docs: install three-tier validation framing; bring codes/corpora current

Make every validation claim tier-accurate across the four reader-facing docs.

validation.md — replace "Input provenance" + "Epistemic stance" with a precise
THREE-TIER model whose axis is whether the correctness check is trustworthy
(Tier 1 real third-party/real-device ground truth; Tier 2 real-engine bytes
confirmed by a derivable answer key or sqlite3/calamine, scenario chosen by us;
Tier 3 only-we-vouch, essentially just the freeblock-clobbered spilled-cell path).
State the one-line rule and correct the in-cell image thumbnail to Tier 2 (calamine
reads the embedded media back). Tier-label the Layer-2 oracle table and add rows for
journal-anomaly arm split (NIST PERSIST = Tier 1; minted hot-journal arms = Tier 2),
table_instance_risk Detector A+B, the survey FP replication, and the iOS no-panic
robustness sweep. State limitations plainly (same-schema drop+recreate undecidable;
DELETE/TRUNCATE leave no in-band residue; encrypted out of scope; FP benchmark is a
replication; Boyer-Moore inapplicable by design).

corpus-catalog.md — correct the stale §K PERSIST claim (now 100/100 via
carve_rollback_journal, not "pending 0/100"); add §N drop_recreate, §O paper_fp
FP scenarios, §P Josh Hickman iOS-17 corpus; extend the §H md5 manifest and the
classification header for the REAL-ext/REAL-device entries.

README.md — add WAL-UNCHECKPOINTED acquisition guidance; document the
table_instance_risk hint column and its honest framing; add the out-of-scope
limitations to Trust-but-verify.

index.md — anomaly-code SCHEMA-CHANGE keyed on the schema cookie; three-tier
pointer + iOS robustness in Validation; rollback-journal/hint entry points.

mkdocs build --strict passes. No Rust source touched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: h4x0r

README.md

@@ -88,6 +88,8 @@ Need a queryable database too? Add `--db` to also write `<name>.carved.db` (same
 - **`recovered_unattributed` — UNKNOWN.** Dropped-table residue, or a shape matching no surviving table — recovered in full, attributed to nothing.
 - **`recovered_fragments`** — the **separate** Tier-2 partial-salvage table (a distinctive cell survived but the row's identity did not), kept distinct so a fragment is never mistaken for a full row. `--no-fragments` drops it.
 
