[mmdisbrow]

Btrfs reflinks make allocated-byte sums count the same storage repeatedly, and selected tile sizes do not reliably predict space freed by deletion. This adds unprivileged extent accounting for local Btrfs scans and separates treemap contributions from conservative reclaim estimates. In the real-filesystem regression, three 1 MiB reflinked files contribute 1 MiB to the tree and promise no saving while their data is shared.

• Deduplicate uncompressed physical ranges (including partial overlaps) per filesystem UUID, with deterministic path ordering. Subvolume device numbers do not separate shared extents.
• Label compressed/unsupported/inaccessible measurements as estimates. Compressed FIEMAP lengths are logical lengths, so they are never treated as ordinary physical ranges or promised as reclaimed bytes.
• Show a separate reclaim estimate in selection and review. Shared, compressed, hardlinked and unknown data are excluded; trash projects no immediate saving. Apparent-size mode retains these independent reclaim estimates.
• Make the accounting pass cancellable, expose its progress stage, and remeasure Btrfs trees when widening a scan.
• Add synthetic accounting tests, real Btrfs fixtures, a window-harness regression and a CI integration step using a disposable compressed Btrfs image.

This deliberately remains conservative: selecting all visible reflink copies does not prove that no snapshot or unscanned reference exists. Exact compressed physical sizes are not available through unprivileged FIEMAP. SSH scans retain their existing accounting. The extra pass adds metadata I/O and the node size increases from 88 to 104 bytes; no privileged helper or new runtime dependency is introduced.

Validation on Linux aarch64, Rust 1.97:

• cargo xtask lint passes.
• DISKTREE_BTRFS_TEST_DIR=/path/on/btrfs cargo test --workspace -j 2: 274 passed, 9 existing tests ignored. This includes the real reflink, compression, sparse-file, unreadable-file and window-harness checks.
• CI workflow YAML and the disposable-image shell block parse successfully; the new loopback CI step has not been run locally.