How macOS actually works
Keeping an index current without rescanning depends on the operating system telling you what changed. On macOS that mechanism is FSEvents.
Rather than repeatedly asking "has anything changed?", a program registers interest in a directory tree and macOS delivers events when something does. The kernel already knows — it processed the write — so reporting it is nearly free.
Every event carries a monotonically increasing global ID, and that ID can be persisted. On next launch, a program says "give me everything since event 918273" and receives exactly the changes that happened while it was not running.
This is why a well-built index can be quit for a week and be fully current within milliseconds of launching, instead of rescanning the disk.
By default FSEvents reports at directory granularity — "something in this folder changed". With kFSEventStreamCreateFlagFileEvents it reports individual files, which is what an index needs to update a single record rather than re-reading a folder.
Events arrive in batches, with a latency you choose. A short latency is responsive; a longer one lets the system merge a burst of changes — an npm install, a large copy — into fewer callbacks. Around 100 ms is a reasonable compromise.
periodic reconcile pass
The difference between a search tool that is right and one that is right *eventually* is whether it uses this properly. An index rebuilt on a timer is stale between rebuilds. An index driven by FSEvents reflects a file you saved a second ago.
No. The kernel already knows about the change; delivering a notification is far cheaper than polling.
FSEvents can drop events under heavy load, and network volumes do not emit them at all. A periodic reconcile covers the gap.
Everywhere keeps track of every file on your Mac — including the folders Spotlight hides and drives you have unplugged. Free for a day, then $19 once.
Download for Mac