And of course I saw one problem as soon as I hit Send, after mulling over this for hours:( Shouldn't be a problem, though.
All transactions start from the lockfile->metapos commit. Write txns do not reuse free pages younger than the datafile->metapos commit.
Except a system crash may yet lose the latter transaction if the datafile->metapos itself has not been synced. So the datafile also needs to indicate the previously synced datafile->metapos value. Or the related txnid, since I think the only place this info is needed is in the search for old txnids in mdb_page_alloc().
If it proves useful to keep this in a single header word: Maybe MDB_meta could hold "txnid of last synced metapos", and (datafile->metapos & 1) can be set if "last synced metapos" == the current metapos. I.e. a full sync would sync the data pages, set datafile->metapos, sync again, and set datafile->metapos |= 1 to note that this transaction is safe.