t.Helper()
 
-	dir := t.TempDir()
+	dir := realTempDir(t)
 
 	dupes := []string{
 		writeFile(t, dir, "one/a.bin", pattern(1, 300)),
@@ -817,6 +951,23 @@ func scanFixture(t *testing.T) []string {
 	return dupes
 }
 
+// storedDiskSize returns the disk_size of the record for path in the
+// database at dbPath. A test of a trees run compares with this rather
+// than with a new lstat, which on ZFS can differ from the scan's (see
+// diskSizeOf).
+func storedDiskSize(t *testing.T, dbPath, path string) int64 {
+	t.Helper()
+
+	db, err := openReportDatabase(t.Context(), dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = db.Close() }()
+
+	return recordByPath(t, dbRecords(t, db), path).diskSize
+}
+
 // scanOK runs scan over operands, fails the test unless it exits 0 with
 // nothing on stdout, and returns everything it printed to stderr.
 func scanOK(t *testing.T, operands ...string) string {
@@ -849,7 +1000,7 @@ func TestRunScanSucceedsDespiteWarnings(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
-	dir := t.TempDir()
+	dir := realTempDir(t)
 	writeFile(t, dir, "a.bin", pattern(1, 300))
 
 	// Same size as a.bin, so the scan reads it, and the read fails.
@@ -862,8 +1013,7 @@ func TestRunScanSucceedsDespiteWarnings(t *testing.T) {
 
 	stderr := scanOK(t, dir)
 
-	warning := "hash " + unreadable + ": open " + unreadable +
-		": permission denied\n"
+	warning := "scan: skipped " + unreadable + " (permission denied)\n"
 	if !strings.Contains(stderr, warning) {
 		t.Errorf("stderr = %q, want %q", stderr, warning)
 	}
@@ -877,75 +1027,292 @@ func TestRunScanSucceedsDespiteWarnings(t *testing.T) {
 	assertNoSidecars(t, path)
 }
 
-func TestRunScanSkipsSymlinkOperand(t *testing.T) {
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
+// realTempDir returns a new temporary directory by its real path, so
+// tests hold where the temporary directory is reached through a
+// symlink.
+func realTempDir(t *testing.T) string {
+	t.Helper()
 
-	dir := t.TempDir()
-	writeFile(t, dir, "target/sub/f", pattern(1, 10))
-
-	link := filepath.Join(dir, "link")
-
-	err := os.Symlink(filepath.Join(dir, "target"), link)
+	dir, err := filepath.EvalSymlinks(t.TempDir())
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Scanning a directory through the symlink stores a record beneath
-	// the symlink's own path for a file beneath its target.
-	scanOK(t, filepath.Join(link, "sub"))
-
-	assertOperandSkipped(t, path, link, "symlink",
-		filepath.Join(link, "sub", "f"))
+	return dir
 }
 
+// symlink creates link pointing at target.
+func symlink(t *testing.T, target, link string) {
+	t.Helper()
+
+	err := os.Symlink(target, link)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestRunScanFollowsSymlinkOperand scans link, a symlink to target.
+// The operand is scanned at its real path, and its file is recorded
+// there.
+func TestRunScanFollowsSymlinkOperand(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	f := writeFile(t, dir, "target/sub/f", pattern(1, 10))
+
+	link := filepath.Join(dir, "link")
+	symlink(t, filepath.Join(dir, "target"), link)
+
+	stderr := scanOK(t, link)
+
+	summary := "scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+		"0 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+
+	if got := storedPaths(t, path); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
+// TestRunScanWalksOperandUnderSymlinkOperand scans link and link/sub,
+// with link a symlink to target. Both resolve under target, so
+// target/sub is walked once, as part of target.
 func TestRunScanWalksOperandUnderSymlinkOperand(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
-	dir := t.TempDir()
-	writeFile(t, dir, "target/sub/f", pattern(1, 10))
+	dir := realTempDir(t)
+	f := writeFile(t, dir, "target/sub/f", pattern(1, 10))
 
 	link := filepath.Join(dir, "link")
+	symlink(t, filepath.Join(dir, "target"), link)
 
-	err := os.Symlink(filepath.Join(dir, "target"), link)
-	if err != nil {
-		t.Fatal(err)
+	stderr := scanOK(t, link, filepath.Join(link, "sub"))
+
+	summary := "scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+		"0 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
 	}
 
-	// link is dropped as a symlink, but link/sub must still be scanned,
-	// not dropped as lying under link.
-	scanOK(t, link, filepath.Join(link, "sub"))
-
-	db, err := openDB(path, reportParams)
-	if err != nil {
-		t.Fatal(err)
+	if got := storedPaths(t, path); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
 	}
-
-	t.Cleanup(func() { _ = db.Close() })
-
-	recordByPath(t, dbRecords(t, db), filepath.Join(link, "sub", "f"))
 }
 
-func TestRunScanSkipsZFSOperand(t *testing.T) {
+// TestRunScanWalksSymlinkedOperandBelowOperand is the case of
+// https://git.eeqj.de/sneak/sfdupes/issues/144: scan dir dir/link/sub,
+// with dir/link a symlink to a directory outside dir. The walk of dir
+// does not follow link, so dir/link/sub is walked on its own at its
+// real path, and the record an earlier scan stored there survives.
+func TestRunScanWalksSymlinkedOperandBelowOperand(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
-	zfs := filepath.Join(t.TempDir(), ".zfs")
-	snapshot := filepath.Join(zfs, "snapshot", "hourly")
-	f := writeFile(t, snapshot, "f", pattern(1, 10))
+	dir := realTempDir(t)
+	a := writeFile(t, dir, "a", pattern(1, 10))
 
-	// An operand beneath a .zfs directory is walked, because it is not
-	// itself named .zfs.
-	scanOK(t, snapshot)
+	outside := realTempDir(t)
+	f := writeFile(t, outside, "sub/f", pattern(2, 10))
+
+	symlink(t, outside, filepath.Join(dir, "link"))
+
+	scanOK(t, filepath.Join(outside, "sub"))
+
+	stderr := scanOK(t, dir, filepath.Join(dir, "link", "sub"))
+
+	summary := "scan: 2 files seen (1 added, 0 updated, 0 removed, " +
+		"1 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+
+	want := []string{a, f}
+	slices.Sort(want)
+
+	if got := storedPaths(t, path); !slices.Equal(got, want) {
+		t.Errorf("records = %q, want %q", got, want)
+	}
+}
+
+// TestRunScanDropsSymlinkOperandInsideOperand scans dir and link, with
+// link, outside dir, a symlink to dir/real. link resolves inside dir,
+// so it is dropped as covered by dir, and its file is recorded once.
+func TestRunScanDropsSymlinkOperandInsideOperand(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	f := writeFile(t, dir, "real/f", pattern(1, 10))
+
+	link := filepath.Join(realTempDir(t), "link")
+	symlink(t, filepath.Join(dir, "real"), link)
+
+	stderr := scanOK(t, dir, link)
+
+	summary := "scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+		"0 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+
+	if got := storedPaths(t, path); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
+// TestRunScanDanglingSymlinkOperandIsFatal scans a valid directory and
+// a symlink whose target does not exist. The scan fails with exit 1 and
+// an error naming the symlink as given, before it walks anything, so no
+// database is created.
+func TestRunScanDanglingSymlinkOperandIsFatal(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	writeFile(t, dir, "f", pattern(1, 10))
+
+	dangling := filepath.Join(realTempDir(t), "dangling")
+	symlink(t, filepath.Join(dir, "missing"), dangling)
+
+	stdout := captureStdout(t)
+
+	var stderr bytes.Buffer
+
+	code := run([]string{cmdScan, dir, dangling}, os.Stdout, &stderr)
+	if code != exitFatal {
+		t.Errorf("run(scan %s %s) = %d, want %d", dir, dangling, code,
+			exitFatal)
+	}
+
+	assertFatalOutput(t, stderr.String(), stdout())
+
+	want := "sfdupes: resolve " + dangling + ": "
+	if !strings.Contains(stderr.String(), want) {
+		t.Errorf("stderr = %q, want %q", stderr.String(), want)
+	}
+
+	_, err := os.Stat(path)
+	if !errors.Is(err, fs.ErrNotExist) {
+		t.Errorf("database: stat error %v, want it missing", err)
+	}
+}
+
+// TestRunScanFromSymlinkedWorkingDirectoryRecordsRealPath runs scan .
+// after a cd through home/proj, a symlink to data/proj. The file is
+// recorded under data/proj, its real path.
+func TestRunScanFromSymlinkedWorkingDirectoryRecordsRealPath(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	f := writeFile(t, dir, "data/proj/f", pattern(1, 10))
+
+	err := os.Mkdir(filepath.Join(dir, "home"), 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	symlink(t, filepath.Join(dir, "data", "proj"),
+		filepath.Join(dir, "home", "proj"))
+
+	// t.Chdir also sets PWD to the path through the symlink, as a
+	// shell does after cd.
+	t.Chdir(filepath.Join(dir, "home", "proj"))
+
+	scanOK(t, ".")
+
+	if got := storedPaths(t, path); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
+// TestRunScanFollowsSymlinkBeforeDotDot scans a path with a ".." after
+// home/proj, a symlink to data/proj: home/proj/.. from dir, and .. after
+// a cd through home/proj. As with realpath, the ".." counts from
+// data/proj, so data is scanned and home is not.
+func TestRunScanFollowsSymlinkBeforeDotDot(t *testing.T) {
+	for _, tc := range []struct{ wd, operand string }{
+		{"", "home/proj/.."},
+		{"home/proj", ".."},
+	} {
+		t.Run(tc.operand, func(t *testing.T) {
+			path := testDBPath(t)
+			t.Setenv(databaseEnv, path)
+
+			dir := realTempDir(t)
+			f := writeFile(t, dir, "data/proj/f", pattern(1, 10))
+			g := writeFile(t, dir, "data/g", pattern(2, 10))
+			writeFile(t, dir, "home/h", pattern(3, 10))
+			symlink(t, filepath.Join(dir, "data", "proj"),
+				filepath.Join(dir, "home", "proj"))
+
+			// t.Chdir also sets PWD to the path given, as a shell does
+			// after cd.
+			t.Chdir(filepath.Join(dir, tc.wd))
+
+			scanOK(t, tc.operand)
+
+			want := []string{f, g}
+			slices.Sort(want)
+
+			if got := storedPaths(t, path); !slices.Equal(got, want) {
+				t.Errorf("records = %q, want %q", got, want)
+			}
+		})
+	}
+}
+
+// TestRunScanSkipsSymlinkToFIFOOperand scans link, a symlink to a FIFO.
+// The scan warns about the FIFO by its real path, counts it as skipped,
+// and exits 0.
+func TestRunScanSkipsSymlinkToFIFOOperand(t *testing.T) {
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	dir := realTempDir(t)
+	fifo := filepath.Join(dir, "fifo")
+
+	err := unix.Mkfifo(fifo, 0o600)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	link := filepath.Join(dir, "link")
+	symlink(t, fifo, link)
+
+	stderr := scanOK(t, link)
+
+	warning := "scan: skipped " + fifo + " (a FIFO)\n"
+	if !strings.Contains(stderr, warning) {
+		t.Errorf("stderr = %q, want %q", stderr, warning)
+	}
+
+	summary := "scan: 0 files seen (0 added, 0 updated, 0 removed, " +
+		"0 unchanged), 1 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+}
+
+func TestRunScanSkipsZFSOperand(t *testing.T) {
+	zfs := filepath.Join(realTempDir(t), ".zfs")
+	f := writeFile(t, zfs, "snapshot/hourly/f", pattern(1, 10))
+
+	// No scan records a file inside a .zfs directory, so the record
+	// beneath the operand is written straight into the database.
+	path := seedDatabase(t, []scanRec{{size: 10, path: f}})
+	t.Setenv(databaseEnv, path)
 
 	assertOperandSkipped(t, path, zfs, ".zfs directory", f)
 }
 
 // assertOperandSkipped scans operand alone and checks that it is skipped
 // as kind: a warning naming it, one skip in the summary, exit 0, and the
-// record for kept, which an earlier scan stored beneath operand, still
-// in the database at dbPath.
+// record for kept, stored beneath operand before this scan, still in the
+// database at dbPath.
 func assertOperandSkipped(t *testing.T, dbPath, operand, kind,
 	kept string,
 ) {
@@ -953,7 +1320,7 @@ func assertOperandSkipped(t *testing.T, dbPath, operand, kind,
 
 	stderr := scanOK(t, operand)
 
-	warning := "walk " + operand + ": skipping " + kind + " operand\n"
+	warning := "scan: skipped " + operand + " (a " + kind + ")\n"
 	if !strings.Contains(stderr, warning) {
 		t.Errorf("stderr = %q, want %q", stderr, warning)
 	}
@@ -974,6 +1341,107 @@ func assertOperandSkipped(t *testing.T, dbPath, operand, kind,
 	recordByPath(t, dbRecords(t, db), kept)
 }
 
+// TestRunScanSkipsOperandInsideZFS scans a directory inside a .zfs
+// directory, first alone and then under another operand. Each time it
+// is warned about and counted as skipped, and nothing in it is walked.
+// The other operand is scanned as usual.
+func TestRunScanSkipsOperandInsideZFS(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	hourly := filepath.Join(dir, ".zfs", "snapshot", "hourly")
+	writeFile(t, hourly, "f", pattern(1, 10))
+	f := writeFile(t, dir, "f", pattern(2, 10))
+
+	warning := "scan: skipped " + hourly + " (inside a .zfs directory)\n"
+
+	for _, tc := range []struct {
+		operands []string
+		summary  string
+	}{
+		{
+			[]string{hourly},
+			"scan: 0 files seen (0 added, 0 updated, 0 removed, " +
+				"0 unchanged), 1 skipped\n",
+		},
+		{
+			[]string{dir, hourly},
+			"scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+				"0 unchanged), 1 skipped\n",
+		},
+	} {
+		stderr := scanOK(t, tc.operands...)
+		if !strings.Contains(stderr, warning) ||
+			!strings.Contains(stderr, tc.summary) {
+			t.Errorf("scan %q: stderr = %q, want %q and %q", tc.operands,
+				stderr, warning, tc.summary)
+		}
+	}
+
+	db, err := openDB(path, reportParams)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() { _ = db.Close() })
+
+	if got := recordPaths(dbRecords(t, db)); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
+// TestRunScanSkipsOperandThroughSymlinkIntoZFS scans snaps/daily, where
+// snaps is a symlink to pool/.zfs/snapshot. The operand is warned about
+// by its real path, counted as skipped, and not walked.
+func TestRunScanSkipsOperandThroughSymlinkIntoZFS(t *testing.T) {
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	dir := realTempDir(t)
+	writeFile(t, dir, "pool/.zfs/snapshot/daily/f", pattern(1, 10))
+
+	snaps := filepath.Join(dir, "snaps")
+	symlink(t, filepath.Join(dir, "pool", ".zfs", "snapshot"), snaps)
+
+	stderr := scanOK(t, filepath.Join(snaps, "daily"))
+
+	daily := filepath.Join(dir, "pool", ".zfs", "snapshot", "daily")
+	warning := "scan: skipped " + daily + " (inside a .zfs directory)\n"
+	summary := "scan: 0 files seen (0 added, 0 updated, 0 removed, " +
+		"0 unchanged), 1 skipped\n"
+
+	if !strings.Contains(stderr, warning) ||
+		!strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q and %q", stderr, warning, summary)
+	}
+}
+
+// TestRunScanWalksOperandThroughSymlink scans data/daily, where data is
+// a symlink to pool/data. The operand is scanned as usual, and its file
+// is recorded by its real path.
+func TestRunScanWalksOperandThroughSymlink(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	f := writeFile(t, dir, "pool/data/daily/f", pattern(1, 10))
+
+	data := filepath.Join(dir, "data")
+	symlink(t, filepath.Join(dir, "pool", "data"), data)
+
+	stderr := scanOK(t, filepath.Join(data, "daily"))
+
+	summary := "scan: 1 files seen (1 added, 0 updated, 0 removed, " +
+		"0 unchanged), 0 skipped\n"
+	if !strings.Contains(stderr, summary) {
+		t.Errorf("stderr = %q, want %q", stderr, summary)
+	}
+
+	if got := storedPaths(t, path); !slices.Equal(got, []string{f}) {
+		t.Errorf("records = %q, want %q", got, []string{f})
+	}
+}
+
 func TestRunReportSucceeds(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
@@ -1028,8 +1496,9 @@ func TestRunTreesSucceeds(t *testing.T) {
 
 	// The two directories holding the duplicate pair are duplicate
 	// trees of each other.
-	want := "first\tdupe\tfiles\tsize\n" +
-		filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) + "\t1\t300\n"
+	want := "first\tdupe\tfiles\tsize\tdisk_size\n" +
+		filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) + "\t1\t300\t" +
+		strconv.FormatInt(storedDiskSize(t, path, dupes[1]), 10) + "\n"
 	if got := stdout.String(); got != want {
 		t.Errorf("stdout = %q, want %q", got, want)
 	}
@@ -1063,9 +1532,10 @@ func TestRunReportsNeedOnlyReadAccess(t *testing.T) {
 	cases := map[string]string{
 		cmdReport: "first\tdupe\tsize\n" +
 			dupes[0] + "\t" + dupes[1] + "\t300\n",
-		cmdTrees: "first\tdupe\tfiles\tsize\n" +
+		cmdTrees: "first\tdupe\tfiles\tsize\tdisk_size\n" +
 			filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) +
-			"\t1\t300\n",
+			"\t1\t300\t" +
+			strconv.FormatInt(storedDiskSize(t, path, dupes[1]), 10) + "\n",
 	}
 
 	for name, want := range cases {
@@ -1100,8 +1570,11 @@ func assertRunsUseDatabase(t *testing.T, dir, name string) {
 		t.Errorf("report stdout = %q, want %q", got, want)
 	}
 
-	want = "first\tdupe\tfiles\tsize\n" +
-		filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) + "\t1\t300\n"
+	diskSize := storedDiskSize(t, filepath.Join(dir, name), dupes[1])
+
+	want = "first\tdupe\tfiles\tsize\tdisk_size\n" +
+		filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) + "\t1\t300\t" +
+		strconv.FormatInt(diskSize, 10) + "\n"
 	if got := runStdout(t, cmdTrees); got != want {
 		t.Errorf("trees stdout = %q, want %q", got, want)
 	}
@@ -1122,7 +1595,7 @@ func assertRunsUseDatabase(t *testing.T, dir, name string) {
 }
 
 func TestRunDatabasePathUsedAsGiven(t *testing.T) {
-	// README §Database: the path names the database file exactly. In
+	// README §Settings: the path names the database file exactly. In
 	// SQLite's connection string an unescaped ? or # would end the file
 	// name and % would start an escape, and a path starting with //
 	// could be read as a host name. %25 is a valid escape, so unescaped
@@ -1152,6 +1625,100 @@ func TestRunDatabasePathUsedAsGiven(t *testing.T) {
 	})
 }
 
+func TestRunNonRootUsesStateDirectory(t *testing.T) {
+	// README §Location: without SFDUPES_DATABASE, a user other than
+	// root keeps the database in the XDG state directory. scan creates
+	// the missing directories with mode 0700, and report and trees read
+	// the same file.
+	if os.Geteuid() == 0 {
+		t.Skip("root uses " + rootDatabasePath)
+	}
+
+	t.Cleanup(xdg.Reload)
+
+	state := filepath.Join(t.TempDir(), "state")
+	t.Setenv(stateHomeEnv, state)
+	t.Setenv(databaseEnv, "")
+	xdg.Reload()
+
+	assertRunsUseDatabase(t, filepath.Join(state, "sfdupes"), "db.sqlite")
+
+	for _, dir := range []string{state, filepath.Join(state, "sfdupes")} {
+		fi, err := os.Stat(dir)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if got := fi.Mode().Perm(); got != stateDirPerm {
+			t.Errorf("%s mode = %#o, want %#o", dir, got, stateDirPerm)
+		}
+	}
+}
+
+func TestRunNonRootDatabaseEnvDirectoryMode(t *testing.T) {
+	// README §Location: for SFDUPES_DATABASE, scan creates each missing
+	// directory with mode 755, for a user other than root too.
+	if os.Geteuid() == 0 {
+		t.Skip("needs a user other than root")
+	}
+
+	top := filepath.Join(t.TempDir(), "missing")
+	sub := filepath.Join(top, "sub")
+	t.Setenv(databaseEnv, filepath.Join(sub, "db.sqlite"))
+
+	scanOK(t, t.TempDir())
+
+	for _, dir := range []string{top, sub} {
+		fi, err := os.Stat(dir)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if got := fi.Mode().Perm(); got != dbDirPerm {
+			t.Errorf("%s mode = %#o, want %#o", dir, got, dbDirPerm)
+		}
+	}
+}
+
+func TestRunRelativeStateHomeFails(t *testing.T) {
+	// README §Location: without SFDUPES_DATABASE, a user other than
+	// root whose XDG_STATE_HOME is not an absolute path gets an error
+	// naming it from every subcommand, which exits 1 before it does
+	// anything else.
+	if os.Geteuid() == 0 {
+		t.Skip("root does not use " + stateHomeEnv)
+	}
+
+	t.Setenv(stateHomeEnv, "relative/state")
+	t.Setenv(databaseEnv, "")
+
+	want := "sfdupes: " + stateHomeEnv +
+		" must be an absolute path, got \"relative/state\"\n"
+
+	// A scan that got past the check would stop at this missing
+	// operand, before it creates anything.
+	missing := filepath.Join(t.TempDir(), "missing")
+
+	for _, args := range [][]string{
+		{cmdScan, missing}, {cmdReport}, {cmdTrees}, {cmdInfo},
+	} {
+		var stdout, stderr bytes.Buffer
+
+		code := run(args, &stdout, &stderr)
+		if code != exitFatal || stderr.String() != want {
+			t.Errorf("run(%v) = %d with stderr %q, want %d and %q",
+				args, code, stderr.String(), exitFatal, want)
+		}
+	}
+
+	// dwim scans /, so runDwim gets the missing operand instead.
+	err := runDwim(t.Context(), missing, scanOptions{workers: 1}, io.Discard)
+	if !errors.Is(err, errStateHomeNotAbsolute) {
+		t.Errorf("runDwim: error = %v, want %v", err,
+			errStateHomeNotAbsolute)
+	}
+}
+
 // holdScanLock takes the lock on the database at path, as a running
 // scan does, and holds it until the test ends. It fails the test when
 // the lock is already held.
@@ -1167,9 +1734,8 @@ func holdScanLock(t *testing.T, path string) {
 }
 
 func TestRunSecondScanFails(t *testing.T) {
-	// README §Database: while one scan holds the lock, a second scan
-	// fails at once, naming the lock file, without opening the
-	// database.
+	// README §Database: a second scan that finds the lock held fails
+	// at once, naming the lock file, without opening the database.
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
@@ -1228,7 +1794,7 @@ func assertSecondScanFails(t *testing.T, path string) {
 }
 
 func TestRunSecondScanThroughSymlinkFails(t *testing.T) {
-	// README §Database: every path to one database names the same lock
+	// README §Database: a path through a symlink names the same lock
 	// file, so while a scan holds it through one path, a scan through
 	// another fails, naming the lock file beside the database's real
 	// path.
@@ -1333,8 +1899,8 @@ func TestRunReportsDuringScan(t *testing.T) {
 }
 
 func TestRunStdoutClosedIsFatal(t *testing.T) {
-	// README §Error handling: a stdout write failure exits 1, reported
-	// in one line on stderr.
+	// README §Error handling: a failed write to stdout is a fatal error,
+	// exit 1, reported on stderr starting with "sfdupes:".
 	for _, name := range []string{cmdReport, cmdTrees, cmdInfo} {
 		t.Run(name, func(t *testing.T) {
 			t.Setenv(databaseEnv, testDBPath(t))
@@ -1383,9 +1949,13 @@ func TestStdoutWriteErrorPropagates(t *testing.T) {
 	scanFixture(t)
 
 	cases := map[string]func(context.Context, io.Writer) error{
-		cmdReport: runReport,
-		cmdTrees:  runTrees,
-		cmdInfo:   runInfo,
+		cmdReport: func(ctx context.Context, w io.Writer) error {
+			return runReport(ctx, nil, w)
+		},
+		cmdTrees: func(ctx context.Context, w io.Writer) error {
+			return runTrees(ctx, nil, w)
+		},
+		cmdInfo: runInfo,
 	}
 
 	for name, fn := range cases {

internal/sfdupes/db.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes
 
 import (
 	"context"
@@ -15,28 +15,40 @@ import (
 	"strings"
 	"time"
 
+	"github.com/adrg/xdg"
 	"golang.org/x/sys/unix"
 	// The pure-Go SQLite driver, registered as "sqlite"; keeps cgo
 	// disabled.
 	_ "modernc.org/sqlite"
 )
 
-// defaultDatabasePath is where the persistent scan database lives when
-// SFDUPES_DATABASE is not set.
-const defaultDatabasePath = "/var/lib/sfdupes/db.sqlite"
+// rootDatabasePath is the database root uses when SFDUPES_DATABASE is
+// not set.
+const rootDatabasePath = "/var/lib/sfdupes/db.sqlite"
 
 // databaseEnv is the environment variable that overrides the database
 // path.
 const databaseEnv = "SFDUPES_DATABASE"
 
+// stateHomeEnv is the environment variable that names the XDG state
+// directory.
+const stateHomeEnv = "XDG_STATE_HOME"
+
 // schemaVersion is the database schema version this build reads and
 // writes, stored in PRAGMA user_version.
 const schemaVersion = 1
 
-// dbDirPerm is the mode for a database parent directory created by
-// scan.
+// dbDirPerm is the mode for a directory scan creates for root's
+// default database or for SFDUPES_DATABASE.
 const dbDirPerm = 0o755
 
+// stateDirPerm is the mode for a directory scan creates for the
+// database at a user's default path in the XDG state directory. It is
+// the mode the XDG Base Directory specification asks for, and it keeps
+// other users from reading the database, which lists every scanned
+// path.
+const stateDirPerm = 0o700
+
 // dbFilePerm is the mode for a database file created by scan, the mode
 // SQLite gives a database file it creates.
 const dbFilePerm = 0o644
@@ -47,14 +59,15 @@ const dbFilePerm = 0o644
 const lockFilePerm = 0o600
 
 // createTableSQL is the schema applied to a fresh database. Paths are
-// BLOBs because Unix paths are raw bytes, not guaranteed UTF-8. mtime
-// holds whole Unix seconds and mtime_nsec the nanoseconds within that
-// second. head, tail and content each hold the raw 32 bytes of a
-// SHA-256.
+// BLOBs because Unix paths are raw bytes, not guaranteed UTF-8.
+// disk_size holds the bytes the file takes on disk. mtime holds whole
+// Unix seconds and mtime_nsec the nanoseconds within that second. head,
+// tail and content each hold the raw 32 bytes of a SHA-256.
 const createTableSQL = `
 CREATE TABLE files (
     path       BLOB PRIMARY KEY,
     size       INTEGER NOT NULL,
+    disk_size  INTEGER NOT NULL,
     mtime      INTEGER NOT NULL,
     mtime_nsec INTEGER NOT NULL,
     head       BLOB NOT NULL,
@@ -69,14 +82,59 @@ const createIndexSQL = `
 CREATE INDEX files_signature ON files (size, head, tail, content)
 `
 
+// createTotalsSQL creates the totals table, which holds one row: the
+// number of records and the sizes of all records added up. Counting
+// them over files would read every record. The three triggers below
+// keep the row current, in the transaction of each change to files.
+const createTotalsSQL = `
+CREATE TABLE totals (
+    records INTEGER NOT NULL,
+    size    INTEGER NOT NULL
+)
+`
+
+// insertTotalsSQL adds the one row of totals, for an empty files table.
+const insertTotalsSQL = `
+INSERT INTO totals (records, size) VALUES (0, 0)
+`
+
+// totalsAfterInsertSQL counts each inserted record into totals.
+const totalsAfterInsertSQL = `
+CREATE TRIGGER totals_after_insert AFTER INSERT ON files BEGIN
+    UPDATE totals SET records = records + 1, size = size + NEW.size;
+END
+`
+
+// totalsAfterDeleteSQL takes each deleted record out of totals.
+const totalsAfterDeleteSQL = `
+CREATE TRIGGER totals_after_delete AFTER DELETE ON files BEGIN
+    UPDATE totals SET records = records - 1, size = size - OLD.size;
+END
+`
+
+// totalsAfterUpdateSQL replaces a record's old size in totals with its
+// new one. scan's upsert of an existing record is such an update.
+const totalsAfterUpdateSQL = `
+CREATE TRIGGER totals_after_update AFTER UPDATE OF size ON files BEGIN
+    UPDATE totals SET size = size + NEW.size - OLD.size;
+END
+`
+
+// recordCountSQL reads the number of records from totals.
+const recordCountSQL = `
+SELECT records FROM totals
+`
+
 // upsertSQL inserts one file record, replacing any existing record for
 // the same path.
 const upsertSQL = `
-INSERT INTO files (path, size, mtime, mtime_nsec, head, tail, content)
-VALUES (?, ?, ?, ?, ?, ?, ?)
+INSERT INTO files (
+    path, size, disk_size, mtime, mtime_nsec, head, tail, content
+)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?)
 ON CONFLICT (path) DO UPDATE SET
-    size = excluded.size, mtime = excluded.mtime,
-    mtime_nsec = excluded.mtime_nsec,
+    size = excluded.size, disk_size = excluded.disk_size,
+    mtime = excluded.mtime, mtime_nsec = excluded.mtime_nsec,
     head = excluded.head, tail = excluded.tail,
     content = excluded.content
 `
@@ -98,48 +156,100 @@ var errScanRunning = errors.New("another scan is running")
 // 32 bytes of a SHA-256.
 var errHashSize = errors.New("hash is not 32 bytes")
 
