Leave removed copies out of report and trees (closes #173)

A deleted duplicate stayed in both reports until a scan covered it, and
a missing scan operand is a fatal error. report now runs lstat on each
path of a possible duplicate group and drops paths that are gone; trees
does the same for the directory at the top of each copy, never the
files inside. A group left with one copy is not reported. Only "does not
exist" and "not a directory" count as gone, so a permission error keeps
the copy for an unprivileged user. README says a stale report is fixed
by scanning again.

Model: opus-5-5

README.md

@@ -99,15 +99,13 @@ Each `-v` flag below makes a bind mount, which shows a host directory at a path
 inside the container. Bind-mount `/var/lib/sfdupes` to keep the database between
 runs. Mount the tree to scan at the same path inside the container as on the
 host. Read-only access is enough. The database then records the host's paths,
-and so do the reports. `report` and `trees` need that mount too. Without it,
-every recorded path counts as gone, and each report holds only its header line.
+and so do the reports.
 
 ```sh
 make docker
 docker run --rm -v /srv:/srv:ro -v /var/lib/sfdupes:/var/lib/sfdupes \
     sfdupes scan /srv
-docker run --rm -v /srv:/srv:ro -v /var/lib/sfdupes:/var/lib/sfdupes \
-    sfdupes report > dupes.tsv
+docker run --rm -v /var/lib/sfdupes:/var/lib/sfdupes sfdupes report > dupes.tsv
 ```
 
 ### Daily scan from `cron`
@@ -213,9 +211,9 @@ makes the comparison exact. Reading samples cuts a 150 GiB file to about 150 MiB
 of reads, at the price of a comparison that is not exact.
 
 The hashes live in a database that is kept between runs. A rescan reads only new
-files, and files whose size or modification time (mtime) differs from their
-record. All analysis then works from the database. The reports only check that
-each copy they name still exists.
+files, and files whose size changed or whose modification time (mtime) is newer
+than recorded. All analysis then works from the database. The reports only check
+that each copy they name still exists.
 
 The goal is whole duplicated trees, not only single files. A download extracted
 twice, or a project copied once too often, is such a tree. It can be removed as
@@ -259,7 +257,7 @@ In order:
   report.
 
 ```
-sfdupes scan [--workers N] [-x] [--no-default-excludes] [--exclude PATH]... PATH...
+sfdupes scan [--workers N] [-x] [--no-default-excludes] PATH...
 sfdupes report > dupes.tsv
 sfdupes trees > dupetrees.tsv
 sfdupes info
@@ -304,16 +302,6 @@ The reference below is also the program's specification.
 - `--no-default-excludes` (`scan`) lets the walk enter the default excludes.
   Those are the system and temporary directories the walk otherwise leaves out,
   such as `/var/tmp` on Linux (see "Rules for the walk").
-- `--exclude PATH` (`scan`) keeps the walk out of `PATH` and everything below
-  it. `PATH` may be a directory or a file. The flag may be given more than once.
-  The walk knows `PATH` by its device ID and inode number, as it knows the
-  database files (see "Rules for the walk"). So the walk leaves `PATH` out
-  whatever path leads to it. That includes a hard link to a file given as
-  `PATH`. A symlink given as `PATH` excludes its target. An empty `PATH`, as in
-  `--exclude ""`, is a usage error, reported in one line on stderr with exit 2
-  before anything is scanned. A `PATH` that does not exist, or whose real path
-  `scan` cannot find, is a fatal error. So is an operand at or below one (see
-  "Operands").
 - `--version`, `-v` prints `sfdupes VERSION` (see "Install") to stdout and
   exits 0. It writes nothing to stderr.
 - `--help`, `-h`, alone or after a subcommand, prints the help text to stderr
@@ -372,10 +360,6 @@ default. An operand may be a directory or a regular file.
 - An operand that does not exist is a fatal error, and so is a symlink whose
   target does not exist. `scan` then stops before it walks anything, and exits
   with code 1.
-- An operand at or below an `--exclude` path is a fatal error too. The message
-  names the operand and the `--exclude` path. `scan` compares the operand and
-  each directory above it with the `--exclude` paths by device ID and inode
-  number, not by name.
 - Each operand is resolved to its real path before the walk, as `realpath`
   prints it. A relative operand is joined to the working directory as `pwd -P`
   prints it. Every symlink in the path is then followed. A `..` after a symlink
@@ -431,16 +415,17 @@ operands:
 
 - A file not yet in the database is hashed and inserted.
 - A file already in the database is not read again when its size and mtime match
-  its record. This is what makes a daily rescan cheap.
+  its record. The mtime matches when it is not newer than the recorded one. This
+  is what makes a daily rescan cheap.
 - When such a file's size on disk differs from its recorded `disk_size`, `scan`
   updates `disk_size` alone. It still does not read the file, and counts it as
   unchanged. ZFS, for example, counts a new file's blocks up to seconds after
   the write. A block is the unit in which a filesystem allocates disk space. A
   file scanned within those seconds gets its real `disk_size` at the next scan.
-- `scan` hashes a file again when its size or its mtime differs from its record.
-  An older mtime counts as much as a newer one. A file put back by `cp -p`,
-  `rsync -a` or a restore from backup often has an older mtime. The mtime is
-  compared to the nanosecond, as finely as the filesystem records it.
+- `scan` hashes a file again when its size differs or its mtime is newer. The
+  mtime is compared to the nanosecond, as finely as the filesystem records it. A
+  same-size rewrite counts as a change whenever the filesystem gives it a later
+  mtime, even within the same second.
 - The scan deletes each record under a scanned operand whose file it could not
   verify. That covers deleted files, and paths the scan could not stat or read
   this run. To stat a file is to read its details, such as its size, without
@@ -451,16 +436,15 @@ operands:
   scanned on different schedules into one database.
 - The scan keeps every record at or below a path that the walk leaves out for
   one of these reasons:
-    - it is an `--exclude` path;
     - it is a default exclude;
     - it is not on a persistent filesystem;
     - with `-x`, it is a directory on another filesystem than its operand.
 
     Such records count as outside the scanned operands. So with `-x`, a
     filesystem mounted under an operand can be scanned on its own schedule into
-    the same database. An operand may itself lie at or inside such a path, other
-    than an `--exclude` path (see "Operands"). Its walk verifies the records
-    below it, so they are deleted when their files are gone.
+    the same database. An operand may itself lie at or inside such a path, as
+    "Operands" describes. Its walk verifies the records below it, so they are
+    deleted when their files are gone.
 
 #### Phases
 
@@ -559,17 +543,6 @@ walk practical on large or busy storage pools.
     The path is not counted as skipped. The records below it are kept, as
     described under "What a scan does to the database".
