Read-only means read-only
There is no command to delete, move, rename, archive, edit, or clean up an indexed file.
Safe by design
Your storage stays yours.
Space Roster is an analyzer, not a cleanup executor. Its boundaries are intentionally visible, testable, and difficult to misunderstand.
Four promises shape every scan.
Indexes remain local
Paths and file metadata are stored in app-owned local data. Space Roster does not upload scan data.
The last good result survives
A canceled scan, failed refresh, or snapshot-write problem cannot silently replace a usable completed index.
Gaps stay visible
Permission failures, skipped links, mount boundaries, duplicate identities, and measurement fallbacks are disclosed rather than estimated away.
Space Roster
A total should explain what it includes.
Space Roster reports the exact selected measurement for unique files it actually indexed, then separates that result from whole-filesystem used space.
- Nested volumes are excluded by default so APFS aliases and mounted runtimes do not multiply a drive scan.
- Symbolic links and reparse points are skipped by default to avoid cycles and duplicate views.
- Inaccessible content remains an explicit gap, never invented reclaimable space.
- Snapshots, filesystem metadata, purgeable space, and other unknowns stay labeled as a reconciliation gap.
Space Roster
Privacy controls extend to optional agents.
AI Agent Control uses the same index and the same non-mutation boundary as the visible desktop app.
- The local control channel is absent until the owner buys the required access and explicitly opts in.
- Path visibility can be full, home-redacted, or aggregate-only.
- Disabling consent or losing verified ownership stops the listener and active restricted work immediately.
Space Roster
Insight should reduce uncertainty, not create a new risk.
Space Roster keeps action outside the product boundary so every storage decision remains yours.