fix(pager): enforce exact realm isolation for cached pages

Author: farhan-syah

src/pager/cache.rs

@@ -32,9 +32,10 @@ pub struct Page {
     /// Page kind recorded at write time; used by the Pager flush path to
     /// reconstruct the correct AAD for each dirty page.
     pub kind_byte: u8,
-    /// Realm that owns this cached plaintext. Used by the Pager read path to
-    /// reject cross-realm cache hits without a VFS round-trip.
-    pub realm_id_bytes: [u8; 16],
+    /// Realm that owns this cached plaintext. `None` marks metadata-less test
+    /// pages, which the Pager read path must reject rather than treat as a
+    /// cache hit.
+    pub realm_id_bytes: Option<[u8; 16]>,
 }
 
 impl Page {
@@ -43,7 +44,7 @@ impl Page {
         Self {
             bytes,
             kind_byte: 0,
-            realm_id_bytes: [0u8; 16],
+            realm_id_bytes: None,
         }
     }
 
@@ -52,7 +53,7 @@ impl Page {
         Self {
             bytes,
             kind_byte,
-            realm_id_bytes: [0u8; 16],
+            realm_id_bytes: None,
         }
     }
 
@@ -61,7 +62,7 @@ impl Page {
         Self {
             bytes,
             kind_byte,
-            realm_id_bytes,
+            realm_id_bytes: Some(realm_id_bytes),
         }
     }
 }
@@ -321,7 +322,11 @@ mod tests {
     fn insert_and_get() {
         let mut c = PageCache::with_capacity(4);
         c.insert((FileKey::Main, 1), page(0));
-        assert!(c.get((FileKey::Main, 1)).is_some());
+        assert_eq!(
+            c.get((FileKey::Main, 1))
+                .map(|cached| cached.realm_id_bytes),
+            Some(None)
+        );
     }
 
     #[test]

src/pager/core.rs

@@ -616,7 +616,7 @@ impl<V: Vfs> Pager<V> {
         {
             let mut cache = self.inner.cache_for_key(file).lock();
             if let Some(page) = cache.get((file, page_id)) {
-                if page.realm_id_bytes != [0u8; 16] && page.realm_id_bytes != realm_id.0 {
+                if page.realm_id_bytes != Some(realm_id.0) {
                     return Err(PagedbError::ChecksumFailure);
                 }
                 self.inner.record_hit(file);
@@ -1030,6 +1030,57 @@ mod tests {
         assert!(matches!(err, PagedbError::ChecksumFailure));
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn cached_pages_require_an_exact_realm_match() {
+        let pager = mk_pager().await;
+        let zero_realm = RealmId([0; 16]);
+        let nonzero_realm = RealmId([1; 16]);
+        let body = vec![0u8; PAGE - ENVELOPE_OVERHEAD];
+
+        pager
+            .write_main_page(1, zero_realm, PageKind::BTreeLeaf, &body)
+            .await
+            .unwrap();
+        pager
+            .write_main_page(2, nonzero_realm, PageKind::BTreeLeaf, &body)
+            .await
+            .unwrap();
+
+        {
+            let mut cache = pager.inner.buffer_pool.lock();
+            assert_eq!(
+                cache
+                    .get((FileKey::Main, 1))
+                    .map(|page| page.realm_id_bytes),
+                Some(Some(zero_realm.0))
+            );
+            assert_eq!(
+                cache
+                    .get((FileKey::Main, 2))
+                    .map(|page| page.realm_id_bytes),
+                Some(Some(nonzero_realm.0))
+            );
+        }
+
+        for (page_id, requested_realm) in [(1, nonzero_realm), (2, zero_realm)] {
+            let misses_before = pager.inner.buffer_pool_misses.load(AtomOrd::Relaxed);
+            let cache_len_before = pager.inner.buffer_pool.lock().len();
+            let err = pager
+                .read_main_page(page_id, requested_realm, PageKind::BTreeLeaf)
+                .await
+                .err()
+                .unwrap();
+
+            assert!(matches!(err, PagedbError::ChecksumFailure));
+            assert_eq!(
+                pager.inner.buffer_pool_misses.load(AtomOrd::Relaxed),
+                misses_before,
+                "cached realm mismatch must not fall back to disk"
+            );
+            assert_eq!(pager.inner.buffer_pool.lock().len(), cache_len_before);
+        }
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn rejects_illegal_page_kind_on_main() {
         let pager = mk_pager().await;