 
-- The walk never enters or records an `--exclude` path, nor anything below it.
-  For each one it reaches, `scan` prints a line on stderr naming it:
-
-    ```
-    scan: skipped /srv/cache (--exclude)
-    ```
-
-    The path is not counted as skipped. The scan keeps the records at and below
-    it, as described under "What a scan does to the database".
-    `--no-default-excludes` does not change this rule.
-
 - Below an operand, the walk does not enter a default exclude. On Linux, the
   default excludes hold temporary files and the kernel's view of the running
   system. They depend on the system, and `sfdupes scan --help` lists those of
@@ -644,8 +617,7 @@ from a thread of its own and never blocks the workers.
   it repeats another or lies under another;
 - the progress display of each phase (see "Progress"). `scan` prints each
   warning for a skipped path as it happens. It prints a line the same way for
-  each path left out as an `--exclude` path, as a default exclude or as not on a
-  persistent filesystem;
+  each path left out as a default exclude or as not on a persistent filesystem;
 - the summary line;
 - a warning when a report still has the database open as the scan ends (see
   "Concurrent reads").
@@ -766,6 +738,7 @@ when they hold the same relative paths, and each path holds a file with the same
 signature in both. It rebuilds the directory tree from the paths in the records,
 split on `/`. Like `report`, it never opens a scanned file. It checks only that
 the directory at the top of each copy still exists, as `report` checks a path.
+It looks at no file or directory inside a copy.
 
 Definitions:
 
@@ -792,8 +765,8 @@ Processing:
   directories that all have the same digest. The parents' group, or an
   ancestor's, already implies it. A group is always reported when it holds
   sibling directories, or when its members' parents have different digests.
-- A directory that is gone is dropped from its group. A group left with fewer
-  than two directories is not reported.
+- In each group that is not left out, a directory that is gone is left out. A
+  group that still has two or more directories is reported.
 - Within a group, paths are sorted in byte order. The first is `first`, and
   every other path is a `dupe`.
 - Groups are ordered by total tree size, largest first, then by `first` path.
@@ -1226,9 +1199,6 @@ showing the count it stopped at.
 - `1`: a fatal error, a `scan` stopped by `SIGINT` or `SIGTERM`, or a `dwim`
   stopped by either during its scan. A fatal error is one of these:
     - an operand that does not exist, or whose real path `scan` cannot find;
-    - an `--exclude` path that does not exist, or whose real path `scan` cannot
-      find;
-    - an operand at or below an `--exclude` path;
     - a list of mounted filesystems that `scan` cannot read;
     - another `scan` holding the lock (see "The scan lock");
     - a database, its directory or its lock file that cannot be created or
@@ -1248,7 +1218,6 @@ showing the count it stopped at.
       `--workers abc`;
     - `scan` with no operand;
     - `--workers` below 1;
-    - an empty `--exclude` value, as in `--exclude ""`;
     - `report`, `trees`, `info` or `dwim` with a positional argument.
 
 A fatal error is reported on stderr, starting with `sfdupes:`. A failed write to

TODO.md

@@ -29,23 +29,17 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
-- New `scan` flag `--exclude PATH`, which may be repeated. The walk neither
-  enters nor records an excluded path, and keeps the records below it. An
-  operand at or below one is a fatal error (2026-11-11,
-  https://git.eeqj.de/sneak/sfdupes/issues/163)
-
 - `report` and `trees` leave out a copy that was deleted after the scan. Each
   checks only the copy itself with `lstat`: the file, or the directory at the
   top of a tree. A group left with one copy is not reported. A missing `scan`
   operand is still a fatal error (2026-11-11,
   https://git.eeqj.de/sneak/sfdupes/issues/173)
-- The usage line of `scan` no longer ends in `[flags]`. It is the line
-  `README.md` shows under "Subcommands" (2026-11-11,
-  https://git.eeqj.de/sneak/sfdupes/issues/169)
+
 - `report` and `trees` leave out empty files. `report` writes no group of size
   0, and `trees` writes no group whose trees hold 0 bytes. An empty file still
   counts toward a tree's digest (2026-11-11,
   https://git.eeqj.de/sneak/sfdupes/issues/178)
+
 - The Go code moved out of the repository root. `cmd/sfdupes/main.go` is the
   command, and it calls `Main` in the package `internal/sfdupes`. `main.go`
   became `internal/sfdupes/cli.go`. Every other file kept its name. The install

internal/sfdupes/cancel_test.go

@@ -359,7 +359,7 @@ func TestRunScanInterrupted(t *testing.T) {
 	dir := buildSmokeTree(t)
 
 	err := runScan(t.Context(), []string{dir}, walkCancelWorkers, false,
-		false, nil)
+		false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -383,7 +383,7 @@ func TestRunScanInterrupted(t *testing.T) {
 		defer close(done)
 
 		err = runScan(cancelledContext(t), []string{dir}, walkCancelWorkers,
-			false, false, nil)
+			false, false)
 	}()
 
 	awaitReturn(t, done, "runScan")
@@ -411,7 +411,7 @@ func TestRunScanInterrupted(t *testing.T) {
 	}
 
 	err = runScan(t.Context(), []string{dir}, walkCancelWorkers, false,
-		false, nil)
+		false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -437,7 +437,7 @@ func TestRunScanInterruptedMidHash(t *testing.T) {
 	dir := buildWalkCancelTree(t)
 
 	err := runScan(newWalkClock(hashCancelAtDone), []string{dir},
-		walkCancelWorkers, false, false, nil)
+		walkCancelWorkers, false, false)
 	if !errors.Is(err, errInterrupted) {
 		t.Fatalf("runScan interrupted mid-hash = %v, want %v",
 			err, errInterrupted)

internal/sfdupes/cli.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"runtime"
 	"runtime/debug"
-	"slices"
 
 	"github.com/spf13/cobra"
 )
@@ -41,11 +40,6 @@ var errNoSubcommand = errors.New("no subcommand")
 // below 1.
 var errWorkersBelowOne = errors.New("--workers must be at least 1")
 
-// errEmptyExcludeValue is the usage error for an empty scan --exclude
-// value, as from --exclude "$DIR" with DIR unset. Taken as a path, it
-// would name the working directory.
-var errEmptyExcludeValue = errors.New("--exclude must not be empty")
-
 // Version is the build version, injected at link time via -ldflags
 // (see the Makefile); empty when the linker set none, as for a binary
 // built by go install. buildVersion turns it into what --version prints.
@@ -207,43 +201,33 @@ func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
 	return root
 }
 
-// newScanCommand builds the scan subcommand, with its --workers, -x,
-// --no-default-excludes and --exclude flags. Its help lists the default
-// excludes of the system it runs on, and the filesystem types it never
-// records anything on.
