Module verify 

Structural verification. verify_published_tree is public so a live database’s shape can be proven after a graft; the rest stays internal. Independent verification for replacement trees.

Recovery and bulk loading both build pages that are not authoritative yet. This module reopens those bytes through a fresh, fixed-size pool and walks the complete reachable graph before either caller publishes the root. The verifier retains one page of separators per level (bounded by page size and tree height), never a visited set proportional to the database.

Enums

DecodedRecord

The one decoder for records stored in B-tree page slots. Ordinary reads, replacement verification, and recovery all enter through this function; none may index a disk-derived key length, value length, marker, or child pointer first. Keeping the decoder here extends the independent verifier’s boundary instead of creating a recovery-only parser that can drift.

Functions

decode_record

verify_published_tree

Walk a PUBLISHED tree and prove its structure: every separator inside its parent’s range, every level strictly ordered, every page this tree’s own, the leaf chain intact. Row count is whatever the walk finds — this asks “is the shape sound”, not “does it hold the rows a build promised”.