sqlite-forensic — Tier-2 anomaly auditor over [sqlite_core].

WS-C skeleton. The reader (sqlite-core) answers "what does this database header show?"; this crate grades the forensically-notable observations into severity-ranked [forensicnomicon::report::Finding]s, so a SQLite evidence database's anomalies aggregate uniformly with the partition / container / filesystem layers.

Each anomaly is an observation ("consistent with …"); the examiner draws the conclusions.

Capabilities

• [carve_deleted_records] — recover deleted rows from free (unallocated) pages, the headline capability rusqlite structurally cannot provide. Each recovered row is confidence-graded, flagged allocated: false, and carries page/offset/rowid provenance.
• [audit] grades header reserved-space, a non-empty freelist (prior deletions), an active WAL overlay (uncheckpointed state), and a header/file page-count mismatch into severity-ranked [forensicnomicon::report::Finding]s.

Deferred: a full anomaly suite (overflow-chain integrity, schema-format / text-encoding checks) and a fuzz harness.