+// newScanCommand builds the scan subcommand, with its --workers, -x and
+// --no-default-excludes flags. Its help lists the default excludes of
+// the system it runs on, and the filesystem types it never records
+// anything on.
 func newScanCommand() *cobra.Command {
 	var (
 		scanWorkers           int
 		scanOneFS             bool
 		scanNoDefaultExcludes bool
-		scanExclude           []string
 	)
 
 	short := "Walk trees and synchronize the scan database"
 
 	scanCmd := &cobra.Command{
-		Use: cmdScan + " [--workers N] [-x] [--no-default-excludes] " +
-			"[--exclude PATH]... PATH...",
-		// The Use line already names every flag, so cobra must not
-		// append its generic "[flags]" to it.
-		DisableFlagsInUseLine: true,
-		Short:                 short,
-		Long:                  short + ".\n\n" + defaultExcludesHelp(runtime.GOOS),
-		Args:                  cobra.MinimumNArgs(1),
+		Use:   cmdScan + " [--workers N] [-x] [--no-default-excludes] PATH...",
+		Short: short,
+		Long:  short + ".\n\n" + defaultExcludesHelp(runtime.GOOS),
+		Args:  cobra.MinimumNArgs(1),
 		PreRunE: func(cmd *cobra.Command, _ []string) error {
-			err := checkScanWorkers(cmd, scanWorkers)
-			if err != nil {
-				return err
-			}
-
-			return rejectEmptyExcludeValue(cmd, scanExclude)
+			return checkScanWorkers(cmd, scanWorkers)
 		},
 		RunE: runE(func(ctx context.Context, args []string) error {
 			ctx, stop := interruptContext(ctx)
 			defer stop()
 
 			return runScan(ctx, args, scanWorkers, scanOneFS,
-				scanNoDefaultExcludes, scanExclude)
+				scanNoDefaultExcludes)
 		}),
 	}
 	scanCmd.Flags().IntVar(&scanWorkers, "workers", runtime.NumCPU(),
@@ -252,10 +236,6 @@ func newScanCommand() *cobra.Command {
 		"do not cross filesystem boundaries")
 	scanCmd.Flags().BoolVar(&scanNoDefaultExcludes, "no-default-excludes",
 		false, "enter the default excludes, the paths listed above")
-	// A string array, not a slice, so a comma in a path is not a
-	// separator.
-	scanCmd.Flags().StringArrayVar(&scanExclude, "exclude", nil,
-		"never enter or record `PATH` or anything below it; repeatable")
 
 	return scanCmd
 }
@@ -273,18 +253,6 @@ func checkScanWorkers(cmd *cobra.Command, workers int) error {
 	return fmt.Errorf("%w, got %d", errWorkersBelowOne, workers)
 }
 
-// rejectEmptyExcludeValue rejects an empty scan --exclude value. That
-// is a usage error reported in one line, as for --workers below 1.
-func rejectEmptyExcludeValue(cmd *cobra.Command, excludePaths []string) error {
-	if !slices.Contains(excludePaths, "") {
-		return nil
-	}
-
-	cmd.SilenceUsage = true
-
-	return errEmptyExcludeValue
-}
-
 // runE adapts a subcommand implementation, or the version print, to
 // cobra's RunE. Cobra prints the error and the command's usage text for
 // every error RunE returns, but a subcommand that ran and failed has no

internal/sfdupes/cli_test.go

@@ -570,8 +570,7 @@ func TestRunNamesDefaultDatabase(t *testing.T) {
 	}{
 		cmdScan: {
 			run: func() error {
-				return runScan(t.Context(), []string{missing}, 1, false, false,
-					nil)
+				return runScan(t.Context(), []string{missing}, 1, false, false)
 			},
 			want: scanWant,
 		},
@@ -713,45 +712,6 @@ func TestRunHelp(t *testing.T) {
 				args, got)
 		}
 	}
-
-	// The scan help lists --exclude with its argument.
-	var stdout, stderr bytes.Buffer
-
-	run([]string{cmdScan, "-h"}, &stdout, &stderr)
-
-	if !strings.Contains(stderr.String(), excludeFlag+" PATH") {
-		t.Errorf("scan -h stderr = %q, want %s PATH", stderr.String(),
-			excludeFlag)
-	}
-}
-
-func TestRunScanUsageLine(t *testing.T) {
-	t.Parallel()
-
-	// README §Subcommands shows this usage line for scan, and the help
-	// and the usage error both print it.
-	const want = "\n  sfdupes scan [--workers N] [-x] [--no-default-excludes] " +
-		"[--exclude PATH]... PATH...\n"
-
-	cases := map[string][]string{
-		"help":          {cmdScan, "-h"},
-		"missing paths": {cmdScan},
-	}
-
-	for name, args := range cases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			var stdout, stderr bytes.Buffer
-
-			run(args, &stdout, &stderr)
-
-			if !strings.Contains(stderr.String(), want) {
-				t.Errorf("run(%v) stderr = %q, want the usage line %q",
-					args, stderr.String(), want)
-			}
-		})
-	}
 }
 
 func TestRunVersion(t *testing.T) {

internal/sfdupes/dwim.go

@@ -17,8 +17,7 @@ import (
 // ends it at once, as it ends trees.
 func runDwim(ctx context.Context, root string, stdout io.Writer) error {
 	scanCtx, stop := interruptContext(ctx)
-	err := runScan(scanCtx, []string{root}, runtime.NumCPU(), false, false,
-		nil)
+	err := runScan(scanCtx, []string{root}, runtime.NumCPU(), false, false)
 
 	stop()
 

internal/sfdupes/exclude.go

@@ -1,9 +1,8 @@
 package sfdupes
 
-// This file holds three rules for the walk (README "Rules for the
-// walk"): the paths given with --exclude, which the scan never enters;
+// This file holds two rules for the walk (README "Rules for the walk"):
 // the default excludes, the paths a scan's walk does not enter below an
-// operand unless scan is given --no-default-excludes; and the
+// operand unless scan is given --no-default-excludes, and the
 // filesystems that are not persistent, on which the scan never records
 // or reads anything.
 
@@ -13,7 +12,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -45,25 +43,17 @@ const typesPerHelpLine = 6
 // readMountInfo reads.
 var errMountInfoLine = errors.New("unexpected line")
 
-// errExcludedOperand reports an operand at or below a path given with
-// --exclude.
