feat(sqlite-forensic): surface recovered dropped schemas in audit

Add AnomalyKind::DroppedSchemaRecovered (code SQLITE-DROPPED-SCHEMA-RECOVERED,
Medium, Residue) and emit one per recover_dropped_schemas hit in audit(), so the
CLI `audit` command reports a dropped table/index/view/trigger's name + that its
definition survived the drop — a graded observation ("consistent with a dropped
<name>"), never a verdict.

- audit_surfaces_the_dropped_schema_as_a_finding pins it on the fixture.
- docs/index.md: anomaly-code table row.
- 100% function coverage; full workspace green; rustdoc/MSRV/mkdocs clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: h4x0r

docs/index.md

@@ -40,6 +40,7 @@ By default the `sqlite4n6 carve` CLI writes a **combined review workbook** (`evi
 | Code | Severity | Observes |
 |---|:-:|---|
 | `SQLITE-DELETED-RECORD-RECOVERED` | Medium | A record-shaped cell recovered from unallocated space. |
+| `SQLITE-DROPPED-SCHEMA-RECOVERED` | Medium | A deleted `sqlite_master` row recovered from page-1 free space — a dropped/replaced table/index/view/trigger and its `CREATE` statement. |
 | `SQLITE-FREELIST-NONEMPTY` | Low | Free pages present — consistent with prior deletions. |
 | `SQLITE-WAL-UNCHECKPOINTED` | Medium | `-wal` overlay the main file does not reflect. |
 | `SQLITE-PAGECOUNT-MISMATCH` | High | Header page count disagrees with file length. |

forensic/src/lib.rs

@@ -58,6 +58,16 @@ pub enum AnomalyKind {
         /// Recovered rowid.
         rowid: i64,
     },
+    /// A `sqlite_master` row was recovered from page-1 free space whose
+    /// definition is absent from the live schema — consistent with a **dropped
+    /// (or replaced)** table/index/view/trigger whose `CREATE` statement and
+    /// existence survive the drop under `secure_delete=OFF`.
+    DroppedSchemaRecovered {
+        /// `sqlite_master.type` — `table`, `index`, `view`, or `trigger`.
+        object_type: String,
+        /// Name of the dropped object.
+        name: String,
+    },
     /// The freelist is non-empty: the database holds free (unallocated) pages.
     /// Consistent with prior deletions (`DELETE` without `VACUUM`); those pages
     /// may retain recoverable deleted records.
@@ -147,6 +157,7 @@ impl AnomalyKind {
                 Severity::Low
             }
             AnomalyKind::DeletedRecordRecovered { .. }
+            | AnomalyKind::DroppedSchemaRecovered { .. }
             | AnomalyKind::WalUncheckpointedState { .. }
             | AnomalyKind::JournalRecoverable { .. }
             | AnomalyKind::JournalSchemaChange { .. }
@@ -164,6 +175,7 @@ impl AnomalyKind {
         match self {
             AnomalyKind::NonZeroReservedSpace { .. } => "SQLITE-RESERVED-SPACE-NONZERO",
             AnomalyKind::DeletedRecordRecovered { .. } => "SQLITE-DELETED-RECORD-RECOVERED",
+            AnomalyKind::DroppedSchemaRecovered { .. } => "SQLITE-DROPPED-SCHEMA-RECOVERED",
             AnomalyKind::NonEmptyFreelist { .. } => "SQLITE-FREELIST-NONEMPTY",
             AnomalyKind::WalUncheckpointedState { .. } => "SQLITE-WAL-UNCHECKPOINTED",
             AnomalyKind::PageCountMismatch { .. } => "SQLITE-PAGECOUNT-MISMATCH",
@@ -194,6 +206,11 @@ impl AnomalyKind {
                  space at page {page} offset {offset} — consistent with a deleted \
                  row not yet overwritten"
             ),
+            AnomalyKind::DroppedSchemaRecovered { object_type, name } => format!(
+                "recovered a deleted sqlite_master row for {object_type} \"{name}\" \
+                 from page-1 free space — consistent with a dropped (or replaced) \
+                 {object_type} whose definition survives the drop"
+            ),
             AnomalyKind::NonEmptyFreelist { free_pages } => format!(
                 "{free_pages} free page(s) on the freelist — consistent with prior \
                  deletions (DELETE without VACUUM); free pages may retain \
@@ -338,6 +355,7 @@ impl Observation for Anomaly {
             // so are a recoverable PERSIST journal and a journaled schema page
             // (the prior schema/rows are recoverable from the journal images).
             AnomalyKind::DeletedRecordRecovered { .. }
+            | AnomalyKind::DroppedSchemaRecovered { .. }
             | AnomalyKind::NonEmptyFreelist { .. }
             | AnomalyKind::JournalRecoverable { .. }
             | AnomalyKind::JournalSchemaChange { .. } => Category::Residue,
@@ -380,6 +398,18 @@ impl Observation for Anomaly {
                     location: Some(Location::ByteOffset(*offset as u64)),
                 },
             ],
+            AnomalyKind::DroppedSchemaRecovered { object_type, name } => vec![
+                Evidence {
+                    field: "object_type".to_string(),
+                    value: object_type.clone(),
+                    location: None,
+                },
+                Evidence {
+                    field: "name".to_string(),
+                    value: name.clone(),
+                    location: None,
+                },
+            ],
             AnomalyKind::NonEmptyFreelist { free_pages } => vec![Evidence {
                 field: "free_pages".to_string(),
                 value: free_pages.to_string(),
@@ -1469,6 +1499,16 @@ pub fn audit(db: &Database) -> Vec<Anomaly> {
         }));
     }
 
+    // Dropped/replaced schema objects whose sqlite_master row survives in page-1
+    // free space (a DROP under secure_delete=OFF). Surfaced as findings so a
+    // dropped table's existence + name is reported, not just buried in the carve.
+    for schema in recover_dropped_schemas(db) {
+        out.push(Anomaly::new(AnomalyKind::DroppedSchemaRecovered {
+            object_type: schema.object_type,
+            name: schema.name,
+        }));
+    }
+
     out
 }
 

forensic/tests/dropped_schema.rs

@@ -18,7 +18,7 @@
 #![allow(clippy::unwrap_used, clippy::expect_used)]
 
 use sqlite_core::Database;
-use sqlite_forensic::recover_dropped_schemas;
+use sqlite_forensic::{audit, recover_dropped_schemas, AnomalyKind};
 
 fn open_fixture() -> Database {
     let bytes = std::fs::read("../tests/data/dropped_table_schema.db")
@@ -54,3 +54,19 @@ fn does_not_report_a_live_table_as_dropped() {
         "live table `keep` must NOT be reported as a recovered (dropped) schema: {schemas:?}"
     );
 }
+
+#[test]
+fn audit_surfaces_the_dropped_schema_as_a_finding() {
+    let db = open_fixture();
+    let found = audit(&db).into_iter().any(|a| {
+        matches!(
+            a.kind,
+            AnomalyKind::DroppedSchemaRecovered { ref name, ref object_type }
+                if name == "secrets" && object_type == "table"
+        )
+    });
+    assert!(
+        found,
+        "audit must surface the dropped `secrets` table as a SQLITE-DROPPED-SCHEMA-RECOVERED finding"
+    );
+}