[audit][P16] Count-offset proofs can paginate by descendant totals instead of selected rows

[QuantumExplorer]

Audit group: P16. Classification: correctness. Provisional severity: medium.

A permitted nested counted-tree element contributes its descendant aggregate count to its parent but represents one row in ordinary raw pagination. Count-offset proofs consume that aggregate for collapsed prefixes before individual non-unit checks, allowing a different page or exhaustion result while the count commitment remains correct.

Authenticate physical row cardinality separately or enforce a verifiable unit-contribution invariant that collapsed prefixes cannot bypass.

PR #672 rejects NonCounted wrappers in provable count parents; that rejected trigger is excluded here. The retained case uses permitted nested counted trees. PR #669 describes first-in-range-key offsets. Open #707 and PR #749 concern an early parent-info API rejection, which is a different issue.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

Validation to complete

• Compare count-offset pages with ordinary raw pagination over permitted nested counted elements in both directions, including empty child trees and truncated offsets.

Related tracking: issue #707 (open), PR #669 (merged), PR #672 (merged), PR #749 (open).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_9b84a6fdf69884c165e8fced

Primary fingerprint: codex-security/v1:sha256:a141ed2f52b5555afb21ee84740d54d44b3d7ec2211cd9244426f448de35cb51

Canonical finding ID: csf_61c5a6f945d9a5a882295dab

Primary fingerprint: codex-security/v1:sha256:96006dabcab9ef4ffcd93849629c46cf8f23a3df5579776e1af90c47b4224d2a

Source locations:

• Location (entrypoint): merk/src/proofs/query/count_offset/mod.rs:1-81
• Location (root_control): grovedb/src/operations/proof/generate.rs:1486-1525
• Location (root_control): grovedb/src/operations/proof/generate.rs:1803-1866
• Location (root_control): grovedb/src/operations/insert/add_element_on_transaction/v1.rs:140-245
• Location (root_control): merk/src/element/insert.rs:606-670
• Location (root_control): merk/src/element/tree_type.rs:300-359
• Location (root_control): grovedb-element/src/element/helpers.rs:90-159
• Location (root_control): merk/src/proofs/query/count_offset/emit.rs:117-209
• Location (root_control): merk/src/proofs/query/count_offset/emit.rs:249-293
• Location (root_control): merk/src/proofs/query/count_offset/verify.rs:288-385
• Location (root_control): merk/src/proofs/query/count_offset/verify.rs:512-569
• Location (root_control): grovedb/src/element/query.rs:785-840
• Location (root_control): grovedb/src/operations/get/query.rs:1145-1180
• Location (root_control): grovedb/src/element/query.rs:498-539
• Location (root_control): grovedb-element/src/element/helpers.rs:116-155
• Location (propagation): merk/src/element/tree_type.rs:311-352
• Location (root_control): merk/src/proofs/query/count_offset/emit.rs:129-198
• Location (expected_control): merk/src/proofs/query/count_offset/emit.rs:252-298
• Location (sink): merk/src/proofs/query/count_offset/verify.rs:342-375
• Location (entrypoint): grovedb/src/operations/get/query.rs:1160-1180
• Location (sink): grovedb/src/element/query.rs:492-526
• Location (sink): grovedb/src/element/query.rs:802-832