+// errStateHomeNotAbsolute reports an XDG_STATE_HOME that is set to a
+// path that is not absolute.
+var errStateHomeNotAbsolute = errors.New(
+	stateHomeEnv + " must be an absolute path")
+
+// defaultDatabasePath is the database used when SFDUPES_DATABASE is not
+// set: rootDatabasePath for root (euid 0), and db.sqlite in the
+// directory sfdupes under the XDG state directory for any other user.
+// xdg reads XDG_STATE_HOME and HOME once, when the program starts. For
+// any other user, an XDG_STATE_HOME that is set and not an absolute
+// path is an error, where xdg would use its default instead. The path
+// is joined as text, not cleaned, for the reason absolutePath gives.
+func defaultDatabasePath(euid int) (string, error) {
+	if euid == 0 {
+		return rootDatabasePath, nil
+	}
+
+	stateHome := os.Getenv(stateHomeEnv)
+	if stateHome != "" && !filepath.IsAbs(stateHome) {
+		return "", fmt.Errorf("%w, got %q", errStateHomeNotAbsolute,
+			stateHome)
+	}
+
+	stateDir := strings.TrimSuffix(xdg.StateHome, "/")
+
+	return stateDir + "/sfdupes/db.sqlite", nil
+}
+
 // databasePath resolves the database location: SFDUPES_DATABASE when
-// set and non-empty, the compiled-in default otherwise. It returns the
-// path, with the working directory, its symlinks resolved, put in front
-// of it when it is relative, and where the path came from, "default" or
-// "from SFDUPES_DATABASE", for the line each subcommand prints first on
-// stderr.
+// set and non-empty, defaultDatabasePath otherwise. It returns the
+// path, made absolute by absolutePath, and where the path came from,
+// "default" or "from SFDUPES_DATABASE", for the line each subcommand
+// prints first on stderr.
 func databasePath() (string, string, error) {
-	path, source := defaultDatabasePath, "default"
-	if p := os.Getenv(databaseEnv); p != "" {
-		path, source = p, "from "+databaseEnv
+	path, source := os.Getenv(databaseEnv), "from "+databaseEnv
+	if path == "" {
+		def, err := defaultDatabasePath(os.Geteuid())
+		if err != nil {
+			return "", "", err
+		}
+
+		path, source = def, "default"
 	}
 
-	if filepath.IsAbs(path) {
-		return path, source, nil
-	}
-
-	// The working directory as the kernel reports it, with no symlink
-	// in it, as README "Database" says. os.Getwd may return PWD
-	// instead, which can name it through a symlink.
-	wd, err := unix.Getwd()
+	abs, err := absolutePath(path)
 	if err != nil {
 		return "", "", fmt.Errorf("resolve database path %s: %w", path, err)
 	}
 
-	// Not filepath.Abs or filepath.Join: they clean the path, which
-	// drops each ".." together with the directory name before it. When
-	// that directory is a symlink, the cleaned path names another file.
+	return abs, source, nil
+}
+
+// absolutePath returns path unchanged when it is absolute, and
+// otherwise the working directory, a "/" and path. The working
+// directory is the one the kernel reports, with no symlink in it;
+// os.Getwd may return PWD instead, which can name it through a symlink.
+// The result is not cleaned, as filepath.Abs and filepath.Join would
+// clean it. Cleaning drops each ".." together with the directory name
+// before it. When that name is a symlink, the cleaned path names
+// another file than the one the system reaches by following the symlink
+// first.
+func absolutePath(path string) (string, error) {
+	if filepath.IsAbs(path) {
+		return path, nil
+	}
+
+	wd, err := unix.Getwd()
+	if err != nil {
+		return "", err
+	}
+
 	// The working directory ends in "/" only when it is the root.
-	return strings.TrimSuffix(wd, "/") + "/" + path, source, nil
+	return strings.TrimSuffix(wd, "/") + "/" + path, nil
 }
 
 // createDatabaseDirectory creates the directory the database at path
 // goes in, and any directory above it, if missing. path is absolute, as
-// databasePath returns it. The directory is path with its last element
-// cut off as text, by filepath.Split. filepath.Dir would clean it,
-// dropping each ".." together with the directory name before it; when
-// that name is a symlink, the cleaned path names another directory than
-// the one the system reaches when it opens path.
+// databasePath returns it. Each directory gets mode dbDirPerm, or
+// stateDirPerm when databasePath uses a user's default path in the XDG
+// state directory: the user is not root and SFDUPES_DATABASE is unset
+// or empty. The directory is path with its last element cut off as
+// text, by filepath.Split. filepath.Dir would clean it, dropping each
+// ".." together with the directory name before it; when that name is a
+// symlink, the cleaned path names another directory than the one the
+// system reaches when it opens path.
 func createDatabaseDirectory(path string) error {
 	dir, _ := filepath.Split(path)
 
-	err := os.MkdirAll(dir, dbDirPerm)
+	perm := os.FileMode(dbDirPerm)
+	if os.Geteuid() != 0 && os.Getenv(databaseEnv) == "" {
+		perm = stateDirPerm
+	}
+
+	err := os.MkdirAll(dir, perm)
 	if err != nil {
 		return fmt.Errorf("create database directory: %w", err)
 	}
@@ -150,9 +260,14 @@ func createDatabaseDirectory(path string) error {
 // scanParams are the connection parameters for scan: read-write, with
 // WAL journaling and a busy timeout, so a report can run while a cron
 // scan is in progress. closeScanDatabase leaves WAL mode again.
+//
+// Each write to files fires a trigger, so SQLite keeps a statement
+// journal for it. temp_store(MEMORY) keeps that journal in memory,
+// which costs far less than a temporary file.
 const scanParams = "_pragma=busy_timeout(10000)" +
 	"&_pragma=journal_mode(WAL)" +
-	"&_pragma=synchronous(NORMAL)"
+	"&_pragma=synchronous(NORMAL)" +
+	"&_pragma=temp_store(MEMORY)"
 
 // reportParams are the connection parameters for report, trees and
 // info: read-only, with the same busy timeout. They set no journal
@@ -426,14 +541,14 @@ func createSchema(ctx context.Context, db *sql.DB) error {
 
 	defer func() { _ = tx.Rollback() }()
 
-	_, err = tx.ExecContext(ctx, createTableSQL)
-	if err != nil {
-		return fmt.Errorf("create schema: %w", err)
-	}
-
-	_, err = tx.ExecContext(ctx, createIndexSQL)
-	if err != nil {
-		return fmt.Errorf("create schema: %w", err)
+	for _, stmt := range []string{
+		createTableSQL, createIndexSQL, createTotalsSQL, insertTotalsSQL,
+		totalsAfterInsertSQL, totalsAfterDeleteSQL, totalsAfterUpdateSQL,
+	} {
+		_, err = tx.ExecContext(ctx, stmt)
+		if err != nil {
+			return fmt.Errorf("create schema: %w", err)
+		}
 	}
 
 	_, err = tx.ExecContext(ctx,
@@ -480,7 +595,7 @@ func loadFileRows(ctx context.Context, db *sql.DB, total func(n int64),
 
 	var n int64
 
-	err = tx.QueryRowContext(ctx, "SELECT COUNT(*) FROM files").Scan(&n)
+	err = tx.QueryRowContext(ctx, recordCountSQL).Scan(&n)
 	if err != nil {
 		return fmt.Errorf("count records: %w", err)
 	}
@@ -488,8 +603,8 @@ func loadFileRows(ctx context.Context, db *sql.DB, total func(n int64),
 	total(n)
 
 	rows, err := tx.QueryContext(ctx,
-		"SELECT path, size, mtime, mtime_nsec, head, tail, content "+
-			"FROM files ORDER BY path")
+		"SELECT path, size, disk_size, mtime, mtime_nsec, head, tail, "+
+			"content FROM files ORDER BY path")
 	if err != nil {
 		return fmt.Errorf("read records: %w", err)
 	}
@@ -503,7 +618,8 @@ func loadFileRows(ctx context.Context, db *sql.DB, total func(n int64),
 			r                         scanRec
 		)
 
-		err = rows.Scan(&path, &r.size, &sec, &nsec, &head, &tail, &content)
+		err = rows.Scan(&path, &r.size, &r.diskSize, &sec, &nsec,
+			&head, &tail, &content)
 		if err != nil {
 			return fmt.Errorf("read record: %w", err)
 		}
@@ -538,10 +654,11 @@ ORDER BY size DESC, head DESC, tail DESC, content DESC
 `
 
 // loadSignatureRows gives total the number of records, then streams
-// every record's signature and path to fn, without its mtime, in the
-// order of signatureRowsSQL. The count and the records are read in one
-// transaction, so they agree while a scan is committing. An error from
-// fn stops the reading and is returned as it is.
+// every record's signature and path to fn, without its mtime or its
+// disk_size, in the order of signatureRowsSQL. The count and the
+// records are read in one transaction, so they agree while a scan is
+// committing. An error from fn stops the reading and is returned as it
+// is.
 func loadSignatureRows(ctx context.Context, db *sql.DB,
 	total func(n int64), fn func(r scanRec) error,
 ) error {
@@ -556,7 +673,7 @@ func loadSignatureRows(ctx context.Context, db *sql.DB,
 
 	var n int64
 
-	err = tx.QueryRowContext(ctx, "SELECT COUNT(*) FROM files").Scan(&n)
+	err = tx.QueryRowContext(ctx, recordCountSQL).Scan(&n)
 	if err != nil {
 		return fmt.Errorf("count records: %w", err)
 	}
@@ -622,7 +739,7 @@ func (r *scanRec) setHashes(head, tail, content []byte) error {
 func countRecords(ctx context.Context, db *sql.DB) (int64, error) {
 	var n int64
 
-	err := db.QueryRowContext(ctx, "SELECT COUNT(*) FROM files").Scan(&n)
+	err := db.QueryRowContext(ctx, recordCountSQL).Scan(&n)
 	if err != nil {
 		return 0, fmt.Errorf("count records: %w", err)
 	}
@@ -630,12 +747,10 @@ func countRecords(ctx context.Context, db *sql.DB) (int64, error) {
 	return n, nil
 }
 
-// databaseCountsSQL counts the records and adds up their sizes, in one
-// pass over the table. A SUM over no rows is NULL, so on an empty table
-// the SUM falls back to 0.
+// databaseCountsSQL reads the number of records and the sizes of all
+// records added up from totals.
 const databaseCountsSQL = `
-SELECT COUNT(*), COALESCE(SUM(size), 0)
-FROM files
+SELECT records, size FROM totals
 `
 
 // databaseCounts is what info reads from the database: its schema
@@ -678,15 +793,15 @@ func readDatabaseCounts(ctx context.Context,
 	return c, nil
 }
 
-// loadFileMeta streams every record's path, size and mtime to fn. Scan
-// change detection needs no hash values, and skipping the hash columns
-// keeps the scan's in-memory index small on multi-million-file
-// databases.
+// loadFileMeta streams every record's path, size, disk_size and mtime
+// to fn. Scan change detection needs no hash values, and skipping the
+// hash columns keeps the scan's in-memory index small on
+// multi-million-file databases.
 func loadFileMeta(ctx context.Context, db *sql.DB,
-	fn func(path string, size int64, mtime time.Time),
+	fn func(path string, m fileMeta),
 ) error {
 	rows, err := db.QueryContext(ctx,
-		"SELECT path, size, mtime, mtime_nsec FROM files")
+		"SELECT path, size, disk_size, mtime, mtime_nsec FROM files")
 	if err != nil {
 		return fmt.Errorf("read records: %w", err)
 	}
@@ -695,16 +810,19 @@ func loadFileMeta(ctx context.Context, db *sql.DB,
 
 	for rows.Next() {
 		var (
-			path            []byte
-			size, sec, nsec int64
+			path      []byte
+			m         fileMeta
+			sec, nsec int64
 		)
 
-		err = rows.Scan(&path, &size, &sec, &nsec)
+		err = rows.Scan(&path, &m.size, &m.diskSize, &sec, &nsec)
 		if err != nil {
 			return fmt.Errorf("read record: %w", err)
 		}
 
-		fn(string(path), size, time.Unix(sec, nsec))
+		m.mtime = time.Unix(sec, nsec)
+
+		fn(string(path), m)
 	}
 
 	err = rows.Err()
@@ -722,21 +840,21 @@ func loadFileMeta(ctx context.Context, db *sql.DB,
 // WAL small and let concurrent reports observe progress.
 const updateBatchSize = 10000
 
-// applyChanges writes one scan's database changes — upserts for new and
-// changed files, deletes for vanished ones — in batched transactions.
-// Progress is rendered on prog (one increment per change).
+// applyChanges writes upserts for new and changed files and deletes for
+// vanished ones, in batched transactions. Progress is rendered on prog
+// (one increment per change).
 func applyChanges(ctx context.Context, db *sql.DB, upserts []scanRec,
 	deletes []string, prog *progress,
 ) error {
 	for batch := range slices.Chunk(upserts, updateBatchSize) {
-		err := applyBatch(ctx, db, batch, nil, prog)
+		err := applyBatch(ctx, db, batch, nil, nil, prog)
 		if err != nil {
 			return err
 		}
 	}
 
 	for batch := range slices.Chunk(deletes, updateBatchSize) {
-		err := applyBatch(ctx, db, nil, batch, prog)
+		err := applyBatch(ctx, db, nil, nil, batch, prog)
 		if err != nil {
 			return err
 		}
@@ -745,10 +863,26 @@ func applyChanges(ctx context.Context, db *sql.DB, upserts []scanRec,
 	return nil
 }
 
-// applyBatch commits one batch of upserts and deletes in a single
-// transaction.
+// applyDiskSizes writes the disk_size of each of recs into its record,
+// in batched transactions, and leaves the rest of the record alone.
+// Progress is rendered on prog (one increment per record).
+func applyDiskSizes(ctx context.Context, db *sql.DB, recs []fileRec,
+	prog *progress,
+) error {
+	for batch := range slices.Chunk(recs, updateBatchSize) {
+		err := applyBatch(ctx, db, nil, batch, nil, prog)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// applyBatch commits one batch of upserts, disk_size updates and
+// deletes in a single transaction.
 func applyBatch(ctx context.Context, db *sql.DB, upserts []scanRec,
-	deletes []string, prog *progress,
+	diskSizes []fileRec, deletes []string, prog *progress,
 ) error {
 	tx, err := db.BeginTx(ctx, nil)
 	if err != nil {
@@ -762,6 +896,11 @@ func applyBatch(ctx context.Context, db *sql.DB, upserts []scanRec,
 		return err
 	}
 
+	err = execDiskSizes(ctx, tx, diskSizes, prog)
+	if err != nil {
+		return err
+	}
+
 	err = execDeletes(ctx, tx, deletes, prog)
 	if err != nil {
 		return err
@@ -787,7 +926,7 @@ func execUpserts(ctx context.Context, tx *sql.Tx, upserts []scanRec,
 	defer func() { _ = st.Close() }()
 
 	for _, r := range upserts {
-		_, err = st.ExecContext(ctx, []byte(r.path), r.size,
+		_, err = st.ExecContext(ctx, []byte(r.path), r.size, r.diskSize,
 			r.mtime.Unix(), r.mtime.Nanosecond(),
 			r.head[:], r.tail[:], r.content[:])
 		if err != nil {
@@ -800,6 +939,31 @@ func execUpserts(ctx context.Context, tx *sql.Tx, upserts []scanRec,
 	return nil
 }
 
+// execDiskSizes sets the disk_size of the record of each of recs. It
+// does not touch size, so the totals triggers do not fire.
+func execDiskSizes(ctx context.Context, tx *sql.Tx, recs []fileRec,
+	prog *progress,
+) error {
+	st, err := tx.PrepareContext(ctx,
+		"UPDATE files SET disk_size = ? WHERE path = ?")
+	if err != nil {
+		return fmt.Errorf("prepare disk_size update: %w", err)
+	}
+
+	defer func() { _ = st.Close() }()
+
+	for _, r := range recs {
+		_, err = st.ExecContext(ctx, r.diskSize, []byte(r.path))
+		if err != nil {
+			return fmt.Errorf("update disk_size of %s: %w", r.path, err)
+		}
+
+		prog.increment()
+	}
+
+	return nil
+}
+
 // execDeletes removes the records for paths no longer present.
 func execDeletes(ctx context.Context, tx *sql.Tx, deletes []string,
 	prog *progress,

internal/sfdupes/db_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // calls the unexported database openers
 
 import (
 	"context"
@@ -9,10 +9,13 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/adrg/xdg"
 )
 
 // testDBPath returns a database path inside a fresh temp dir, with
@@ -56,11 +59,16 @@ func TestDatabasePath(t *testing.T) {
 
 	t.Chdir(dir)
 
+	defaultPath, err := defaultDatabasePath(os.Geteuid())
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	fromEnv := "from " + databaseEnv
 	cases := []struct {
 		env, path, source string
 	}{
-		{"", defaultDatabasePath, "default"},
+		{"", defaultPath, "default"},
 		{"/custom/place.sqlite", "/custom/place.sqlite", fromEnv},
 		{"/custom/link/../place.sqlite", "/custom/link/../place.sqlite",
 			fromEnv},
@@ -89,6 +97,48 @@ func TestDatabasePath(t *testing.T) {
 	}
 }
 
+func TestDefaultDatabasePath(t *testing.T) {
+	// README §Location: root's database is /var/lib/sfdupes/db.sqlite.
+	// Any other user's is db.sqlite in sfdupes under XDG_STATE_HOME, or
+	// under ~/.local/state when XDG_STATE_HOME is unset or empty. For
+	// that user, an XDG_STATE_HOME that is not an absolute path is an
+	// error.
+	if runtime.GOOS != goosLinux {
+		t.Skip("macOS has another default state directory")
+	}
+
+	t.Cleanup(xdg.Reload)
+	t.Setenv("HOME", "/home/someone")
+
+	cases := []struct {
+		euid      int
+		stateHome string
+		want      string
+		wantErr   error
+	}{
+		{0, "", rootDatabasePath, nil},
+		{0, "/elsewhere/state", rootDatabasePath, nil},
+		{0, "relative/state", rootDatabasePath, nil},
+		{1000, "", "/home/someone/.local/state/sfdupes/db.sqlite", nil},
+		{1000, "relative/state", "", errStateHomeNotAbsolute},
+		{1000, "~/state", "", errStateHomeNotAbsolute},
+		{1000, "/elsewhere/state", "/elsewhere/state/sfdupes/db.sqlite", nil},
+		{1000, "/elsewhere/state/", "/elsewhere/state/sfdupes/db.sqlite", nil},
+	}
+
+	for _, tc := range cases {
+		t.Setenv(stateHomeEnv, tc.stateHome)
+		xdg.Reload()
+
+		got, err := defaultDatabasePath(tc.euid)
+		if got != tc.want || !errors.Is(err, tc.wantErr) {
+			t.Errorf("defaultDatabasePath(%d) with %s=%q = %q, %v; want %q, %v",
+				tc.euid, stateHomeEnv, tc.stateHome, got, err, tc.want,
+				tc.wantErr)
+		}
+	}
+}
+
 func TestOpenScanDatabaseCreates(t *testing.T) {
 	t.Parallel()
 
@@ -535,17 +585,12 @@ func TestLoadRowsRefuseWrongSizeHash(t *testing.T) {
 	}
 }
 
-// TestSignatureRowsNeedNoSort checks that SQLite reads signatureRowsSQL
-// from the files_signature index alone, with nothing to sort: the
-// first record comes at once, so report's read phase counts each
-// record as it comes rather than waiting on SQLite for all of them.
-func TestSignatureRowsNeedNoSort(t *testing.T) {
-	t.Parallel()
+// queryPlan returns the detail of each line of SQLite's EXPLAIN QUERY
+// PLAN for query.
+func queryPlan(t *testing.T, db *sql.DB, query string) []string {
+	t.Helper()
 
-	db := openTestDB(t)
-
-	rows, err := db.QueryContext(t.Context(),
-		"EXPLAIN QUERY PLAN "+signatureRowsSQL)
+	rows, err := db.QueryContext(t.Context(), "EXPLAIN QUERY PLAN "+query)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -573,12 +618,164 @@ func TestSignatureRowsNeedNoSort(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	return plan
+}
+
+// TestSignatureRowsNeedNoSort checks that SQLite reads signatureRowsSQL
+// from the files_signature index alone, with nothing to sort: the
+// first record comes at once, so report's read phase counts each
+// record as it comes rather than waiting on SQLite for all of them.
+func TestSignatureRowsNeedNoSort(t *testing.T) {
+	t.Parallel()
+
+	db := openTestDB(t)
+
+	plan := queryPlan(t, db, signatureRowsSQL)
+
 	want := []string{"SCAN files USING COVERING INDEX files_signature"}
 	if !slices.Equal(plan, want) {
 		t.Errorf("query plan = %q, want %q", plan, want)
 	}
 }
 
+// TestCountsReadOnlyTotals checks that SQLite answers the queries for
+// the number of records and their total size from the one row of
+// totals. A plan that reads files or its index reads every record.
+func TestCountsReadOnlyTotals(t *testing.T) {
+	t.Parallel()
+
+	db := openTestDB(t)
+
+	for _, query := range []string{recordCountSQL, databaseCountsSQL} {
+		plan := queryPlan(t, db, query)
+
+		want := []string{"SCAN totals"}
+		if !slices.Equal(plan, want) {
+			t.Errorf("query plan of %q = %q, want %q", query, plan, want)
+		}
+	}
+}
+
+// TestCountsComeFromTotals sets the row of totals to numbers that files
+// does not hold, then checks that scan's load phase, the read phases of
+// trees and report, and info each report the numbers from totals.
+func TestCountsComeFromTotals(t *testing.T) {
+	t.Parallel()
+
+	// files is empty, so a count over files gives 0 records of 0 bytes.
+	const records, size = 7, 9000
+
+	db := openTestDB(t)
+
+	_, err := db.ExecContext(t.Context(),
+		"UPDATE totals SET records = ?, size = ?", records, size)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scanTotal, err := countRecords(t.Context(), db)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var treesTotal, reportTotal int64
+
+	err = loadFileRows(t.Context(), db,
+		func(n int64) { treesTotal = n }, func(scanRec) {})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = loadSignatureRows(t.Context(), db,
+		func(n int64) { reportTotal = n },
+		func(scanRec) error { return nil })
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := readDatabaseCounts(t.Context(), db)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for name, got := range map[string]int64{
+		"scan's load":   scanTotal,
+		"trees' read":   treesTotal,
+		"report's read": reportTotal,
+		"info":          info.records,
+	} {
+		if got != records {
+			t.Errorf("%s: %d records, want %d from totals",
+				name, got, records)
+		}
+	}
+
+	if info.size != size {
+		t.Errorf("info: size %d, want %d from totals", info.size, size)
+	}
+}
+
+// assertTotalsMatchFiles fails unless the row of totals holds the
+// number of records and the sizes of all records added up, as counted
+// over files.
+func assertTotalsMatchFiles(t *testing.T, db *sql.DB) {
+	t.Helper()
+
+	got, err := readDatabaseCounts(t.Context(), db)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var records, size int64
+
+	err = db.QueryRowContext(t.Context(),
+		"SELECT COUNT(*), COALESCE(SUM(size), 0) FROM files").
+		Scan(&records, &size)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got.records != records || got.size != size {
+		t.Errorf("totals = %d records of %d bytes, files holds %d of %d",
+			got.records, got.size, records, size)
+	}
+}
+
+// TestTotalsMatchFiles scans the smoke tree, rescans it after two files
+// change size, and rescans it after two files are removed. After each
+// scan the row of totals must agree with files.
+func TestTotalsMatchFiles(t *testing.T) {
+	t.Parallel()
+
+	dir := buildSmokeTree(t)
+	db := openTestDB(t)
+
+	syncTree(t, db, dir)
+	assertTotalsMatchFiles(t, db)
+
+	writeFile(t, dir, "a/one.bin", pattern(10, 2500))
+	writeFile(t, dir, "t1/f1", pattern(30, 1000))
+
+	if st := syncTree(t, db, dir); st.updated != 2 {
+		t.Fatalf("rescan stats = %+v, want 2 updated", st)
+	}
+
+	assertTotalsMatchFiles(t, db)
+
+	for _, name := range []string{"a/unique.bin", "t2/sub/f2"} {
+		err := os.Remove(filepath.Join(dir, name))
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if st := syncTree(t, db, dir); st.removed != 2 {
+		t.Fatalf("rescan stats = %+v, want 2 removed", st)
+	}
+
+	assertTotalsMatchFiles(t, db)
+}
+
 func TestApplyChangesRoundTrip(t *testing.T) {
 	t.Parallel()
 

internal/sfdupes/dwim.go

@@ -0,0 +1,38 @@
+package sfdupes
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+)
+
+// runDwim implements the dwim subcommand: it runs what "sfdupes scan
+// root" runs with the scan flags in opts, then what "sfdupes trees"
+// runs, and ends with a line on stderr saying how to print the report
+// again. The dwim command passes "/" as root. It catches SIGINT and
+// SIGTERM as scan does, but only during the scan. An error from the
+// scan, an interrupt included, ends it before the report. During the
+// report, a signal ends it at once, as it ends trees.
+func runDwim(
+	ctx context.Context, root string, opts scanOptions, stdout io.Writer,
+) error {
+	scanCtx, stop := interruptContext(ctx)
+	err := runScan(scanCtx, []string{root}, opts)
+
+	stop()
+
+	if err != nil {
+		return err
+	}
+
+	err = runTrees(ctx, nil, stdout)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintln(os.Stderr,
+		`dwim: run "sfdupes trees" to print this report again`)
+
+	return nil
+}

internal/sfdupes/dwim_test.go

@@ -0,0 +1,210 @@
+package sfdupes //nolint:testpackage // calls the unexported runDwim
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestRunDwimPrintsLargestTreesFirst(t *testing.T) {
+	// dwim scans its root, then prints the trees report, the larger of
+	// two duplicate-tree pairs first, and ends by saying how to print
+	// the report again.
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	root := realTempDir(t)
+
+	small := []string{
+		filepath.Dir(writeFile(t, root, "a1/f.bin", pattern(1, 300))),
+		filepath.Dir(writeFile(t, root, "a2/f.bin", pattern(1, 300))),
+	}
+	large := []string{
+		filepath.Dir(writeFile(t, root, "b1/f.bin", pattern(2, 5000))),
+		filepath.Dir(writeFile(t, root, "b2/f.bin", pattern(2, 5000))),
+	}
+
+	var stdout bytes.Buffer
+
+	stderr := captureStderr(t)
+
+	err := runDwim(t.Context(), root, scanOptions{workers: 1}, &stdout)
+	if err != nil {
+		t.Fatalf("runDwim: %v; stderr: %s", err, stderr())
+	}
+
+	lines := strings.Split(strings.TrimSuffix(stdout.String(), "\n"), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("stdout = %q, want a header and two groups",
+			stdout.String())
+	}
+
+	wantFirst := large[0] + "\t" + large[1] + "\t1\t5000\t"
+	if !strings.HasPrefix(lines[1], wantFirst) {
+		t.Errorf("first group = %q, want it to start %q", lines[1], wantFirst)
+	}
+
+	wantSecond := small[0] + "\t" + small[1] + "\t1\t300\t"
+	if !strings.HasPrefix(lines[2], wantSecond) {
+		t.Errorf("second group = %q, want it to start %q",
+			lines[2], wantSecond)
+	}
+
+	last := "\ndwim: run \"sfdupes trees\" to print this report again\n"
+	if got := stderr(); !strings.HasSuffix(got, last) {
+		t.Errorf("stderr = %q, want it to end %q", got, last)
+	}
+}
+
+func TestRunDwimScanErrorPrintsNoReport(t *testing.T) {
+	// A fatal scan error ends dwim before the report: a root that does
+	// not exist fails the scan as it fails scan itself.
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	missing := filepath.Join(realTempDir(t), "missing")
+
+	var stdout bytes.Buffer
+
+	stderr := captureStderr(t)
+
+	err := runDwim(t.Context(), missing, scanOptions{workers: 1}, &stdout)
+	if err == nil {
+		t.Fatal("runDwim on a missing root: error = nil, want it fatal")
+	}
+
+	if got := stdout.String(); got != "" {
+		t.Errorf("stdout = %q, want no report", got)
+	}
+
+	if got := stderr(); strings.Contains(got, "trees:") ||
+		strings.Contains(got, "dwim:") {
+		t.Errorf("stderr = %q, want nothing from trees or dwim", got)
+	}
+}
+
+func TestRunDwimExcludeLeavesTreeOut(t *testing.T) {
+	// dwim passes its --exclude paths to the scan: an excluded copy is
+	// not recorded, so its pair is not reported.
+	t.Setenv(databaseEnv, testDBPath(t))
+
+	root := realTempDir(t)
+
+	kept := []string{
+		filepath.Dir(writeFile(t, root, "a1/f.bin", pattern(1, 300))),
+		filepath.Dir(writeFile(t, root, "a2/f.bin", pattern(1, 300))),
+	}
+	writeFile(t, root, "b1/f.bin", pattern(2, 5000))
+	excluded := filepath.Dir(writeFile(t, root, "b2/f.bin", pattern(2, 5000)))
+
+	var stdout bytes.Buffer
+
+	stderr := captureStderr(t)
+
+	opts := scanOptions{workers: 1, excludePaths: []string{excluded}}
+
+	err := runDwim(t.Context(), root, opts, &stdout)
+	if err != nil {
+		t.Fatalf("runDwim: %v; stderr: %s", err, stderr())
+	}
+
+	lines := strings.Split(strings.TrimSuffix(stdout.String(), "\n"), "\n")
+	if len(lines) != 2 {
+		t.Fatalf("stdout = %q, want a header and one group",
+			stdout.String())
+	}
+
+	want := kept[0] + "\t" + kept[1] + "\t1\t300\t"
+	if !strings.HasPrefix(lines[1], want) {
+		t.Errorf("group = %q, want it to start %q", lines[1], want)
+	}
+
+	leftOut := "scan: left out " + excluded + " (--exclude)\n"
+	if got := stderr(); !strings.Contains(got, leftOut) {
+		t.Errorf("stderr = %q, want it to contain %q", got, leftOut)
+	}
+}
+
+func TestRunDwimTakesScanFlags(t *testing.T) {
+	// The dwim command parses and checks the scan flags as scan does.
+	// Each case stops before the walk of / begins, and before the
+	// database is created. "dwim --exclude /" excludes its own operand.
+	cases := map[string]struct {
+		args []string
+		code int
+		want string
+	}{
+		"--exclude /": {
+			[]string{cmdDwim, excludeFlag, "/"},
+			exitFatal,
+			"sfdupes: scan /: operand excluded by --exclude /\n",
+		},
+		"--exclude empty": {
+			[]string{cmdDwim, excludeFlag, ""},
+			exitUsage,
+			"Error: --exclude must not be empty\n",
+		},
+		"--workers 0": {
+			[]string{cmdDwim, workersFlag, "0", "-x", "--no-default-excludes"},
+			exitUsage,
+			"Error: --workers must be at least 1, got 0\n",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			path := testDBPath(t)
+			t.Setenv(databaseEnv, path)
+
+			stdout := captureStdout(t)
+			stderr := captureStderr(t)
+
+			code := run(tc.args, os.Stdout, os.Stderr)
+			if code != tc.code {
+				t.Errorf("run(%q) = %d, want %d", tc.args, code, tc.code)
+			}
+
+			if !strings.HasSuffix(stderr(), tc.want) || stdout() != "" {
+				t.Errorf("stdout, stderr = %q, %q, want \"\" and stderr "+
+					"ending %q", stdout(), stderr(), tc.want)
+			}
+
+			_, err := os.Lstat(path)
+			if !errors.Is(err, os.ErrNotExist) {
+				t.Errorf("lstat %s: %v, want no database", path, err)
+			}
+		})
+	}
+}
+
+func TestRunDwimHelpListsScanFlags(t *testing.T) {
+	t.Parallel()
+
+	// README "Subcommands" shows this usage line for dwim.
+	const want = "\n  sfdupes dwim [--workers N] [-x] [--no-default-excludes] " +
+		"[--exclude PATH]...\n"
+
+	var stdout, stderr bytes.Buffer
+
+	run([]string{cmdDwim, "-h"}, &stdout, &stderr)
+
+	if !strings.Contains(stderr.String(), want) {
+		t.Errorf("dwim -h stderr = %q, want the usage line %q",
+			stderr.String(), want)
+	}
+
+	if !strings.Contains(stderr.String(), excludeFlag+" PATH") {
+		t.Errorf("dwim -h stderr = %q, want %s PATH", stderr.String(),
+			excludeFlag)
+	}
+
+	// README "Settings": the help lists the default excludes and the
+	// filesystem types the walk never records anything on.
+	help := strings.TrimSpace(defaultExcludesHelp(runtime.GOOS))
+	if !strings.Contains(stderr.String(), help) {
+		t.Errorf("dwim -h stderr = %q, want it to hold %q", stderr.String(),
+			help)
+	}
+}

internal/sfdupes/exclude.go

@@ -1,8 +1,9 @@
-package main
+package sfdupes
 
-// This file holds two rules for the walk (README "Rules for the walk"):
+// This file holds three rules for the walk (README "Rules for the
+// walk"): the paths given with --exclude, which the scan never enters;
 // the default excludes, the paths a scan's walk does not enter below an
-// operand unless scan is given --no-default-excludes, and the
+// operand unless scan is given --no-default-excludes; and the
 // filesystems that are not persistent, on which the scan never records
 // or reads anything.
 