-var errExcludedOperand = errors.New("operand excluded by --exclude")
-
 // walkRules holds the rules for the walk that a scan sets up as it
-// starts. excludePaths are the paths given with --exclude, each with
-// the device ID and inode number of the file it names (see
-// excludePathInodes), which the walk neither enters nor records,
-// whatever path leads to them. defaultExcludes are the default
-// excludes, or none with --no-default-excludes. nonPersistent maps the
-// device ID of every mounted filesystem that is not persistent to its
-// type; the scan records and reads nothing on one of those, whatever
-// the flags. databaseFiles are the scan's own database files, which the
-// walk passes over (see databaseFiles in db.go).
+// starts. excludes are the default excludes, or none with
+// --no-default-excludes. nonPersistent maps the device ID of every
+// mounted filesystem that is not persistent to its type; the scan
+// records and reads nothing on one of those, whatever the flags.
+// databaseFiles are the scan's own database files, which the walk
+// passes over (see databaseFiles in db.go).
 type walkRules struct {
-	excludePaths    []fileRec
-	defaultExcludes []string
-	nonPersistent   map[uint64]string
-	databaseFiles   []fileRec
+	excludes      []string
+	nonPersistent map[uint64]string
+	databaseFiles []fileRec
 }
 
 // defaultExcludes returns the default excludes of the system goos
@@ -107,88 +97,6 @@ func isDefaultExclude(path string, excludes []string) bool {
 	return false
 }
 
-// excludePathInodes returns each of paths, the --exclude values, as its
-// real path (see realPaths) with the device ID and inode number of the
-// file there. The walk compares what it reaches with those, as it does
-// with the database files, so it also leaves out an --exclude path
-// spelled another way, such as in another letter case on macOS.
-func excludePathInodes(paths []string) ([]fileRec, error) {
-	resolved, err := realPaths(paths)
-	if err != nil {
-		return nil, err
-	}
-
-	files := make([]fileRec, 0, len(resolved))
-
-	for _, path := range resolved {
-		fi, err := os.Lstat(path)
-		if err != nil {
-			return nil, err
-		}
-
-		dev, ino := inodeOfInfo(fi)
-		files = append(files, fileRec{path: path, dev: dev, ino: ino})
-	}
-
-	return files, nil
-}
-
-// matchingExcludePath returns the path of the one of excludePaths with
-// the device ID and inode number of fi, an lstat result, or "" when
-// there is none.
-func matchingExcludePath(fi fs.FileInfo, excludePaths []fileRec) string {
-	dev, ino := inodeOfInfo(fi)
-	f := fileRec{dev: dev, ino: ino}
-
-	for _, exclude := range excludePaths {
-		if sameInode(exclude, f) {
-			return exclude.path
-		}
-	}
-
-	return ""
-}
-
-// checkOperandsNotExcluded returns an error when one of roots, the
-// operands, or a directory above it is one of excludePaths, the
-// --exclude paths, by device ID and inode number. The error names the
-// operand and the --exclude path. The roots are absolute, so the
-// directories above each one end at /. A path here that lstat cannot
-// read is an error too.
-func checkOperandsNotExcluded(roots []string, excludePaths []fileRec) error {
-	for _, root := range roots {
-		for path := root; ; path = filepath.Dir(path) {
-			fi, err := os.Lstat(path)
-			if err != nil {
-				return fmt.Errorf("scan %s: %w", root, err)
-			}
-
-			exclude := matchingExcludePath(fi, excludePaths)
-			if exclude != "" {
-				return fmt.Errorf("scan %s: %w %s", root, errExcludedOperand,
-					exclude)
-			}
-
-			if path == "/" {
-				break
-			}
-		}
-	}
-
-	return nil
-}
-
-// excludePathLine returns the line the scan prints for path when fi,
-// its lstat, makes it one of rules.excludePaths, and "" when it does
-// not.
-func (rules walkRules) excludePathLine(path string, fi fs.FileInfo) string {
-	if matchingExcludePath(fi, rules.excludePaths) == "" {
-		return ""
-	}
-
-	return fmt.Sprintf("scan: skipped %s (--exclude)", path)
-}
-
 // nonPersistentFilesystemTypes returns the filesystem types that are
 // not persistent: filesystems that the kernel makes up or that are kept
 // in memory. devfs is the macOS filesystem of /dev; the others are

internal/sfdupes/exclude_test.go

@@ -14,9 +14,6 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// excludeFlag is the scan flag that names a path the walk never enters.
-const excludeFlag = "--exclude"
-
 func TestDefaultExcludes(t *testing.T) {
 	t.Parallel()
 
@@ -191,7 +188,7 @@ func TestScanDoesNotEnterDefaultExclude(t *testing.T) {
 	unseen := writeFile(t, excluded, "new", pattern(2, 10))
 
 	st, err := syncScan(t.Context(), db, []string{dir}, 1, false,
-		walkRules{defaultExcludes: []string{excluded}})
+		walkRules{excludes: []string{excluded}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -237,7 +234,7 @@ func TestScanWalksOperandInDefaultExclude(t *testing.T) {
 			db := openTestDB(t)
 
 			st, err := syncScan(t.Context(), db, roots, 1, false,
-				walkRules{defaultExcludes: []string{excluded}})
+				walkRules{excludes: []string{excluded}})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -265,7 +262,7 @@ func TestScanNamesNoDefaultExcludeThatIsAnOperand(t *testing.T) {
 	f := writeFile(t, excluded, "f", pattern(1, 10))
 
 	st, err := syncScan(t.Context(), db, []string{dir, excluded}, 1, false,
-		walkRules{defaultExcludes: []string{excluded}})
+		walkRules{excludes: []string{excluded}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -359,217 +356,6 @@ func TestRunScanNoDefaultExcludes(t *testing.T) {
 	assertRecorded(t, path, f, true)
 }
 
-// TestRunScanExcludeNested scans a tree through the command with an
-// --exclude path two levels below the operand. The walk records nothing
-// at or below it and says so. The record an earlier scan left there is
-// kept although its file is gone.
-func TestRunScanExcludeNested(t *testing.T) {
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
-
-	dir := realTempDir(t)
-	excluded := filepath.Join(dir, "a", "b")
-	kept := writeFile(t, dir, "a/f", pattern(1, 10))
-	gone := writeFile(t, excluded, "gone", pattern(2, 10))
-
-	scanOK(t, dir)
-
-	err := os.Remove(gone)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	unseen := writeFile(t, excluded, "c/new", pattern(3, 10))
-
-	stderr := scanOK(t, excludeFlag, excluded, dir)
-
-	line := "scan: skipped " + excluded + " (--exclude)\n"
-	if !strings.Contains(stderr, line) {
-		t.Errorf("stderr = %q, want %q", stderr, line)
-	}
-
-	assertRecorded(t, path, kept, true)
-	assertRecorded(t, path, gone, true)
-	assertRecorded(t, path, unseen, false)
-}
-
-// TestRunScanExcludeRepeated gives --exclude twice, once for a
-// directory and once for a file, the file through a symlink to it. The
-// walk records neither, and records the file beside them.
