Function carve_at_commit 

pub fn carve_at_commit(
    db: &Database,
    timeline: &WalTimeline,
    id: CommitId,
) -> Vec<CarvedRecord>

Carve the deleted residue of one materialized commit snapshot of the -wal, the per-commit temporal building block of the N-snapshot carve.

id addresses a CommitId in timeline; the snapshot it resolves to is the database state replayed up to that COMMIT (base image ∪ every committed frame to that commit, capped to db_size_after_commit). This runs the same three carving primitives the on-disk path uses — Database::carve_leaf_cells (intact cells the snapshot records as allocated, the strongest case), Database::carve_free_regions, and Database::reconstruct_freeblock_records — over each of the snapshot’s materialized page images, then applies the SAME live-row precision filter: a record whose decoded values match a currently-live row (the WAL-applied view) is dropped, so a row that survived to the final state is never re-surfaced as deleted. Surviving records are tagged RecoverySource::CommitSnapshot and carry the commit’s (salt1, salt2, commit_frame_index) LSN in CarvedRecord::wal.

An unknown CommitId (absent from timeline) yields an empty vector, never a panic. Read-only throughout.