+Each `recovered_<table>` row also carries a `table_instance_risk` column — a non-overclaiming **hint** (not an attribution tier), empty unless the residue is consistent with predating the current table instance: `rowid_exceeds_autoinc_highwater(r=…,seq=…)` (Detector A — a carved rowid above the `AUTOINCREMENT` high-water mark) or `sidecar_schema_changed(table)` (Detector B — a `-wal`/`-journal` sidecar whose prior schema differs). The hint is framed honestly: *consistent with* prior-incarnation residue, but also explainable by an `UPDATE`, a manual `sqlite_sequence` edit, or a current-instance deletion — it never asserts a predecessor or a drop+recreate, and a same-schema drop+recreate (indistinguishable from a benign `VACUUM` page move) is deliberately never flagged.
+
 Want a queryable database, the files elsewhere, or a stream instead? Pick the option:
 
 ```console
@@ -230,7 +232,7 @@ This is one workspace (`sqlite-forensic`): two library crates following the flee
 |---|:-:|---|
 | `SQLITE-DELETED-RECORD-RECOVERED` | Medium | A record-shaped cell recovered from unallocated space — consistent with a deleted row not yet overwritten. Carries page / offset / rowid provenance. |
 | `SQLITE-FREELIST-NONEMPTY` | Low | The database holds free pages — consistent with prior deletions (`DELETE` without `VACUUM`); those pages may retain recoverable rows. |
-| `SQLITE-WAL-UNCHECKPOINTED` | Medium | A `-wal` sidecar carries committed page versions the main file does not reflect — the main file alone under-reports the true state. |
+| `SQLITE-WAL-UNCHECKPOINTED` | Medium | A `-wal` sidecar carries committed page versions the main file does not reflect — the main file alone under-reports the true state. **Acquire the live `-wal` before the application terminates**: a checkpoint (e.g. on its next clean close) folds the WAL into the main file and discards the uncheckpointed deleted/superseded residue, which the post-checkpoint main file no longer contains. |
 | `SQLITE-PAGECOUNT-MISMATCH` | High | The in-header page count disagrees with the count implied by file length — consistent with truncation, carving, or out-of-band modification. |
 | `SQLITE-RESERVED-SPACE-NONZERO` | Low | The header reserves bytes per page — non-standard; consistent with a page-level extension such as encryption (SQLCipher/SEE) or a checksum VFS. |
 | `SQLITE-JOURNAL-HOT` | High | A `-journal` with a valid header sits beside the database — consistent with an interrupted or in-progress write transaction (the main db may require rollback). |
@@ -255,7 +257,8 @@ A carver that *over*-reports is worse than useless on an evidence database — i
 - **High precision, structurally — never a live-row re-read.** Our carver carves only the *complement* of the live cell extents on a page, then drops any carved record whose rowid is currently live. Across the Nemetz recall corpus it produces **0 live-re-reads** (verified against the answer key's live rows), with only a small, low-confidence **phantom** class (all-empty/NULL records the inferred carver matches on a run of zero bytes). The two over-reporting failure modes the reference oracles exhibit on no-deletion databases — re-reading live cells, and re-surfacing a stale byte-copy of a live row — our carver does not. On the 2025 SQLite false-positive survey's B-tree-rebalancing scenario, measured on **identical bytes**, this discipline yields **0 false positives** where `bring2lite` re-surfaces 13 live rows as deleted ([`docs/competitive-landscape.md`](docs/competitive-landscape.md)).
 - **Strong in-page recall via freeblock reconstruction — reported honestly.** On the cleanest category (`0C`: records deleted in place, `secure_delete=0`, no overwrite, so **every** deleted row's bytes survive) the carver recovers **70 of the 84** cross-tool-scored rows (recall **0.833**), ahead of `fqlite`'s 0.798. SQLite overwrites a freed cell's first four bytes (payload-length + rowid varints, `header_len`, leading serial) with the freeblock pointer; `reconstruct_freeblock_records` rebuilds each record from its surviving serial-type tail plus a schema template derived from a live cell on the same page, with the destroyed rowid surfaced as unknown. It does so at higher precision than `fqlite` and **0 live-re-reads**.
