How macOS actually works
A handful of invisible mechanisms cause most of macOS's 'why did it do that' file moments.
Finder's per-folder view memory — icon positions, window size, sort order. One appears in every folder you open. Harmless on a Mac, an eyesore on shared drives and in zip files sent to Windows users.
find . -name .DS_Store -delete
Stop them on network shares:
defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true
Copy a Mac file to a FAT/exFAT drive and macOS splits its metadata into a companion ._filename. Harmless on a Mac, clutter everywhere else. dot_clean merges them back:
dot_clean /Volumes/USBDrive
Under APFS your Mac is two volumes — a read-only System and your Data — stitched into one apparent tree by firmlinks. It is why /Users and /System/Volumes/Data/Users are the same place, and why a path can look duplicated in Terminal. Not something to touch; useful to recognise.
The old Mac way of attaching data to a file, mostly gone, occasionally lingering:
ls -l@ file # @ column shows extended attrs incl. forks
xattr -c file # strip them
A file's Get Info has Stationery Pad (opening it makes a copy — a template) and Locked (a flag, not a permission). Both surprise people who ticked them by accident:
chflags nouchg file # unlock
None of this is broken; all of it is invisible. Recognising the mechanism turns a baffling Finder moment into a two-word explanation — which is most of what mastering a Mac's files amounts to.
macOS storing a Mac file's metadata separately on filesystems that cannot hold it natively. dot_clean merges them.
APFS firmlinks join the read-only System volume and your Data volume into one tree; the paths reach the same files.
Everywhere keeps track of every file on your Mac — including the folders Spotlight hides and drives you have unplugged. Free for a day, then $19 once.
Download for Mac