Downloads

The files profiles have saved, when downloadMode is "perProfile".

Mosaic has two answers for where a download lands. shared is what every browser does and what this app did for its whole life: one folder, because a download is a file the operator asked for and burying it per profile means a different unopenable folder each time. perProfile answers the question that never addressed — a downloaded file is evidence of a profile, and in ~/Downloads it sits with every other profile’s files, in the first place anybody looks, in the search index, outliving the profile that made it. In that mode each profile writes into its own folder inside Mosaic’s data directory, its file picker starts there too (Chromium moves that preference when somebody browses elsewhere, and it is written again at the next launch, so the folder is where each session begins rather than a cage), the files go when the profile is purged, and these routes report and empty them.

It is not encryption. Chromium writes the bytes itself with its own file handle; nothing is between the network and the disk. What the mode buys is isolation from the home folder, a .metadata_never_index marker so Spotlight never indexes the contents, and a wipe that actually wipes. Anything stronger is FileVault.

In shared mode these routes still answer, and mode says so — they report nothing because the folder belongs to the operating system, and offering to empty somebody’s ~/Downloads is not a thing this API will do.