@@ -12,6 +13,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -43,17 +45,25 @@ const typesPerHelpLine = 6
 // readMountInfo reads.
 var errMountInfoLine = errors.New("unexpected line")
 
+// errExcludedOperand reports an operand at or below a path given with
+// --exclude.
+var errExcludedOperand = errors.New("operand excluded by --exclude")
+
 // walkRules holds the rules for the walk that a scan sets up as it
-// starts. excludes are the default excludes, or none with
-// --no-default-excludes. nonPersistent maps the device ID of every
-// mounted filesystem that is not persistent to its type; the scan
-// records and reads nothing on one of those, whatever the flags.
-// databaseFiles are the scan's own database files, which the walk
-// passes over (see databaseFiles in db.go).
+// starts. excludePaths are the paths given with --exclude, each with
+// the device ID and inode number of the file it names (see
+// excludePathInodes), which the walk neither enters nor records,
+// whatever path leads to them. defaultExcludes are the default
+// excludes, or none with --no-default-excludes. nonPersistent maps the
+// device ID of every mounted filesystem that is not persistent to its
+// type; the scan records and reads nothing on one of those, whatever
+// the flags. databaseFiles are the scan's own database files, which the
+// walk passes over (see databaseFiles in db.go).
 type walkRules struct {
-	excludes      []string
-	nonPersistent map[uint64]string
-	databaseFiles []fileRec
+	excludePaths    []fileRec
+	defaultExcludes []string
+	nonPersistent   map[uint64]string
+	databaseFiles   []fileRec
 }
 
 // defaultExcludes returns the default excludes of the system goos
@@ -62,14 +72,31 @@ type walkRules struct {
 func defaultExcludes(goos string) []string {
 	switch goos {
 	case goosLinux:
-		return []string{"/proc", "/sys", "/dev", "/run", "/tmp", "/var/tmp"}
+		// The kernel's view of the running system, temporary files, and
+		// caches that programs and package managers fill again on their
+		// own: the system's, root's and those in each home in /home.
+		return []string{
+			"/proc", "/sys", "/dev", "/run", "/tmp", "/var/tmp", "/var/cache",
+			"/root/.cache", "/root/.npm", "/root/.cargo/registry",
+			"/root/go/pkg/mod",
+			"/home/*/.cache", "/home/*/.npm", "/home/*/.cargo/registry",
+			"/home/*/go/pkg/mod",
+		}
 	case goosDarwin:
 		// A walk of / reaches everything in /System/Volumes/Data through
 		// the firmlinks, so walking it as well would record each of
-		// those files twice.
+		// those files twice. /private/var/folders holds each user's
+		// temporary files and caches. The walk reaches root's home,
+		// /var/root, as /private/var/root.
 		return []string{
 			"/dev", "/private/tmp", "/private/var/tmp", "/private/var/vm",
 			"/System/Volumes/VM", "/System/Volumes/Data",
+			"/private/var/folders", "/Library/Caches",
+			"/private/var/root/Library/Caches", "/private/var/root/.cache",
+			"/private/var/root/.npm", "/private/var/root/.cargo/registry",
+			"/private/var/root/go/pkg/mod",
+			"/Users/*/Library/Caches", "/Users/*/.cache", "/Users/*/.npm",
+			"/Users/*/.cargo/registry", "/Users/*/go/pkg/mod",
 		}
 	case goosWindows:
 		// Relative to the root of the drive an operand lies on. The
@@ -97,6 +124,88 @@ func isDefaultExclude(path string, excludes []string) bool {
 	return false
 }
 
+// excludePathInodes returns each of paths, the --exclude values, as its
+// real path (see realPaths) with the device ID and inode number of the
+// file there. The walk compares what it reaches with those, as it does
+// with the database files, so it also leaves out an --exclude path
+// spelled another way, such as in another letter case on macOS.
+func excludePathInodes(paths []string) ([]fileRec, error) {
+	resolved, err := realPaths(paths)
+	if err != nil {
+		return nil, err
+	}
+
+	files := make([]fileRec, 0, len(resolved))
+
+	for _, path := range resolved {
+		fi, err := os.Lstat(path)
+		if err != nil {
+			return nil, err
+		}
+
+		dev, ino := inodeOfInfo(fi)
+		files = append(files, fileRec{path: path, dev: dev, ino: ino})
+	}
+
+	return files, nil
+}
+
+// matchingExcludePath returns the path of the one of excludePaths with
+// the device ID and inode number of fi, an lstat result, or "" when
+// there is none.
+func matchingExcludePath(fi fs.FileInfo, excludePaths []fileRec) string {
+	dev, ino := inodeOfInfo(fi)
+	f := fileRec{dev: dev, ino: ino}
+
+	for _, exclude := range excludePaths {
+		if sameInode(exclude, f) {
+			return exclude.path
+		}
+	}
+
+	return ""
+}
+
+// checkOperandsNotExcluded returns an error when one of roots, the
+// operands, or a directory above it is one of excludePaths, the
+// --exclude paths, by device ID and inode number. The error names the
+// operand and the --exclude path. The roots are absolute, so the
+// directories above each one end at /. A path here that lstat cannot
+// read is an error too.
+func checkOperandsNotExcluded(roots []string, excludePaths []fileRec) error {
+	for _, root := range roots {
+		for path := root; ; path = filepath.Dir(path) {
+			fi, err := os.Lstat(path)
+			if err != nil {
+				return fmt.Errorf("scan %s: %w", root, err)
+			}
+
+			exclude := matchingExcludePath(fi, excludePaths)
+			if exclude != "" {
+				return fmt.Errorf("scan %s: %w %s", root, errExcludedOperand,
+					exclude)
+			}
+
+			if path == "/" {
+				break
+			}
+		}
+	}
+
+	return nil
+}
+
+// excludePathLine returns the line the scan prints for path when fi,
+// its lstat, makes it one of rules.excludePaths, and "" when it does
+// not.
+func (rules walkRules) excludePathLine(path string, fi fs.FileInfo) string {
+	if matchingExcludePath(fi, rules.excludePaths) == "" {
+		return ""
+	}
+
+	return fmt.Sprintf("scan: left out %s (--exclude)", path)
+}
+
 // nonPersistentFilesystemTypes returns the filesystem types that are
 // not persistent: filesystems that the kernel makes up or that are kept
 // in memory. devfs is the macOS filesystem of /dev; the others are
@@ -124,7 +233,7 @@ func (rules walkRules) nonPersistentLine(path string, fi fs.FileInfo) string {
 		return ""
 	}
 
-	return fmt.Sprintf("scan: skipped %s (%s, not a persistent filesystem)",
+	return fmt.Sprintf("scan: left out %s (%s, not a persistent filesystem)",
 		path, fsType)
 }
 
@@ -162,7 +271,7 @@ func readMountInfo(mountinfo io.Reader) (map[uint64]string, error) {
 	return devices, lines.Err()
 }
 
-// defaultExcludesHelp describes, for the scan command's help, the
+// defaultExcludesHelp describes, for the scan and dwim help, the
 // default excludes of the system goos names and, where the scan lists
 // the mounted filesystems, the types it never records anything on.
 func defaultExcludesHelp(goos string) string {

internal/sfdupes/exclude_darwin.go

@@ -1,6 +1,6 @@
 //go:build darwin
 
-package main
+package sfdupes
 
 import (
 	"slices"

internal/sfdupes/exclude_other.go

@@ -1,6 +1,6 @@
 //go:build !darwin
 
-package main
+package sfdupes
 
 import (
 	"fmt"

internal/sfdupes/exclude_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // checks the unexported defaultExcludes
 
 import (
 	"bytes"
@@ -14,15 +14,32 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+// excludeFlag is the scan flag that names a path the walk never enters.
+const excludeFlag = "--exclude"
+
 func TestDefaultExcludes(t *testing.T) {
 	t.Parallel()
 
-	// README "Rules for the walk": each system's list.
+	// README "Rules for the walk": the Linux and macOS lists, and none
+	// on any other system. The Windows list exists in the code only: the
+	// binary does not build for Windows, so the README leaves it out.
 	cases := map[string][]string{
-		goosLinux: {"/proc", "/sys", "/dev", "/run", "/tmp", "/var/tmp"},
+		goosLinux: {
+			"/proc", "/sys", "/dev", "/run", "/tmp", "/var/tmp", "/var/cache",
+			"/root/.cache", "/root/.npm", "/root/.cargo/registry",
+			"/root/go/pkg/mod",
+			"/home/*/.cache", "/home/*/.npm", "/home/*/.cargo/registry",
+			"/home/*/go/pkg/mod",
+		},
 		goosDarwin: {
 			"/dev", "/private/tmp", "/private/var/tmp", "/private/var/vm",
 			"/System/Volumes/VM", "/System/Volumes/Data",
+			"/private/var/folders", "/Library/Caches",
+			"/private/var/root/Library/Caches", "/private/var/root/.cache",
+			"/private/var/root/.npm", "/private/var/root/.cargo/registry",
+			"/private/var/root/go/pkg/mod",
+			"/Users/*/Library/Caches", "/Users/*/.cache", "/Users/*/.npm",
+			"/Users/*/.cargo/registry", "/Users/*/go/pkg/mod",
 		},
 		goosWindows: {
 			"pagefile.sys", "swapfile.sys", "hiberfil.sys",
@@ -58,6 +75,29 @@ func TestIsDefaultExclude(t *testing.T) {
 			t.Errorf("isDefaultExclude(%q) = %v, want %v", path, got, want)
 		}
 	}
+
+	// The Linux list matches the cache directories in /root and in each
+	// home in /home, but nothing below them and no .cache directory
+	// elsewhere.
+	linux := map[string]bool{
+		"/home/u/.cache":           true,
+		"/home/u/go/pkg/mod":       true,
+		"/root/.cache":             true,
+		"/var/cache":               true,
+		"/home/u/.cache/pip":       false,
+		"/home/u/src/.cache":       false,
+		"/srv/home/u/.cache":       false,
+		"/home/u/.cargo/bin":       false,
+		"/home/u/go/pkg/mod/cache": false,
+	}
+
+	for path, want := range linux {
+		got := isDefaultExclude(path, defaultExcludes(goosLinux))
+		if got != want {
+			t.Errorf("isDefaultExclude(%q, Linux list) = %v, want %v", path,
+				got, want)
+		}
+	}
 }
 
 func TestReadMountInfo(t *testing.T) {
@@ -186,7 +226,7 @@ func TestScanDoesNotEnterDefaultExclude(t *testing.T) {
 	unseen := writeFile(t, excluded, "new", pattern(2, 10))
 
 	st, err := syncScan(t.Context(), db, []string{dir}, 1, false,
-		walkRules{excludes: []string{excluded}})
+		walkRules{defaultExcludes: []string{excluded}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -202,7 +242,7 @@ func TestScanDoesNotEnterDefaultExclude(t *testing.T) {
 		t.Errorf("%s recorded: the walk entered %s", unseen, excluded)
 	}
 
-	line := "\nscan: skipped " + excluded + " (default exclude)\n"
+	line := "\nscan: left out " + excluded + " (default exclude)\n"
 	if !strings.Contains(stderr(), line) {
 		t.Errorf("stderr = %q, want %q", stderr(), line)
 	}
@@ -232,7 +272,7 @@ func TestScanWalksOperandInDefaultExclude(t *testing.T) {
 			db := openTestDB(t)
 
 			st, err := syncScan(t.Context(), db, roots, 1, false,
-				walkRules{excludes: []string{excluded}})
+				walkRules{defaultExcludes: []string{excluded}})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -260,7 +300,7 @@ func TestScanNamesNoDefaultExcludeThatIsAnOperand(t *testing.T) {
 	f := writeFile(t, excluded, "f", pattern(1, 10))
 
 	st, err := syncScan(t.Context(), db, []string{dir, excluded}, 1, false,
-		walkRules{excludes: []string{excluded}})
+		walkRules{defaultExcludes: []string{excluded}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -271,7 +311,7 @@ func TestScanNamesNoDefaultExcludeThatIsAnOperand(t *testing.T) {
 
 	recordByPath(t, dbRecords(t, db), f)
 
-	if strings.Contains(stderr(), "scan: skipped") {
+	if strings.Contains(stderr(), "scan: left out") {
 		t.Errorf("stderr = %q, want no line for %s", stderr(), excluded)
 	}
 }
@@ -284,16 +324,16 @@ func TestRunScanTempDirOperand(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
-	dir := t.TempDir()
-	if !underAnyRoot(dir, defaultExcludes(runtime.GOOS)) {
+	dir := realTempDir(t)
+	if !insideDefaultExclude(dir, defaultExcludes(runtime.GOOS)) {
 		t.Skip(dir + " is not inside a default exclude")
 	}
 
 	f := writeFile(t, dir, "sub/f", pattern(1, 10))
 
 	stderr := scanOK(t, dir)
-	if strings.Contains(stderr, "scan: skipped") {
-		t.Errorf("stderr = %q, want no line saying a path was skipped",
+	if strings.Contains(stderr, "scan: left out") {
+		t.Errorf("stderr = %q, want no line saying a path was left out",
 			stderr)
 	}
 
@@ -337,7 +377,7 @@ func TestRunScanNoDefaultExcludes(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
 
-	line := "scan: skipped /var/tmp (default exclude)\n"
+	line := "scan: left out /var/tmp (default exclude)\n"
 
 	if stderr := scanOK(t, "/var"); !strings.Contains(stderr, line) {
 		t.Errorf("scan /var: stderr = %q, want %q", stderr, line)
@@ -354,6 +394,217 @@ func TestRunScanNoDefaultExcludes(t *testing.T) {
 	assertRecorded(t, path, f, true)
 }
 
+// TestRunScanExcludeNested scans a tree through the command with an
+// --exclude path two levels below the operand. The walk records nothing
+// at or below it and says so. The record an earlier scan left there is
+// kept although its file is gone.
+func TestRunScanExcludeNested(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	excluded := filepath.Join(dir, "a", "b")
+	kept := writeFile(t, dir, "a/f", pattern(1, 10))
+	gone := writeFile(t, excluded, "gone", pattern(2, 10))
+
+	scanOK(t, dir)
+
+	err := os.Remove(gone)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unseen := writeFile(t, excluded, "c/new", pattern(3, 10))
+
+	stderr := scanOK(t, excludeFlag, excluded, dir)
+
+	line := "scan: left out " + excluded + " (--exclude)\n"
+	if !strings.Contains(stderr, line) {
+		t.Errorf("stderr = %q, want %q", stderr, line)
+	}
+
+	assertRecorded(t, path, kept, true)
+	assertRecorded(t, path, gone, true)
+	assertRecorded(t, path, unseen, false)
+}
+
+// TestRunScanExcludeRepeated gives --exclude twice, once for a
+// directory and once for a file, the file through a symlink to it. The
+// walk records neither, and records the file beside them.
+func TestRunScanExcludeRepeated(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	inDir := writeFile(t, dir, "skip/f", pattern(1, 10))
+	file := writeFile(t, dir, "skip-file", pattern(2, 10))
+	kept := writeFile(t, dir, "keep", pattern(3, 10))
+
+	link := filepath.Join(t.TempDir(), "link")
+	symlink(t, file, link)
+
+	scanOK(t, excludeFlag, filepath.Dir(inDir), excludeFlag, link, dir)
+
+	assertRecorded(t, path, inDir, false)
+	assertRecorded(t, path, file, false)
+	assertRecorded(t, path, kept, true)
+}
+
+// TestRunScanExcludeReachedByAnotherPath gives --exclude a directory
+// through a symlink and a file through "..", so the walk reaches
+// neither by the path given. The walk also reaches the file through a
+// hard link. It records none of these, prints a line naming each, and
+// records the file beside them.
+func TestRunScanExcludeReachedByAnotherPath(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	dir := realTempDir(t)
+	inDir := writeFile(t, dir, "a/cache/f", pattern(1, 10))
+	file := writeFile(t, dir, "a/big", pattern(2, 10))
+	kept := writeFile(t, dir, "keep", pattern(3, 10))
+
+	hardLink := filepath.Join(dir, "big-link")
+
+	err := os.Link(file, hardLink)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	link := filepath.Join(t.TempDir(), "link")
+	symlink(t, filepath.Join(dir, "a"), link)
+
+	// Joined as text, since filepath.Join would drop the "..".
+	dotDot := dir + "/a/cache/../big"
+
+	stderr := scanOK(t, excludeFlag, filepath.Join(link, "cache"),
+		excludeFlag, dotDot, dir)
+
+	for _, leftOut := range []string{filepath.Dir(inDir), file, hardLink} {
+		line := "scan: left out " + leftOut + " (--exclude)\n"
+		if !strings.Contains(stderr, line) {
+			t.Errorf("stderr = %q, want %q", stderr, line)
+		}
+	}
+
+	assertRecorded(t, path, inDir, false)
+	assertRecorded(t, path, file, false)
+	assertRecorded(t, path, hardLink, false)
+	assertRecorded(t, path, kept, true)
+}
+
+// TestRunScanExcludedOperand checks that an operand at or below an
+// --exclude path is a fatal error that names both, and so is an
+// --exclude path that does not exist. An operand that is a hard link to
+// an --exclude file is at it. Neither scan writes a database.
+func TestRunScanExcludedOperand(t *testing.T) {
+	dir := realTempDir(t)
+	sub := filepath.Join(dir, "sub")
+	f := writeFile(t, sub, "f", pattern(1, 10))
+
+	hardLink := filepath.Join(dir, "f-link")
+
+	err := os.Link(f, hardLink)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cases := map[string]struct {
+		args []string
+		want string
+	}{
+		"at it": {
+			[]string{excludeFlag, sub, sub},
+			"scan " + sub + ": operand excluded by --exclude " + sub + "\n",
+		},
+		"below it": {
+			[]string{excludeFlag, dir, sub},
+			"scan " + sub + ": operand excluded by --exclude " + dir + "\n",
+		},
+		"after an operand it does not exclude": {
+			[]string{dir, excludeFlag, sub, sub},
+			"scan " + sub + ": operand excluded by --exclude " + sub + "\n",
+		},
+		"a hard link to it": {
+			[]string{excludeFlag, f, hardLink},
+			"scan " + hardLink + ": operand excluded by --exclude " + f + "\n",
+		},
+		"exclude missing": {
+			[]string{excludeFlag, filepath.Join(dir, "nope"), dir},
+			"--exclude: resolve " + filepath.Join(dir, "nope") + ": ",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			path := testDBPath(t)
+			t.Setenv(databaseEnv, path)
+
+			stdout := captureStdout(t)
+			stderr := captureStderr(t)
+
+			code := run(append([]string{cmdScan}, tc.args...), os.Stdout,
+				os.Stderr)
+			if code != exitFatal {
+				t.Errorf("run(scan %q) = %d, want %d", tc.args, code,
+					exitFatal)
+			}
+
+			assertFatalOutput(t, stderr(), stdout())
+
+			if !strings.Contains(stderr(), "sfdupes: "+tc.want) {
+				t.Errorf("stderr = %q, want %q", stderr(), tc.want)
+			}
+
+			_, err := os.Lstat(path)
+			if !errors.Is(err, os.ErrNotExist) {
+				t.Errorf("lstat %s: %v, want no database", path, err)
+			}
+		})
+	}
+}
+
+// TestRunScanRejectsEmptyExclude checks that an empty --exclude value,
+// given as its own argument, after "=" or after another --exclude, is
+// a usage error reported in one line before anything is scanned
+// (README "Settings").
+func TestRunScanRejectsEmptyExclude(t *testing.T) {
+	dir := t.TempDir()
+
+	cases := map[string][]string{
+		"separate":     {excludeFlag, "", dir},
+		"joined by =":  {excludeFlag + "=", dir},
+		"after a path": {excludeFlag, t.TempDir(), excludeFlag, "", dir},
+	}
+
+	for name, args := range cases {
+		t.Run(name, func(t *testing.T) {
+			path := testDBPath(t)
+			t.Setenv(databaseEnv, path)
+
+			var stdout, stderr bytes.Buffer
+
+			code := run(append([]string{cmdScan}, args...), &stdout,
+				&stderr)
+			if code != exitUsage {
+				t.Errorf("run(scan %q) = %d, want %d", args, code,
+					exitUsage)
+			}
+
+			want := "Error: --exclude must not be empty\n"
+			if stdout.String() != "" || stderr.String() != want {
+				t.Errorf("stdout, stderr = %q, %q, want \"\", %q",
+					stdout.String(), stderr.String(), want)
+			}
+
+			_, err := os.Lstat(path)
+			if !errors.Is(err, os.ErrNotExist) {
+				t.Errorf("lstat %s: %v, want no database", path, err)
+			}
+		})
+	}
+}
+
 // TestRunScanSkipsNonPersistentOperand scans, through the command, a
 // directory on a filesystem that is not persistent, with and without
 // --no-default-excludes: either way it is skipped, with a line saying
@@ -364,7 +615,7 @@ func TestRunScanSkipsNonPersistentOperand(t *testing.T) {
 
 	t.Setenv(databaseEnv, testDBPath(t))
 
-	line := "scan: skipped " + shm + " (" + fsType +
+	line := "scan: left out " + shm + " (" + fsType +
 		", not a persistent filesystem)\n"
 	summary := "scan: 0 files seen"
 
@@ -418,7 +669,7 @@ func TestScanKeepsRecordsOnNonPersistent(t *testing.T) {
 		t.Errorf("%s recorded", unseen)
 	}
 
-	line := "scan: skipped " + shm + " (" + fsType +
+	line := "scan: left out " + shm + " (" + fsType +
 		", not a persistent filesystem)\n"
 	if !strings.Contains(stderr(), line) {
 		t.Errorf("stderr = %q, want %q", stderr(), line)
@@ -451,7 +702,7 @@ func TestWalkLeavesOutNonPersistent(t *testing.T) {
 
 		leftOut = append(leftOut, ev.leftOut)
 
-		want := "scan: skipped " + ev.leftOut + " (" + fsType +
+		want := "scan: left out " + ev.leftOut + " (" + fsType +
 			", not a persistent filesystem)"
 		if ev.warn != want {
 			t.Errorf("line = %q, want %q", ev.warn, want)
@@ -495,6 +746,20 @@ func shmTempDir(t *testing.T) (string, string, walkRules) {
 	return dir, fsType, walkRules{nonPersistent: nonPersistent}
 }
 
+// insideDefaultExclude reports whether path, which is absolute and
+// clean, or a directory above it is one of excludes.
+func insideDefaultExclude(path string, excludes []string) bool {
+	for dir := path; ; dir = filepath.Dir(dir) {
+		if isDefaultExclude(dir, excludes) {
+			return true
+		}
+
+		if dir == "/" {
+			return false
+		}
+	}
+}
+
 // assertRecorded checks that the database at dbPath holds a record for
 // path when want is set, and none when it is not.
 func assertRecorded(t *testing.T, dbPath, path string, want bool) {

internal/sfdupes/info.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes
 
 import (
 	"context"
@@ -26,11 +26,11 @@ func infoPhase(name string) string {
 // it. Any database problem, including a missing database, is fatal.
 //
 // The work runs in two phases, each under a progress display of its
-// own on stderr: open (open the database) and count (count the records,
-// with one query). Each display ends before the next phase starts, and
-// before an error is returned to be printed. The details are written
-// once the last display has ended, so no display is drawn while they
-// are written.
+// own on stderr: open (open the database) and count (read the number of
+// records and their total size from the totals table). Each display
+// ends before the next phase starts, and before an error is returned
+// to be printed. The details are written once the last display has
+// ended, so no display is drawn while they are written.
 func runInfo(ctx context.Context, stdout io.Writer) error {
 	dbPath, source, err := databasePath()
 	if err != nil {
@@ -56,7 +56,7 @@ func runInfo(ctx context.Context, stdout io.Writer) error {
 
 	defer func() { _ = db.Close() }()
 
-	// One query counts everything, so the phase never has a total.
+	// One row holds both counts, so the phase never has a total.
 	prog = newProgress(progressParams{
 		label: infoPhase("count"), total: -1,
 		waitingFor: countingRecords,

internal/sfdupes/info_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // seeds the database with unexported scanRec
 
 import (
 	"fmt"

internal/sfdupes/progress.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes
 
 import (
 	"fmt"
@@ -9,8 +9,10 @@ import (
 	"strings"
 	"sync"
 	"time"
+	"unicode"
 	"unicode/utf8"
 
+	"github.com/rivo/uniseg"
 	"github.com/schollz/progressbar/v3"
 	"golang.org/x/term"
 )
@@ -60,7 +62,7 @@ const fallbackWidth = 80
 const spinnerMargin = 5
 
 // countingRecords is what the display of a phase that reads the records
-// says while it counts them, before it has its total.
+// says until it has the number of records, its total.
 const countingRecords = "counting the records"
 