 - **Overflow-page chains: partial recovery, honestly bounded.** A deleted row whose payload spilled onto a freed overflow chain is reassembled to a full row **only when every chain page survives as a freelist leaf**; a chain page reallocated as the freelist trunk destroys the record, which is then refused from the full tier and surfaces only as a Tier-2 fragment. On the Nemetz `0E` category this reassembles the one byte-perfectly-recoverable spilled chain (verified `assert_eq!` against the answer key, substrate recall **1.000**) for an **end-to-end `0E` recall of 0.333** — a deliberately bounded capability, graded below the in-page tier, never claimed as full overflow recovery.
-- **Secondary checks stay labelled as such.** The undark/fqlite differential ([`docs/validation.md`](docs/validation.md)) is **inter-tool concordance** (the oracles disagree with each other — agreement, not correctness), and the DC3 `sqlite_dissect` corpus is a **no-false-positive regression set** (its `expected_rows` are live content, not a deleted set), never a recall oracle.
+- **Secondary checks stay labelled as such.** The undark/fqlite differential ([`docs/validation.md`](docs/validation.md)) is **inter-tool concordance** (the oracles disagree with each other — agreement, not correctness), and the DC3 `sqlite_dissect` corpus is a **no-false-positive regression set** (its `expected_rows` are live content, not a deleted set), never a recall oracle. The 2025 survey false-positive benchmark is a **replication** of the paper's scenario construction (the official corpus is not public yet), and the FQLite scenario-10 number is **cited from the paper**, not measured here (its WAL recovery is GUI-coupled).
+- **Out of scope, stated plainly.** A **same-schema drop+recreate** is undecidable from a single snapshot and from a sidecar (indistinguishable from a benign `VACUUM` page move), so `table_instance_risk` flags only `AUTOINCREMENT` rowid-overflow and unambiguous sidecar schema changes — never the same-schema case. **DELETE-mode** (the `-journal` is unlinked) and **TRUNCATE-mode** (it is zeroed) rollback journals leave no in-band residue (a disk-carving-layer concern). **Encrypted databases** (SQLCipher / SEE) are out of scope. The carver is **structural** (b-tree / freelist / journal layout), so a Boyer-Moore signature scan is inapplicable by design.
 
 Carved records remain **confidence-graded observations** ("consistent with a deleted row"), never a verdict. The honest summary: a strict precision discipline confirmed against independent ground truth, and a documented in-page recall gap — not a claim of perfect recall or proof of correctness.
 

docs/corpus-catalog.md

@@ -20,9 +20,14 @@ All fixtures were built with the system `sqlite3` CLI / Python `sqlite3` module:
 
 ## Classification
 
-`SYNTHETIC` — all built locally with the real `sqlite3` engine (REAL engine,
-synthetic data). Confidence `✓` (confirmed: each generator below was run and the
-resulting file inspected, not just named).
+The corpus spans three provenance classes, labelled per section below:
+`REAL-engine`/`SYNTHETIC` (built locally with the real `sqlite3` engine — real
+engine, our data: §A–§E, §J, §L, §M, §N, §O); `REAL-ext` (externally-authored real
+artifacts — the Nemetz corpus §I, NIST CFReDS §K, SharifCTF §K, the DC3 corpus §G);
+and `REAL-device` (genuine device data — the Josh Hickman iOS-17 images §P).
+Confidence `✓` throughout (each generator was run and the file inspected, or the
+external artifact downloaded and its schema/ground-truth parse confirmed — not just
+named).
 
 ## §A `tests/data/places.db`  (pre-existing, WS-C spike)
 
@@ -453,13 +458,15 @@ manifest: `tests/data/cfreds/README.md` (the single detailed index for this set)
   `UPDATE … SET Quantity=200` modifications per variation.
   - *WAL* variation (uncheckpointed): main-only view = 2240 rows, WAL-applied =
     2140; our WAL handling surfaces both. Validated now.
-  - *PERSIST* variation (rollback journal): the 100 deletes survive in the
-    `-journal` page images (header zeroed post-commit, bodies intact, all 100
-    confirmed present). **Recovering them is a pending capability** — the carver
-    reads only the main db today (0/100). Rollback-journal carving is designed in
-    [`design/journal-recovery.md`](design/journal-recovery.md). This is the
-    Doer-Checker payoff: real NIST ground truth surfaced a real recovery-substrate
-    gap our synthetic fixtures never exercised.
+  - *PERSIST* variation (rollback journal): the 100 deletes and 100 modifications
+    survive in the `-journal` page images (header zeroed post-commit, bodies
