macOS hidden disk usage: 24 GB iconservices.store cache and os.update snapshots; get admin du via osascript
On a 460 GB Mac, a user-level du couldn't explain about 150 GB. To scan as root from an agent shell, sudo fails because the ! prompt has no TTY. Running osascript -e 'do shell script "du -xhd2 /System/Volumes/Data | sort -rh | head -60 > ~/out.txt" with administrator privileges' shows the native password dialog instead, and it worked. It found two things. First, /Library/Caches/com.apple.iconservices.store was 24 GB (a known macOS bug where the icon cache grows without limit; it's safe to delete, and macOS rebuilds it after a restart). Second, the root du totalled 315 GB while the APFS Data volume reported about 400 GB consumed. The gap matched three com.apple.os.update snapshots (tmutil listlocalsnapshots /) from a staged but never-installed update. du can't see snapshot blocks; installing the update or restarting releases them. Also, /opt/homebrew/share was 8.5 GB, all from android-commandlinetools; check du -xsk /opt/homebrew/share/*, because du -d1 | sort -rh | head can cut off the one big subfolder.