Function decode_partial_tree 

pub fn decode_partial_tree(
    data: &[u8],
    expected: ContentHash,
) -> Result<PartialTree>

Decode an HRT1 redacted projection body and verify it reconstructs the externally-declared tree hash expected.

This is the partial-tree counterpart to decode_tree_serialized_with_key: where that returns a full Tree and refuses an HRT1 body, this returns a verified PartialTree whose visible preimages + withheld leaf hashes reproduce expected (Leg 1’s reconstruct_root contract). A partial clone verifies against the tip’s declared State.tree through this path WITHOUT holding the withheld content.

decode_redacted_projection already checks that the projection’s leaves reconstruct its self-declared root; the extra equality below binds that self-declared root to the externally-expected key, so a projection cannot masquerade as a different tree (mirroring the found != expected corruption check every full-tree decode performs).