 // openPhase is the name of the phase in which report, trees and info
@@ -116,7 +118,8 @@ type drawnCount struct {
 // terminal's width. A phase with an exact total ends the line with its
 // percent and bar, at the terminal's right edge, when the terminal has
 // room for them. It is drawn again every redrawInterval, so its elapsed
-// time keeps moving while the phase waits for its next item. When
+// time keeps moving while the phase waits for its next item. Each draw
+// of the walk shows the path it reached last on the line below. When
 // stderr is not a TTY it emits no ANSI redraws: it prints line as the
 // phase starts, every plainInterval while it runs, and as it ends.
 //
@@ -141,6 +144,7 @@ type progress struct {
 	estimate   bool
 	waitingFor string
 	stalledOn  string
+	path       string // the path the walk reached last; "" for none
 	count      int64
 	start      time.Time // when the phase started, for the elapsed time
 	rateStart  time.Time // when the count started, for the time remaining
@@ -239,6 +243,82 @@ func (p *progress) draw() {
 	// less the terminal's last column, which spinnerMargin keeps clear. A
 	// bar's cells take one column each but more than one byte.
 	p.widest = max(p.widest, utf8.RuneCountInString(text)+spinnerMargin-1)
+
+	if p.path != "" {
+		// The library draws the path on the line below and returns to
+		// the phase's line. The path is escaped as warnings are, and its
+		// other control characters are written out, so that the terminal
+		// shows them instead of acting on them. It stays clear of the
+		// last column, so that no terminal wraps it.
+		shown := escapeControlChars(escapePath(p.path))
+		_ = p.bar.AddDetail(cutToColumns(shown, width-1))
+	}
+}
+
+// escapeControlChars returns s with each control character written as
+// \x and its code in two hex digits, as \x1b for the escape character.
+// The control characters are U+0000 to U+001F, U+007F and U+0080 to
+// U+009F, as unicode.IsControl reports them. A byte from 0x80 to 0x9F
+// that is not part of a valid UTF-8 character is written the same way,
+// as \x9b, since a terminal not in UTF-8 mode acts on it. Every other
+// byte is kept as it is.
+func escapeControlChars(s string) string {
+	var b strings.Builder
+
+	for rest := s; rest != ""; {
+		char, size := utf8.DecodeRuneInString(rest)
+		if char == utf8.RuneError && size == 1 {
+			// Not part of a valid UTF-8 character. A terminal not in
+			// UTF-8 mode reads the byte as the character with its code,
+			// so that 0x9b is a control character there and 0xe9 is not.
+			char = rune(rest[0])
+		}
+
+		if unicode.IsControl(char) {
+			fmt.Fprintf(&b, `\x%02x`, char)
+		} else {
+			b.WriteString(rest[:size])
+		}
+
+		rest = rest[size:]
+	}
+
+	return b.String()
+}
+
+// cutToColumns returns s cut to at most columns terminal columns, at a
+// character boundary. A wide character, as in Chinese, takes two
+// columns.
+func cutToColumns(s string, columns int) string {
+	used, end, state := 0, 0, -1
+
+	for rest := s; rest != ""; {
+		char, next, width, nextState := uniseg.FirstGraphemeClusterInString(
+			rest, state)
+		if used+width > columns {
+			break
+		}
+
+		used += width
+		end += len(char)
+		rest, state = next, nextState
+	}
+
+	return s[:end]
+}
+
+// clear erases the display from the terminal: its line, and the path on
+// the line below when one is shown. p.mu must be held.
+func (p *progress) clear() {
+	if p.bar == nil {
+		return
+	}
+
+	if p.path != "" {
+		_ = p.bar.AddDetail("")
+	}
+
+	_ = p.bar.Clear()
 }
 
 // newBar has the library make what draw draws: its spinner, followed by
@@ -263,6 +343,8 @@ func (p *progress) newBar(width int) {
 		// The text carries the elapsed time and the time remaining.
 		progressbar.OptionSetElapsedTime(false),
 		progressbar.OptionSetPredictTime(false),
+		// The line below the phase's line, for the walk's path.
+		progressbar.OptionSetMaxDetailRow(1),
 	)
 	p.widest = 0
 }
@@ -314,6 +396,19 @@ func (p *progress) increment() {
 	p.lastItem = now
 }
 
+// setPath records the path the walk reached last, which a display on a
+// terminal shows at its next draw.
+func (p *progress) setPath(path string) {
+	if p == nil {
+		return
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.path = path
+}
+
 // warnf prints a one-line warning to stderr without corrupting the
 // display. The whole message is escaped like a report's path columns,
 // so a path holding a newline cannot split the warning.
@@ -327,11 +422,9 @@ func (p *progress) warnf(format string, args ...any) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
-	if p.bar != nil {
-		// The warning takes the display's line; the next draw shows
-		// the display again, on the line below.
-		_ = p.bar.Clear()
-	}
+	// The warning takes the display's line; the next draw shows the
+	// display again, on the line below.
+	p.clear()
 
 	fmt.Fprintln(os.Stderr, msg)
 }
@@ -392,9 +485,7 @@ func (w *progressWriter) Flush() error {
 		w.p.mu.Lock()
 		defer w.p.mu.Unlock()
 
-		if w.p.bar != nil {
-			_ = w.p.bar.Clear()
-		}
+		w.p.clear()
 	}
 
 	_, err := w.out.Write(w.buf)
@@ -414,6 +505,13 @@ func (p *progress) finish() {
 	close(p.stop)
 	<-p.done
 
+	// The walk's path is only for someone watching the walk. Its line is
+	// erased, and the next phase is drawn on it.
+	p.mu.Lock()
+	p.clear()
+	p.path = ""
+	p.mu.Unlock()
+
 	p.draw()
 
 	if p.width != nil {

internal/sfdupes/progress_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // drives the unexported startProgress
 
 import (
 	"fmt"
@@ -6,6 +6,7 @@ import (
 	"math"
 	"os"
 	"path/filepath"
+	"regexp"
 	"slices"
 	"strings"
 	"sync"
@@ -642,9 +643,9 @@ func TestTerminalStalledLines(t *testing.T) {
 		{label: scanPhase("hash"), stalledOn: hashStalledOn},
 		{label: scanPhase("update"), stalledOn: "db"},
 		{label: treesPhase("read"), stalledOn: "db"},
-		{label: treesPhase("group"), stalledOn: "cpu"},
+		{label: treesPhase("group"), stalledOn: "cpu/disk"},
 		{label: treesPhase("write"), stalledOn: "out"},
-		{label: reportPhase("read"), stalledOn: "db/out"},
+		{label: reportPhase("read"), stalledOn: "db/disk/out"},
 	}
 
 	for _, params := range phases {
@@ -1138,3 +1139,164 @@ func TestWarningAfterLastItemKeepsBar(t *testing.T) {
 		t.Errorf("terminal shows %q, want a count of 2 of 2", shown)
 	}
 }
+
+func TestCutToColumns(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		s       string
+		columns int
+		want    string
+	}{
+		{"/srv/a", 10, "/srv/a"},
+		{"/srv/photos", 8, "/srv/pho"},
+		// Each of these two fullwidth letters takes two columns.
+		{"/ＡＢ/a", 4, "/Ａ"},
+		{"/ＡＢ/a", 5, "/ＡＢ"},
+		// An accent that combines with the letter before stays with it.
+		{"/café/a", 5, "/café"},
+		{"/srv", 0, ""},
+	}
+
+	for _, tc := range cases {
+		if got := cutToColumns(tc.s, tc.columns); got != tc.want {
+			t.Errorf("cutToColumns(%q, %d) = %q, want %q",
+				tc.s, tc.columns, got, tc.want)
+		}
+	}
+}
+
+func TestEscapeControlChars(t *testing.T) {
+	t.Parallel()
+
+	cases := map[string]string{
+		"/srv/music":    "/srv/music",
+		"/a\x1b[2Jb":    `/a\x1b[2Jb`,
+		"/a\x00\a\x7fb": `/a\x00\x07\x7fb`,
+		// U+009B takes two bytes in UTF-8.
+		"/a\u009b2Jb": `/a\x9b2Jb`,
+		// Byte 0x9b alone is not valid UTF-8. A terminal not in UTF-8
+		// mode acts on it, as on every byte from 0x80 to 0x9f.
+		"/a\x9b2Jb":       `/a\x9b2Jb`,
+		"/a\x80\x9f\xa0b": `/a\x80\x9f` + "\xa0b",
+		// In ě, which is c4 9b in UTF-8, byte 0x9b is part of a valid
+		// character.
+		"/aě2Jb":          "/aě2Jb",
+		"/café/ＡＢ":        "/café/ＡＢ",
+		"/latin1-caf\xe9": "/latin1-caf\xe9",
+	}
+	for in, want := range cases {
+		if got := escapeControlChars(in); got != want {
+			t.Errorf("escapeControlChars(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// pathLines returns the text of each line the library wrote below a
+// display's line. It writes one as an erase to the end of the line, a
+// carriage return, the text and a newline.
+func pathLines(out string) []string {
+	matches := regexp.MustCompile("\x1b\\[K\r([^\n]*)\n").
+		FindAllStringSubmatch(out, -1)
+	lines := make([]string, 0, len(matches))
+
+	for _, m := range matches {
+		lines = append(lines, m[1])
+	}
+
+	return lines
+}
+
+// TestTerminalWalkShowsPathBelow checks that the walk's display on a
+// terminal 30 columns wide shows the path it reached last on the line
+// below, cut to 29 columns. That line is erased before a warning is
+// printed, and again when the walk ends, so the next phase is drawn on
+// an empty line.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalWalkShowsPathBelow(t *testing.T) {
+	stderr := captureStderr(t)
+	p := startProgress(progressParams{
+		label: scanPhase("walk"), unit: scanUnit, total: -1,
+	}, func() int { return 30 }, testRedraw, time.Now)
+
+	const shown = "/srv/photos/2026/holiday/beac"
+
+	p.setPath("/srv/photos/2026/holiday/beach.jpg")
+	p.increment()
+	awaitOutput(t, stderr, shown, 1)
+
+	p.warnf("warning")
+
+	before, _, _ := strings.Cut(stderr(), "warning")
+	if lines := pathLines(before); lines[len(lines)-1] != "" {
+		t.Errorf("line below shows %q as the warning is printed, want it "+
+			"empty", lines[len(lines)-1])
+	}
+
+	// Drawn again below the warning.
+	awaitOutput(t, stderr, shown, strings.Count(before, shown)+1)
+	p.finish()
+
+	lines := pathLines(stderr())
+	if !slices.Contains(lines, shown) {
+		t.Errorf("lines below the display = %q, want %q among them",
+			lines, shown)
+	}
+
+	if last := lines[len(lines)-1]; last != "" {
+		t.Errorf("line below the display shows %q after the walk, want it "+
+			"empty", last)
+	}
+}
+
+// TestTerminalWalkEscapesControlChars checks that a walked path holding
+// escape characters, which would clear the screen and set the window
+// title, puts none on the line below the walk's display. The line shows
+// each control character written out, as \x1b.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalWalkEscapesControlChars(t *testing.T) {
+	stderr := captureStderr(t)
+	p := startProgress(progressParams{
+		label: scanPhase("walk"), unit: scanUnit, total: -1,
+	}, func() int { return 80 }, testRedraw, time.Now)
+
+	p.setPath("/srv/\x1b[2J\x1b]0;title\a/beach.jpg")
+	p.increment()
+	awaitOutput(t, stderr, "beach.jpg", 1)
+	p.finish()
+
+	lines := pathLines(stderr())
+	for _, line := range lines {
+		if strings.Contains(line, "\x1b") {
+			t.Errorf("line below the display = %q, want no escape "+
+				"character", line)
+		}
+	}
+
+	const shown = `/srv/\x1b[2J\x1b]0;title\x07/beach.jpg`
+	if !slices.Contains(lines, shown) {
+		t.Errorf("lines below the display = %q, want %q among them",
+			lines, shown)
+	}
+}
+
+// TestPlainWalkShowsNoPath checks that the walk's display prints no path
+// when stderr is not a terminal.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestPlainWalkShowsNoPath(t *testing.T) {
+	stderr := captureStderr(t)
+	p := startProgress(progressParams{
+		label: scanPhase("walk"), unit: scanUnit, total: -1,
+	}, nil, testRedraw, time.Now)
+
+	p.setPath("/srv/a")
+	p.increment()
+	p.finish()
+
+	if strings.Contains(stderr(), "/srv/a") {
+		t.Errorf("stderr = %q, want no path", stderr())
+	}
+}

internal/sfdupes/report.go

@@ -1,14 +1,18 @@
-package main
+package sfdupes
 
 import (
 	"context"
 	"crypto/sha256"
 	"database/sql"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
+	"path/filepath"
 	"slices"
 	"strings"
+	"syscall"
 	"time"
 )
 
@@ -21,14 +25,16 @@ const minGroupSize = 2
 
 // scanRec is one file record from the database. The signature (size,
 // head, tail, content) is the duplicate key; mtime is informational
-// only and used by scan for change detection.
+// only and used by scan for change detection. diskSize is the bytes the
+// file takes on disk, which trees adds up.
 type scanRec struct {
-	size    int64
-	mtime   time.Time
-	head    [sha256.Size]byte
-	tail    [sha256.Size]byte
-	content [sha256.Size]byte
-	path    string
+	size     int64
+	diskSize int64
+	mtime    time.Time
+	head     [sha256.Size]byte
+	tail     [sha256.Size]byte
+	content  [sha256.Size]byte
+	path     string
 }
 
 // reportPhase names one phase of report with its place among all of
@@ -39,18 +45,25 @@ func reportPhase(name string) string {
 }
 
 // runReport implements the report subcommand: it prints the file-level
-// duplicates report as TSV on stdout. It never touches the scanned
-// filesystem; its only I/O is the database, stdout, and stderr. It
+// duplicates report as TSV on stdout, from the records at or below the
+// operands in args, or from every record when args is empty. Of the
+// scanned filesystem it only checks, with pathExists, that each path in
+// a duplicate group is still there; it never looks up an operand. It
 // names the database on stderr before it opens it. Any database
 // problem, including a missing database, is fatal.
 //
 // The work runs in two phases, each under a progress display of its
-// own on stderr: open (open the database) and read (count the records,
-// then read them in signature order, writing each size's duplicate
-// groups to stdout once that size is read; see readReport). Each
-// display ends before the next phase starts, and before an error is
-// returned to be printed.
-func runReport(ctx context.Context, stdout io.Writer) error {
+// own on stderr: open (open the database) and read (read the number of
+// records from the totals table, then read the records in signature
+// order, writing each size's duplicate groups to stdout once that size
+// is read; see readReport). Each display ends before the next phase
+// starts, and before an error is returned to be printed.
+func runReport(ctx context.Context, args []string, stdout io.Writer) error {
+	operands, err := cleanOperands(args)
+	if err != nil {
+		return err
+	}
+
 	dbPath, source, err := databasePath()
 	if err != nil {
 		return err
@@ -75,13 +88,15 @@ func runReport(ctx context.Context, stdout io.Writer) error {
 
 	defer func() { _ = db.Close() }()
 
-	// The read phase writes the report to stdout while it reads the
-	// records, so it may wait on either.
+	// The read phase checks the paths of each duplicate group on disk
+	// and writes the report to stdout while it reads the records, so it
+	// may wait on any of the three.
 	prog = newProgress(progressParams{
 		label: reportPhase("read"), unit: "records", total: -1,
-		waitingFor: countingRecords, stalledOn: "db/out",
+		waitingFor: countingRecords, stalledOn: "db/disk/out",
 	})
-	report, err := readReport(ctx, db, dbPath, stdout, prog)
+	report, err := readReport(ctx, db, dbPath, operands, stdout, pathExists,
+		prog)
 
 	prog.finish()
 
@@ -102,14 +117,17 @@ func runReport(ctx context.Context, stdout io.Writer) error {
 // dbPath, as its total, then reads every record in signature order,
 // counting each on prog, and writes the report to stdout: the header
 // line, then the rows of each size's duplicate groups once that size is
-// read. stdout may be the terminal prog is drawn on, so the lines go
+// read. Only the records that underOperand finds under operands join a
+// group, and a path for which exists returns false is left out of its
+// group. stdout may be the terminal prog is drawn on, so the lines go
 // through prog's writer. It returns what it wrote, with the totals for
 // the summary line.
 func readReport(ctx context.Context, db *sql.DB, dbPath string,
-	stdout io.Writer, prog *progress,
+	operands []string, stdout io.Writer, exists func(path string) bool,
+	prog *progress,
 ) (*reportWriter, error) {
 	out := prog.writer(stdout)
-	report := &reportWriter{out: out}
+	report := &reportWriter{out: out, exists: exists}
 
 	_, err := fmt.Fprintln(out, "first\tdupe\tsize")
 	if err != nil {
@@ -121,6 +139,12 @@ func readReport(ctx context.Context, db *sql.DB, dbPath string,
 	err = loadSignatureRows(ctx, db, prog.setTotal, func(r scanRec) error {
 		prog.increment()
 
+		report.records++
+
+		if !underOperand(r.path, operands) {
+			return nil
+		}
+
 		writeErr = report.add(r)
 
 		return writeErr
@@ -152,10 +176,14 @@ func readReport(ctx context.Context, db *sql.DB, dbPath string,
 // records of one size, so it holds only the duplicate groups of the
 // size being read, and writes them, ordered by first path, once a
 // record of a smaller size comes. It counts what the summary line
-// reports.
+// reports; readReport counts the records read.
 type reportWriter struct {
 	out io.Writer
 
+	// exists reports whether a path is still on disk. A path that is
+	// gone is left out of its group.
+	exists func(path string) bool
+
 	sig    scanRec    // the signature being read; its path is not used
 	paths  []string   // the paths read so far with sig
 	groups [][]string // the duplicate groups of sig.size, each sorted
@@ -168,8 +196,6 @@ type reportWriter struct {
 // its paths; any other ends them, and one of a smaller size first
 // writes the groups of the size before.
 func (w *reportWriter) add(r scanRec) error {
-	w.records++
-
 	if r.size == w.sig.size && r.head == w.sig.head &&
 		r.tail == w.sig.tail && r.content == w.sig.content {
 		w.paths = append(w.paths, r.path)
@@ -192,11 +218,20 @@ func (w *reportWriter) add(r scanRec) error {
 	return nil
 }
 
-// endGroup ends the paths read with w.sig: two or more are a duplicate
-// group, held with its paths sorted until writeGroups writes it.
+// endGroup ends the paths read with w.sig: two or more that are still
+// on disk are a duplicate group, held with its paths sorted until
+// writeGroups writes it. Empty files form no group, since removing one
+// frees nothing. Only the paths of a possible group are checked, never
+// a path with no duplicate or an empty file.
 func (w *reportWriter) endGroup() {
-	if len(w.paths) < minGroupSize {
-		// A path with no duplicate is dropped, and its slice reused.
+	if len(w.paths) >= minGroupSize && w.sig.size > 0 {
+		w.paths = slices.DeleteFunc(w.paths, func(p string) bool {
+			return !w.exists(p)
+		})
+	}
+
+	if len(w.paths) < minGroupSize || w.sig.size == 0 {
+		// The paths are dropped, and their slice reused.
 		w.paths = w.paths[:0]
 
 		return
@@ -243,6 +278,57 @@ func (w *reportWriter) finish() error {
 	return w.writeGroups()
 }
 
+// pathExists reports whether path is still on disk, for report and
+// trees. It is false only when lstat finds that the path, or a
+// directory above it, is gone. Any other error counts as present, so
+// a user who may not look inside a directory still sees its copies.
+func pathExists(path string) bool {
+	_, err := os.Lstat(path)
+
+	return !errors.Is(err, fs.ErrNotExist) && !errors.Is(err, syscall.ENOTDIR)
+}
+
+// cleanOperands returns the operands of report or trees, each made
+// absolute by absolutePath and then cleaned. The records hold real
+// paths, with no "." or ".." element and no repeated or trailing
+// slash, so an operand is cleaned to match them. No operand is looked
+// up on the filesystem. None is empty: rejectEmptyOperand refuses an
+// empty operand on the command line.
+func cleanOperands(args []string) ([]string, error) {
+	operands := make([]string, 0, len(args))
+
+	for _, a := range args {
+		abs, err := absolutePath(a)
+		if err != nil {
+			return nil, fmt.Errorf("resolve path %s: %w", escapePath(a), err)
+		}
+
+		operands = append(operands, filepath.Clean(abs))
+	}
+
+	return operands, nil
+}
+
+// underOperand reports whether path is one of operands or lies below
+// one of them. Each operand is clean and absolute, as cleanOperands
+// returns it. With no operands, a report covers the whole database, so
+// underOperand is true for every path.
+func underOperand(path string, operands []string) bool {
+	if len(operands) == 0 {
+		return true
+	}
+
+	for _, o := range operands {
+		// Only the root directory's clean path ends in "/".
+		dir := strings.TrimSuffix(o, "/") + "/"
+		if path == o || strings.HasPrefix(path, dir) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // escapePath returns a path as it is written in a report column (README
 // "Report output format"): a backslash, tab, newline or carriage return
 // becomes \\, \t, \n or \r, and every other byte is kept as it is.

internal/sfdupes/report_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // checks the unexported dupeGroup results
 
 import (
 	"bytes"
@@ -38,8 +38,8 @@ func awkwardPairRecs() []scanRec {
 	h, tl, c := testHash("h"), testHash("t"), testHash("c")
 
 	return []scanRec{
-		{size: 5, head: h, tail: tl, content: c, path: "/d/A/f"},
-		{size: 5, head: h, tail: tl, content: c, path: awkwardDir + "/f"},
+		{size: 5, diskSize: 4096, head: h, tail: tl, content: c, path: "/d/A/f"},
+		{size: 5, diskSize: 4096, head: h, tail: tl, content: c, path: awkwardDir + "/f"},
 	}
 }
 
@@ -72,15 +72,38 @@ type dupeGroup struct {
 	paths []string
 }
 
+// everyPathExists stands in for pathExists where a test's records name
+// made-up paths that are not on disk.
+func everyPathExists(string) bool { return true }
+
+// recsOnDisk returns a new directory and recs with each path moved
+// under it, after creating an empty file at each moved path: report and
+// trees then find every path still on disk.
+func recsOnDisk(t *testing.T, recs []scanRec) (string, []scanRec) {
+	t.Helper()
+
+	dir := realTempDir(t)
+	moved := make([]scanRec, len(recs))
+
+	for i, r := range recs {
+		r.path = writeFile(t, dir, r.path, nil)
+		moved[i] = r
+	}
+
+	return dir, moved
+}
+
 // dupeGroups returns the duplicate groups report reads from db, in
 // report order, from the rows it writes: a group's rows come together,
-// each naming the group's first path.
+// each naming the group's first path. Every path counts as still on
+// disk.
 func dupeGroups(t *testing.T, db *sql.DB) []dupeGroup {
 	t.Helper()
 
 	var out bytes.Buffer
 
-	_, err := readReport(t.Context(), db, "", &out, nil)
+	_, err := readReport(t.Context(), db, "", nil, &out, everyPathExists,
+		nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -126,8 +149,139 @@ func dupeGroupsOf(t *testing.T, recs []scanRec) []dupeGroup {
 	return dupeGroups(t, db)
 }
 
+// TestRunReportOperands runs report with operands on three copies of
+// one file, two of them under srv/photos, and a fourth copy in
+// srv/photos2, all in a new directory. Only the records at or below the
+// operands form the groups and the totals, however each operand is
+// written.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestRunReportOperands(t *testing.T) {
+	h := testHash("h")
+
+	recs := make([]scanRec, 0, 4)
+	for _, p := range []string{
+		"/a/copy", "/srv/photos/x", "/srv/photos/y", "/srv/photos2/z",
+	} {
+		recs = append(recs,
+			scanRec{size: 7, head: h, tail: h, content: h, path: p})
+	}
+
+	dir, recs := recsOnDisk(t, recs)
+	a, x, y, z := recs[0].path, recs[1].path, recs[2].path, recs[3].path
+
+	t.Setenv(databaseEnv, seedDatabase(t, recs))
+
+	header := "first\tdupe\tsize\n"
+	row := func(first, dupe string) string {
+		return first + "\t" + dupe + "\t7\n"
+	}
+	photos := header + row(x, y)
+
+	cases := map[string]struct {
+		operands []string
+		want     string
+		summary  string
+	}{
+		"directory": {[]string{dir + "/srv/photos"}, photos,
+			"1 duplicate groups, 1 dupe files, 7 B reclaimable"},
+		"trailing slash":  {[]string{dir + "/srv/photos/"}, photos, ""},
+		"dot and dot-dot": {[]string{dir + "/srv/./a/../photos"}, photos, ""},
+		"files":           {[]string{a, z}, header + row(a, z), ""},
+		"overlapping": {[]string{dir + "/srv", dir + "/srv/photos"},
+			header + row(x, y) + row(x, z), ""},
+		"root": {[]string{"/"},
+			header + row(a, x) + row(a, y) + row(a, z), ""},
+		"no record": {[]string{dir + "/srv/photo"}, header,
+			"0 duplicate groups, 0 dupe files, 0 B reclaimable"},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			var stdout bytes.Buffer
+
+			stderr := captureStderr(t)
+
+			code := run(append([]string{cmdReport}, tc.operands...),
+				&stdout, os.Stderr)
+			if code != exitOK {
+				t.Fatalf("run(report %q) = %d, want %d; stderr: %s",
+					tc.operands, code, exitOK, stderr())
+			}
+
+			if got := stdout.String(); got != tc.want {
+				t.Errorf("stdout = %q, want %q", got, tc.want)
+			}
+
+			// The records read are all four, whatever the operands.
+			summary := "report: 4 records read, " + tc.summary + "\n"
+			if got := stderr(); tc.summary != "" &&
+				!strings.HasSuffix(got, summary) {
+				t.Errorf("stderr = %q, want it to end %q", got, summary)
+			}
+		})
+	}
+}
+
+//nolint:paralleltest // t.Chdir changes the process-wide working directory
+func TestCleanOperandsMakesRelativePathsAbsolute(t *testing.T) {
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	wd, err := absolutePath(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := cleanOperands([]string{"photos/", "a/../b", "/c//d"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	want := []string{
+		filepath.Join(wd, "photos"), filepath.Join(wd, "b"), "/c/d",
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("cleanOperands = %q, want %q", got, want)
+	}
+}
+
+// TestRunReportsRejectEmptyOperand checks that an empty PATH operand of
+// report or trees, alone or after another operand, is a usage error
+// reported in one line before the database is opened (README "Error
+// handling and exit codes").
+func TestRunReportsRejectEmptyOperand(t *testing.T) {
+	cases := map[string][]string{
+		"report":           {cmdReport, ""},
+		"trees":            {cmdTrees, ""},
+		"after an operand": {cmdTrees, t.TempDir(), ""},
+	}
+
+	for name, args := range cases {
+		t.Run(name, func(t *testing.T) {
+			// No database exists there, so opening one would be a fatal
+			// error, exit 1.
+			t.Setenv(databaseEnv, testDBPath(t))
+
+			var stdout, stderr bytes.Buffer
+
+			code := run(args, &stdout, &stderr)
+			if code != exitUsage {
+				t.Errorf("run(%q) = %d, want %d", args, code, exitUsage)
+			}
+
+			want := "Error: PATH must not be empty\n"
+			if stdout.String() != "" || stderr.String() != want {
+				t.Errorf("stdout, stderr = %q, %q, want \"\", %q",
+					stdout.String(), stderr.String(), want)
+			}
+		})
+	}
+}
+
 func TestRunReportEscapesPaths(t *testing.T) {
-	t.Setenv(databaseEnv, seedDatabase(t, awkwardPairRecs()))
+	dir, recs := recsOnDisk(t, awkwardPairRecs())
+	t.Setenv(databaseEnv, seedDatabase(t, recs))
 
 	var stdout, stderr bytes.Buffer
 
@@ -138,7 +292,7 @@ func TestRunReportEscapesPaths(t *testing.T) {
 	}
 
 	want := "first\tdupe\tsize\n" +
-		`/d/\tone\ntwo\rthree\\four/f` + "\t/d/A/f\t5\n"
+		dir + `/d/\tone\ntwo\rthree\\four/f` + "\t" + dir + "/d/A/f\t5\n"
 	if got := stdout.String(); got != want {
 		t.Errorf("stdout = %q, want %q", got, want)
 	}
@@ -172,7 +326,8 @@ func TestReportStdoutFailsWhileReading(t *testing.T) {
 	// Counts the records read, and draws nothing.
 	prog := &progress{now: time.Now}
 
-	_, err = readReport(t.Context(), db, "", failingWriter{}, prog)
+	_, err = readReport(t.Context(), db, "", nil, failingWriter{},
+		everyPathExists, prog)
 	if !errors.Is(err, errWriteFailed) ||
 		!strings.HasPrefix(err.Error(), "write stdout: ") {
 		t.Errorf("error = %v, want write stdout: %v", err, errWriteFailed)
@@ -203,7 +358,8 @@ const smokeReport = "first\tdupe\tsize\n" +
 // it ends; read counts the 6 records before it reads them. The summary
 // comes last, and stdout holds the report alone.
 func TestRunReportProgressNamesEachPhase(t *testing.T) {
-	path := seedDatabase(t, smokeTreeRecs())
+	dir, recs := recsOnDisk(t, smokeTreeRecs())
+	path := seedDatabase(t, recs)
 	t.Setenv(databaseEnv, path)
 
 	stderr := captureStderr(t)
@@ -216,8 +372,9 @@ func TestRunReportProgressNamesEachPhase(t *testing.T) {
 			code, exitOK, stderr())
 	}
 
-	if got := stdout.String(); got != smokeReport {
-		t.Errorf("stdout = %q, want %q", got, smokeReport)
+	report := strings.ReplaceAll(smokeReport, "/d/", dir+"/d/")
+	if got := stdout.String(); got != report {
+		t.Errorf("stdout = %q, want %q", got, report)
 	}
 
 	// How each line starts; the rate at the end of a phase varies.
@@ -266,7 +423,8 @@ func TestReadReportOnTerminal(t *testing.T) {
 		waitingFor: countingRecords,
 	}, terminalWidth, time.Hour, time.Now)
 
-	_, err = readReport(t.Context(), db, "", os.Stderr, p)
+	_, err = readReport(t.Context(), db, "", nil, os.Stderr,
+		everyPathExists, p)
 
 	p.finish()
 
@@ -301,6 +459,8 @@ func TestRunReportsIgnoreInsertionOrder(t *testing.T) {
 		scanRec{size: 50, head: a, tail: a, content: a, path: "/x/1"},
 	)
 
+	_, recs = recsOnDisk(t, recs)
+
 	reversed := slices.Clone(recs)
 	slices.Reverse(reversed)
 
