fix(snapshot): stop rejecting deltas over follower-local pages

Incremental apply distinguished the base's reader-visible page set from
its published set only for the write guard, then reused the wider
published set to define which pages the delta must contain. That made
a producer's legitimate reuse of a page still held by the follower's
own free-list chain or commit-history tree look like a malformed
artifact instead of the true base/target mismatch it is.

Split the two page sets explicitly, report the real collision as a new
SnapshotBasePageReused error, restrict segment restore to segment-id
filenames, and record destination ownership so failed export/restore/
apply cleanup never deletes a directory the caller pre-created.

Author: farhan-syah

CHANGELOG.md

@@ -6,19 +6,9 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-### Fixed
-
-- Snapshot export, restore, and incremental apply now fail closed on malformed,
-  incomplete, extra, or unreadable artifacts instead of silently skipping
-  pages or segment files; exported files are synced before success.
-- Incremental apply authenticates its exact reachable page and segment sets,
-  invalidates stale cached plaintext after raw page writes, preserves published
-  base pages, rejects stale future-page dependencies, and journals both segment
-  promotion and tombstoning before publishing the target header.
-
-## [0.1.0] - 2026-06-07
-
-Initial release.
+The first stable release. Pre-releases are published as `0.1.0-beta.N`; the
+entries below describe `0.1.0` as a whole rather than deltas against a shipped
+version, since none exists yet.
 
 ### Added
 
@@ -40,7 +30,9 @@ Initial release.
   (Grand Central Dispatch), Android, WASM/OPFS, and WASI backends, plus a
   tokio thread-pool fallback and an in-memory backend, with format-bit identity
   across targets.
-- **Snapshots** — `snapshot_to`, `restore_from`, and incremental apply.
+- **Snapshots** — `snapshot_to`, `restore_from`, and incremental apply, each
+  authenticated against the exact state its manifest describes. Destinations
+  must be empty; malformed or incomplete artifacts fail closed.
 - **Recovery** — open-flow GC, apply-journal replay, deep-walk `fsck`, and the
   `pagedb-fsck` binary.
 - **Online rekey** — rekey the database under a new key with mixed-cipher and
@@ -53,5 +45,7 @@ Initial release.
 - Single-writer per database; multi-writer cross-process is not supported.
 - Writes carry per-page AEAD and copy-on-write overhead; for throughput-bound
   plaintext KV workloads a generic store may be faster.
-
-[0.1.0]: https://github.com/nodedb-lab/pagedb/releases/tag/v0.1.0
+- An incremental snapshot cannot always be applied: if the producer recycled a
+  page the follower's own free-list chain or commit-history tree still hosts,
+  apply reports `PagedbError::SnapshotBasePageReused` and the follower needs a
+  full snapshot or a nearer base commit.

src/errors.rs

@@ -56,6 +56,17 @@ pub enum PagedbError {
     #[error("incremental snapshot is incompatible: {field}")]
     SnapshotIncompatible { field: &'static str },
 
+    /// The target state reuses a page the base commit still hosts, so the delta
+    /// cannot be expressed without overwriting state a follower on that base
+    /// still depends on.
+    ///
+    /// Not a corruption: both states are internally sound. They simply cannot be
+    /// related by a page delta, and the correct remedy is a full snapshot or a
+    /// nearer base commit — which is why this is distinct from
+    /// [`CorruptionDetail::SnapshotArtifactInvalid`].
+    #[error("incremental snapshot would overwrite base-live page {page_id}")]
+    SnapshotBasePageReused { page_id: u64 },
+
     #[error("commit {commit:?} is durable but unpublished; reopen required")]
     DurablyCommittedButUnpublished { commit: CommitId },
 
@@ -433,6 +444,12 @@ impl PagedbError {
         Self::SnapshotIncompatible { field }
     }
 
+    /// Canonical constructor for a target state that reuses a base-live page.
+    #[must_use]
+    pub const fn snapshot_base_page_reused(page_id: u64) -> Self {
+        Self::SnapshotBasePageReused { page_id }
+    }
+
     /// Canonical constructor for a handle whose newest durable commit could
     /// not be reconciled into its reader-visible state.
     #[must_use]

src/snapshot/apply.rs

@@ -10,6 +10,7 @@ use tokio::io::{AsyncReadExt, AsyncSeekExt, AsyncWriteExt};
 
 use crate::Result;
 use crate::errors::PagedbError;
+use crate::pager::page_space::is_reserved;
 
 /// Pages consumed from one `pages.delta` stream during an incremental apply.
 pub struct AppliedDeltaPages {
@@ -29,7 +30,6 @@ pub async fn apply_delta_pages(
     dst_main_db_path: &Path,
     page_size: usize,
     protected_page_ids: &BTreeSet<u64>,
-    base_allocation_floor: u64,
     target_next_page_id: u64,
 ) -> Result<AppliedDeltaPages> {
     let delta_path = src_path.join("pages.delta");
@@ -68,14 +68,25 @@ pub async fn apply_delta_pages(
             .await
             .map_err(PagedbError::Io)?;
         let page_id = u64::from_be_bytes(id_buf);
-        if page_id < base_allocation_floor
-            || page_id >= target_next_page_id
-            || protected_page_ids.contains(&page_id)
-        {
+        // Reserved pages are the A/B headers and the apply-journal slots. A
+        // delta record naming one would overwrite the very state that makes the
+        // apply recoverable, so it is rejected by identity rather than by
+        // happening to fall under some allocation bound.
+        if is_reserved(page_id) || page_id >= target_next_page_id {
             return Err(PagedbError::snapshot_artifact_invalid(
                 "pages.delta.page_id",
             ));
         }
+        // The follower keeps its own free-list chain and commit-history tree
+        // across an apply, and those pages are invisible to the producer, which
+        // can neither predict nor avoid them. A collision is therefore not a
+        // malformed artifact — both states are internally sound, they simply
+        // cannot be related by a page delta — so it reports as
+        // `SnapshotBasePageReused` and the remedy is a full snapshot or a nearer
+        // base. Caught here, before `main.db` is opened for writing.
+        if protected_page_ids.contains(&page_id) {
+            return Err(PagedbError::snapshot_base_page_reused(page_id));
+        }
         if !page_ids.insert(page_id) {
             return Err(PagedbError::snapshot_artifact_invalid(
                 "pages.delta.duplicate_page_id",