+    intact). `carve_rollback_journal` diffs the journal's pre-transaction snapshot
+    against the live db and recovers **100/100 deletes + 100/100 modified prior
+    values** (`forensic/tests/cfreds_journal_recovery.rs`); `audit_journal` raises
+    the RECOVERABLE observation on it (`cfreds_journal_anomaly.rs`). Rollback-journal
+    carving is designed in [`design/journal-recovery.md`](design/journal-recovery.md).
+    This was the Doer-Checker payoff: real NIST ground truth surfaced a real
+    recovery-substrate gap our synthetic fixtures never exercised, now closed.
 - **SFT-05** (BLOB): **not committed** — each db is ~206 MB (gitignored/env-gated
   class). Re-download from the SFT-05 dataset link in `tests/data/cfreds/README.md`.
 
@@ -488,6 +495,90 @@ third-party content); full provenance + recipes + md5s in
   (`ALTER TABLE … ADD COLUMN`). Live schema cookie (2) advanced past the journal's
   prior page-1 image cookie (1), so SCHEMA-CHANGE fires with both values shown.
 
+## §N `tests/data/drop_recreate/`  (real-engine artifact, **committed**)
+
+Five small real-engine databases (plus two `-journal` sidecars) that exercise the
+`table_instance_risk` diagnostic **HINT** — Detector A (AUTOINCREMENT high-water
+reconciliation) and Detector B (sidecar `-wal`/`-journal` schema change). The flag
+is a hint that names its evidence; it is **not** an assertion that a predecessor
+table existed. Construction reference: `docs/design/drop-recreate-attribution.md`;
+full fixture table + ground truth in `tests/data/drop_recreate/README.md`.
+
+- Classification: `REAL-engine` (minted with the public-domain SQLite engine via
+  the committed `gen.py`; no third-party content), confidence `✓` (generated and
+  the ground truth confirmed with the `sqlite3` CLI). **Committed** (CC0).
+- Detector A — `rowid > sqlite_sequence` on an AUTOINCREMENT table: `b_autoinc.db`
+  fires on residue rowids 6..10; `upd_autoinc.db` fires on rowid 1000 — a row a
+  *current-instance* `UPDATE` moved past the high-water mark (proving A is a hint,
+  not proof); `b_plainpk.db` (no AUTOINCREMENT) **never** fires — the honest limit
+  that a same-schema, plain-PK drop+recreate is undecidable.
+- Detector B — sidecar prior schema differs: `b_journal_altered.db` + `-journal`
+  fires for `students` (the prior CREATE SQL lacks the later `ALTER`'s column);
+  `b_journal_dml.db` + `-journal` (DML-only last txn) **never** fires. Detector B is
+  table-level and deliberately does NOT fire on a same-schema drop+recreate or a
+  `VACUUM` page move.
+- Consumed by `forensic/tests/drop_recreate_risk.rs` (Detector A),
+  `forensic/tests/detector_b.rs` (Detector B), the CLI provenance-column test, and
+  the `core` prior-schema unit tests.
+- md5 (the `.db` files are byte-reproducible; the `-journal` sidecars embed a random
+  checksum nonce so their md5 varies per run — the tests read content, not hash):
+
+  | file | md5 | bytes |
+  |---|---|---|
+  | `b_autoinc.db` | `b5f380a6376a8701e73514eb09a4ef27` | — |
+  | `b_plainpk.db` | `042ab37d307951db79df011a9eb0deec` | — |
+  | `upd_autoinc.db` | `6225cdb9cd88973bcad4a4325830c0a1` | — |
+  | `b_journal_altered.db` | `3a77f03ea3ac1ef40f8e9b284af98a59` | — |
+  | `b_journal_dml.db` | `2c1a405f4cc27856b367059554b319bf` | — |
+
+## §O `tests/data/paper_fp/` false-positive scenarios  (real-engine **replication**, **committed**)
+
+Real-engine **replications** of the three false-positive scenarios from the 2025
+survey (Lee, Park, Lee & Choi, *FSI:DI* **55**, art. 302031,
+[DOI](https://doi.org/10.1016/j.fsidi.2025.302031)). These reproduce the survey's
+Table-5 *construction* with the real SQLite engine — they are **not** the authors'
+byte-identical corpus (the official corpus is released "upon request" / not public
+yet). Generator + full ground truth: `tests/data/paper_fp/README.md`.
+
+- Classification: `REAL-engine` (minted by the committed `gen.py` via Python stdlib
+  `sqlite3`; no third-party data embedded), confidence `✓`. **Committed** (CC0).
+- `f.db` — **0F**, B-tree rebalancing (Type \*\*): live ids 51..80, deleted 1..50.
+  Our carver excludes live rowids structurally → **0 live-row false positives**
+  where `bring2lite` re-surfaces 13.
+- `b.db` — **0B**, table reinsertion with the SAME schema (Type \*): live ids 1..5
+  (`NEW-NAME`), dropped residue = 10 `OLD-NAME` rows. The genuinely-undecidable
+  same-schema case.
+- `wcase.db` + `wcase.db-wal` — **10**, WAL + `secure_delete=ON`: the residue lives