@@ -434,6 +594,141 @@ func TestDupeGroups(t *testing.T) {
 	}
 }
 
+// TestDupeGroupsLeavesOutEmptyFiles checks that empty files form no
+// duplicate group, while 1-byte files still do.
+func TestDupeGroupsLeavesOutEmptyFiles(t *testing.T) {
+	t.Parallel()
+
+	e, x := sha256.Sum256(nil), testHash("x")
+	recs := []scanRec{
+		{size: 0, head: e, tail: e, content: e, path: "/a/.gitkeep"},
+		{size: 0, head: e, tail: e, content: e, path: "/b/.gitkeep"},
+		{size: 0, head: e, tail: e, content: e, path: "/c/__init__.py"},
+		{size: 1, head: x, tail: x, content: x, path: "/tiny1"},
+		{size: 1, head: x, tail: x, content: x, path: "/tiny2"},
+	}
+
+	groups := dupeGroupsOf(t, recs)
+	if len(groups) != 1 || groups[0].size != 1 ||
+		!slices.Equal(groups[0].paths, []string{"/tiny1", "/tiny2"}) {
+		t.Fatalf("groups = %+v, want only /tiny1 /tiny2 of size 1", groups)
+	}
+}
+
+// TestReadReportChecksOnlyPossibleDuplicates checks that report asks
+// whether a path is on disk only when its signature has two or more
+// records, and never for an empty file.
+func TestReadReportChecksOnlyPossibleDuplicates(t *testing.T) {
+	t.Parallel()
+
+	a, u, e := testHash("a"), testHash("u"), sha256.Sum256(nil)
+	recs := []scanRec{
+		{size: 9, head: a, tail: a, content: a, path: "/copy/1"},
+		{size: 9, head: a, tail: a, content: a, path: "/copy/2"},
+		{size: 9, head: a, tail: a, content: a, path: "/copy/3"},
+		{size: 9, head: u, tail: u, content: u, path: "/lonely"},
+		{size: 0, head: e, tail: e, content: e, path: "/empty1"},
+		{size: 0, head: e, tail: e, content: e, path: "/empty2"},
+	}
+
+	db := openTestDB(t)
+
+	err := applyChanges(t.Context(), db, recs, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var checked []string
+
+	exists := func(path string) bool {
+		checked = append(checked, path)
+
+		return true
+	}
+
+	_, err = readReport(t.Context(), db, "", nil, io.Discard, exists, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	slices.Sort(checked)
+
+	want := []string{"/copy/1", "/copy/2", "/copy/3"}
+	if !slices.Equal(checked, want) {
+		t.Errorf("paths checked on disk = %q, want %q", checked, want)
+	}
+}
+
+// TestReadReportDropsGroupLeftWithOnePath checks that a group of two
+// paths, one of them gone, is no duplicate group. If kept, it would
+// write no row, but the summary line would count it.
+func TestReadReportDropsGroupLeftWithOnePath(t *testing.T) {
+	t.Parallel()
+
+	a := testHash("a")
+	recs := []scanRec{
+		{size: 9, head: a, tail: a, content: a, path: "/a/kept"},
+		{size: 9, head: a, tail: a, content: a, path: "/a/gone"},
+	}
+
+	db := openTestDB(t)
+
+	err := applyChanges(t.Context(), db, recs, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	exists := func(path string) bool { return path != "/a/gone" }
+
+	report, err := readReport(t.Context(), db, "", nil, io.Discard, exists,
+		nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if report.dupeGroups != 0 {
+		t.Errorf("duplicate groups = %d, want 0", report.dupeGroups)
+	}
+}
+
+// TestReadReportKeepsGroupLeftWithTwoPaths checks that a group of three
+// paths, one of them gone, is a duplicate group of the other two.
+func TestReadReportKeepsGroupLeftWithTwoPaths(t *testing.T) {
+	t.Parallel()
+
+	a := testHash("a")
+	recs := []scanRec{
+		{size: 9, head: a, tail: a, content: a, path: "/b/kept1"},
+		{size: 9, head: a, tail: a, content: a, path: "/b/gone"},
+		{size: 9, head: a, tail: a, content: a, path: "/b/kept2"},
+	}
+
+	db := openTestDB(t)
+
+	err := applyChanges(t.Context(), db, recs, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	exists := func(path string) bool { return path != "/b/gone" }
+
+	var out bytes.Buffer
+
+	report, err := readReport(t.Context(), db, "", nil, &out, exists, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if report.dupeGroups != 1 {
+		t.Errorf("duplicate groups = %d, want 1", report.dupeGroups)
+	}
+
+	want := "first\tdupe\tsize\n/b/kept1\t/b/kept2\t9\n"
+	if got := out.String(); got != want {
+		t.Errorf("stdout = %q, want %q", got, want)
+	}
+}
+
 func TestDupeGroupsContentSeparates(t *testing.T) {
 	t.Parallel()
 

internal/sfdupes/scan.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes
 
 import (
 	"cmp"
@@ -48,32 +48,30 @@ const sampleWindow = 1024 * 1024
 // and hash worker pools.
 const workQueueDepth = 1024
 
-// zfsDirName is the name of the directory in which ZFS shows a
-// filesystem's snapshots. The walk never enters one, since it would
-// list every file once per snapshot.
-const zfsDirName = ".zfs"
-
 // errInterrupted reports a scan stopped by SIGINT or SIGTERM. runScan
 // has already printed its line, so run prints nothing more.
 var errInterrupted = errors.New("scan interrupted")
 
-// fileRec carries one statted file between the scan phases. dev and
-// ino identify the underlying inode so hard-linked paths can share
-// one read; both are zero when the platform exposes no inode.
+// fileRec carries one statted file between the scan phases. diskSize is
+// the bytes the file takes on disk. dev and ino identify the underlying
+// inode so hard-linked paths can share one read; both are zero when the
+// platform exposes no inode.
 type fileRec struct {
-	path  string
-	size  int64
-	mtime time.Time
-	dev   uint64
-	ino   uint64
+	path     string
+	size     int64
+	diskSize int64
+	mtime    time.Time
+	dev      uint64
+	ino      uint64
 }
 
 // fileMeta is the in-memory index entry for one existing database
-// record: just enough for change detection. Hashes stay on disk; at
+// record: what the walk compares the file with. Hashes stay on disk; at
 // tens of millions of records they would dominate the scan's memory.
 type fileMeta struct {
-	size  int64
-	mtime time.Time
+	size     int64
+	diskSize int64
+	mtime    time.Time
 }
 
 // scanUnit is what every scan phase counts, as its progress display
@@ -100,44 +98,47 @@ func scanPhase(name string) string {
 // runs, and the lock is released after it. When ctx is cancelled, as by
 // the SIGINT or SIGTERM that interruptContext catches, the scan keeps
 // what it has hashed (see syncScan), prints how many files its walk
-// reached, and returns errInterrupted. workers must be at least 1; the
-// scan command rejects anything less. Before the lock is taken, the
-// scan lists the filesystems that are not persistent, on which the walk
-// records nothing; unless noDefaultExcludes is set, the walk does not
-// enter the default excludes either. Once the database is open, the
-// scan notes its files, which the walk passes over.
-func runScan(ctx context.Context, roots []string, workers int,
-	oneFS, noDefaultExcludes bool,
-) error {
+// reached, and returns errInterrupted. opts.workers must be at least 1;
+// the scan and dwim commands reject anything less. Before the lock is
+// taken, the scan lists the filesystems that are not persistent, on
+// which the walk records nothing; unless opts.noDefaultExcludes is set,
+// the walk does not enter the default excludes either. The walk neither
+// enters nor records the paths in opts.excludePaths, the --exclude
+// values; an operand at or below one is a fatal error. Once the
+// database is open, the scan notes its files, which the walk passes
+// over.
+func runScan(ctx context.Context, roots []string, opts scanOptions) error {
 	dbPath, source, err := databasePath()
 	if err != nil {
 		return err
 	}
 
-	// A database file missing now is created by lockScanDatabase below.
-	what := "database"
+	printDatabasePath(dbPath, source)
 
-	_, err = os.Stat(dbPath)
-	if errors.Is(err, fs.ErrNotExist) {
-		what = "new database"
-	}
-
-	fmt.Fprintf(os.Stderr, "scan: %s %s (%s)\n", what, escapePath(dbPath),
-		source)
-
-	roots, err = resolveRoots(roots)
+	roots, err = realPaths(roots)
 	if err != nil {
 		return err
 	}
 
-	nonPersistent, err := nonPersistentFilesystems()
+	var rules walkRules
+
+	rules.excludePaths, err = excludePathInodes(opts.excludePaths)
+	if err != nil {
+		return fmt.Errorf("--exclude: %w", err)
+	}
+
+	err = checkOperandsNotExcluded(roots, rules.excludePaths)
+	if err != nil {
+		return err
+	}
+
+	rules.nonPersistent, err = nonPersistentFilesystems()
 	if err != nil {
 		return fmt.Errorf("list the mounted filesystems: %w", err)
 	}
 
-	rules := walkRules{nonPersistent: nonPersistent}
-	if !noDefaultExcludes {
-		rules.excludes = defaultExcludes(runtime.GOOS)
+	if !opts.noDefaultExcludes {
+		rules.defaultExcludes = defaultExcludes(runtime.GOOS)
 	}
 
 	lock, err := lockScanDatabase(dbPath)
@@ -165,7 +166,7 @@ func runScan(ctx context.Context, roots []string, workers int,
 		return err
 	}
 
-	st, err := syncScan(ctx, db, roots, workers, oneFS, rules)
+	st, err := syncScan(ctx, db, roots, opts.workers, opts.oneFS, rules)
 	if errors.Is(err, context.Canceled) {
 		return interrupted(st.walked)
 	}
@@ -183,6 +184,21 @@ func runScan(ctx context.Context, roots []string, workers int,
 	return nil
 }
 
+// printDatabasePath prints on stderr the line that names the database
+// at dbPath, with source, saying whether it is new. A database file
+// missing now is new: lockScanDatabase creates it.
+func printDatabasePath(dbPath, source string) {
+	what := "database"
+
+	_, err := os.Stat(dbPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		what = "new database"
+	}
+
+	fmt.Fprintf(os.Stderr, "scan: %s %s (%s)\n", what, escapePath(dbPath),
+		source)
+}
+
 // interruptContext returns a copy of ctx that the first SIGINT or
 // SIGTERM cancels; the scan command runs the scan under it. stop
 // releases the signals.
@@ -211,29 +227,31 @@ func interrupted(walked int) error {
 	return errInterrupted
 }
 
-// resolveRoots converts each PATH operand to an absolute, lexically
-// cleaned path (symlinks are not resolved) and verifies that it
-// exists. Database records are keyed by absolute path, so scan results
-// must not depend on the working directory.
-func resolveRoots(roots []string) ([]string, error) {
-	abs := make([]string, 0, len(roots))
+// realPaths returns the real path of each of paths, the PATH operands
+// or the --exclude values: absolute, with every symlink in it followed.
+// Database records are keyed by that path, so scan results depend
+// neither on the working directory nor on the symlinks an operand was
+// given through. A path that cannot be resolved, because it or a
+// symlink's target does not exist or cannot be read, is a fatal error
+// before any scanning.
+func realPaths(paths []string) ([]string, error) {
+	resolved := make([]string, 0, len(paths))
 
-	for _, root := range roots {
-		a, err := filepath.Abs(root)
+	for _, path := range paths {
+		a, err := absolutePath(path)
 		if err != nil {
-			return nil, fmt.Errorf("resolve %s: %w", root, err)
+			return nil, fmt.Errorf("resolve %s: %w", path, err)
 		}
 
-		// A nonexistent operand is a fatal error before any scanning.
-		_, err = os.Lstat(a)
+		r, err := filepath.EvalSymlinks(a)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("resolve %s: %w", path, err)
 		}
 
-		abs = append(abs, a)
+		resolved = append(resolved, r)
 	}
 
-	return abs, nil
+	return resolved, nil
 }
 
 // pruneRoots drops operands already covered by another operand:
@@ -277,10 +295,9 @@ func pruneRoots(roots []string, oneFS bool, rules walkRules,
 }
 
 // walkReaches reports whether the walk of operand above reaches r, an
-// operand under it. That walk never follows a symlink. It does not
-// enter a directory named .zfs, nor a default exclude in rules, nor a
-// directory that device puts on a filesystem in rules that is not
-// persistent, nor, with -x, one that device puts on a different
+// operand under it. That walk does not enter a default exclude in
+// rules, nor a directory that device puts on a filesystem in rules that
+// is not persistent, nor, with -x, one that device puts on a different
 // filesystem than above, when device knows above's. It reaches every
 // regular file in a directory it enters, so for a regular-file operand
 // the directories checked start at its directory; they end below above.
@@ -297,16 +314,7 @@ func walkReaches(above, r string, oneFS bool, rules walkRules,
 	}
 
 	for ; dir != above; dir = filepath.Dir(dir) {
-		if isDefaultExclude(dir, rules.excludes) {
-			return false
-		}
-
-		if filepath.Base(dir) == zfsDirName {
-			return false
-		}
-
-		fi, err = os.Lstat(dir)
-		if err == nil && fi.Mode()&fs.ModeSymlink != 0 {
+		if isDefaultExclude(dir, rules.defaultExcludes) {
 			return false
 		}
 
@@ -354,11 +362,12 @@ type scanStats struct {
 // whatever remains after the walk and hash phases is deleted by the
 // update phase.
 type scanState struct {
-	db       *sql.DB
-	existing map[string]fileMeta
-	toHash   []fileRec // new and changed files: must be read
-	batch    []scanRec
-	st       scanStats
+	db        *sql.DB
+	existing  map[string]fileMeta
+	toHash    []fileRec // new and changed files: must be read
+	diskSizes []fileRec // unchanged files whose disk_size changed
+	batch     []scanRec
+	st        scanStats
 }
 
 // syncScan synchronizes the database with the filesystem under roots;
@@ -398,7 +407,8 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 ) error {
 	// Types and filesystems are checked before pruning so that an
 	// operand under a dropped one is still scanned, not dropped as lying
-	// under it.
+	// under it, and so that an operand inside a .zfs directory gets its
+	// warning even when it lies under another operand.
 	roots = pruneRoots(s.walkableRoots(roots, rules), oneFS, rules,
 		deviceOfPath)
 
@@ -426,15 +436,17 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 }
 
 // walkableRoots returns the operands the walk can start from: regular
-// files, and directories not named .zfs. Every other operand is warned
-// about, counted as skipped, and dropped. A dropped operand is no
-// longer a root, so the records stored beneath it are treated as if it
-// had not been given: those under no other root count as outside the
-// roots and are not deleted as unverified. An operand on a filesystem
-// in rules that is not persistent is dropped the same way, with a line
-// saying so that is not a warning, and is not counted as skipped. An
-// operand that fails lstat here is kept, and the walk warns about it
-// unless it no longer exists.
+// files, and directories not named .zfs, none of them inside a
+// directory named .zfs. The operands are real paths from realPaths,
+// so these checks apply to what a symlink operand points at. Every
+// other operand is warned about, counted as skipped, and dropped. A
+// dropped operand is no longer a root, so the records stored beneath it
+// are treated as if it had not been given: those under no other root
+// count as outside the roots and are not deleted as unverified. An
+// operand on a filesystem in rules that is not persistent is dropped
+// the same way, with a line saying so that is not a warning, and is not
+// counted as skipped. An operand that fails lstat here is kept, and the
+// walk warns about it unless it no longer exists.
 func (s *scanState) walkableRoots(roots []string, rules walkRules) []string {
 	kept := make([]string, 0, len(roots))
 
@@ -469,8 +481,8 @@ func (s *scanState) walkableRoots(roots []string, rules walkRules) []string {
 // included, so its display counts against the number of records.
 func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 	// Indexing tens of millions of records takes real time; without a
-	// display the scan looks hung before the walk begins. Counting them
-	// first gives the display its total.
+	// display the scan looks hung before the walk begins. The number of
+	// records, read first, gives the display its total.
 	prog := newProgress(progressParams{
 		label: scanPhase("load"), unit: scanUnit, total: -1,
 		waitingFor: countingRecords, stalledOn: "db",
@@ -486,24 +498,25 @@ func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 
 	s.existing = make(map[string]fileMeta)
 
-	return loadFileMeta(ctx, s.db,
-		func(path string, size int64, mtime time.Time) {
-			prog.increment()
+	return loadFileMeta(ctx, s.db, func(path string, m fileMeta) {
+		prog.increment()
 
-			if underAnyRoot(path, roots) {
-				s.existing[path] = fileMeta{size: size, mtime: mtime}
-			}
-		})
+		if underAnyRoot(path, roots) {
+			s.existing[path] = m
+		}
+	})
 }
 
 // walkPhase drains the walk and queues every new or changed file for
-// the hash phase. An unchanged file needs nothing more, and its record
-// counts as verified. A record at or below a path the walk left out,
-// because -x stopped at it, it is a default exclude, or it is not on a
-// persistent filesystem, counts as outside the roots: it is not
-// deleted. That does not hold below a root at or inside that path,
-// since that root's own walk verifies the records below it; nor is a
-// line printed for such a root.
+// the hash phase. An unchanged file is not read, and its record counts
+// as verified. When its disk_size differs from the record's, it is
+// queued for the update phase, which writes the new disk_size. A record
+// at or below a path the walk left out, because -x stopped at it, it is
+// an --exclude path or a default exclude, or it is not on a persistent
+// filesystem, counts as outside the roots: it is not deleted. That does
+// not hold below a root at or inside that path, since that root's own
+// walk verifies the records below it; nor is a line printed for such a
+// root.
 func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 	// The records the last scan left under the roots estimate how many
 	// files the walk will find. A first scan has none, and no estimate.
@@ -549,10 +562,11 @@ func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 
 		s.st.walked++
 
+		prog.setPath(ev.rec.path)
 		prog.increment()
 
 		old, ok := s.existing[ev.rec.path]
-		if !ok || old.size != ev.rec.size || mtimeAfter(ev.rec.mtime, old.mtime) {
+		if !ok || old.size != ev.rec.size || !ev.rec.mtime.Equal(old.mtime) {
 			s.toHash = append(s.toHash, ev.rec)
 
 			continue
@@ -561,6 +575,13 @@ func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 		delete(s.existing, ev.rec.path)
 
 		s.st.unchanged++
+
+		// The space a file takes on disk can change while its size and
+		// mtime stay the same. ZFS, for one, counts a new file's blocks
+		// up to seconds after the write.
+		if old.diskSize != ev.rec.diskSize {
+			s.diskSizes = append(s.diskSizes, ev.rec)
+		}
 	}
 
 	prog.finish()
@@ -643,8 +664,8 @@ func isDatabaseFile(f fileRec, rules walkRules) bool {
 // inode run, committing completed records to the database in batches
 // as results arrive, so a long scan persists its progress as it goes
 // (an interrupted scan resumes cheaply: the next run skips everything
-// already recorded). A run that fails to hash is warned about and
-// counted as skipped; stale records for its paths, if any, are deleted
+// already recorded). Each path of a run that fails to hash is warned
+// about and counted as skipped; stale records for them, if any, are deleted
 // by the update phase. A run whose file no longer exists gets no record
 // and no warning, and is not counted as skipped. The total counts actual
 // reads, so the display's time remaining is meaningful.
@@ -685,9 +706,12 @@ func (s *scanState) hashPhase(ctx context.Context, workers int) error {
 		}
 
 		if r.err != nil {
-			s.st.skipped += len(r.run)
+			// Every path in the run is counted, so every path gets a line.
+			for _, rec := range r.run {
+				s.st.skipped++
 
-			prog.warnf("hash %s: %v", r.run[0].path, r.err)
+				prog.warnf("%s", skippedLine(rec.path, r.err))
+			}
 
 			continue
 		}
@@ -709,12 +733,13 @@ func (s *scanState) recordRun(ctx context.Context, r hashResult) error {
 		s.resolve(rec.path)
 
 		s.batch = append(s.batch, scanRec{
-			size:    rec.size,
-			mtime:   rec.mtime,
-			head:    r.head,
-			tail:    r.tail,
-			content: r.content,
-			path:    rec.path,
+			size:     rec.size,
+			diskSize: rec.diskSize,
+			mtime:    rec.mtime,
+			head:     r.head,
+			tail:     r.tail,
+			content:  r.content,
+			path:     rec.path,
 		})
 	}
 
@@ -730,7 +755,7 @@ func (s *scanState) commitFullBatch(ctx context.Context) error {
 		return nil
 	}
 
-	err := applyBatch(ctx, s.db, s.batch, nil, nil)
+	err := applyBatch(ctx, s.db, s.batch, nil, nil, nil)
 	if err != nil {
 		return err
 	}
@@ -741,9 +766,10 @@ func (s *scanState) commitFullBatch(ctx context.Context) error {
 }
 
 // updatePhase writes the scan's tail under one progress display: the
-// final partial batch of hashed records, and deletions for every record
-// the scan did not verify (vanished files, plus paths that failed to
-// stat or hash).
+// final partial batch of hashed records, the new disk_size of every
+// unchanged file whose disk_size changed, and deletions for every
+// record the scan did not verify (vanished files, plus paths that
+// failed to stat or hash).
 func (s *scanState) updatePhase(ctx context.Context) error {
 	deletes := make([]string, 0, len(s.existing))
 	for path := range s.existing {
@@ -755,7 +781,7 @@ func (s *scanState) updatePhase(ctx context.Context) error {
 
 	s.st.removed = len(deletes)
 
-	total := len(s.batch) + len(deletes)
+	total := len(s.batch) + len(s.diskSizes) + len(deletes)
 	prog := newProgress(progressParams{
 		label: scanPhase("update"), unit: scanUnit, total: int64(total),
 		stalledOn: "db",
@@ -770,17 +796,12 @@ func (s *scanState) updatePhase(ctx context.Context) error {
 
 	s.batch = nil
 
-	return applyChanges(ctx, s.db, nil, deletes, prog)
-}
-
-// mtimeAfter reports whether mtime a is later than mtime b.
-// Not a.After(b): time.Time wraps an mtime past year 292 billion; Unix() undoes it.
-func mtimeAfter(a, b time.Time) bool {
-	if a.Unix() != b.Unix() {
-		return a.Unix() > b.Unix()
+	err = applyDiskSizes(ctx, s.db, s.diskSizes, prog)
+	if err != nil {
+		return err
 	}
 
-	return a.Nanosecond() > b.Nanosecond()
+	return applyChanges(ctx, s.db, nil, deletes, prog)
 }
 
 // underAnyRoot reports whether path is any of the roots or lies under
@@ -837,9 +858,9 @@ type dirJob struct {
 // file's statted record, a warning when fail is set, or a path the walk
 // left out: when otherFSDir is set, a directory -x did not enter
 // because it is on another filesystem than its operand, and when
-// leftOut is set, a default exclude or a directory or file on a
-// filesystem that is not persistent, with warn holding the line that
-// says so.
+// leftOut is set, an --exclude path, a default exclude or a directory or
+// file on a filesystem that is not persistent, with warn holding the
+// line that says so.
 type walkEvent struct {
 	rec        fileRec
 	warn       string
@@ -889,16 +910,24 @@ func sendEvent(ctx context.Context, events chan<- walkEvent,
 
 // operandWarning returns the one-line warning for an operand the walk
 // does not start from, naming the path and what it is, or "" for one it
-// does: a regular file, or a directory not named .zfs. Symlinks are
-// never followed, including as operands.
+// does: a regular file, or a directory not named .zfs, that is not
+// inside a directory named .zfs. realPaths has already followed the
+// operand's symlinks, so a symlink here is an operand replaced by one
+// after it was resolved, and is not followed.
 func operandWarning(root string, fi fs.FileInfo) string {
+	// The walk never enters a .zfs directory, so it starts from nothing
+	// inside one either.
+	if slices.Contains(strings.Split(filepath.Dir(root), "/"), ".zfs") {
+		return fmt.Sprintf("scan: skipped %s (inside a .zfs directory)", root)
+	}
+
 	var kind string
 
 	switch mode := fi.Mode(); {
 	case mode.IsRegular():
 		return ""
 	case mode.IsDir():
-		if filepath.Base(root) != zfsDirName {
+		if filepath.Base(root) != ".zfs" {
 			return ""
 		}
 
@@ -915,7 +944,21 @@ func operandWarning(root string, fi fs.FileInfo) string {
 		kind = "non-regular file"
 	}
 
-	return fmt.Sprintf("walk %s: skipping %s operand", root, kind)
+	return fmt.Sprintf("scan: skipped %s (a %s)", root, kind)
+}
+
+// skippedLine returns the warning for a path the scan skips because of
+// err. The reason is the error without its path, which the line already
+// names.
+func skippedLine(path string, err error) string {
+	reason := err.Error()
+
+	var pathErr *fs.PathError
+	if errors.As(err, &pathErr) {
+		reason = pathErr.Err.Error()
+	}
+
+	return fmt.Sprintf("scan: skipped %s (%s)", path, reason)
 }
 
 // seedRoot turns one PATH operand into the walk's starting state: a
@@ -938,7 +981,7 @@ func seedRoot(ctx context.Context, root string, rules walkRules,
 
 	if err != nil {
 		sendEvent(ctx, events, walkEvent{
-			warn: fmt.Sprintf("walk %s: %v", root, err),
+			warn: skippedLine(root, err),
 			fail: true,
 		})
 
@@ -960,11 +1003,12 @@ func seedRoot(ctx context.Context, root string, rules walkRules,
 
 	dev, ino := inodeOfInfo(fi)
 	rec := fileRec{
-		path:  root,
-		size:  fi.Size(),
-		mtime: fi.ModTime(),
-		dev:   dev,
-		ino:   ino,
+		path:     root,
+		size:     fi.Size(),
+		diskSize: diskSizeOfInfo(fi),
+		mtime:    fi.ModTime(),
+		dev:      dev,
+		ino:      ino,
 	}
 
 	if !isDatabaseFile(rec, rules) {
@@ -1066,7 +1110,7 @@ func walkOneDir(ctx context.Context, job dirJob, oneFS bool,
 
 	if err != nil {
 		sendEvent(ctx, events, walkEvent{
-			warn: fmt.Sprintf("walk %s: %v", job.path, err),
+			warn: skippedLine(job.path, err),
 			fail: true,
 		})
 
@@ -1111,8 +1155,9 @@ func walkOneDir(ctx context.Context, job dirJob, oneFS bool,
 // no longer exists, and one that has stopped being a regular file is
 // skipped. A file on a filesystem in rules that is not persistent, as
 // through a bind mount of one file, is not recorded: it gets an event
-// naming it instead. One of the scan's own database files in rules gets
-// no event at all.
+// naming it instead, and so does a file given with --exclude, reached
+// by any path, a hard link to it included. One of the scan's own
+// database files in rules gets no event at all.
 func emitFile(ctx context.Context, p string, e fs.DirEntry,
 	rules walkRules, events chan<- walkEvent,
 ) {
@@ -1124,7 +1169,7 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 
 	if err != nil {
 		sendEvent(ctx, events, walkEvent{
-			warn: fmt.Sprintf("stat %s: %v", p, err),
+			warn: skippedLine(p, err),
 			fail: true,
 		})
 
@@ -1136,6 +1181,10 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 	}
 
 	line := rules.nonPersistentLine(p, info)
+	if line == "" {
+		line = rules.excludePathLine(p, info)
+	}
+
 	if line != "" {
 		sendEvent(ctx, events, walkEvent{leftOut: p, warn: line})
 
@@ -1144,11 +1193,12 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 
 	dev, ino := inodeOfInfo(info)
 	rec := fileRec{
-		path:  p,
-		size:  info.Size(),
-		mtime: info.ModTime(),
-		dev:   dev,
-		ino:   ino,
+		path:     p,
+		size:     info.Size(),
+		diskSize: diskSizeOfInfo(info),
+		mtime:    info.ModTime(),
+		dev:      dev,
+		ino:      ino,
 	}
 
 	if !isDatabaseFile(rec, rules) {
@@ -1159,16 +1209,16 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 // subdirJob applies the descent rules to directory p: never enter
 // .zfs (ZFS snapshot pseudo-dirs would list every file once per
 // snapshot), never enter a directory on a filesystem in rules that is
-// not persistent, nor a default exclude in rules, and with -x never
-// enter a directory on a different filesystem than its operand. For the
-// last three it sends an event that names the directory, so the scan
-// keeps the records below it, except those below an operand at or
-// inside it.
+// not persistent, nor an --exclude path or a default exclude in rules,
+// and with -x never enter a directory on a different filesystem than
+// its operand. For all but .zfs it sends an event that names the
+// directory, so the scan keeps the records below it, except those below
+// an operand at or inside it.
 func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	parent dirJob, oneFS bool, rules walkRules,
 	events chan<- walkEvent,
 ) (dirJob, bool) {
-	if e.Name() == zfsDirName {
+	if e.Name() == ".zfs" {
 		return dirJob{}, false
 	}
 
@@ -1180,7 +1230,7 @@ func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 
 	if err != nil {
 		sendEvent(ctx, events, walkEvent{
-			warn: fmt.Sprintf("walk %s: %v", p, err),
+			warn: skippedLine(p, err),
 			fail: true,
 		})
 
@@ -1188,16 +1238,20 @@ func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	}
 
 	line := rules.nonPersistentLine(p, info)
+	if line == "" {
+		line = rules.excludePathLine(p, info)
+	}
+
 	if line != "" {
 		sendEvent(ctx, events, walkEvent{leftOut: p, warn: line})
 
 		return dirJob{}, false
 	}
 
-	if isDefaultExclude(p, rules.excludes) {
+	if isDefaultExclude(p, rules.defaultExcludes) {
 		sendEvent(ctx, events, walkEvent{
 			leftOut: p,
-			warn:    fmt.Sprintf("scan: skipped %s (default exclude)", p),
+			warn:    fmt.Sprintf("scan: left out %s (default exclude)", p),
 		})
 
 		return dirJob{}, false
@@ -1240,6 +1294,23 @@ func inodeOfInfo(fi fs.FileInfo) (uint64, uint64) {
 	return statDev(st), st.Ino
 }
 
+// statBlockSize is the unit of st_blocks in an lstat result on Linux and
+// macOS, whatever the filesystem's own block size.
+const statBlockSize = 512
+
+// diskSizeOfInfo returns the bytes a file takes on disk: its allocated
+// blocks, st_blocks × 512. On a compressed or sparse file it is less
+// than the file's size. It is 0 when the platform exposes no block
+// count.
+func diskSizeOfInfo(fi fs.FileInfo) int64 {
+	st, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0
+	}
+
+	return st.Blocks * statBlockSize
+}
+
 // hashResult carries the hashes computed for one inode run (or the
 // error that prevented computing them) from the pool's workers to the
 // hash phase. Its run leaves out the paths found removed.

