2016-08-08 20:13 GMT+03:00 Chris Murphy [off-list ref]:

Just a wild guess, the deletions may be in the tree log and haven't
been applied to the other trees (fs tree, extent tree, etc). So yes
I'd expect they get deleted on a rw mount.

This is what kernel? Because kernel 4.6 offers mount option
"nologreplay" which suggests even if you do mount -r that log replay
happens, so you shouldn't see these deleted files unless you mount ro
*and* use nologreplay mount option.

Live USB has kernel 4.5.7. Maybe I should try to run "btrfs rescue
zero-log" and then mount RW? Will the files safe in that case?

Anyway, even 5 seconds of rm -rf damages too much. If you don't have
recent snapshots then it's not sanely salvageable, just reinstall.

As I could see, almost all the "deleted" files are present. Certainly,
I'll make an rsync diff between two-week-ago snapshot and the current
FS state. But it will better if in-place recover without backup is
possible.

P.S. IMHO, log replay by default is a quite dangerous thing. I didn't
know about that change and I could lose all files if the live USB had
4.6 kernel))

-- 
Ivan Sizov (SIvan)