yes, u r clear right. I referenced sourceAppAuditToken in ur answer. https://developer.apple.com/forums/thread/126820

fflag: 1074790400(0x4010000) Previously (macOS 15 and earlier), when performing operation copy files, the es_event_open_t events were only triggered for the source file and target file, with fflag values such as FWRITE or FREAD. However, on macOS 26 beta 4, before the file events occur, additional AUTH_OPEN events are triggered for the source and target directories, and in those cases, the fflag field contains O_SEARCH (e.g., 0x4010000) instead of the expected FREAD/FWRITE.

Thank you very much