internal/sfdupes/scan_dev_darwin.go

@@ -1,6 +1,6 @@
 //go:build darwin
 
-package main
+package sfdupes
 
 import "syscall"
 

internal/sfdupes/scan_dev_other.go

@@ -1,6 +1,6 @@
 //go:build !darwin
 
-package main
+package sfdupes
 
 import "syscall"
 

internal/sfdupes/scan_test.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes //nolint:testpackage // drives the unexported syncTree
 
 import (
 	"bytes"
@@ -42,6 +42,30 @@ func writeFile(t *testing.T, dir, name string, data []byte) string {
 	return p
 }
 
+// diskSizeOf returns the bytes the file at path takes on disk, from its
+// own lstat: st_blocks counts 512-byte units. ZFS counts a write's
+// blocks only when it commits the write, up to seconds later, and one
+// commit can take the file through several growing sizes. So this value
+// can change at any moment. Neither fsync nor unix.Sync hastens that,
+// but a unix.Sync call often takes long enough that the blocks are
+// counted when it returns. A test that needs the value to change waits
+// for the change. A test that compares it with a scan's disk_size reads
+// it before and after the scan. The rewrite test rescans until the two
+// reads match, then compares exactly. The other two tests fail only on
+// a disk_size outside the two reads.
+func diskSizeOf(t *testing.T, path string) int64 {
+	t.Helper()
+
+	var st syscall.Stat_t
+
+	err := syscall.Lstat(path, &st)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return st.Blocks * 512
+}
+
 // pattern returns n bytes of deterministic content seeded by tag.
 func pattern(tag byte, n int) []byte {
 	data := make([]byte, n)
@@ -728,8 +752,9 @@ func TestWalkPassesOverRemovedPaths(t *testing.T) {
 
 // TestScanWarnsAboutUnreadablePaths checks that a permission error is
 // still warned about and counted as skipped, unlike a removed path. The
-// walk reaches an unreadable directory, and a file in a directory that
-// can be read but not searched. Another such file is an operand.
+// walk reaches an unreadable directory. It also reaches a file and a
+// subdirectory in a directory that can be read but not searched. Another
+// such file is an operand.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestScanWarnsAboutUnreadablePaths(t *testing.T) {
@@ -741,6 +766,7 @@ func TestScanWarnsAboutUnreadablePaths(t *testing.T) {
 	dir := t.TempDir()
 	tree := filepath.Join(dir, "tree")
 	walked := writeFile(t, tree, "unsearchable/f", []byte("x"))
+	subdir := filepath.Join(filepath.Dir(walked), "d")
 	operand := writeFile(t, dir, "unsearchable/f", []byte("y"))
 	unreadable := filepath.Join(tree, "unreadable")
 
@@ -749,6 +775,11 @@ func TestScanWarnsAboutUnreadablePaths(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	err = os.Mkdir(subdir, 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	modes := map[string]fs.FileMode{
 		unreadable:            0,
 		filepath.Dir(walked):  0o400,
@@ -769,15 +800,16 @@ func TestScanWarnsAboutUnreadablePaths(t *testing.T) {
 	}
 
 	st := syncTree(t, openTestDB(t), tree, operand)
-	if st != (scanStats{skipped: 3}) {
-		t.Errorf("stats = %+v, want 3 skipped and nothing else", st)
+	if st != (scanStats{skipped: 4}) {
+		t.Errorf("stats = %+v, want 4 skipped and nothing else", st)
 	}
 
 	got := stderr()
 	for _, warning := range []string{
-		"walk " + unreadable + ": open " + unreadable + ": permission denied\n",
-		"stat " + walked + ": lstat " + walked + ": permission denied\n",
-		"walk " + operand + ": lstat " + operand + ": permission denied\n",
+		"scan: skipped " + unreadable + " (permission denied)\n",
+		"scan: skipped " + walked + " (permission denied)\n",
+		"scan: skipped " + subdir + " (permission denied)\n",
+		"scan: skipped " + operand + " (permission denied)\n",
 	} {
 		if !strings.Contains(got, warning) {
 			t.Errorf("stderr = %q, want %q", got, warning)
@@ -1064,12 +1096,13 @@ func TestScanOneFilesystemWalksNestedFileOperand(t *testing.T) {
 	}
 }
 
-// buildSmokeTree recreates the README smoke-test filesystem layout
-// with deterministic content and returns the tree root.
+// buildSmokeTree recreates the tree of the test under README
+// "Definition of done" with deterministic content and returns the tree
+// root.
 func buildSmokeTree(t *testing.T) string {
 	t.Helper()
 
-	dir := t.TempDir()
+	dir := realTempDir(t)
 	one := pattern(10, 2000)
 	f1 := pattern(30, 3000)
 	f2 := pattern(40, 100)
@@ -1160,11 +1193,12 @@ func assertSmokeDupeGroups(t *testing.T, dir string, db *sql.DB) {
 	t.Helper()
 
 	groups := dupeGroups(t, db)
-	if len(groups) != 5 {
-		t.Fatalf("len(groups) = %d, want 5", len(groups))
+	if len(groups) != 4 {
+		t.Fatalf("len(groups) = %d, want 4", len(groups))
 	}
 
-	wantSizes := []int64{3000, 2000, 100, 1, 0}
+	// The empty files empty1 and empty2 form no group.
+	wantSizes := []int64{3000, 2000, 100, 1}
 	for i, g := range groups {
 		if g.size != wantSizes[i] {
 			t.Errorf("groups[%d].size = %d, want %d",
@@ -1189,7 +1223,7 @@ func assertSmokeTreeGroups(t *testing.T, dir string, db *sql.DB) {
 
 	super, dirs := dbTree(t, db)
 
-	tg := collectTreeGroups(dirs, super, nil)
+	tg := collectTreeGroups(dirs, super, everyPathExists, nil)
 	if len(tg) != 1 {
 		t.Fatalf("len(tree groups) = %d, want 1", len(tg))
 	}
@@ -1228,9 +1262,9 @@ func TestScanPipeline(t *testing.T) {
 // TestScanProgressNamesEachPhase checks the plain progress lines of a
 // first scan, and of a rescan of one operand holding two of the
 // database's records. Each phase's first line names it with its place
-// among the four: load counts the records before reading them, and the
-// walk estimates its total from the records under its operand, or says
-// its time remaining is unknown when there are none.
+// among the four: load gets the number of records before reading them,
+// and the walk estimates its total from the records under its operand,
+// or says its time remaining is unknown when there are none.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestScanProgressNamesEachPhase(t *testing.T) {
@@ -1358,6 +1392,47 @@ func TestSyncScanMtimeBump(t *testing.T) {
 	}
 }
 
+// TestSyncScanMtimeMovedBack replaces a file with other content of the
+// same size and an older mtime, as cp -p or a restore from backup does.
+// The next scan must hash the file again.
+func TestSyncScanMtimeMovedBack(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+	a := writeFile(t, dir, "a.bin", pattern(1, 500))
+
+	recorded := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	err := os.Chtimes(a, recorded, recorded)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	syncTree(t, db, dir)
+
+	replaced := pattern(3, 500)
+	writeFile(t, dir, "a.bin", replaced)
+
+	older := recorded.Add(-time.Hour)
+
+	err = os.Chtimes(a, older, older)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	st := syncTree(t, db, dir)
+	if st != (scanStats{walked: 1, updated: 1}) {
+		t.Fatalf("rescan stats = %+v, want 1 updated", st)
+	}
+
+	assertWholeFileHashed(t, db, a, replaced)
+
+	if r := recordByPath(t, dbRecords(t, db), a); !r.mtime.Equal(older) {
+		t.Fatalf("mtime = %v, want %v", r.mtime, older)
+	}
+}
+
 // assertWholeFileHashed fails unless the record for path holds the
 // whole-file hash of data as its head, tail, and content.
 func assertWholeFileHashed(t *testing.T, db *sql.DB, path string,
@@ -1416,6 +1491,159 @@ func TestScanStoresRawHashes(t *testing.T) {
 	}
 }
 
+// TestScanStoresDiskSize scans a sparse file, which takes less space on
+// disk than its length, once through its directory and once as the
+// operand itself. Each scan stores the disk_size of the file's lstat.
+func TestScanStoresDiskSize(t *testing.T) {
+	t.Parallel()
+
+	const length = 1024 * 1024
+
+	p := sparseFile(t, t.TempDir(), "sparse", length)
+	pokeAt(t, p, 0, []byte("x"))
+
+	unix.Sync() // see diskSizeOf
+
+	size := diskSizeOf(t, p)
+	if size == 0 || size >= length {
+		t.Fatalf("the file takes %d bytes on disk, want more than none "+
+			"and fewer than its length %d", size, length)
+	}
+
+	for _, operand := range []string{filepath.Dir(p), p} {
+		db := openTestDB(t)
+
+		// ZFS may count the blocks during the scan; see diskSizeOf.
+		before := diskSizeOf(t, p)
+
+		syncTree(t, db, operand)
+
+		after := diskSizeOf(t, p)
+
+		got := recordByPath(t, dbRecords(t, db), p).diskSize
+		if got < before || got > after {
+			t.Errorf("scan of %s: disk_size = %d, want %d to %d",
+				operand, got, before, after)
+		}
+	}
+}
+
+// TestSyncScanRewriteUpdatesDiskSize writes into the hole of a scanned
+// sparse file and moves its mtime on. The rescan hashes the file again
+// and rewrites its record with the new disk_size.
+func TestSyncScanRewriteUpdatesDiskSize(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+	p := sparseFile(t, dir, "sparse", 1024*1024)
+	pokeAt(t, p, 0, []byte("x"))
+
+	syncTree(t, db, dir)
+
+	recorded := recordByPath(t, dbRecords(t, db), p).diskSize
+
+	pokeAt(t, p, 512*1024, pattern(7, 64*1024))
+
+	// The write may leave the mtime the scan recorded; a later one makes
+	// the rescan read the file again.
+	later := time.Now().Add(time.Hour)
+
+	err := os.Chtimes(p, later, later)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for ZFS to count the write; see diskSizeOf.
+	deadline := time.Now().Add(30 * time.Second)
+	for diskSizeOf(t, p) == recorded {
+		if time.Now().After(deadline) {
+			t.Fatalf("the file still takes %d bytes on disk 30 seconds "+
+				"after the write into its hole", recorded)
+		}
+
+		unix.Sync()
+	}
+
+	// ZFS may still be counting, so the size may change during a rescan.
+	// Only a rescan with the same size on both sides of it can be compared
+	// exactly. A rescan that keeps the old size still fails, because the
+	// wait made before differ from it.
+	for {
+		before := diskSizeOf(t, p)
+
+		st := syncTree(t, db, dir)
+
+		after := diskSizeOf(t, p)
+
+		if st != (scanStats{walked: 1, updated: 1}) {
+			t.Fatalf("rescan stats = %+v, want 1 updated", st)
+		}
+
+		if before == after {
+			got := recordByPath(t, dbRecords(t, db), p).diskSize
+			if got != after {
+				t.Errorf("disk_size = %d, want %d", got, after)
+			}
+
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("the size on disk was still changing 30 seconds after "+
+				"the write into its hole: %d, then %d", before, after)
+		}
+
+		// A later mtime makes the next rescan read the file again.
+		later = later.Add(time.Second)
+
+		err = os.Chtimes(p, later, later)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// TestSyncScanUnchangedUpdatesDiskSize gives a file's record a
+// disk_size the file does not have, as when ZFS had not yet counted the
+// file's blocks at the last scan. The rescan writes the file's own
+// disk_size into the record without reading the file again.
+func TestSyncScanUnchangedUpdatesDiskSize(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+	p := writeFile(t, dir, "a.bin", pattern(1, 500))
+
+	syncTree(t, db, dir)
+
+	// lstat counts 512-byte units, so no file takes 1 byte on disk.
+	_, err := db.ExecContext(t.Context(),
+		"UPDATE files SET disk_size = 1 WHERE path = ?", []byte(p))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unix.Sync() // see diskSizeOf
+
+	// ZFS may count the blocks during the rescan; see diskSizeOf.
+	before := diskSizeOf(t, p)
+
+	// A file read again would count as updated.
+	st := syncTree(t, db, dir)
+
+	after := diskSizeOf(t, p)
+
+	if st != (scanStats{walked: 1, unchanged: 1}) {
+		t.Fatalf("rescan stats = %+v, want 1 unchanged", st)
+	}
+
+	got := recordByPath(t, dbRecords(t, db), p).diskSize
+	if got < before || got > after {
+		t.Errorf("disk_size = %d, want %d to %d", got, before, after)
+	}
+}
+
 // TestSyncScanSameSecondRewrite rewrites a file in place at the same
 // size with an mtime later in the same second as the recorded one: the
 // next scan must notice the change and re-hash the file. The operand is
@@ -1672,81 +1900,6 @@ func TestSyncScanOverlappingRoots(t *testing.T) {
 	}
 }
 
-// TestScanWalksOperandInZFSDirectory checks that an operand inside a
-// directory named .zfs below another operand is walked on its own,
-// since the walk of the other operand does not enter .zfs. The file
-// under it is recorded, and a second scan keeps the record.
-func TestScanWalksOperandInZFSDirectory(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	db := openTestDB(t)
-	f := writeFile(t, dir, "pool/.zfs/snapshot/daily/f", pattern(1, 10))
-	daily := filepath.Dir(f)
-
-	syncTree(t, db, dir, daily)
-	recordByPath(t, dbRecords(t, db), f)
-
-	syncTree(t, db, dir, daily)
-	recordByPath(t, dbRecords(t, db), f)
-}
-
-// TestScanWalksOperandBehindSymlink checks that an operand reached
-// through a symlinked directory below another operand is walked on its
-// own, since the walk of the other operand does not follow the symlink.
-// The file under it is recorded, and a second scan keeps the record.
-func TestScanWalksOperandBehindSymlink(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	target := t.TempDir()
-	db := openTestDB(t)
-	writeFile(t, target, "sub/f", pattern(1, 10))
-
-	link := filepath.Join(dir, "link")
-
-	err := os.Symlink(target, link)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	sub := filepath.Join(link, "sub")
-	f := filepath.Join(sub, "f")
-
-	syncTree(t, db, dir, sub)
-	recordByPath(t, dbRecords(t, db), f)
-
-	syncTree(t, db, dir, sub)
-	recordByPath(t, dbRecords(t, db), f)
-}
-
-// TestScanDropsOperandReachedBehindSymlink checks that an operand under
-// another one is still dropped when both lie behind the same symlinked
-// directory: the walk of the other operand starts past the symlink and
-// reaches it, so the file under it is walked once.
-func TestScanDropsOperandReachedBehindSymlink(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	target := t.TempDir()
-	db := openTestDB(t)
-	writeFile(t, target, "sub/deeper/f", pattern(1, 10))
-
-	link := filepath.Join(dir, "link")
-
-	err := os.Symlink(target, link)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	sub := filepath.Join(link, "sub")
-
-	st := syncTree(t, db, sub, filepath.Join(sub, "deeper"))
-	if st != (scanStats{walked: 1, added: 1}) {
-		t.Fatalf("stats = %+v, want 1 walked and added", st)
-	}
-}
-
 // TestScanHashesUniqueSize checks that a file whose size no other file
 // shares is hashed like every other file.
 func TestScanHashesUniqueSize(t *testing.T) {
@@ -1796,14 +1949,19 @@ func TestScanHardlinksReadOnce(t *testing.T) {
 	}
 }
 
+// TestScanHardlinkRunFailsTogether makes a file with two hard links
+// unreadable. Both paths are counted as skipped, and each gets its own
+// warning.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestScanHardlinkRunFailsTogether(t *testing.T) {
-	t.Parallel()
-
+	stderr := captureStderr(t)
 	dir := t.TempDir()
 	db := openTestDB(t)
 	a := writeFile(t, dir, "a.bin", pattern(1, 300))
+	b := filepath.Join(dir, "b.bin")
 
-	err := os.Link(a, filepath.Join(dir, "b.bin"))
+	err := os.Link(a, b)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1819,6 +1977,15 @@ func TestScanHardlinkRunFailsTogether(t *testing.T) {
 	if st.skipped != 2 || st.added != 0 {
 		t.Fatalf("stats = %+v, want both hardlink paths skipped", st)
 	}
+
+	got := stderr()
+
+	for _, p := range []string{a, b} {
+		warning := "scan: skipped " + p + " (permission denied)\n"
+		if !strings.Contains(got, warning) {
+			t.Errorf("stderr = %q, want %q", got, warning)
+		}
+	}
 }
 
 // TestHashPhaseSkipsFileReplacedByFIFO replaces a walked regular file
@@ -1856,7 +2023,7 @@ func TestHashPhaseSkipsFileReplacedByFIFO(t *testing.T) {
 			s.st.skipped, len(s.batch))
 	}
 
-	warning := "hash " + p + ": not a regular file\n"
+	warning := "scan: skipped " + p + " (not a regular file)\n"
 	if got := stderr(); strings.Count(got, warning) != 1 {
 		t.Errorf("stderr = %q, want %q once", got, warning)
 	}
@@ -2051,7 +2218,7 @@ func TestScanHashWriteFailureUnwindsPool(t *testing.T) {
 	var stderr bytes.Buffer
 
 	code := run([]string{
-		cmdScan, "--workers", strconv.Itoa(hashLeakWorkers), dir,
+		cmdScan, workersFlag, strconv.Itoa(hashLeakWorkers), dir,
 	}, io.Discard, &stderr)
 	if code != exitFatal {
 		t.Fatalf("run(scan) = %d, want %d; stderr: %s",
@@ -2144,7 +2311,7 @@ func TestPruneRoots(t *testing.T) {
 
 	// The walk of /p does not enter /p/q when it is a default exclude, so
 	// /p/q is kept, without -x too; /p/q/r lies under it and is dropped.
-	got = pruneRoots(nested, false, walkRules{excludes: []string{pqRoot}},
+	got = pruneRoots(nested, false, walkRules{defaultExcludes: []string{pqRoot}},
 		device)
 	if !slices.Equal(got, want) {
 		t.Fatalf("pruneRoots excluding %s = %q, want %q", pqRoot, got, want)
@@ -2160,35 +2327,88 @@ func TestPruneRoots(t *testing.T) {
 		t.Fatalf("pruneRoots with %s not persistent = %q, want %q",
 			pqRoot, got, want)
 	}
-
-	// Nor does it enter a directory named .zfs, so /p/.zfs/s is kept. The
-	// walk of /p/.zfs/s reaches /p/.zfs/s/t, which is dropped.
-	got = pruneRoots([]string{"/p", "/p/.zfs/s", "/p/.zfs/s/t"}, false,
-		walkRules{}, device)
-
-	want = []string{"/p", "/p/.zfs/s"}
-	if !slices.Equal(got, want) {
-		t.Fatalf("pruneRoots with .zfs = %q, want %q", got, want)
-	}
 }
 
-func TestReportsNeverTouchFilesystem(t *testing.T) {
-	t.Parallel()
+// TestRunReportsLeaveOutRemovedCopies scans the smoke tree, then
+// removes copies the reports name. report leaves out each removed file,
+// and a group left with one path. trees checks only the root of each
+// duplicate tree: with a file under t2 removed it still names t2, and
+// with t2 removed it names nothing.
+func TestRunReportsLeaveOutRemovedCopies(t *testing.T) {
+	t.Setenv(databaseEnv, testDBPath(t))
 
 	dir := buildSmokeTree(t)
-	db := openTestDB(t)
+	p := func(name string) string { return filepath.Join(dir, name) }
 
-	syncTree(t, db, dir)
+	scanOK(t, dir)
 
-	// Remove the scanned tree entirely; the analysis must be
-	// unaffected because it reads the database alone.
-	err := os.RemoveAll(dir)
+	for _, name := range []string{"b/copy2.bin", "tiny2", "t2/sub/f2"} {
+		err := os.Remove(p(name))
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	want := "first\tdupe\tsize\n" +
+		p("t1/f1") + "\t" + p("t2/f1") + "\t3000\n" +
+		p("t1/f1") + "\t" + p("t3/f1") + "\t3000\n" +
+		p("a/one.bin") + "\t" + p("b/copy.bin") + "\t2000\n" +
+		p("t1/sub/f2") + "\t" + p("t3/sub/f2renamed") + "\t100\n"
+	if got := runStdout(t, cmdReport); got != want {
+		t.Errorf("report stdout = %q, want %q", got, want)
+	}
+
+	// disk_size, the last column, depends on the filesystem.
+	header := "first\tdupe\tfiles\tsize\tdisk_size\n"
+
+	want = header + p("t1") + "\t" + p("t2") + "\t2\t3100\t"
+	if got := runStdout(t, cmdTrees); !strings.HasPrefix(got, want) ||
+		strings.Count(got, "\n") != 2 {
+		t.Errorf("trees stdout = %q, want one row starting %q", got, want)
+	}
+
+	err := os.RemoveAll(p("t2"))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	assertSmokeDupeGroups(t, dir, db)
-	assertSmokeTreeGroups(t, dir, db)
+	if got := runStdout(t, cmdTrees); got != header {
+		t.Errorf("trees stdout after removing t2 = %q, want %q", got, header)
+	}
+}
+
+func TestPathExists(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	file := writeFile(t, dir, "file", nil)
+	locked := writeFile(t, dir, "locked/file", nil)
+
+	// Without search permission on its directory, a file cannot be
+	// looked at by anyone but root.
+	err := os.Chmod(filepath.Dir(locked), 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Runs before t.TempDir's own cleanup, which must delete the files.
+	t.Cleanup(func() {
+		//nolint:gosec // removing the directory needs its search bit back
+		_ = os.Chmod(filepath.Dir(locked), 0o700)
+	})
+
+	cases := map[string]bool{
+		dir:                                 true,
+		file:                                true,
+		locked:                              true,
+		filepath.Join(dir, "gone"):          false,
+		filepath.Join(file, "under-a-file"): false,
+	}
+	for path, want := range cases {
+		if got := pathExists(path); got != want {
+			t.Errorf("pathExists(%q) = %v, want %v", path, got, want)
+		}
+	}
 }
 
 func TestUnderRoot(t *testing.T) {
@@ -2217,33 +2437,24 @@ func TestUnderRoot(t *testing.T) {
 }
 
 // TestRunScanPassesOverDatabase scans a tree that holds the scan's own
-// database, reached directly and through a symlinked directory. The
-// walk passes over the database file, its -wal and -shm files and its
-// .lock file with no line and no count, and the record an earlier scan
-// left for the .lock file is deleted. A rescan of the unchanged tree
-// updates nothing, and report lists none of the database's files.
+// database, and in one case also a hard link to the database file. The
+// walk knows the database's files by device ID and inode number, so it
+// passes over the database file, its -wal and -shm files, its .lock
+// file and the hard link with no line and no count. The record an
+// earlier scan left for the .lock file is deleted. A rescan of the
+// unchanged tree updates nothing, and report lists none of the
+// database's files.
 func TestRunScanPassesOverDatabase(t *testing.T) {
-	for _, viaSymlink := range []bool{false, true} {
-		t.Run(fmt.Sprintf("via symlink %v", viaSymlink), func(t *testing.T) {
-			base := t.TempDir()
-			tree := filepath.Join(base, "real", "tree")
-			operand := tree
+	for _, viaHardLink := range []bool{false, true} {
+		t.Run(fmt.Sprintf("via hard link %v", viaHardLink), func(t *testing.T) {
+			tree := realTempDir(t)
+			hardLink := filepath.Join(tree, "hardlink")
 
 			writeFile(t, tree, "a", pattern(1, 100))
 			writeFile(t, tree, "b", pattern(1, 100))
 			writeFile(t, tree, "empty1", nil)
 			writeFile(t, tree, "empty2", nil)
 
-			if viaSymlink {
-				err := os.Symlink(filepath.Join(base, "real"),
-					filepath.Join(base, "link"))
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				operand = filepath.Join(base, "link", "tree")
-			}
-
 			dbPath := filepath.Join(tree, "db.sqlite")
 			t.Setenv(databaseEnv, dbPath)
 
@@ -2253,7 +2464,7 @@ func TestRunScanPassesOverDatabase(t *testing.T) {
 			}
 
 			err = applyChanges(t.Context(), db, []scanRec{
-				{path: filepath.Join(operand, "db.sqlite.lock")},
+				{path: filepath.Join(tree, "db.sqlite.lock")},
 			}, nil, nil)
 			if err != nil {
 				t.Fatal(err)
@@ -2261,17 +2472,30 @@ func TestRunScanPassesOverDatabase(t *testing.T) {
 
 			closeScanDatabase(t.Context(), db, dbPath)
 
-			assertScanSummary(t,
+			if viaHardLink {
+				err = os.Link(dbPath, hardLink)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			stderr := assertScanSummary(t,
 				"4 files seen (4 added, 0 updated, 1 removed, 0 unchanged)",
-				operand)
-			assertScanSummary(t,
+				tree)
+			stderr += assertScanSummary(t,
 				"4 files seen (0 added, 0 updated, 0 removed, 4 unchanged)",
-				operand)
+				tree)
+
+			if strings.Contains(stderr, hardLink) {
+				t.Errorf("scan stderr = %q, want no line naming %s",
+					stderr, hardLink)
+			}
 
 			report := runStdout(t, cmdReport)
 			if strings.Contains(report, "db.sqlite") ||
-				!strings.Contains(report, filepath.Join(operand, "empty2")) {
-				t.Errorf("report = %q, want the empty files and none of "+
+				strings.Contains(report, hardLink) ||
+				!strings.Contains(report, filepath.Join(tree, "b")) {
+				t.Errorf("report = %q, want a and b and none of "+
 					"the database's files", report)
 			}
 		})
@@ -2295,8 +2519,9 @@ func TestRunScanPassesOverDatabaseOperands(t *testing.T) {
 
 // assertScanSummary scans operands and fails the test unless the
 // summary line gives counts with nothing skipped, and the line naming
-// the database is the only one that names one of its files.
-func assertScanSummary(t *testing.T, counts string, operands ...string) {
+// the database is the only one that names one of its files. It returns
+// everything the scan printed to stderr.
+func assertScanSummary(t *testing.T, counts string, operands ...string) string {
 	t.Helper()
 
 	stderr := scanOK(t, operands...)
@@ -2310,4 +2535,6 @@ func assertScanSummary(t *testing.T, counts string, operands ...string) {
 		t.Errorf("scan %q: stderr = %q, want only the line naming the "+
 			"database to name one of its files", operands, stderr)
 	}
+
+	return stderr
 }

internal/sfdupes/trees.go

@@ -1,4 +1,4 @@
-package main
+package sfdupes
 
 import (
 	"context"
@@ -22,6 +22,10 @@ type treeNode struct {
 	digest    [sha256.Size]byte
 	fileCount int64
 	totalSize int64
+	// diskSize is the bytes the directory's files take on disk. Two
+	// copies of one tree have the same totalSize, but their diskSize
+	// can differ.
+	diskSize int64
 }
 
 // treesPhase names one phase of trees with its place among all of them,
@@ -33,19 +37,27 @@ func treesPhase(name string) string {
 
 // runTrees implements the trees subcommand: it reads every record from
 // the database in path order, reconstructs the directory hierarchy from
-// the record paths, computes a Merkle-style digest per directory, and
-// prints maximal duplicate-tree groups as TSV on stdout. It never
-// touches the scanned filesystem; its only I/O is the database, stdout,
-// and stderr. It names the database on stderr before it opens it. Any
-// database problem, including a missing database, is fatal.
+// the paths of the records at or below the operands in args (of every
+// record when args is empty), computes a Merkle-style digest per
+// directory, and prints maximal duplicate-tree groups as TSV on stdout.
+// Of the scanned filesystem it only checks, with pathExists, that the
+// root of each duplicate tree is still there, never the files below it;
+// it never looks up an operand. It names the database on stderr before
+// it opens it. Any database problem, including a missing database, is
+// fatal.
 //
 // The work runs in four phases, each under a progress display of its
-// own on stderr: open (open the database), read (count the records,
-// then read them into the hierarchy), group (group the directories by
-// digest) and write (write the groups to stdout). Each display ends
-// before the next phase starts, and before an error is returned to be
-// printed.
-func runTrees(ctx context.Context, stdout io.Writer) error {
+// own on stderr: open (open the database), read (read the number of
+// records from the totals table, then read the records into the
+// hierarchy), group (group the directories by digest) and write (write
+// the groups to stdout). Each display ends before the next phase
+// starts, and before an error is returned to be printed.
+func runTrees(ctx context.Context, args []string, stdout io.Writer) error {
+	operands, err := cleanOperands(args)
+	if err != nil {
+		return err
+	}
+
 	dbPath, source, err := databasePath()
 	if err != nil {
 		return err
@@ -74,7 +86,7 @@ func runTrees(ctx context.Context, stdout io.Writer) error {
 		label: treesPhase("read"), unit: "records", total: -1,
 		waitingFor: countingRecords, stalledOn: "db",
 	})
-	records, super, allDirs, err := readTree(ctx, db, prog)
+	records, super, allDirs, err := readTree(ctx, db, operands, prog)
 
 	prog.finish()
 
@@ -82,13 +94,13 @@ func runTrees(ctx context.Context, stdout io.Writer) error {
 		return fmt.Errorf("database %s: %w", dbPath, err)
 	}
 
-	// Grouping works in memory, so it waits on nothing but the
-	// processor.
+	// Grouping works in memory, then checks the root of each duplicate
+	// tree on disk, so it waits on the processor or the disk.
 	prog = newProgress(progressParams{
 		label: treesPhase("group"), unit: "directories",
-		total: int64(len(allDirs)), stalledOn: "cpu",
+		total: int64(len(allDirs)), stalledOn: "cpu/disk",
 	})
-	dupes := collectTreeGroups(allDirs, super, prog)
+	dupes := collectTreeGroups(allDirs, super, pathExists, prog)
 
 	prog.finish()
 
@@ -96,7 +108,7 @@ func runTrees(ctx context.Context, stdout io.Writer) error {
 		label: treesPhase("write"), unit: "groups", total: int64(len(dupes)),
 		stalledOn: "out",
 	})
-	dupeTrees, reclaimable, err := writeTreeGroups(stdout, dupes, prog)
+	dupeTrees, err := writeTreeGroups(stdout, dupes, prog)
 
 	prog.finish()
 
