Function verify_published_tree 

pub fn verify_published_tree(
    path: &Path,
    mode: IoMode,
    root: u32,
    tree_id: u16,
) -> Result<(u64, u64)>

Walk a PUBLISHED tree and prove its structure: every separator inside its parent’s range, every level strictly ordered, every page this tree’s own, the leaf chain intact. Row count is whatever the walk finds — this asks “is the shape sound”, not “does it hold the rows a build promised”.

The graft path verifies its candidate subtree before publication, but install_graft then rewrites the parent path, and nothing re-read THAT. A boundary anchored one child left of a stale separator produced a tree whose root disagreed with its own leaves — full scans saw the keys, seeks skipped them. This is the check that catches that class at its source.