Regarding snapshots, I use a setup, where at the root of the btrfs partition I have the subvolumes “rootfs”, “home”, and a directory “snapshots”. I can boot into a snapshot by changing the mount options for the rootfs in the kernel command line, e.g.setting subvol=snapshots/rootfs-yyyy-mm-dd
.
The only difference between a snapshot and a regular subvolume is that snapshots are readonly by default, you can keep a writable copy of a snapshot beside it for recovery purposes, if you need it. As long as nothing is written in it, it shouldn’t use any significant extra space.
My theory for why it created copies: The files you listed look like they are all subdirectories from /dev, which is (usually) a separate filesystem. When you try to move a file or directory across filesystems, the OS can’t just change the link, it has to actually copy the files and then remove the original. As a directory is a set of links to files, and the copies are different files, directories are just newly created with the same name in the new location instead of copying the directory filesystem entry. It looks like
mv
creates these target directories, before it checks if it actually has permission to remove the source, but checks file permissions, before it copies them