@@ -107,16 +119,23 @@ func runTrees(ctx context.Context, stdout io.Writer) error {
 	fmt.Fprintf(os.Stderr,
 		"trees: %d records read, %d duplicate tree groups, %d dupe trees, "+
 			"%s reclaimable\n",
-		records, len(dupes), dupeTrees, humanBytes(reclaimable))
+		records, len(dupes), dupeTrees, humanBytes(reclaimableBytes(dupes)))
 
 	return nil
 }
 
 // readTree gives prog the number of records in db as its total, then
-// reads every record in path order into the directory hierarchy,
-// counting each on prog. It returns the number of records read, the
-// super-root and every directory.
-func readTree(ctx context.Context, db *sql.DB,
+// reads every record in path order, counting each on prog. It adds the
+// records that underOperand finds under operands to the directory
+// hierarchy. It returns the number of records read, the super-root and
+// every directory at or below one of operands.
+//
+// Any other directory lies above an operand and can hold files that are
+// not used, so its digest does not describe it. It is left out of the
+// directories returned. A directory whose parent is left out gets the
+// super-root as its parent, so suppressed never judges its group by
+// that parent's digest.
+func readTree(ctx context.Context, db *sql.DB, operands []string,
 	prog *progress,
 ) (int, *treeNode, []*treeNode, error) {
 	records := 0
@@ -126,7 +145,10 @@ func readTree(ctx context.Context, db *sql.DB,
 		records++
 
 		prog.increment()
-		tree.add(r)
+
+		if underOperand(r.path, operands) {
+			tree.add(r)
+		}
 	})
 	if err != nil {
 		return 0, nil, nil, err
@@ -134,40 +156,51 @@ func readTree(ctx context.Context, db *sql.DB,
 
 	super, allDirs := tree.finish()
 
-	return records, super, allDirs, nil
+	dirs := allDirs[:0]
+
+	for _, d := range allDirs {
+		if !underOperand(d.path, operands) {
+			continue
+		}
+
+		if !underOperand(d.parent.path, operands) {
+			d.parent = super
+		}
+
+		dirs = append(dirs, d)
+	}
+
+	return records, super, dirs, nil
 }
 
 // writeTreeGroups writes dupes to stdout as TSV, a header line and then
 // a row for every member of each group but its first, counting each
-// group on prog once its rows are written. stdout may be the terminal
-// prog is drawn on, so the lines go through prog's writer. It returns
-// the number of rows (dupe trees) and the bytes they could reclaim.
+// group on prog once its rows are written. The disk_size column is the
+// dupe's own. stdout may be the terminal prog is drawn on, so the lines
+// go through prog's writer. It returns the number of rows (dupe trees).
 func writeTreeGroups(stdout io.Writer, dupes [][]*treeNode,
 	prog *progress,
-) (int, int64, error) {
+) (int, error) {
 	out := prog.writer(stdout)
 
-	_, err := fmt.Fprintln(out, "first\tdupe\tfiles\tsize")
+	_, err := fmt.Fprintln(out, "first\tdupe\tfiles\tsize\tdisk_size")
 	if err != nil {
-		return 0, 0, fmt.Errorf("write stdout: %w", err)
+		return 0, fmt.Errorf("write stdout: %w", err)
 	}
 
 	dupeTrees := 0
 
-	var reclaimable int64
-
 	for _, g := range dupes {
 		first := g[0]
 		for _, n := range g[1:] {
-			_, err = fmt.Fprintf(out, "%s\t%s\t%d\t%d\n",
+			_, err = fmt.Fprintf(out, "%s\t%s\t%d\t%d\t%d\n",
 				escapePath(first.path), escapePath(n.path),
-				first.fileCount, first.totalSize)
+				first.fileCount, first.totalSize, n.diskSize)
 			if err != nil {
-				return 0, 0, fmt.Errorf("write stdout: %w", err)
+				return 0, fmt.Errorf("write stdout: %w", err)
 			}
 
 			dupeTrees++
-			reclaimable += first.totalSize
 		}
 
 		prog.increment()
@@ -175,10 +208,44 @@ func writeTreeGroups(stdout io.Writer, dupes [][]*treeNode,
 
 	err = out.Flush()
 	if err != nil {
-		return 0, 0, fmt.Errorf("write stdout: %w", err)
+		return 0, fmt.Errorf("write stdout: %w", err)
 	}
 
-	return dupeTrees, reclaimable, nil
+	return dupeTrees, nil
+}
+
+// reclaimableBytes returns the sum of the size column over the rows
+// that writeTreeGroups writes for dupes, leaving out a row whose dupe
+// lies inside another row's dupe.
+func reclaimableBytes(dupes [][]*treeNode) int64 {
+	isDupe := make(map[*treeNode]bool)
+
+	for _, g := range dupes {
+		for _, n := range g[1:] {
+			isDupe[n] = true
+		}
+	}
+
+	var total int64
+
+	for n := range isDupe {
+		if !insideDupe(n, isDupe) {
+			total += n.totalSize
+		}
+	}
+
+	return total
+}
+
+// insideDupe reports whether a directory above n is in isDupe.
+func insideDupe(n *treeNode, isDupe map[*treeNode]bool) bool {
+	for p := n.parent; p != nil; p = p.parent {
+		if isDupe[p] {
+			return true
+		}
+	}
+
+	return false
 }
 
 // treeBuilder reconstructs the directory hierarchy from records added
@@ -232,6 +299,7 @@ func (b *treeBuilder) add(r scanRec) {
 	dir.entries = append(dir.entries, fileEntry(name, r))
 	dir.fileCount++
 	dir.totalSize += r.size
+	dir.diskSize += r.diskSize
 }
 
 // openDir starts the directory called name inside the innermost open
@@ -270,6 +338,7 @@ func (b *treeBuilder) closeTo(n int) {
 			"d\x00"+name+"\x00"+string(dir.digest[:]))
 		dir.parent.fileCount += dir.fileCount
 		dir.parent.totalSize += dir.totalSize
+		dir.parent.diskSize += dir.diskSize
 		b.dirs = append(b.dirs, dir)
 	}
 }
@@ -293,10 +362,14 @@ func fileEntry(name string, r scanRec) string {
 
 // collectTreeGroups groups directories by digest, counting each one on
 // prog as it is grouped, and returns every maximal group with two or
-// more members, each group's members sorted by path, groups ordered by
-// tree size descending then by first path ascending.
+// more members for which exists returns true, each group's members
+// sorted by path, groups ordered by tree size descending then by first
+// path ascending. A group whose trees hold 0 bytes is left out, since
+// removing one frees nothing. The groups it implies hold 0 bytes too,
+// so leaving it out hides nothing. exists is called only on the members
+// of maximal groups.
 func collectTreeGroups(allDirs []*treeNode, super *treeNode,
-	prog *progress,
+	exists func(path string) bool, prog *progress,
 ) [][]*treeNode {
 	groups := make(map[[sha256.Size]byte][]*treeNode)
 	for _, d := range allDirs {
@@ -308,7 +381,19 @@ func collectTreeGroups(allDirs []*treeNode, super *treeNode,
 	var dupes [][]*treeNode
 
 	for _, g := range groups {
-		if len(g) < minGroupSize || suppressed(g, super) {
+		// The members share a digest, so they share a total size.
+		if len(g) < minGroupSize || g[0].totalSize == 0 ||
+			suppressed(g, super) {
+			continue
+		}
+
+		// A member that is gone leaves the group. A suppressed group is
+		// still implied: its members still on disk have parents still
+		// on disk, and those parents' group is checked the same way.
+		g = slices.DeleteFunc(g, func(n *treeNode) bool {
+			return !exists(n.path)
+		})
+		if len(g) < minGroupSize {
 			continue
 		}
 

internal/sfdupes/trees_test.go

@@ -0,0 +1,701 @@
+package sfdupes //nolint:testpackage // checks the unexported treeNode results
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"database/sql"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// treesOpenLine is the plain line of trees' open phase when it opens
+// the database at once; it prints it as the phase starts and as it ends.
+const treesOpenLine = "[1/4] open: opening the database, elapsed 0s, " +
+	"remain unknown"
+
+// smokeTreeRecs mirrors the tree of the test under README "Definition
+// of done": /d/t1 and /d/t2 are identical, /d/t3 differs from them only
+// by one filename. Each file takes one 4 KiB block on disk.
+func smokeTreeRecs() []scanRec {
+	f1Head, f1Tail, f1Content := testHash("f1h"), testHash("f1t"), testHash("f1c")
+	f2Head, f2Tail, f2Content := testHash("f2h"), testHash("f2t"), testHash("f2c")
+
+	return []scanRec{
+		{size: 3000, diskSize: 4096, head: f1Head, tail: f1Tail,
+			content: f1Content, path: "/d/t1/f1"},
+		{size: 100, diskSize: 4096, head: f2Head, tail: f2Tail,
+			content: f2Content, path: "/d/t1/sub/f2"},
+		{size: 3000, diskSize: 4096, head: f1Head, tail: f1Tail,
+			content: f1Content, path: "/d/t2/f1"},
+		{size: 100, diskSize: 4096, head: f2Head, tail: f2Tail,
+			content: f2Content, path: "/d/t2/sub/f2"},
+		{size: 3000, diskSize: 4096, head: f1Head, tail: f1Tail,
+			content: f1Content, path: "/d/t3/f1"},
+		{size: 100, diskSize: 4096, head: f2Head, tail: f2Tail,
+			content: f2Content, path: "/d/t3/sub/f2renamed"},
+	}
+}
+
+// dbTree builds the directory hierarchy from the records in db the way
+// trees does, and returns the super-root and every directory.
+func dbTree(t *testing.T, db *sql.DB) (*treeNode, []*treeNode) {
+	t.Helper()
+
+	tree := newTreeBuilder()
+
+	err := loadFileRows(t.Context(), db, func(int64) {}, tree.add)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return tree.finish()
+}
+
+// treeOf writes recs into a fresh database and builds the directory
+// hierarchy from it the way trees does.
+func treeOf(t *testing.T, recs []scanRec) (*treeNode, []*treeNode) {
+	t.Helper()
+
+	db := openTestDB(t)
+
+	err := applyChanges(t.Context(), db, recs, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return dbTree(t, db)
+}
+
+// nodeByPath finds the directory node with the given path.
+func nodeByPath(t *testing.T, dirs []*treeNode, path string) *treeNode {
+	t.Helper()
+
+	for _, d := range dirs {
+		if d.path == path {
+			return d
+		}
+	}
+
+	t.Fatalf("no directory node with path %q", path)
+
+	return nil
+}
+
+// groupPaths flattens tree groups into their member path lists.
+func groupPaths(groups [][]*treeNode) [][]string {
+	out := make([][]string, 0, len(groups))
+	for _, g := range groups {
+		paths := make([]string, 0, len(g))
+		for _, n := range g {
+			paths = append(paths, n.path)
+		}
+
+		out = append(out, paths)
+	}
+
+	return out
+}
+
+func TestTreeCounts(t *testing.T) {
+	t.Parallel()
+
+	_, dirs := treeOf(t, smokeTreeRecs())
+
+	d := nodeByPath(t, dirs, "/d")
+	if d.fileCount != 6 || d.totalSize != 9300 {
+		t.Errorf("/d: fileCount %d size %d, want 6 9300",
+			d.fileCount, d.totalSize)
+	}
+
+	t1 := nodeByPath(t, dirs, "/d/t1")
+	if t1.fileCount != 2 || t1.totalSize != 3100 {
+		t.Errorf("/d/t1: fileCount %d size %d, want 2 3100",
+			t1.fileCount, t1.totalSize)
+	}
+
+	sub := nodeByPath(t, dirs, "/d/t1/sub")
+	if sub.fileCount != 1 || sub.totalSize != 100 {
+		t.Errorf("/d/t1/sub: fileCount %d size %d, want 1 100",
+			sub.fileCount, sub.totalSize)
+	}
+}
+
+func TestTreeRootPath(t *testing.T) {
+	t.Parallel()
+
+	// The root directory's path is "/", never empty, and its
+	// children's paths start with a single slash.
+	_, dirs := treeOf(t, []scanRec{{path: "/f"}, {path: "/srv/g"}})
+
+	got := make([]string, 0, len(dirs))
+	for _, d := range dirs {
+		got = append(got, d.path)
+	}
+
+	slices.Sort(got)
+
+	want := []string{"/", "/srv"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("directory paths = %q, want %q", got, want)
+	}
+}
+
+func TestTreeNamesSortingBeforeSlash(t *testing.T) {
+	t.Parallel()
+
+	// In path order "/a/b-x/f" and "/a/b.txt" come between the file
+	// "/a/b" and "/a/b/f", because "-" and "." sort before "/". Each
+	// directory must still be built once, whole, so /a matches /c.
+	recs := make([]scanRec, 0, 8)
+
+	for _, top := range []string{"/a", "/c"} {
+		for _, p := range []string{"/b", "/b-x/f", "/b.txt", "/b/f"} {
+			content := testHash("c")
+			if p == "/b-x/f" {
+				content = testHash("other")
+			}
+
+			recs = append(recs, scanRec{
+				size: 1, head: testHash("h"), tail: testHash("t"),
+				content: content, path: top + p,
+			})
+		}
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	got := make([]string, 0, len(dirs))
+	for _, d := range dirs {
+		got = append(got, d.path)
+	}
+
+	slices.Sort(got)
+
+	want := []string{"/", "/a", "/a/b", "/a/b-x", "/c", "/c/b", "/c/b-x"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("directory paths = %q, want %q", got, want)
+	}
+
+	groups := collectTreeGroups(dirs, super, everyPathExists, nil)
+
+	gotGroups := groupPaths(groups)
+	wantGroups := [][]string{{"/a", "/c"}}
+
+	if !slices.EqualFunc(gotGroups, wantGroups, slices.Equal) {
+		t.Fatalf("groups = %v, want %v", gotGroups, wantGroups)
+	}
+
+	if groups[0][0].fileCount != 4 || groups[0][0].totalSize != 4 {
+		t.Errorf("group totals: %d files %d bytes, want 4 4",
+			groups[0][0].fileCount, groups[0][0].totalSize)
+	}
+}
+
+func TestRunTreesEscapesPaths(t *testing.T) {
+	dir, recs := recsOnDisk(t, awkwardPairRecs())
+	t.Setenv(databaseEnv, seedDatabase(t, recs))
+
+	var stdout, stderr bytes.Buffer
+
+	code := run([]string{cmdTrees}, &stdout, &stderr)
+	if code != exitOK {
+		t.Fatalf("run(trees) = %d, want %d; stderr: %s",
+			code, exitOK, stderr.String())
+	}
+
+	want := "first\tdupe\tfiles\tsize\tdisk_size\n" +
+		dir + `/d/\tone\ntwo\rthree\\four` + "\t" + dir + "/d/A\t1\t5\t4096\n"
+	if got := stdout.String(); got != want {
+		t.Errorf("stdout = %q, want %q", got, want)
+	}
+}
+
+// TestRunTreesOperands runs trees with operands on records in a new
+// directory. x/a and y/a are copies, and so are y/a and srv/b. x and y
+// also hold files that differ. Given x/a and y/a, trees reads x and y
+// as holding one copy each of a, yet neither is reported: only the
+// directories at or below an operand are.
+func TestRunTreesOperands(t *testing.T) {
+	f, g, k := testHash("f"), testHash("g"), testHash("k")
+	dir, recs := recsOnDisk(t, []scanRec{
+		{size: 10, head: f, tail: f, content: f, path: "/srv/b/f"},
+		{size: 10, head: f, tail: f, content: f, path: "/x/a/f"},
+		{size: 20, head: g, tail: g, content: g, path: "/x/g"},
+		{size: 10, head: f, tail: f, content: f, path: "/y/a/f"},
+		{size: 30, head: k, tail: k, content: k, path: "/y/k"},
+	})
+	b, xa, ya := dir+"/srv/b", dir+"/x/a", dir+"/y/a"
+
+	header := "first\tdupe\tfiles\tsize\tdisk_size\n"
+	row := func(first, dupe string) string {
+		return first + "\t" + dupe + "\t1\t10\t0\n"
+	}
+
+	cases := map[string]struct {
+		operands []string
+		want     string
+	}{
+		"none":       {nil, header + row(b, xa) + row(b, ya)},
+		"two copies": {[]string{xa, ya}, header + row(xa, ya)},
+		"parents":    {[]string{dir + "/x", dir + "/y"}, header + row(xa, ya)},
+		"one copy":   {[]string{b}, header},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(databaseEnv, seedDatabase(t, recs))
+
+			var stdout, stderr bytes.Buffer
+
+			code := run(append([]string{cmdTrees}, tc.operands...),
+				&stdout, &stderr)
+			if code != exitOK {
+				t.Fatalf("run(trees %q) = %d, want %d; stderr: %s",
+					tc.operands, code, exitOK, stderr.String())
+			}
+
+			if got := stdout.String(); got != tc.want {
+				t.Errorf("stdout = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// TestRunTreesDiskSize runs trees on two copies of a tree whose files
+// take different space on disk. The row's disk_size is the sum over the
+// dupe copy's files, those in its subdirectory included.
+func TestRunTreesDiskSize(t *testing.T) {
+	f, g := testHash("f"), testHash("g")
+	recs := []scanRec{
+		{size: 10, diskSize: 4096, head: f, tail: f, content: f, path: "/a/f"},
+		{size: 20, diskSize: 4096, head: g, tail: g, content: g, path: "/a/sub/g"},
+		{size: 10, diskSize: 512, head: f, tail: f, content: f, path: "/b/f"},
+		{size: 20, diskSize: 1024, head: g, tail: g, content: g, path: "/b/sub/g"},
+	}
+
+	dir, recs := recsOnDisk(t, recs)
+	t.Setenv(databaseEnv, seedDatabase(t, recs))
+
+	want := "first\tdupe\tfiles\tsize\tdisk_size\n" +
+		dir + "/a\t" + dir + "/b\t2\t30\t1536\n"
+	if got := runStdout(t, cmdTrees); got != want {
+		t.Errorf("stdout = %q, want %q", got, want)
+	}
+}
+
+// TestRunTreesProgressNamesEachPhase runs trees on the smoke-test
+// records with stderr not a terminal, and checks every line it prints
+// there. After the line naming the database, each phase prints a line
+// naming it with its place among the four as it starts and another as
+// it ends. read counts the 6 records before it reads them, group counts
+// the directories, and write the 1 group. The summary comes last, and
+// stdout holds the report alone.
+func TestRunTreesProgressNamesEachPhase(t *testing.T) {
+	dir, recs := recsOnDisk(t, smokeTreeRecs())
+	path := seedDatabase(t, recs)
+	t.Setenv(databaseEnv, path)
+
+	stderr := captureStderr(t)
+
+	var stdout bytes.Buffer
+
+	code := run([]string{cmdTrees}, &stdout, os.Stderr)
+	if code != exitOK {
+		t.Fatalf("run(trees) = %d, want %d; stderr: %s",
+			code, exitOK, stderr())
+	}
+
+	report := "first\tdupe\tfiles\tsize\tdisk_size\n" +
+		dir + "/d/t1\t" + dir + "/d/t2\t2\t3100\t8192\n"
+	if got := stdout.String(); got != report {
+		t.Errorf("stdout = %q, want %q", got, report)
+	}
+
+	// The smoke-test records name 8 directories, / included. Moved under
+	// dir, they name one more for each slash in dir.
+	dirs := strconv.Itoa(8 + strings.Count(dir, "/"))
+
+	// How each line starts; the rate at the end of a phase varies.
+	want := []string{
+		"trees: database " + path + " (from " + databaseEnv + ")",
+		treesOpenLine,
+		treesOpenLine,
+		"[2/4] read: counting the records, elapsed 0s, remain unknown",
+		"[2/4] read: [6/6] 100%, ",
+		"[3/4] group: [0/" + dirs + "] 0%, 0 directories/s, elapsed 0s, " +
+			"remain unknown",
+		"[3/4] group: [" + dirs + "/" + dirs + "] 100%, ",
+		"[4/4] write: [0/1] 0%, 0 groups/s, elapsed 0s, remain unknown",
+		"[4/4] write: [1/1] 100%, ",
+		"trees: 6 records read, 1 duplicate tree groups, 1 dupe trees, ",
+	}
+
+	lines := strings.Split(strings.TrimSuffix(stderr(), "\n"), "\n")
+	if len(lines) != len(want) {
+		t.Fatalf("stderr lines = %q, want %d lines starting %q",
+			lines, len(want), want)
+	}
+
+	for i := range want {
+		if !strings.HasPrefix(lines[i], want[i]) {
+			t.Errorf("stderr line %d = %q, want it to start %q",
+				i+1, lines[i], want[i])
+		}
+	}
+}
+
+// TestWriteTreeGroupsOnTerminal writes the smoke-test report to the
+// terminal its write phase's display is drawn on, as a plain "sfdupes
+// trees" does: the terminal must show the header and the row whole,
+// each on a line of its own.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestWriteTreeGroupsOnTerminal(t *testing.T) {
+	stderr := captureStderr(t)
+	super, dirs := treeOf(t, smokeTreeRecs())
+	dupes := collectTreeGroups(dirs, super, everyPathExists, nil)
+
+	// No timed draws: the display is drawn as it starts and as it ends.
+	p := startProgress(progressParams{
+		label: treesPhase("write"), unit: "groups", total: int64(len(dupes)),
+	}, terminalWidth, time.Hour, time.Now)
+
+	_, err := writeTreeGroups(os.Stderr, dupes, p)
+
+	p.finish()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// A terminal shows each line as the text after its last carriage
+	// return.
+	var shown []string
+
+	for line := range strings.SplitSeq(stderr(), "\n") {
+		shown = append(shown, line[strings.LastIndex(line, "\r")+1:])
+	}
+
+	want := []string{
+		"first\tdupe\tfiles\tsize\tdisk_size", "/d/t1\t/d/t2\t2\t3100\t8192",
+	}
+	if len(shown) < len(want) || !slices.Equal(shown[:len(want)], want) {
+		t.Errorf("terminal shows lines %q, want %q first", shown, want)
+	}
+}
+
+func TestTreeDigests(t *testing.T) {
+	t.Parallel()
+
+	_, dirs := treeOf(t, smokeTreeRecs())
+
+	t1 := nodeByPath(t, dirs, "/d/t1")
+	t2 := nodeByPath(t, dirs, "/d/t2")
+	t3 := nodeByPath(t, dirs, "/d/t3")
+
+	if t1.digest != t2.digest {
+		t.Error("identical trees /d/t1 and /d/t2 have different digests")
+	}
+
+	// t3 differs only in a filename; names are part of the digest.
+	if t1.digest == t3.digest {
+		t.Error("/d/t3 digest equals /d/t1 despite a renamed file")
+	}
+
+	sub1 := nodeByPath(t, dirs, "/d/t1/sub")
+	sub3 := nodeByPath(t, dirs, "/d/t3/sub")
+
+	if sub1.digest == sub3.digest {
+		t.Error("subdirs with differently-named files share a digest")
+	}
+}
+
+func TestTreeDigestContentSensitivity(t *testing.T) {
+	t.Parallel()
+
+	same, c := testHash("same"), testHash("c")
+	recs := []scanRec{
+		{size: 10, head: same, tail: same, content: c, path: "/r/a/f"},
+		{size: 10, head: testHash("DIFF"), tail: same, content: c, path: "/r/b/f"},
+	}
+
+	_, dirs := treeOf(t, recs)
+
+	a := nodeByPath(t, dirs, "/r/a")
+	b := nodeByPath(t, dirs, "/r/b")
+
+	if a.digest == b.digest {
+		t.Error("trees with different file content share a digest")
+	}
+}
+
+func TestCollectTreeGroupsMaximal(t *testing.T) {
+	t.Parallel()
+
+	super, dirs := treeOf(t, smokeTreeRecs())
+
+	groups := collectTreeGroups(dirs, super, everyPathExists, nil)
+
+	want := [][]string{{"/d/t1", "/d/t2"}}
+	if got := groupPaths(groups); !slices.EqualFunc(got, want,
+		slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, want)
+	}
+
+	// The /d/t1/sub vs /d/t2/sub group must be suppressed as implied
+	// by its parents' group; the winning group reports one copy's
+	// recursive totals.
+	if groups[0][0].fileCount != 2 || groups[0][0].totalSize != 3100 {
+		t.Errorf("group totals: %d files %d bytes, want 2 3100",
+			groups[0][0].fileCount, groups[0][0].totalSize)
+	}
+}
+
+func TestCollectTreeGroupsDeterministic(t *testing.T) {
+	t.Parallel()
+
+	recs := smokeTreeRecs()
+
+	super, dirs := treeOf(t, recs)
+
+	forward := groupPaths(collectTreeGroups(dirs, super, everyPathExists,
+		nil))
+
+	reversed := slices.Clone(recs)
+	slices.Reverse(reversed)
+
+	superR, dirsR := treeOf(t, reversed)
+
+	backward := groupPaths(collectTreeGroups(dirsR, superR, everyPathExists,
+		nil))
+	if !slices.EqualFunc(forward, backward, slices.Equal) {
+		t.Fatalf("output depends on record order: %v vs %v",
+			forward, backward)
+	}
+}
+
+func TestCollectTreeGroupsSiblings(t *testing.T) {
+	t.Parallel()
+
+	// Identical sibling dirs share a parent, so their group cannot be
+	// implied by a parent group and must be reported.
+	h, tl, c := testHash("h"), testHash("t"), testHash("c")
+	recs := []scanRec{
+		{size: 10, head: h, tail: tl, content: c, path: "/p/x1/f"},
+		{size: 10, head: h, tail: tl, content: c, path: "/p/x2/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	got := groupPaths(collectTreeGroups(dirs, super, everyPathExists, nil))
+
+	want := [][]string{{"/p/x1", "/p/x2"}}
+	if !slices.EqualFunc(got, want, slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, want)
+	}
+}
+
+// TestCollectTreeGroupsLeavesOutEmptyTrees checks that directories
+// holding only empty files form no group, and that an empty file still
+// counts toward the digest of a tree that holds other files.
+func TestCollectTreeGroupsLeavesOutEmptyTrees(t *testing.T) {
+	t.Parallel()
+
+	h, tl, c, e := testHash("h"), testHash("t"), testHash("c"),
+		sha256.Sum256(nil)
+	recs := []scanRec{
+		{size: 0, head: e, tail: e, content: e, path: "/e/a/.gitkeep"},
+		{size: 0, head: e, tail: e, content: e, path: "/e/b/.gitkeep"},
+		{size: 10, head: h, tail: tl, content: c, path: "/p/x1/f"},
+		{size: 0, head: e, tail: e, content: e, path: "/p/x1/.gitkeep"},
+		{size: 10, head: h, tail: tl, content: c, path: "/p/x2/f"},
+		{size: 0, head: e, tail: e, content: e, path: "/p/x2/.gitkeep"},
+		// Without the empty file, /p/x3 is no copy of /p/x1.
+		{size: 10, head: h, tail: tl, content: c, path: "/p/x3/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	got := groupPaths(collectTreeGroups(dirs, super, everyPathExists, nil))
+
+	want := [][]string{{"/p/x1", "/p/x2"}}
+	if !slices.EqualFunc(got, want, slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, want)
+	}
+}
+
+func TestCollectTreeGroupsDifferingParents(t *testing.T) {
+	t.Parallel()
+
+	// /p/a and /q/b contain identical x subtrees, but /p/a has an
+	// extra file, so the parents' digests differ and the x group must
+	// be reported.
+	h, tl, c, e := testHash("h"), testHash("t"), testHash("c"), testHash("e")
+	recs := []scanRec{
+		{size: 10, head: h, tail: tl, content: c, path: "/p/a/x/f"},
+		{size: 99, head: e, tail: e, content: e, path: "/p/a/extra"},
+		{size: 10, head: h, tail: tl, content: c, path: "/q/b/x/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	got := groupPaths(collectTreeGroups(dirs, super, everyPathExists, nil))
+
+	want := [][]string{{"/p/a/x", "/q/b/x"}}
+	if !slices.EqualFunc(got, want, slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, want)
+	}
+}
+
+// TestCollectTreeGroupsChecksOnlyReportedCopies checks that trees asks
+// whether a directory is on disk only for the members of the groups it
+// returns. It never asks about /a/proj/sub, which lies inside a copy
+// and whose group the group of /a/proj implies.
+func TestCollectTreeGroupsChecksOnlyReportedCopies(t *testing.T) {
+	t.Parallel()
+
+	f, g, u := testHash("f"), testHash("g"), testHash("u")
+	recs := []scanRec{
+		{size: 10, head: f, tail: f, content: f, path: "/a/proj/f"},
+		{size: 20, head: g, tail: g, content: g, path: "/a/proj/sub/g"},
+		{size: 10, head: f, tail: f, content: f, path: "/b/proj/f"},
+		{size: 20, head: g, tail: g, content: g, path: "/b/proj/sub/g"},
+		// /a lacks this file, so /a and /b are no copies of each other.
+		{size: 30, head: u, tail: u, content: u, path: "/b/lonely"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	var checked []string
+
+	exists := func(path string) bool {
+		checked = append(checked, path)
+
+		return true
+	}
+
+	got := groupPaths(collectTreeGroups(dirs, super, exists, nil))
+
+	want := [][]string{{"/a/proj", "/b/proj"}}
+	if !slices.EqualFunc(got, want, slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, want)
+	}
+
+	slices.Sort(checked)
+
+	if !slices.Equal(checked, want[0]) {
+		t.Errorf("directories checked on disk = %q, want %q",
+			checked, want[0])
+	}
+}
+
+// TestCollectTreeGroupsDropsGroupLeftWithOneCopy checks that a group of
+// two copies, one of them gone, is not returned. If kept, it would
+// write no row, but the summary line would count it.
+func TestCollectTreeGroupsDropsGroupLeftWithOneCopy(t *testing.T) {
+	t.Parallel()
+
+	f := testHash("f")
+	recs := []scanRec{
+		{size: 10, head: f, tail: f, content: f, path: "/c/kept/f"},
+		{size: 10, head: f, tail: f, content: f, path: "/c/gone/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	exists := func(path string) bool { return path != "/c/gone" }
+
+	got := groupPaths(collectTreeGroups(dirs, super, exists, nil))
+	if len(got) != 0 {
+		t.Errorf("groups = %v, want none", got)
+	}
+}
+
+// TestCollectTreeGroupsKeepsGroupLeftWithTwoCopies checks that a group
+// of three copies, one of them gone, is returned with the other two.
+func TestCollectTreeGroupsKeepsGroupLeftWithTwoCopies(t *testing.T) {
+	t.Parallel()
+
+	f := testHash("f")
+	recs := []scanRec{
+		{size: 10, head: f, tail: f, content: f, path: "/d/kept1/f"},
+		{size: 10, head: f, tail: f, content: f, path: "/d/gone/f"},
+		{size: 10, head: f, tail: f, content: f, path: "/d/kept2/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+
+	exists := func(path string) bool { return path != "/d/gone" }
+
+	got := groupPaths(collectTreeGroups(dirs, super, exists, nil))
+
+	want := [][]string{{"/d/kept1", "/d/kept2"}}
+	if !slices.EqualFunc(got, want, slices.Equal) {
+		t.Errorf("groups = %v, want %v", got, want)
+	}
+}
+
+// TestReclaimableBytesCountsNestedDupeOnce checks that a dupe tree
+// inside another dupe tree adds nothing to the reclaimable bytes. /B/x
+// lies in /B, so the total adds the sizes of /B and /C/x, 1500 + 1000.
+func TestReclaimableBytesCountsNestedDupeOnce(t *testing.T) {
+	t.Parallel()
+
+	fh, ft, fc := testHash("fh"), testHash("ft"), testHash("fc")
+	gh, gt, gc := testHash("gh"), testHash("gt"), testHash("gc")
+	recs := []scanRec{
+		{size: 1000, head: fh, tail: ft, content: fc, path: "/A/x/f"},
+		{size: 500, head: gh, tail: gt, content: gc, path: "/A/y/g"},
+		{size: 1000, head: fh, tail: ft, content: fc, path: "/B/x/f"},
+		{size: 500, head: gh, tail: gt, content: gc, path: "/B/y/g"},
+		{size: 1000, head: fh, tail: ft, content: fc, path: "/C/x/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+	dupes := collectTreeGroups(dirs, super, everyPathExists, nil)
+
+	wantGroups := [][]string{{"/A", "/B"}, {"/A/x", "/B/x", "/C/x"}}
+	if got := groupPaths(dupes); !slices.EqualFunc(got, wantGroups,
+		slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, wantGroups)
+	}
+
+	if got := reclaimableBytes(dupes); got != 2500 {
+		t.Errorf("reclaimableBytes = %d, want 2500", got)
+	}
+}
+
+// TestReclaimableBytesCountsDupeInsideGrandparentDupeOnce checks that a
+// dupe tree adds nothing when a dupe tree above its parent holds it.
+// /B/m/x lies in /B, and /B/m is no dupe, since the group of /A and /B
+// implies that of /A/m and /B/m. The total adds the sizes of /B and
+// /C/x, 1300 + 1000.
+func TestReclaimableBytesCountsDupeInsideGrandparentDupeOnce(t *testing.T) {
+	t.Parallel()
+
+	f, w := testHash("f"), testHash("w")
+	recs := []scanRec{
+		{size: 1000, head: f, tail: f, content: f, path: "/A/m/x/f"},
+		{size: 300, head: w, tail: w, content: w, path: "/A/m/w"},
+		{size: 1000, head: f, tail: f, content: f, path: "/B/m/x/f"},
+		{size: 300, head: w, tail: w, content: w, path: "/B/m/w"},
+		{size: 1000, head: f, tail: f, content: f, path: "/C/x/f"},
+	}
+
+	super, dirs := treeOf(t, recs)
+	dupes := collectTreeGroups(dirs, super, everyPathExists, nil)
+
+	wantGroups := [][]string{{"/A", "/B"}, {"/A/m/x", "/B/m/x", "/C/x"}}
+	if got := groupPaths(dupes); !slices.EqualFunc(got, wantGroups,
+		slices.Equal) {
+		t.Fatalf("groups = %v, want %v", got, wantGroups)
+	}
+
+	if got := reclaimableBytes(dupes); got != 2300 {
+		t.Errorf("reclaimableBytes = %d, want 2300", got)
+	}
+}

