Thanks for the suggestions! mdfind is indeed fast and those content-type queries are elegant. However, the core constraint we're solving for is Spotlight disabled on managed endpoints. In enterprise environments, some orgs disable Spotlight indexing via MDM policy for security or performance reasons. When Spotlight is off, mdfind returns nothing. It queries the Spotlight index, which is empty or stale when indexing is disabled. Same applies to NSMetadataQuery. system_profiler SPApplicationsDataType also breaks. We tested this empirically and it was unable to return the complete application list with Spotlight disabled. It internally depends on Spotlight metadata for app discovery beyond a minimal hardcoded set. choose application uses Launch Services under the hood, which is the same data source we're already tapping into, but it's UI-only and not suitable for a background agent. So we went with _LSCopyAllApplicationURLs — the private Launch Services API backed by the lsd daemon. It works completely independent of Spotlight. We supplement it with a targeted filesystem scan of standard app directories to catch newly installed apps that lsd hasn't registered yet. The combination gives us Spotlight-equivalent coverage with zero Spotlight dependency, and newly installed apps are detected immediately via the filesystem scan even before lsd picks them up. mdfind would absolutely be our first choice if we could guarantee Spotlight is always on — it's faster and cleaner. But since we can't control that on customer machines, we needed something that works regardless.