Pre-release audit ahead of the next alpha, over security, performance, Drupal standards, documentation and duplication. Two findings; the rest of the module came back clean and the detail is below so the clean dimensions are on record rather than merely unmentioned. ## Finding 1: the documented hot-path short-circuit does not exist `docs/architecture.md`, under "Hot-path resolution cache", describes an `any_auto` key on the chain registry and states that on a site with no `mode: auto` chain, "every dblog-style log call exits in two array reads: no entity load, no foreach, no ksort." `any_auto` appears nowhere in the code. `ChainRegistry::getRegistry()` unconditionally loads every `audit_trail_chain` config entity, sorts them, and runs two passes over them, and it does that on the first `log()` call of every request, before any short-circuit can be reached. The result is memoized, so the second and later calls in a request really are two array reads; the first is not. This is the one path in the module worth the attention. Every `\Drupal::logger()` call anywhere on the site reaches `AuditTrailLogger::log()`, and the module's own screens are all `/admin`, so a read per row there costs an operator nothing while this costs every request that logs. The fix keeps the data source and drops the object construction. The two scalar maps the hot path needs, the channel claim and the auto-channel subset, are built from the raw configuration rather than from constructed config entities, and the entities are built only when a chain actually resolves and one has to be returned. A site with no auto chain therefore never constructs a chain entity to answer a log call. Deliberately NOT a persistent cache. A stale channel map means entries silently not chained, which is precisely the failure this module exists to make impossible, and that risk is not worth paying to avoid a per-request read that the configuration system already serves from its own cache. The documentation is corrected to describe what the code does, `any_auto` included. ## Finding 2: the metrics page goes stale on its own, and nothing catches it `docs/metrics.md` is a measured snapshot regenerated by `scripts/generate-metrics.py`. Nothing in the repository or the pipeline references that script, so the page stays current only when somebody remembers to run it before a tag. It has already shipped stale inside earlier tags, and it is stale again now: the page records 253 files and 32,315 lines of code, measured on a date that is no longer the head, against a tree that currently measures 263 files and 33,655. Regenerating it is part of this change. Enforcing it is the actual fix, and a job that regenerates the page and fails when it differs is proposed rather than added here, because it needs `cloc` in the CI image and because turning a pipeline red is a decision for the maintainer rather than for an audit. ## Dimensions that came back clean - **Drupal standards.** `phpcs` with `Drupal,DrupalPractice` over the whole module reports zero errors, and `phpstan` at the shipped level 5 reports none. No `@todo`, `FIXME` or `XXX` remains in `src/`. - **Security.** Every raw `where()` fragment in the entries filter binds its values as placeholders, and the only interpolated SQL is a module-owned literal. Every route declares a permission, every state-changing controller declares `_csrf_token`, and every destructive lifecycle operation is a confirm form. - **Documentation.** The `CHANGELOG.md` removal left no dangling references. The one remaining terminology overlap previously noted in `docs/roadmap.md`, between the planned redaction table and the old `redacted` bucket, is now moot: that bucket no longer exists anywhere in the code, so nothing collides. - **Translations.** The module ships none, by decision: it is operator-facing and its interface is entirely `/admin`. Recorded here so the absence reads as a choice. This issue summary was drafted with the assistance of an AI agent (Claude). The analysis and the wording were reviewed by me before posting, and accountability for the content is mine.