About midnight, I closed my MacBook Pro (16-inch, 2019), which puts it to sleep. The only apps open were TextEdit and Finder (as far as the Dock shows). Nothing was in the Trash (according to the Dock icon). All software is up-to-date including macOS 12.1 (21C52).
When I opened it the next morning, the Trash icon showed not-empty. Looking inside, I saw a folder called Recovered files
. Now, these have often appeared in the past, but they have always been in either ~/Desktop or /Users/Shared. They have never contained anything worth keeping (usually a soft link to a path that doesn't exist). I've always just deleted them and moved on. This is the first time one of these (or anything else) has apparently moved into the Trash while the laptop was asleep.
When I tried to empty trash, it was not allowed "because xxx is in use." I've forgotten whether xxx is Recovered files
or the file inside which was named knowledge-ag%nt.plist.CQbdANk
. It was a regular file, not a symlink.
I moved Recovered files
to /tmp, closed the Trash, exited all apps, and even Re-launched Finder, then shut down. Normally, startup removes almost anything in /tmp. But this time, Recovered files
is still in /tmp. The file inside had an xattr of com.apple.macl, which is allegedly not removable, but
Update: I typed a couple of paragraphs after that dangling half-sentence and saw them after saving. Don't know where they went. Anyway, I am going to try First Aid on the internal SSD and see if it clears that. It's not important enough for Recovery mode by itself, but now Time Machine is being weird, so that motivates me bit more.
lsof
./Users/Shared
contained theRelocated Items
following the installation and the previousRelocated Items
was assigned toPreviously Relocated...
as I would expect. There was also aRelocated Items
in the trash which I haven't seen before. Without much thought, I simply (successfully) emptied the trash, having noted the expected contents in/Users/Shared
.