Hacker News Reader

Isn't it sufficient to just track open() and stat(). Maybe access()? That shouldn't be too slow.

Rename tracking is what undoes a lot if the more naive variants.

Hard links as well, which are nastier because they introduce aliases for the things you want to track.