A quick test shows it uses the xattr-specific ES events. Not definitive, and may differ on some systems, but this was one of the affected devices. ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR: process=/System/Applications/TextEdit.app/Contents/MacOS/TextEdit path=/Users/matt.slot/Library/Containers/com.apple.TextEdit/Data/tmp/TemporaryItems/NSIRD_TextEdit_ihoZLx/21B97262-CCCD-4DE3-929D-DC322367AC80.rtf xattr=com.apple.genstore.origdisplayname ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR: process=/System/Applications/TextEdit.app/Contents/MacOS/TextEdit path=/Users/matt.slot/Library/Containers/com.apple.TextEdit/Data/tmp/TemporaryItems/NSIRD_TextEdit_ihoZLx/21B97262-CCCD-4DE3-929D-DC322367AC80.rtf xattr=com.apple.genstore.info ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR: process=/System/Applications/TextEdit.app/Contents/MacOS/TextEdit path=/Users/matt.slot/Library/Containers/com.apple.TextEdit/Data/tmp/TemporaryItems/NSIRD_TextEdit_ihoZLx/21B97262-CCCD-4DE3-929D-DC322367AC80.rtf xattr=com.apple.genstore.gen_opt
Topic:
App & System Services
SubTopic:
Core OS
Tags: