How find thinks
find walks the tree and evaluates an expression against every entry: tests (-name, -size, -mtime) combine with implicit AND, explicit -o for OR, ! for NOT, and actions (-print, -exec, -delete) fire when everything before them matched. Order is evaluation order, which is why -delete written first deletes everything (it matched before your filters ran) and why cheap tests like -name belong before expensive ones. The safety ritual: build the expression, run it printing matches, read the list, then append the destructive action.
Time tests, precisely
The units trip everyone once: -mtime +30 means "more than 30 whole 24-hour periods ago", -mtime -1 "within the last 24 hours", and -mtime 0 "between now and 24h ago". For finer control use -mmin. There are three timestamps, mtime (content changed), ctime (metadata changed: chmod, chown), atime (read; often disabled or lazy via relatime), and cleanup jobs almost always want mtime.
Acting on matches at scale
-exec cmd {} + is the modern default: it batches filenames like xargs, minus the pipe. Reach for -print0 | xargs -0 when you need xargs features like parallelism (-P8). Never pipe unquoted names through plain xargs, one filename with a space or embedded newline and your rm is deleting things you didn't list. And on a full disk, remember deleted-but-open files: if find-and-delete didn't free space, lsof +L1 shows which process still holds the bytes.