[audit][M011] Recursive discovery treats non-Merk descendant storage as Merk records

[QuantumExplorer]

Audit group: M011. Classification: correctness. Provisional severity: low.

Recursive subtree discovery queues every tree namespace and decodes it as Merk storage. A valid populated nested MMR uses a different encoding and can prevent recursive deletion/discovery. Other append families share the architectural mismatch, but the saved concrete encoding trace establishes MMR. Immediate non-Merk deletion has a bypass; empty namespaces may avoid the failure.

Expected behavior: Recursive discovery must recognize each descendant storage family without interpreting non-Merk records as Merk nodes.

Fix direction: Carry each discovered namespace's storage family. Include non-Merk namespaces in cleanup without traversing their records as Merk, and preserve indexed-axis cleanup where applicable.

Validation to complete

• Suggested: exercise recursive discovery and authorized deletion of healthy trees containing populated non-Merk descendants.
• Validate each storage family independently and preserve complete axis cleanup.

Limits and existing work

• The concrete saved encoding mismatch is MMR; other families require their own validation before claiming identical failure behavior.

Related tracking: issue #785 (closed), issue #848 (closed), PR #599 (merged), PR #620 (merged), PR #788 (merged), PR #849 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_b61d4d4ea46f1e6f89f9a291

Primary fingerprint: codex-security/v1:sha256:078b8ed38c0ca4ef2edfc5400b204e961d20f2eb4ef70c760198f72110664a24

Source locations:

• Location (root_control): grovedb/src/operations/auxiliary.rs:151-196
• Location (implementation): grovedb/src/operations/delete/mod.rs:774-790
• Location (implementation): grovedb/src/operations/delete/mod.rs:894-910
• Location (implementation): grovedb-merkle-mountain-range/src/node.rs:110-128
• Location (implementation): merk/src/tree/kv.rs:548-562