-func TestRunScanExcludeRepeated(t *testing.T) {
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
-
-	dir := realTempDir(t)
-	inDir := writeFile(t, dir, "skip/f", pattern(1, 10))
-	file := writeFile(t, dir, "skip-file", pattern(2, 10))
-	kept := writeFile(t, dir, "keep", pattern(3, 10))
-
-	link := filepath.Join(t.TempDir(), "link")
-	symlink(t, file, link)
-
-	scanOK(t, excludeFlag, filepath.Dir(inDir), excludeFlag, link, dir)
-
-	assertRecorded(t, path, inDir, false)
-	assertRecorded(t, path, file, false)
-	assertRecorded(t, path, kept, true)
-}
-
-// TestRunScanExcludeReachedByAnotherPath gives --exclude a directory
-// through a symlink and a file through "..", so the walk reaches
-// neither by the path given. The walk also reaches the file through a
-// hard link. It records none of these, prints a line naming each, and
-// records the file beside them.
-func TestRunScanExcludeReachedByAnotherPath(t *testing.T) {
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
-
-	dir := realTempDir(t)
-	inDir := writeFile(t, dir, "a/cache/f", pattern(1, 10))
-	file := writeFile(t, dir, "a/big", pattern(2, 10))
-	kept := writeFile(t, dir, "keep", pattern(3, 10))
-
-	hardLink := filepath.Join(dir, "big-link")
-
-	err := os.Link(file, hardLink)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	link := filepath.Join(t.TempDir(), "link")
-	symlink(t, filepath.Join(dir, "a"), link)
-
-	// Joined as text, since filepath.Join would drop the "..".
-	dotDot := dir + "/a/cache/../big"
-
-	stderr := scanOK(t, excludeFlag, filepath.Join(link, "cache"),
-		excludeFlag, dotDot, dir)
-
-	for _, skipped := range []string{filepath.Dir(inDir), file, hardLink} {
-		line := "scan: skipped " + skipped + " (--exclude)\n"
-		if !strings.Contains(stderr, line) {
-			t.Errorf("stderr = %q, want %q", stderr, line)
-		}
-	}
-
-	assertRecorded(t, path, inDir, false)
-	assertRecorded(t, path, file, false)
-	assertRecorded(t, path, hardLink, false)
-	assertRecorded(t, path, kept, true)
-}
-
-// TestRunScanExcludedOperand checks that an operand at or below an
-// --exclude path is a fatal error that names both, and so is an
-// --exclude path that does not exist. An operand that is a hard link to
-// an --exclude file is at it. Neither scan writes a database.
-func TestRunScanExcludedOperand(t *testing.T) {
-	dir := realTempDir(t)
-	sub := filepath.Join(dir, "sub")
-	f := writeFile(t, sub, "f", pattern(1, 10))
-
-	hardLink := filepath.Join(dir, "f-link")
-
-	err := os.Link(f, hardLink)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	cases := map[string]struct {
-		args []string
-		want string
-	}{
-		"at it": {
-			[]string{excludeFlag, sub, sub},
-			"scan " + sub + ": operand excluded by --exclude " + sub + "\n",
-		},
-		"below it": {
-			[]string{excludeFlag, dir, sub},
-			"scan " + sub + ": operand excluded by --exclude " + dir + "\n",
-		},
-		"after an operand it does not exclude": {
-			[]string{dir, excludeFlag, sub, sub},
-			"scan " + sub + ": operand excluded by --exclude " + sub + "\n",
-		},
-		"a hard link to it": {
-			[]string{excludeFlag, f, hardLink},
-			"scan " + hardLink + ": operand excluded by --exclude " + f + "\n",
-		},
-		"exclude missing": {
-			[]string{excludeFlag, filepath.Join(dir, "nope"), dir},
-			"--exclude: resolve " + filepath.Join(dir, "nope") + ": ",
-		},
-	}
-
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			path := testDBPath(t)
-			t.Setenv(databaseEnv, path)
-
-			stdout := captureStdout(t)
-			stderr := captureStderr(t)
-
-			code := run(append([]string{cmdScan}, tc.args...), os.Stdout,
-				os.Stderr)
-			if code != exitFatal {
-				t.Errorf("run(scan %q) = %d, want %d", tc.args, code,
-					exitFatal)
-			}
-
-			assertFatalOutput(t, stderr(), stdout())
-
-			if !strings.Contains(stderr(), "sfdupes: "+tc.want) {
-				t.Errorf("stderr = %q, want %q", stderr(), tc.want)
-			}
-
-			_, err := os.Lstat(path)
-			if !errors.Is(err, os.ErrNotExist) {
-				t.Errorf("lstat %s: %v, want no database", path, err)
-			}
-		})
-	}
-}
-
-// TestRunScanRejectsEmptyExclude checks that an empty --exclude value,
-// given as its own argument, after "=" or after another --exclude, is
-// a usage error reported in one line before anything is scanned
-// (README "Settings").
-func TestRunScanRejectsEmptyExclude(t *testing.T) {
-	dir := t.TempDir()
-
-	cases := map[string][]string{
-		"separate":     {excludeFlag, "", dir},
-		"joined by =":  {excludeFlag + "=", dir},
-		"after a path": {excludeFlag, t.TempDir(), excludeFlag, "", dir},
-	}
-
-	for name, args := range cases {
-		t.Run(name, func(t *testing.T) {
-			path := testDBPath(t)
-			t.Setenv(databaseEnv, path)
-
-			var stdout, stderr bytes.Buffer
-
-			code := run(append([]string{cmdScan}, args...), &stdout,
-				&stderr)
-			if code != exitUsage {
-				t.Errorf("run(scan %q) = %d, want %d", args, code,
-					exitUsage)
-			}
-
-			want := "Error: --exclude must not be empty\n"
-			if stdout.String() != "" || stderr.String() != want {
-				t.Errorf("stdout, stderr = %q, %q, want \"\", %q",
-					stdout.String(), stderr.String(), want)
-			}
-
-			_, err := os.Lstat(path)
-			if !errors.Is(err, os.ErrNotExist) {
-				t.Errorf("lstat %s: %v, want no database", path, err)
-			}
-		})
-	}
-}
-
 // TestRunScanSkipsNonPersistentOperand scans, through the command, a
 // directory on a filesystem that is not persistent, with and without
 // --no-default-excludes: either way it is skipped, with a line saying

internal/sfdupes/report_test.go

@@ -491,9 +491,9 @@ func TestReadReportChecksOnlyPossibleDuplicates(t *testing.T) {
 
 	a, u, e := testHash("a"), testHash("u"), sha256.Sum256(nil)
 	recs := []scanRec{
-		{size: 9, head: a, tail: a, content: a, path: "/copy/1"},
-		{size: 9, head: a, tail: a, content: a, path: "/copy/2"},
-		{size: 9, head: a, tail: a, content: a, path: "/copy/3"},
+		{size: 9, head: a, tail: a, content: a, path: "/x/1"},
+		{size: 9, head: a, tail: a, content: a, path: "/x/2"},
+		{size: 9, head: a, tail: a, content: a, path: "/x/3"},
 		{size: 9, head: u, tail: u, content: u, path: "/lonely"},
 		{size: 0, head: e, tail: e, content: e, path: "/empty1"},
 		{size: 0, head: e, tail: e, content: e, path: "/empty2"},
@@ -521,81 +521,12 @@ func TestReadReportChecksOnlyPossibleDuplicates(t *testing.T) {
 
 	slices.Sort(checked)
 
-	want := []string{"/copy/1", "/copy/2", "/copy/3"}
+	want := []string{"/x/1", "/x/2", "/x/3"}
 	if !slices.Equal(checked, want) {
 		t.Errorf("paths checked on disk = %q, want %q", checked, want)
 	}
 }
 
-// TestReadReportDropsGroupLeftWithOnePath checks that a group of two
-// paths, one of them gone, is no duplicate group. If kept, it would
-// write no row, but the summary line would count it.
