# Full Codebase Audit Report — 2026-04-12

**Scope**: All `src/` files (~17K LOC)
**Base commit**: `ee73f27` (master)
**Subsystems Audited**: write-path, read-path, memtable, WAL, SST, iterator, compaction, manifest, cache, types & encoding
**Fixed in**: `532ace5` (v3.2.0) — 13 findings resolved

---

## Remaining Findings

### [INFO] options: DbOptions Debug impl omits 14 of 30 fields

**Where**: `src/options.rs:190-218`
**What**: Manual `Debug` implementation shows only 16 fields. Missing: `l0_slowdown_trigger`, `l0_stop_trigger`, `rate_limiter_bytes_per_sec`, `max_background_compactions`, `max_subcompactions`, `compression_per_level`, and 8 others. When debugging configuration issues, output is incomplete.

---

### [INFO] compaction: Block cache not evicted for non-L0 input files in inline compaction path

**Where**: `src/db.rs:2133-2143`
**What**: `execute_compaction_with_cache` passes `block_cache: None`, so L1+ input file blocks are not evicted. The background compaction path correctly passes the cache. Stale entries waste memory until LRU eviction, not a correctness bug.

---

*Style violations resolved in separate commit. Import rule relaxed: function-body `use` is allowed; inline paths flagged at 3+ occurrences per file.*

---

## Clean Areas

The following subsystems/invariants were verified with no findings:

- **Group commit ordering** (INV-CC3): seq -> WAL -> MemTable in single forward pass under lock
- **SuperVersion publish protocol** (INV-CC2): data fully initialized before ArcSwap::store
- **Lock ordering** (INV-CC1): `write_queue` -> `inner`, no cycles
- **InternalKey encoding round-trip**: bit inversion symmetric, proptests confirm
- **compare_internal_key**: handles variable-length user keys and short/corrupted keys
- **WAL CRC scope**: covers `type_byte || payload` symmetrically in writer and reader
- **WAL block alignment**: writer and reader handle `leftover < HEADER_SIZE` correctly
- **SST prefix compression**: restart points and prefix length correctly maintained
- **SST bloom filter**: hash function and probe count symmetric between build and query
- **SST compression round-trip**: CRC covers compression type byte, verified before decompress
- **MergingIterator heap**: direction switch re-seeks all sources and rebuilds heap
- **Snapshot filtering**: checks all versions of a key until seq <= snapshot
- **Range tombstone half-open intervals**: `[start, end)` consistently applied
- **Compaction tombstone retention**: correct at non-bottommost levels + snapshot-aware
- **Compaction sequence zeroing**: only at bottommost level for Value types
- **Compaction trivial move**: all three conditions checked (1 input, 0 overlap, no filter)
- **Sub-compaction boundaries**: exclusive-start semantics, no key duplication
- **MANIFEST atomicity**: write-fsync-rename-fsync_directory pattern
- **Unsafe code (skiplist)**: all SAFETY comments verified, memory ordering correct
- **Unsafe code (posix_fadvise)**: valid fd, advisory only