main.go

@@ -1,294 +0,0 @@
-// Command sfdupes quickly identifies candidate duplicate files across
-// very large filesystems without reading every byte of every file.
-// Files are considered duplicates when their sizes are equal and they
-// agree on three SHA-256 hashes: of the first 64 KiB, of the last 64
-// KiB, and of the content. The content hash covers the whole file under
-// 100 MiB, and 1 MiB at each gigabyte at 100 MiB or more, so a large
-// file is never read in full. scan maintains a persistent SQLite
-// database of file signatures (SFDUPES_DATABASE, default
-// /var/lib/sfdupes/db.sqlite) that the other subcommands read.
-//
-// Usage:
-//
-//	sfdupes scan [--workers N] [-x] [--no-default-excludes] PATH...
-//	sfdupes report > dupes.tsv
-//	sfdupes trees > dupetrees.tsv
-//	sfdupes info
-//	sfdupes --version
-//
-// See README.md for the complete specification.
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"runtime"
-	"runtime/debug"
-
-	"github.com/spf13/cobra"
-)
-
-// Exit codes: exitOK is success (even with per-file warnings),
-// exitFatal is a fatal error, exitUsage is a usage error.
-const (
-	exitOK    = 0
-	exitFatal = 1
-	exitUsage = 2
-)
-
-// The subcommand names, as typed on the command line.
-const (
-	cmdScan   = "scan"
-	cmdReport = "report"
-	cmdTrees  = "trees"
-	cmdInfo   = "info"
-)
-
-// errNoSubcommand is returned by the root command when it is invoked
-// without a subcommand. That is a usage error, and the usage text
-// cobra prints for it is the whole message.
-var errNoSubcommand = errors.New("no subcommand")
-
-// errWorkersBelowOne is the usage error for a scan --workers value
-// below 1.
-var errWorkersBelowOne = errors.New("--workers must be at least 1")
-
-// Version is the build version, injected at link time via -ldflags
-// (see the Makefile); empty when the linker set none, as for a binary
-// built by go install. buildVersion turns it into what --version prints.
-//
-//nolint:gochecknoglobals // written only by the linker
-var Version string
-
-// buildVersion returns the version that sfdupes --version prints
-// (README "Install"): the version the linker set, when it set one;
-// otherwise the main module's version that Go recorded in the binary,
-// a tag such as v0.0.2 or the pseudo-version of an @main build; and
-// "dev" when neither is known. info is what debug.ReadBuildInfo
-// returns, nil when the binary carries none. Go records "(devel)" for
-// a build that has no version, such as one inside a copy of the source
-// without git.
-func buildVersion(linkerVersion string, info *debug.BuildInfo) string {
-	if linkerVersion != "" {
-		return linkerVersion
-	}
-
-	if info == nil || info.Main.Version == "" ||
-		info.Main.Version == "(devel)" {
-		return "dev"
-	}
-
-	return info.Main.Version
-}
-
-func main() {
-	// Once the reader of a stdout pipe has gone, as in "sfdupes report |
-	// head", the Go runtime ends the process with SIGPIPE on the next
-	// write instead of returning an error (README "Error handling").
-	// Registering for SIGPIPE with os/signal would change that.
-	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
-}
-
-// run executes args against the command tree and returns the process
-// exit code. It is the program's single exit point: the subcommands
-// return their errors instead of exiting, so every deferred cleanup —
-// above all closing the database, which checkpoints the SQLite WAL —
-// runs before the process ends. The report, trees and info subcommands
-// write their data to stdout.
-func run(args []string, stdout, stderr io.Writer) int {
-	// A nil slice makes cobra fall back to os.Args, which would let a
-	// test binary's own flags reach the command tree.
-	if args == nil {
-		args = []string{}
-	}
-
-	root := newRootCommand(stdout, stderr)
-	root.SetArgs(args)
-
-	err := root.Execute()
-
-	var fatal fatalError
-
-	switch {
-	case err == nil:
-		return exitOK
-	case errors.Is(err, errInterrupted):
-		// The interrupted scan has printed its own line.
-		return exitFatal
-	case errors.As(err, &fatal):
-		// The command ran and failed: a runtime error, reported
-		// without the usage text that a usage error gets.
-		_, _ = fmt.Fprintf(stderr, "sfdupes: %v\n", err)
-
-		return exitFatal
-	default:
-		// A usage error, which cobra has already reported on stderr.
-		return exitUsage
-	}
-}
-
-// newRootCommand builds the command tree. Everything on stdout is
-// machine-readable data, the version line included; all human-facing
-// output (help, usage, errors) goes to stderr.
-func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
-	var showVersion bool
-
-	printVersion := runE(func(context.Context, []string) error {
-		info, _ := debug.ReadBuildInfo()
-
-		_, err := fmt.Fprintf(stdout, "sfdupes %s\n",
-			buildVersion(Version, info))
-		if err != nil {
-			return fmt.Errorf("write stdout: %w", err)
-		}
-
-		return nil
-	})
-
-	root := &cobra.Command{
-		Use:   "sfdupes",
-		Short: "Find candidate duplicate files by size and head/tail/content SHA-256",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if showVersion {
-				return printVersion(cmd, args)
-			}
-
-			// A missing subcommand prints usage and exits 2: cobra
-			// prints the usage text for the returned error, and run
-			// maps everything that is not a fatal error to exit 2.
-			cmd.SilenceErrors = true
-
-			return errNoSubcommand
-		},
-	}
-	root.SetOut(stderr)
-	root.SetErr(stderr)
-	root.CompletionOptions.DisableDefaultCmd = true
-
-	// Cobra's built-in version flag prints through the help writer,
-	// stderr; this one prints to stdout.
-	root.Flags().BoolVarP(&showVersion, "version", "v", false,
-		"print the version to stdout")
-
-	reportCmd := &cobra.Command{
-		Use:   cmdReport,
-		Short: "Read the scan database and print the file-level duplicates report",
-		Args:  cobra.NoArgs,
-		RunE: runE(func(ctx context.Context, _ []string) error {
-			return runReport(ctx, stdout)
-		}),
-	}
-
-	treesCmd := &cobra.Command{
-		Use:   cmdTrees,
-		Short: "Read the scan database and print the duplicate-tree report",
-		Args:  cobra.NoArgs,
-		RunE: runE(func(ctx context.Context, _ []string) error {
-			return runTrees(ctx, stdout)
-		}),
-	}
-
-	infoCmd := &cobra.Command{
-		Use:   cmdInfo,
-		Short: "Read the scan database and print its details",
-		Args:  cobra.NoArgs,
-		RunE: runE(func(ctx context.Context, _ []string) error {
-			return runInfo(ctx, stdout)
-		}),
-	}
-
-	root.AddCommand(newScanCommand(), reportCmd, treesCmd, infoCmd)
-
-	return root
-}
-
-// newScanCommand builds the scan subcommand, with its --workers, -x and
-// --no-default-excludes flags. Its help lists the default excludes of
-// the system it runs on, and the filesystem types it never records
-// anything on.
-func newScanCommand() *cobra.Command {
-	var (
-		scanWorkers           int
-		scanOneFS             bool
-		scanNoDefaultExcludes bool
-	)
-
-	short := "Walk trees and synchronize the scan database"
-
-	scanCmd := &cobra.Command{
-		Use:   cmdScan + " [--workers N] [-x] [--no-default-excludes] PATH...",
-		Short: short,
-		Long:  short + ".\n\n" + defaultExcludesHelp(runtime.GOOS),
-		Args:  cobra.MinimumNArgs(1),
-		PreRunE: func(cmd *cobra.Command, _ []string) error {
-			return checkScanWorkers(cmd, scanWorkers)
-		},
-		RunE: runE(func(ctx context.Context, args []string) error {
-			ctx, stop := interruptContext(ctx)
-			defer stop()
-
-			return runScan(ctx, args, scanWorkers, scanOneFS,
-				scanNoDefaultExcludes)
-		}),
-	}
-	scanCmd.Flags().IntVar(&scanWorkers, "workers", runtime.NumCPU(),
-		"concurrent workers for the walk and hash phases")
-	scanCmd.Flags().BoolVarP(&scanOneFS, "one-file-system", "x", false,
-		"do not cross filesystem boundaries")
-	scanCmd.Flags().BoolVar(&scanNoDefaultExcludes, "no-default-excludes",
-		false, "enter the default excludes, the paths listed above")
-
-	return scanCmd
-}
-
-// checkScanWorkers rejects a scan --workers value below 1. That is a
-// usage error reported in one line: cobra prints the returned message
-// without the usage text, and run exits 2.
-func checkScanWorkers(cmd *cobra.Command, workers int) error {
-	if workers >= 1 {
-		return nil
-	}
-
-	cmd.SilenceUsage = true
-
-	return fmt.Errorf("%w, got %d", errWorkersBelowOne, workers)
-}
-
-// runE adapts a subcommand implementation, or the version print, to
-// cobra's RunE. Cobra prints the error and the command's usage text for
-// every error RunE returns, but a subcommand that ran and failed has no
-// usage problem to report: both are silenced here, and the error is
-// marked fatal so that run reports it on stderr and exits 1 rather than
-// 2. The command's context is handed to the implementation: cancelling
-// it unwinds the scan's worker pools.
-func runE(
-	fn func(ctx context.Context, args []string) error,
-) func(*cobra.Command, []string) error {
-	return func(cmd *cobra.Command, args []string) error {
-		cmd.SilenceUsage = true
-		cmd.SilenceErrors = true
-
-		err := fn(cmd.Context(), args)
-		if err != nil {
-			return fatalError{err: err}
-		}
-
-		return nil
-	}
-}
-
-// fatalError marks a runtime failure, as opposed to the usage errors
-// cobra itself produces while parsing arguments and flags. Both come
-// out of Execute as plain errors, so the wrapper is what tells run to
-// report this one as "sfdupes: ..." and exit 1.
-type fatalError struct {
-	err error
-}
-
-func (e fatalError) Error() string { return e.err.Error() }
-
-func (e fatalError) Unwrap() error { return e.err }

trees_test.go

@@ -1,430 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"database/sql"
-	"os"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-)
-
-// treesOpenLine is the plain line of trees' open phase when it opens
-// the database at once; it prints it as the phase starts and as it ends.
-const treesOpenLine = "[1/4] open: opening the database, elapsed 0s, " +
-	"remain unknown"
-
-// smokeTreeRecs mirrors the README smoke-test tree layout: /d/t1 and
-// /d/t2 are identical, /d/t3 differs from them only by one filename.
-func smokeTreeRecs() []scanRec {
-	f1Head, f1Tail, f1Content := testHash("f1h"), testHash("f1t"), testHash("f1c")
-	f2Head, f2Tail, f2Content := testHash("f2h"), testHash("f2t"), testHash("f2c")
-
-	return []scanRec{
-		{size: 3000, head: f1Head, tail: f1Tail, content: f1Content, path: "/d/t1/f1"},
-		{size: 100, head: f2Head, tail: f2Tail, content: f2Content, path: "/d/t1/sub/f2"},
-		{size: 3000, head: f1Head, tail: f1Tail, content: f1Content, path: "/d/t2/f1"},
-		{size: 100, head: f2Head, tail: f2Tail, content: f2Content, path: "/d/t2/sub/f2"},
-		{size: 3000, head: f1Head, tail: f1Tail, content: f1Content, path: "/d/t3/f1"},
-		{size: 100, head: f2Head, tail: f2Tail, content: f2Content,
-			path: "/d/t3/sub/f2renamed"},
-	}
-}
-
-// dbTree builds the directory hierarchy from the records in db the way
-// trees does, and returns the super-root and every directory.
-func dbTree(t *testing.T, db *sql.DB) (*treeNode, []*treeNode) {
-	t.Helper()
-
-	tree := newTreeBuilder()
-
-	err := loadFileRows(t.Context(), db, func(int64) {}, tree.add)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return tree.finish()
-}
-
-// treeOf writes recs into a fresh database and builds the directory
-// hierarchy from it the way trees does.
-func treeOf(t *testing.T, recs []scanRec) (*treeNode, []*treeNode) {
-	t.Helper()
-
-	db := openTestDB(t)
-
-	err := applyChanges(t.Context(), db, recs, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return dbTree(t, db)
-}
-
-// nodeByPath finds the directory node with the given path.
-func nodeByPath(t *testing.T, dirs []*treeNode, path string) *treeNode {
-	t.Helper()
-
-	for _, d := range dirs {
-		if d.path == path {
-			return d
-		}
-	}
-
-	t.Fatalf("no directory node with path %q", path)
-
-	return nil
-}
-
-// groupPaths flattens tree groups into their member path lists.
-func groupPaths(groups [][]*treeNode) [][]string {
-	out := make([][]string, 0, len(groups))
-	for _, g := range groups {
-		paths := make([]string, 0, len(g))
-		for _, n := range g {
-			paths = append(paths, n.path)
-		}
-
-		out = append(out, paths)
-	}
-
-	return out
-}
-
-func TestTreeCounts(t *testing.T) {
-	t.Parallel()
-
-	_, dirs := treeOf(t, smokeTreeRecs())
-
-	d := nodeByPath(t, dirs, "/d")
-	if d.fileCount != 6 || d.totalSize != 9300 {
-		t.Errorf("/d: fileCount %d size %d, want 6 9300",
-			d.fileCount, d.totalSize)
-	}
-
-	t1 := nodeByPath(t, dirs, "/d/t1")
-	if t1.fileCount != 2 || t1.totalSize != 3100 {
-		t.Errorf("/d/t1: fileCount %d size %d, want 2 3100",
-			t1.fileCount, t1.totalSize)
-	}
-
-	sub := nodeByPath(t, dirs, "/d/t1/sub")
-	if sub.fileCount != 1 || sub.totalSize != 100 {
-		t.Errorf("/d/t1/sub: fileCount %d size %d, want 1 100",
-			sub.fileCount, sub.totalSize)
-	}
-}
-
-func TestTreeRootPath(t *testing.T) {
-	t.Parallel()
-
-	// The root directory's path is "/", never empty, and its
-	// children's paths start with a single slash.
-	_, dirs := treeOf(t, []scanRec{{path: "/f"}, {path: "/srv/g"}})
-
-	got := make([]string, 0, len(dirs))
-	for _, d := range dirs {
-		got = append(got, d.path)
-	}
-
-	slices.Sort(got)
-
-	want := []string{"/", "/srv"}
-	if !slices.Equal(got, want) {
-		t.Fatalf("directory paths = %q, want %q", got, want)
-	}
-}
-
-func TestTreeNamesSortingBeforeSlash(t *testing.T) {
-	t.Parallel()
-
-	// In path order "/a/b-x/f" and "/a/b.txt" come between the file
-	// "/a/b" and "/a/b/f", because "-" and "." sort before "/". Each
-	// directory must still be built once, whole, so /a matches /c.
-	recs := make([]scanRec, 0, 8)
-
-	for _, top := range []string{"/a", "/c"} {
-		for _, p := range []string{"/b", "/b-x/f", "/b.txt", "/b/f"} {
-			content := testHash("c")
-			if p == "/b-x/f" {
-				content = testHash("other")
-			}
-
-			recs = append(recs, scanRec{
-				size: 1, head: testHash("h"), tail: testHash("t"),
-				content: content, path: top + p,
-			})
-		}
-	}
-
-	super, dirs := treeOf(t, recs)
-
-	got := make([]string, 0, len(dirs))
-	for _, d := range dirs {
-		got = append(got, d.path)
-	}
-
-	slices.Sort(got)
-
-	want := []string{"/", "/a", "/a/b", "/a/b-x", "/c", "/c/b", "/c/b-x"}
-	if !slices.Equal(got, want) {
-		t.Fatalf("directory paths = %q, want %q", got, want)
-	}
-
-	groups := collectTreeGroups(dirs, super, nil)
-
-	gotGroups := groupPaths(groups)
-	wantGroups := [][]string{{"/a", "/c"}}
-
-	if !slices.EqualFunc(gotGroups, wantGroups, slices.Equal) {
-		t.Fatalf("groups = %v, want %v", gotGroups, wantGroups)
-	}
-
-	if groups[0][0].fileCount != 4 || groups[0][0].totalSize != 4 {
-		t.Errorf("group totals: %d files %d bytes, want 4 4",
-			groups[0][0].fileCount, groups[0][0].totalSize)
-	}
-}
-
-func TestRunTreesEscapesPaths(t *testing.T) {
-	t.Setenv(databaseEnv, seedDatabase(t, awkwardPairRecs()))
-
-	var stdout, stderr bytes.Buffer
-
-	code := run([]string{cmdTrees}, &stdout, &stderr)
-	if code != exitOK {
-		t.Fatalf("run(trees) = %d, want %d; stderr: %s",
-			code, exitOK, stderr.String())
-	}
-
-	want := "first\tdupe\tfiles\tsize\n" +
-		`/d/\tone\ntwo\rthree\\four` + "\t/d/A\t1\t5\n"
-	if got := stdout.String(); got != want {
-		t.Errorf("stdout = %q, want %q", got, want)
-	}
-}
-
-// TestRunTreesProgressNamesEachPhase runs trees on the smoke-test
-// records with stderr not a terminal, and checks every line it prints
-// there. After the line naming the database, each phase prints a line
-// naming it with its place among the four as it starts and another as
-// it ends. read counts the 6 records before it reads them, group counts
-// the 8 directories, and write the 1 group. The summary comes last, and
-// stdout holds the report alone.
-func TestRunTreesProgressNamesEachPhase(t *testing.T) {
-	path := seedDatabase(t, smokeTreeRecs())
-	t.Setenv(databaseEnv, path)
-
-	stderr := captureStderr(t)
-
-	var stdout bytes.Buffer
-
-	code := run([]string{cmdTrees}, &stdout, os.Stderr)
-	if code != exitOK {
-		t.Fatalf("run(trees) = %d, want %d; stderr: %s",
-			code, exitOK, stderr())
-	}
-
-	report := "first\tdupe\tfiles\tsize\n/d/t1\t/d/t2\t2\t3100\n"
-	if got := stdout.String(); got != report {
-		t.Errorf("stdout = %q, want %q", got, report)
-	}
-
-	// How each line starts; the rate at the end of a phase varies.
-	want := []string{
-		"trees: database " + path + " (from " + databaseEnv + ")",
-		treesOpenLine,
-		treesOpenLine,
-		"[2/4] read: counting the records, elapsed 0s, remain unknown",
-		"[2/4] read: [6/6] 100%, ",
-		"[3/4] group: [0/8] 0%, 0 directories/s, elapsed 0s, remain unknown",
-		"[3/4] group: [8/8] 100%, ",
-		"[4/4] write: [0/1] 0%, 0 groups/s, elapsed 0s, remain unknown",
-		"[4/4] write: [1/1] 100%, ",
-		"trees: 6 records read, 1 duplicate tree groups, 1 dupe trees, ",
-	}
-
-	lines := strings.Split(strings.TrimSuffix(stderr(), "\n"), "\n")
-	if len(lines) != len(want) {
-		t.Fatalf("stderr lines = %q, want %d lines starting %q",
-			lines, len(want), want)
-	}
-
-	for i := range want {
-		if !strings.HasPrefix(lines[i], want[i]) {
-			t.Errorf("stderr line %d = %q, want it to start %q",
-				i+1, lines[i], want[i])
-		}
-	}
-}
-
-// TestWriteTreeGroupsOnTerminal writes the smoke-test report to the
-// terminal its write phase's display is drawn on, as a plain "sfdupes
-// trees" does: the terminal must show the header and the row whole,
-// each on a line of its own.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestWriteTreeGroupsOnTerminal(t *testing.T) {
-	stderr := captureStderr(t)
-	super, dirs := treeOf(t, smokeTreeRecs())
-	dupes := collectTreeGroups(dirs, super, nil)
-
-	// No timed draws: the display is drawn as it starts and as it ends.
-	p := startProgress(progressParams{
-		label: treesPhase("write"), unit: "groups", total: int64(len(dupes)),
-	}, terminalWidth, time.Hour, time.Now)
-
-	_, _, err := writeTreeGroups(os.Stderr, dupes, p)
-
-	p.finish()
-
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// A terminal shows each line as the text after its last carriage
-	// return.
-	var shown []string
-
-	for line := range strings.SplitSeq(stderr(), "\n") {
-		shown = append(shown, line[strings.LastIndex(line, "\r")+1:])
-	}
-
-	want := []string{"first\tdupe\tfiles\tsize", "/d/t1\t/d/t2\t2\t3100"}
-	if len(shown) < len(want) || !slices.Equal(shown[:len(want)], want) {
-		t.Errorf("terminal shows lines %q, want %q first", shown, want)
-	}
-}
-
-func TestTreeDigests(t *testing.T) {
-	t.Parallel()
-
-	_, dirs := treeOf(t, smokeTreeRecs())
-
-	t1 := nodeByPath(t, dirs, "/d/t1")
-	t2 := nodeByPath(t, dirs, "/d/t2")
-	t3 := nodeByPath(t, dirs, "/d/t3")
-
-	if t1.digest != t2.digest {
-		t.Error("identical trees /d/t1 and /d/t2 have different digests")
-	}
-
-	// t3 differs only in a filename; names are part of the digest.
-	if t1.digest == t3.digest {
-		t.Error("/d/t3 digest equals /d/t1 despite a renamed file")
-	}
-
-	sub1 := nodeByPath(t, dirs, "/d/t1/sub")
-	sub3 := nodeByPath(t, dirs, "/d/t3/sub")
-
-	if sub1.digest == sub3.digest {
-		t.Error("subdirs with differently-named files share a digest")
-	}
-}
-
-func TestTreeDigestContentSensitivity(t *testing.T) {
-	t.Parallel()
-
-	same, c := testHash("same"), testHash("c")
-	recs := []scanRec{
-		{size: 10, head: same, tail: same, content: c, path: "/r/a/f"},
-		{size: 10, head: testHash("DIFF"), tail: same, content: c, path: "/r/b/f"},
-	}
-
-	_, dirs := treeOf(t, recs)
-
-	a := nodeByPath(t, dirs, "/r/a")
-	b := nodeByPath(t, dirs, "/r/b")
-
-	if a.digest == b.digest {
-		t.Error("trees with different file content share a digest")
-	}
-}
-
-func TestCollectTreeGroupsMaximal(t *testing.T) {
-	t.Parallel()
-
-	super, dirs := treeOf(t, smokeTreeRecs())
-
-	groups := collectTreeGroups(dirs, super, nil)
-
-	want := [][]string{{"/d/t1", "/d/t2"}}
-	if got := groupPaths(groups); !slices.EqualFunc(got, want,
-		slices.Equal) {
-		t.Fatalf("groups = %v, want %v", got, want)
-	}
-
-	// The /d/t1/sub vs /d/t2/sub group must be suppressed as implied
-	// by its parents' group; the winning group reports one copy's
-	// recursive totals.
-	if groups[0][0].fileCount != 2 || groups[0][0].totalSize != 3100 {
-		t.Errorf("group totals: %d files %d bytes, want 2 3100",
-			groups[0][0].fileCount, groups[0][0].totalSize)
-	}
-}
-
-func TestCollectTreeGroupsDeterministic(t *testing.T) {
-	t.Parallel()
-
-	recs := smokeTreeRecs()
-
-	super, dirs := treeOf(t, recs)
-
-	forward := groupPaths(collectTreeGroups(dirs, super, nil))
-
-	reversed := slices.Clone(recs)
-	slices.Reverse(reversed)
-
-	superR, dirsR := treeOf(t, reversed)
-
-	backward := groupPaths(collectTreeGroups(dirsR, superR, nil))
-	if !slices.EqualFunc(forward, backward, slices.Equal) {
-		t.Fatalf("output depends on record order: %v vs %v",
-			forward, backward)
-	}
-}
-
-func TestCollectTreeGroupsSiblings(t *testing.T) {
-	t.Parallel()
-
-	// Identical sibling dirs share a parent, so their group cannot be
-	// implied by a parent group and must be reported.
-	h, tl, c := testHash("h"), testHash("t"), testHash("c")
-	recs := []scanRec{
-		{size: 10, head: h, tail: tl, content: c, path: "/p/x1/f"},
-		{size: 10, head: h, tail: tl, content: c, path: "/p/x2/f"},
-	}
-
-	super, dirs := treeOf(t, recs)
-
-	got := groupPaths(collectTreeGroups(dirs, super, nil))
-
-	want := [][]string{{"/p/x1", "/p/x2"}}
-	if !slices.EqualFunc(got, want, slices.Equal) {
-		t.Fatalf("groups = %v, want %v", got, want)
-	}
-}
-
-func TestCollectTreeGroupsDifferingParents(t *testing.T) {
-	t.Parallel()
-
-	// /p/a and /q/b contain identical x subtrees, but /p/a has an
-	// extra file, so the parents' digests differ and the x group must
-	// be reported.
-	h, tl, c, e := testHash("h"), testHash("t"), testHash("c"), testHash("e")
-	recs := []scanRec{
-		{size: 10, head: h, tail: tl, content: c, path: "/p/a/x/f"},
-		{size: 99, head: e, tail: e, content: e, path: "/p/a/extra"},
-		{size: 10, head: h, tail: tl, content: c, path: "/q/b/x/f"},
-	}
-
-	super, dirs := treeOf(t, recs)
-
-	got := groupPaths(collectTreeGroups(dirs, super, nil))
-
-	want := [][]string{{"/p/a/x", "/q/b/x"}}
-	if !slices.EqualFunc(got, want, slices.Equal) {
-		t.Fatalf("groups = %v, want %v", got, want)
-	}
-}