-func TestReadReportDropsGroupLeftWithOnePath(t *testing.T) {
-	t.Parallel()
-
-	a := testHash("a")
-	recs := []scanRec{
-		{size: 9, head: a, tail: a, content: a, path: "/a/kept"},
-		{size: 9, head: a, tail: a, content: a, path: "/a/gone"},
-	}
-
-	db := openTestDB(t)
-
-	err := applyChanges(t.Context(), db, recs, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	exists := func(path string) bool { return path != "/a/gone" }
-
-	report, err := readReport(t.Context(), db, "", io.Discard, exists, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if report.dupeGroups != 0 {
-		t.Errorf("duplicate groups = %d, want 0", report.dupeGroups)
-	}
-}
-
-// TestReadReportKeepsGroupLeftWithTwoPaths checks that a group of three
-// paths, one of them gone, is a duplicate group of the other two.
-func TestReadReportKeepsGroupLeftWithTwoPaths(t *testing.T) {
-	t.Parallel()
-
-	a := testHash("a")
-	recs := []scanRec{
-		{size: 9, head: a, tail: a, content: a, path: "/b/kept1"},
-		{size: 9, head: a, tail: a, content: a, path: "/b/gone"},
-		{size: 9, head: a, tail: a, content: a, path: "/b/kept2"},
-	}
-
-	db := openTestDB(t)
-
-	err := applyChanges(t.Context(), db, recs, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	exists := func(path string) bool { return path != "/b/gone" }
-
-	var out bytes.Buffer
-
-	report, err := readReport(t.Context(), db, "", &out, exists, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if report.dupeGroups != 1 {
-		t.Errorf("duplicate groups = %d, want 1", report.dupeGroups)
-	}
-
-	want := "first\tdupe\tsize\n/b/kept1\t/b/kept2\t9\n"
-	if got := out.String(); got != want {
-		t.Errorf("stdout = %q, want %q", got, want)
-	}
-}
-
 func TestDupeGroupsContentSeparates(t *testing.T) {
 	t.Parallel()
 

internal/sfdupes/scan.go

@@ -102,44 +102,40 @@ func scanPhase(name string) string {
 // scan command rejects anything less. Before the lock is taken, the
 // scan lists the filesystems that are not persistent, on which the walk
 // records nothing; unless noDefaultExcludes is set, the walk does not
-// enter the default excludes either. The walk neither enters nor
-// records the paths in excludePaths, the --exclude values; an operand
-// at or below one is a fatal error. Once the database is open, the scan
-// notes its files, which the walk passes over.
+// enter the default excludes either. Once the database is open, the
+// scan notes its files, which the walk passes over.
 func runScan(ctx context.Context, roots []string, workers int,
-	oneFS, noDefaultExcludes bool, excludePaths []string,
+	oneFS, noDefaultExcludes bool,
 ) error {
 	dbPath, source, err := databasePath()
 	if err != nil {
 		return err
 	}
 
-	printDatabasePath(dbPath, source)
+	// A database file missing now is created by lockScanDatabase below.
+	what := "database"
 
-	roots, err = realPaths(roots)
+	_, err = os.Stat(dbPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		what = "new database"
+	}
+
+	fmt.Fprintf(os.Stderr, "scan: %s %s (%s)\n", what, escapePath(dbPath),
+		source)
+
+	roots, err = resolveRoots(roots)
 	if err != nil {
 		return err
 	}
 
-	var rules walkRules
-
-	rules.excludePaths, err = excludePathInodes(excludePaths)
-	if err != nil {
-		return fmt.Errorf("--exclude: %w", err)
-	}
-
-	err = checkOperandsNotExcluded(roots, rules.excludePaths)
-	if err != nil {
-		return err
-	}
-
-	rules.nonPersistent, err = nonPersistentFilesystems()
+	nonPersistent, err := nonPersistentFilesystems()
 	if err != nil {
 		return fmt.Errorf("list the mounted filesystems: %w", err)
 	}
 
+	rules := walkRules{nonPersistent: nonPersistent}
 	if !noDefaultExcludes {
-		rules.defaultExcludes = defaultExcludes(runtime.GOOS)
+		rules.excludes = defaultExcludes(runtime.GOOS)
 	}
 
 	lock, err := lockScanDatabase(dbPath)
@@ -185,21 +181,6 @@ func runScan(ctx context.Context, roots []string, workers int,
 	return nil
 }
 
-// printDatabasePath prints on stderr the line that names the database
-// at dbPath, with source, saying whether it is new. A database file
-// missing now is new: lockScanDatabase creates it.
-func printDatabasePath(dbPath, source string) {
-	what := "database"
-
-	_, err := os.Stat(dbPath)
-	if errors.Is(err, fs.ErrNotExist) {
-		what = "new database"
-	}
-
-	fmt.Fprintf(os.Stderr, "scan: %s %s (%s)\n", what, escapePath(dbPath),
-		source)
-}
-
 // interruptContext returns a copy of ctx that the first SIGINT or
 // SIGTERM cancels; the scan command runs the scan under it. stop
 // releases the signals.
@@ -228,25 +209,24 @@ func interrupted(walked int) error {
 	return errInterrupted
 }
 
-// realPaths returns the real path of each of paths, the PATH operands
-// or the --exclude values: absolute, with every symlink in it followed.
