macOS: keep Spotlight's file results off, and add a way to stop the indexer

[landsman]

Two separate things, because they turn out to be separate mechanisms: which rows Spotlight is allowed to show, and whether mds indexes files at all.

Why

A kernel panic on 2026-08-12, #82. The vnode table filled up (263168 numvnodes, 0 free) while mds reindexed a monorepo behind several coding agents, APFS could no longer create vnodes, every mmapped page after that faulted with SIGBUS, launchd took one and the kernel panicked with initproc exited.

The results half — bin/macos/defaults.sh

defaults write com.apple.Spotlight EnabledPreferenceRules -array Custom.relatedContents … System.files System.folders System.iphoneApps

The key name lies: EnabledPreferenceRules lists what is turned off. Read, not guessed — defaults read was snapshotted, the Files and Folders switches flipped, and those two entries appeared in the array. A row left at Apple's default is simply absent, so the whole array is the state and adding a line means switching something off.

This does not stop indexing. With both switches off, a probe file dropped in ~/projects was in mdfind twenty seconds later. It filters what Spotlight shows, and that is all.

The indexer half — make macos-spotlight-off

sudo mdutil -i off -d /System/Volumes/Data

A whole volume, because nothing finer exists:

• man mdutil, man mds, man mdimport, man mdfind — not one mention of exclusions. A volume is the only granularity Apple documents.
• .metadata_never_index in ~/projects — tested, changed nothing.
• The Privacy list in System Settings does work, but it lives in /System/Volumes/Data/.Spotlight-V100/VolumeConfiguration.plist, which TCC hides even from root: PlistBuddy reports File Doesn't Exist for a file sudo mdutil -P prints happily. Scripting it needs Full Disk Access handed to whichever terminal runs it, and it is undocumented besides.

Costs Finder's "This Mac" search. App results (Mail, Notes, Messages) come from CoreSpotlight and are expected to survive — that is the one claim here not verified live, and it says so in the Makefile.

Its own target, not part of make macos: that one writes nothing outside $HOME and asks for no password, same reason macos-touchid stands alone. macos-spotlight-on reverses it.

Conflicts with #32

#32 (draft) adds a check that warns from make macos when too few apps are indexed, pointing at sudo mdutil -E /. With indexing off that check nags forever, and both branches touch bin/macos/defaults.sh. Whichever lands second needs the other taken into account — the check would have to skip when mdutil -s reports indexing disabled.

Checks

make lint bin-test passes. defaults.test.sh asserted a hardcoded domain count, 11 → 12. Neither make macos nor make macos-spotlight-off was run as part of preparing this.