+  **only** in the `-wal`; the main image holds zero message bodies. **FQLite's
+  scenario-10 number is cited from the paper, not measured here** — its WAL recovery
+  is GUI-coupled (see §F.2).
+- Consumed by `forensic/tests/paper_fp_scenarios.rs` and the oracle comparison in
+  [`competitive-landscape.md`](competitive-landscape.md).
+- md5 (`.db` files byte-reproducible; `wcase.db-wal` is content-stable but
+  salt-variant per run):
+
+  | file | md5 | bytes |
+  |---|---|---|
+  | `f.db` | `a61a446a1cf0e5304956384b69644071` | 45056 |
+  | `b.db` | `042ab37d307951db79df011a9eb0deec` | 8192 |
+  | `wcase.db` | `22ebdd36e102f2af2f5766b7297dcad3` | 4096 |
+  | `wcase.db-wal` | `baaf207913b60136c1762dbe435bb03e` | 16512 (content-stable, salt-variant) |
+
+## §P Josh Hickman iOS-17 image corpus  (REAL-device, env-gated, **not committed**)
+
+Genuine iOS-17 application SQLite databases from Josh Hickman's public reference
+image — real-device data used as a **robustness sweep** (no-panic), NOT a
+known-answer recall oracle. The full open → audit → carve pipeline must survive
+every real db without panicking.
+
+- Classification: `REAL-device` (third-party real-device artifacts), confidence `✓`
+  (the sweep runs the pipeline over every db). **Not committed** — large, owned by
+  the `issen` corpus; downloaded manually and read in place, env-gated like §G/§M.
+- Test gate: `SQLITE_FORENSIC_IOS_CORPUS` (absolute path to the extracted corpus
+  root). `forensic/tests/ios_realdata_robustness.rs` opens every `.db`/`.sqlite`/
+  `.sqlite3` under it and asserts the pipeline never panics; it **skips cleanly**
+  when the var is unset, so a plain `cargo test` stays green.
+
 ## §M `tests/data/paper_fp/large_messages.db`  (throughput benchmark, generated, **not committed**)
 
 A ~100 MB messages-like database for the throughput benchmark that sits alongside
@@ -533,15 +624,28 @@ Committed fixtures (under `tests/data/`, `tests/data/`):
 | `tests/data/journal/hot.db-journal` | `d428e2fcf8e6f3d9c71a58b18c6f4dcc` | 22016 |
 | `tests/data/journal/ddl_persist.db` | `0271673fb35215d80f313e5f549dbbaf` | 16384 |
 | `tests/data/journal/ddl_persist.db-journal` | `fe785dd18b5eb58b6dd4176ae5864130` | 8720 |
-
-The 141 committed Nemetz databases under `tests/data/nemetz/` (CC0, §I) have their
-own md5 manifest in `tests/data/nemetz/README.md` to avoid duplicating it here.
+| `tests/data/drop_recreate/b_autoinc.db` | `b5f380a6376a8701e73514eb09a4ef27` | — |
+| `tests/data/drop_recreate/b_plainpk.db` | `042ab37d307951db79df011a9eb0deec` | — |
+| `tests/data/drop_recreate/upd_autoinc.db` | `6225cdb9cd88973bcad4a4325830c0a1` | — |
+| `tests/data/drop_recreate/b_journal_altered.db` | `3a77f03ea3ac1ef40f8e9b284af98a59` | — |
+| `tests/data/drop_recreate/b_journal_dml.db` | `2c1a405f4cc27856b367059554b319bf` | — |
+| `tests/data/paper_fp/f.db` | `a61a446a1cf0e5304956384b69644071` | 45056 |
+| `tests/data/paper_fp/b.db` | `042ab37d307951db79df011a9eb0deec` | 8192 |
+| `tests/data/paper_fp/wcase.db` | `22ebdd36e102f2af2f5766b7297dcad3` | 4096 |
+| `tests/data/paper_fp/wcase.db-wal` | `baaf207913b60136c1762dbe435bb03e` | 16512 |
+
+The `drop_recreate` and `paper_fp` `-journal`/`-wal` sidecars embed a per-run nonce,
+so their md5 varies; the consuming tests read content, not hash. The 141 committed
+Nemetz databases under `tests/data/nemetz/` (CC0, §I) have their own md5 manifest in
+`tests/data/nemetz/README.md` to avoid duplicating it here.
 
 Not committed (provenance only — see §F, §G and the per-directory READMEs):
 `tools/undark`, the fqlite tap under `tools/fqlite/` (source, jars, built classes
 — recipe in `tools/fqlite/README.md`), the `bring2lite` checkout + PyQt5 shim
 under `tools/bring2lite/` (§F.3), the Py3-ported `sqlparse` under `tools/sqldrp/`
-(§F.4), and the DC3 corpus under `tests-oracle-corpus/dc3-sqlite-dissect/` (full
-sha256/md5 list in `tests-oracle-corpus/README.md`). The committed
-`scripts/run-bring2lite.sh` / `scripts/run-sqldrp.sh` wrappers are the stable
-harness interface to the gitignored tool sources.
+(§F.4), the DC3 corpus under `tests-oracle-corpus/dc3-sqlite-dissect/` (full
+sha256/md5 list in `tests-oracle-corpus/README.md`), the env-gated Josh Hickman
+iOS-17 image corpus (`SQLITE_FORENSIC_IOS_CORPUS`, §P), and the ~100 MB throughput
+db (`SQLITE_FORENSIC_PERF_DB`, §M). The committed `scripts/run-bring2lite.sh` /
+`scripts/run-sqldrp.sh` wrappers are the stable harness interface to the gitignored
+tool sources.