-// Database records are keyed by that path, so scan results depend
-// neither on the working directory nor on the symlinks an operand was
-// given through. A path that cannot be resolved, because it or a
-// symlink's target does not exist or cannot be read, is a fatal error
-// before any scanning.
-func realPaths(paths []string) ([]string, error) {
-	resolved := make([]string, 0, len(paths))
+// resolveRoots converts each PATH operand to its real path: absolute,
+// with every symlink in it followed. Database records are keyed by
+// that path, so scan results depend neither on the working directory
+// nor on the symlinks an operand was given through. An operand that
+// cannot be resolved, because it or a symlink's target does not exist
+// or cannot be read, is a fatal error before any scanning.
+func resolveRoots(roots []string) ([]string, error) {
+	resolved := make([]string, 0, len(roots))
 
-	for _, path := range paths {
-		a, err := absolutePath(path)
+	for _, root := range roots {
+		a, err := absolutePath(root)
 		if err != nil {
-			return nil, fmt.Errorf("resolve %s: %w", path, err)
+			return nil, fmt.Errorf("resolve %s: %w", root, err)
 		}
 
 		r, err := filepath.EvalSymlinks(a)
 		if err != nil {
-			return nil, fmt.Errorf("resolve %s: %w", path, err)
+			return nil, fmt.Errorf("resolve %s: %w", root, err)
 		}
 
 		resolved = append(resolved, r)
@@ -315,7 +295,7 @@ func walkReaches(above, r string, oneFS bool, rules walkRules,
 	}
 
 	for ; dir != above; dir = filepath.Dir(dir) {
-		if isDefaultExclude(dir, rules.defaultExcludes) {
+		if isDefaultExclude(dir, rules.excludes) {
 			return false
 		}
 
@@ -438,7 +418,7 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 
 // walkableRoots returns the operands the walk can start from: regular
 // files, and directories not named .zfs, none of them inside a
-// directory named .zfs. The operands are real paths from realPaths,
+// directory named .zfs. The operands are real paths from resolveRoots,
 // so these checks apply to what a symlink operand points at. Every
 // other operand is warned about, counted as skipped, and dropped. A
 // dropped operand is no longer a root, so the records stored beneath it
@@ -513,11 +493,10 @@ func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 // as verified. When its disk_size differs from the record's, it is
 // queued for the update phase, which writes the new disk_size. A record
 // at or below a path the walk left out, because -x stopped at it, it is
-// an --exclude path or a default exclude, or it is not on a persistent
-// filesystem, counts as outside the roots: it is not deleted. That does
-// not hold below a root at or inside that path, since that root's own
-// walk verifies the records below it; nor is a line printed for such a
-// root.
+// a default exclude, or it is not on a persistent filesystem, counts as
+// outside the roots: it is not deleted. That does not hold below a root
+// at or inside that path, since that root's own walk verifies the
+// records below it; nor is a line printed for such a root.
 func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 	// The records the last scan left under the roots estimate how many
 	// files the walk will find. A first scan has none, and no estimate.
@@ -566,7 +545,7 @@ func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 		prog.increment()
 
 		old, ok := s.existing[ev.rec.path]
-		if !ok || old.size != ev.rec.size || !ev.rec.mtime.Equal(old.mtime) {
+		if !ok || old.size != ev.rec.size || mtimeAfter(ev.rec.mtime, old.mtime) {
 			s.toHash = append(s.toHash, ev.rec)
 
 			continue
@@ -801,6 +780,16 @@ func (s *scanState) updatePhase(ctx context.Context) error {
 	return applyChanges(ctx, s.db, nil, deletes, prog)
 }
 
+// mtimeAfter reports whether mtime a is later than mtime b.
+// Not a.After(b): time.Time wraps an mtime past year 292 billion; Unix() undoes it.
+func mtimeAfter(a, b time.Time) bool {
+	if a.Unix() != b.Unix() {
+		return a.Unix() > b.Unix()
+	}
+
+	return a.Nanosecond() > b.Nanosecond()
+}
+
 // underAnyRoot reports whether path is any of the roots or lies under
 // one of them.
 func underAnyRoot(path string, roots []string) bool {
@@ -855,9 +844,9 @@ type dirJob struct {
 // file's statted record, a warning when fail is set, or a path the walk
 // left out: when otherFSDir is set, a directory -x did not enter
 // because it is on another filesystem than its operand, and when
-// leftOut is set, an --exclude path, a default exclude or a directory or
-// file on a filesystem that is not persistent, with warn holding the
-// line that says so.
+// leftOut is set, a default exclude or a directory or file on a
+// filesystem that is not persistent, with warn holding the line that
+// says so.
 type walkEvent struct {
 	rec        fileRec
 	warn       string
@@ -908,7 +897,7 @@ func sendEvent(ctx context.Context, events chan<- walkEvent,
 // operandWarning returns the one-line warning for an operand the walk
 // does not start from, naming the path and what it is, or "" for one it
 // does: a regular file, or a directory not named .zfs, that is not
-// inside a directory named .zfs. realPaths has already followed the
+// inside a directory named .zfs. resolveRoots has already followed the
 // operand's symlinks, so a symlink here is an operand replaced by one
 // after it was resolved, and is not followed.
 func operandWarning(root string, fi fs.FileInfo) string {
@@ -1139,9 +1128,8 @@ func walkOneDir(ctx context.Context, job dirJob, oneFS bool,
 // no longer exists, and one that has stopped being a regular file is
 // skipped. A file on a filesystem in rules that is not persistent, as
 // through a bind mount of one file, is not recorded: it gets an event
-// naming it instead, and so does a file given with --exclude, reached
-// by any path, a hard link to it included. One of the scan's own
-// database files in rules gets no event at all.
+// naming it instead. One of the scan's own database files in rules gets
+// no event at all.
 func emitFile(ctx context.Context, p string, e fs.DirEntry,
 	rules walkRules, events chan<- walkEvent,
 ) {
@@ -1165,10 +1153,6 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 	}
 
 	line := rules.nonPersistentLine(p, info)
-	if line == "" {
-		line = rules.excludePathLine(p, info)
-	}
-
 	if line != "" {
 		sendEvent(ctx, events, walkEvent{leftOut: p, warn: line})
 
@@ -1193,11 +1177,11 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 // subdirJob applies the descent rules to directory p: never enter
 // .zfs (ZFS snapshot pseudo-dirs would list every file once per
 // snapshot), never enter a directory on a filesystem in rules that is
-// not persistent, nor an --exclude path or a default exclude in rules,
-// and with -x never enter a directory on a different filesystem than
-// its operand. For all but .zfs it sends an event that names the
-// directory, so the scan keeps the records below it, except those below
-// an operand at or inside it.
