[audit][C006] Reconcile bulk and commitment read/hash accounting with the versioned cost model

[QuantumExplorer]

Audit group: C006. Classification: correctness. Provisional severity: low.

The saved audit identifies dropped nested Dense/MMR read costs and manually reconstructed hash counts in bulk append/root/fetch paths, including a dense-root computation repeated during combined-root calculation. Direct/batch GroveDB routes and CommitmentTree consumers propagate those measurements.

Billing intent is material: merged PR #828 explicitly preserves a convention in which Result-returning bulk/commitment appends omit dense reads, while CostResult-returning append_deferred_roots bills them. An unbilled read therefore does not by itself establish a violation of the intended fee contract. Its V4 root-maintenance changes and later #829 work may also supersede parts of the saved implementation.

Expected contract and correction: identify the versioned billing model for each public route, distinguish deliberately uncharged reads from independently missing or repeated hash work, and reconcile each result with that contract. Preserve historical charges; either propagate or document omitted costs according to the selected model. Reuse computed roots or account for repeated work where the model requires it, without double counting.

Validation to complete

• Establish the intended versioned billing contract for each Result/CostResult route before treating a measured omission as incorrect.
• Compare returned component costs with bounded instrumented work for cold and warm paths.
• Cover direct/batch bulk operations, commitment append consumers, compaction and getters.
• Verify valid roots/storage are unchanged and historical cost versions remain pinned.

Limits and existing work

• Partial evidence overlap with C007, but the missing transfer into OperationCost needs its own correction.
• Later PR changes may supersede the historical code; current develop applicability remains unverified.
• PR feat(dense): O(height) dense-buffer root maintenance via per-position hash records (GROVE_V4) #828 documents intentional versioned read-billing omissions; the audit does not establish that every omitted cost violates the intended public contract.

Related tracking: issue #822 (closed), PR #751 (merged), PR #825 (merged), PR #826 (merged), PR #829 (merged), PR #828 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_3ccc317b6467a66c24861ceb

Primary fingerprint: codex-security/v1:sha256:d9dc5a4c56278592aae5c9efb0839076d4aa95dfafb9d90f86543d16ed7cd142

Canonical finding ID: csf_e2518347f553de4da6869547

Primary fingerprint: codex-security/v1:sha256:22d4bbaed8d3a88405b310efd6c9fe8370b97129764facdd172d7bdeb15c4c2a

Source locations:

• Location (root_control): grovedb-bulk-append-tree/src/tree/append.rs:54-112
• Location (implementation): grovedb-bulk-append-tree/src/tree/append.rs:131-150
• Location (implementation): grovedb-dense-fixed-sized-merkle-tree/src/tree.rs:167-186
• Location (implementation): grovedb-dense-fixed-sized-merkle-tree/src/tree.rs:317-358
• Location (implementation): grovedb/src/operations/bulk_append_tree.rs:80-111
• Location (implementation): grovedb-commitment-tree/src/commitment_tree/mod.rs:309-333
• Location (implementation): grovedb-commitment-tree/src/commitment_tree/mod.rs:500-521
• Location (root_control): grovedb-bulk-append-tree/src/tree/append.rs:30-151
• Location (root_control): grovedb-bulk-append-tree/src/tree/fetch.rs:25-89
• Location (root_control): grovedb-dense-fixed-sized-merkle-tree/src/tree.rs:309-361
• Location (root_control): costs/src/context.rs:39-58
• Location (outcome): grovedb/src/operations/bulk_append_tree.rs:70-92
• Location (outcome): grovedb/src/operations/bulk_append_tree.rs:526-545
• Location (root_control): grovedb-commitment-tree/src/commitment_tree/mod.rs:314-342
• Location (root_control): grovedb-bulk-append-tree/src/tree/append.rs:86-108
• Location (propagation): grovedb-bulk-append-tree/src/tree/append.rs:137-146
• Location (sink): grovedb/src/operations/bulk_append_tree.rs:81-91
• Location (sink): grovedb/src/operations/bulk_append_tree.rs:535-548
• Location (root_control): grovedb-bulk-append-tree/src/tree/fetch.rs:36-50
• Location (supporting): grovedb-dense-fixed-sized-merkle-tree/src/tree.rs:338-359