I probably just don't understand how APFS snapshots work, but this seems odd to me:
~ $ mkdir /private/tmp/snap
~ $ pwd
/Users/dmd
~ $ ls foo
ls: foo: No such file or directory
~ $ tmutil localsnapshot /
Created local snapshot with date: 2020-02-28-191657
~ $ tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2020-02-28-191657.local
~ $ mount_apfs -s com.apple.TimeMachine.2020-02-28-191657.local / /private/tmp/snap
mount_apfs: snapshot implicitly mounted readonly
~ $ ls /private/tmp/snap/Users/dmd/foo
ls: /private/tmp/snap/Users/dmd/foo: No such file or directory
~ $ touch /Users/dmd/foo
~ $ ls /private/tmp/snap/Users/dmd/foo
/private/tmp/snap/Users/dmd/foo
~ $ ##### WHAT? WHY IS FOO IN THE SNAPSHOT? WHY DID THE SNAPSHOT CHANGE?
~ $ rm /Users/dmd/foo
~ $ ls /private/tmp/snap/Users/dmd/foo
ls: /private/tmp/snap/Users/dmd/foo: No such file or directory
Note that the file /Users/dmd/foo
is being created on the 'real' disk, but when it is created and deleted those changes are also showing up in the mounted snapshot.
Why?