+// not persistent, nor a default exclude in rules, and with -x never
+// enter a directory on a different filesystem than its operand. For the
+// last three it sends an event that names the directory, so the scan
+// keeps the records below it, except those below an operand at or
+// inside it.
 func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	parent dirJob, oneFS bool, rules walkRules,
 	events chan<- walkEvent,
@@ -1222,17 +1206,13 @@ func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	}
 
 	line := rules.nonPersistentLine(p, info)
-	if line == "" {
-		line = rules.excludePathLine(p, info)
-	}
-
 	if line != "" {
 		sendEvent(ctx, events, walkEvent{leftOut: p, warn: line})
 
 		return dirJob{}, false
 	}
 
-	if isDefaultExclude(p, rules.defaultExcludes) {
+	if isDefaultExclude(p, rules.excludes) {
 		sendEvent(ctx, events, walkEvent{
 			leftOut: p,
 			warn:    fmt.Sprintf("scan: skipped %s (default exclude)", p),

internal/sfdupes/scan_test.go

@@ -1384,47 +1384,6 @@ func TestSyncScanMtimeBump(t *testing.T) {
 	}
 }
 
-// TestSyncScanMtimeMovedBack replaces a file with other content of the
-// same size and an older mtime, as cp -p or a restore from backup does.
-// The next scan must hash the file again.
-func TestSyncScanMtimeMovedBack(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	db := openTestDB(t)
-	a := writeFile(t, dir, "a.bin", pattern(1, 500))
-
-	recorded := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-
-	err := os.Chtimes(a, recorded, recorded)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	syncTree(t, db, dir)
-
-	replaced := pattern(3, 500)
-	writeFile(t, dir, "a.bin", replaced)
-
-	older := recorded.Add(-time.Hour)
-
-	err = os.Chtimes(a, older, older)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	st := syncTree(t, db, dir)
-	if st != (scanStats{walked: 1, updated: 1}) {
-		t.Fatalf("rescan stats = %+v, want 1 updated", st)
-	}
-
-	assertWholeFileHashed(t, db, a, replaced)
-
-	if r := recordByPath(t, dbRecords(t, db), a); !r.mtime.Equal(older) {
-		t.Fatalf("mtime = %v, want %v", r.mtime, older)
-	}
-}
-
 // assertWholeFileHashed fails unless the record for path holds the
 // whole-file hash of data as its head, tail, and content.
 func assertWholeFileHashed(t *testing.T, db *sql.DB, path string,
@@ -2289,7 +2248,7 @@ func TestPruneRoots(t *testing.T) {
 
 	// The walk of /p does not enter /p/q when it is a default exclude, so
 	// /p/q is kept, without -x too; /p/q/r lies under it and is dropped.
-	got = pruneRoots(nested, false, walkRules{defaultExcludes: []string{pqRoot}},
+	got = pruneRoots(nested, false, walkRules{excludes: []string{pqRoot}},
 		device)
 	if !slices.Equal(got, want) {
 		t.Fatalf("pruneRoots excluding %s = %q, want %q", pqRoot, got, want)

internal/sfdupes/trees_test.go

@@ -503,16 +503,20 @@ func TestCollectTreeGroupsDifferingParents(t *testing.T) {
 // TestCollectTreeGroupsChecksOnlyReportedCopies checks that trees asks
 // whether a directory is on disk only for the members of the groups it
 // returns. It never asks about /a/proj/sub, which lies inside a copy
-// and whose group the group of /a/proj implies.
+// and whose group the group of /a/proj implies, nor about /a/empty,
+// which holds 0 bytes.
 func TestCollectTreeGroupsChecksOnlyReportedCopies(t *testing.T) {
 	t.Parallel()
 
-	f, g, u := testHash("f"), testHash("g"), testHash("u")
+	f, g, u, e := testHash("f"), testHash("g"), testHash("u"),
+		sha256.Sum256(nil)
 	recs := []scanRec{
 		{size: 10, head: f, tail: f, content: f, path: "/a/proj/f"},
 		{size: 20, head: g, tail: g, content: g, path: "/a/proj/sub/g"},
+		{size: 0, head: e, tail: e, content: e, path: "/a/empty/.gitkeep"},
 		{size: 10, head: f, tail: f, content: f, path: "/b/proj/f"},
 		{size: 20, head: g, tail: g, content: g, path: "/b/proj/sub/g"},
+		{size: 0, head: e, tail: e, content: e, path: "/b/empty/.gitkeep"},
 		// /a lacks this file, so /a and /b are no copies of each other.
 		{size: 30, head: u, tail: u, content: u, path: "/b/lonely"},
 	}
@@ -541,49 +545,3 @@ func TestCollectTreeGroupsChecksOnlyReportedCopies(t *testing.T) {
 			checked, want[0])
 	}
 }
-
-// TestCollectTreeGroupsDropsGroupLeftWithOneCopy checks that a group of
-// two copies, one of them gone, is not returned. If kept, it would
-// write no row, but the summary line would count it.
-func TestCollectTreeGroupsDropsGroupLeftWithOneCopy(t *testing.T) {
-	t.Parallel()
-
-	f := testHash("f")
-	recs := []scanRec{
-		{size: 10, head: f, tail: f, content: f, path: "/c/kept/f"},
-		{size: 10, head: f, tail: f, content: f, path: "/c/gone/f"},
-	}
-
-	super, dirs := treeOf(t, recs)
-
-	exists := func(path string) bool { return path != "/c/gone" }
-
-	got := groupPaths(collectTreeGroups(dirs, super, exists, nil))
-	if len(got) != 0 {
-		t.Errorf("groups = %v, want none", got)
-	}
-}
-
-// TestCollectTreeGroupsKeepsGroupLeftWithTwoCopies checks that a group
-// of three copies, one of them gone, is returned with the other two.
-func TestCollectTreeGroupsKeepsGroupLeftWithTwoCopies(t *testing.T) {
-	t.Parallel()
-
-	f := testHash("f")
-	recs := []scanRec{
-		{size: 10, head: f, tail: f, content: f, path: "/d/kept1/f"},
-		{size: 10, head: f, tail: f, content: f, path: "/d/gone/f"},
-		{size: 10, head: f, tail: f, content: f, path: "/d/kept2/f"},
-	}
-
-	super, dirs := treeOf(t, recs)
-
-	exists := func(path string) bool { return path != "/d/gone" }
-
-	got := groupPaths(collectTreeGroups(dirs, super, exists, nil))
-
-	want := [][]string{{"/d/kept1", "/d/kept2"}}
-	if !slices.EqualFunc(got, want, slices.Equal) {
-		t.Errorf("groups = %v, want %v", got, want)
-	}
-}