fix(test): make secure_delete oracle host-engine-independent (auto_vacuum)

[h4x0r]

Summary

Fixes the pre-existing, main-wide CI failure of the Tier-2 oracle test real_engine_secure_delete_raises_the_fingerprint (forensic/tests/audit.rs). It passes locally on sqlite3 3.45.3 but fails on GitHub's macOS runner (e.g. run 29022915845); ubuntu/windows are canceled by fail-fast.

Root-cause verdict: brittle host-build-dependent ORACLE — NOT a detector gap

The test asserts SQLITE-FREELIST-RESIDUE-ZEROED fires after PRAGMA secure_delete=ON. The failure is not the detector: it is the oracle's assumption that secure_delete=ON always leaves zeroed freed leaf pages on the freelist.

Evidence (byte-level, measured on identical inputs):

sqlite3 build	secure_delete=ON result	freed leaves	fingerprint
3.43.2 (Apple aapl, /usr/bin/sqlite3)	42 zeroed leaves	42	fires ✅
3.43.2 (upstream), 3.45.3, 3.46.1, 3.50.4	42 zeroed leaves	42	fires ✅
built with -DSQLITE_DEFAULT_AUTOVACUUM=1 (reproduces runner)	file truncated 50→8 pages, freelist_count=0	0	cannot fire ❌

On a build compiled with SQLITE_DEFAULT_AUTOVACUUM=1, the DELETE reclaims the freed pages and truncates the file, so there is no freed-leaf freelist to detect. The fingerprint correctly stays silent — there genuinely is no zeroed residue. This exactly matches the CI failure signature (the ON assertion at line 315 fails; OFF is never reached).

Across every conforming engine — including Apple's — the detector recognizes real secure_delete=ON zeroing (ON → fires, OFF → silent). There is no detector gap, so no forensic/src / core change is warranted; fixing the detector would mask nothing real.

Fix

Force PRAGMA auto_vacuum=NONE in the oracle script so the freed-leaf freelist is produced deterministically on any build (a no-op on builds that already default to auto_vacuum off). This removes the ambient-engine dependency while keeping the Tier-2 real-engine cross-check that guards against a self-encoded fixture (the value it adds over the existing synthetic zeroed_freed_leaves_flag_residue_destruction construction test: it proves a real engine actually emits the zeroed-leaf layout the detector matches).

Validation

• Reproduced the failure at the byte level on a SQLITE_DEFAULT_AUTOVACUUM=1 build (0 freed leaves) and confirmed the patched script restores 42 zeroed leaves (ON fires) and 42 residue-retaining leaves (OFF silent).
• Test passes via SQLITE3_BIN against: the auto_vacuum runner-sim build, Apple /usr/bin/sqlite3 3.43.2, upstream 3.43.2, and 3.50.4.
• Gate: cargo fmt --all -- --check clean · cargo clippy --workspace --all-targets -- -D warnings no issues · cargo test --workspace 507 passed / 0 failed.

🤖 Generated with Claude Code