## Problem Four of these are white screens reachable from a valid form submission, and one is a form that reports doing something it never does. ## What happens `$form_state->setError()` called inside `submitForm()` is a WSOD: validation has already run, so the error is set on a form that will never be rebuilt. `AuditTrailAcknowledgmentForm::submitForm()` does exactly this, catching `\InvalidArgumentException` and calling `setError()` on `$form['from_id']`. The chain delete form **promises a config delete it never performs**. `$this->deleteConfig` is read in five places, all of them only to choose a word for a message or a label; `submitForm()` calls `$this->archiver->deleteChain($this->chainId)` and nothing else. The operator ticks the box, reads "deleted", and the config entity is still there. An empty number field stores 0, because `Number::validateNumber()` early-returns on `''`. With `checkpoint_retain: 0` that silently kills automatic verification. The field an operator is most likely to clear while experimenting is the one that turns the feature off. A blank `archive_directory` 500s the segments page; the Ajax remove button re-indexes onto the next row, so removing one item removes a different one; and an ISO-duration `TypeError` 500s the retention preview and strands the save. ## Findings in this issue - **H17** `src/Form/AuditTrailAcknowledgmentForm.php:180-183`: `$form_state->setError()` inside `submitForm()` is a WSOD. - **H8** `src/Form`: an empty number field stores 0, and `checkpoint_retain: 0` kills automatic verification. `Number::validateNumber()` early-returns on `''`. - finding `src/Form/AuditTrailChainDeleteForm.php:174-222`: the form promises a config delete it never performs. `$this->deleteConfig` only picks a word, and the form then logs "deleted". - finding `src/Archive/AuditTrailSegmentListBuilder.php`: a blank `archive_directory` 500s the segments page. - finding `src/Form`: the Ajax remove button re-indexes onto the next row, so removing one item removes the wrong one. - finding `src/Form`: an ISO-duration `TypeError` 500s the retention preview and strands the save. - finding `src/Form/AuditTrailSecretForm.php`: the add form throws `EntityStorageException` and white-screens when the id `preCreate()` gave the entity at BUILD time is taken before the operator submits. `save()` re-asks for a free id, correctly, but `ConfigEntityBase::__construct()` stamped the build-time id as the entity's ORIGINAL id and `EntityStorageBase::doPreSave()` tests existence against that in preference to the id just assigned. Found by auditing the same shape in audit_trail_tsa (#3620324). - finding `src/Key/KeyBackedSecretRepository.php`: the 32-byte floor on a signing secret is enforced only in `activate()`, so the secret form saves a Key too short to sign with and the refusal arrives later, as a failed rotation. Found while fixing #3620309 and folded in here, because it is the same shape as the rest: a rule that fires too late to tell the operator anything useful. The dropdown does not catch it either, filtering on the size the key type DECLARES rather than on what its provider returns. ## Proposed fix 1. Move the acknowledgment validation into `validateForm()`, where `setError()` works. 2. Either delete the config entity when the box is ticked, or remove the option and the messages that promise it. The log line must describe what happened. 3. Use `#required` with `#required_error` for the number fields rather than accepting `''` and storing 0. (Note that a direct `validateConfigurationForm()` unit test passes either way: the empty case only shows up through the form API.) 4. Guard the blank `archive_directory` on the segments page. 5. Key the Ajax rows by identity rather than by index. 6. Catch the ISO-duration parse failure in `validateForm()` so the preview cannot 500. 7. Tell storage the entity has no earlier identity once the form settles its id, so the re-assignment is the one storage checks. 8. Check the resolved byte length in the secret form's `validateForm()`, and keep the repository's refusal for what never passes through a form (the entity API, a configuration import). An unreadable Key needs its own message: "resolved to nothing" and "resolved to too little" send an operator to different places. --- Found by a full-tree audit of `1.x` pinned at `7bae553` (tag `1.0.0-alpha9`), reading all 271 tracked files. Every claim above was checked against the source, and where a claim could only be settled by running something, the issue says so. AI-Generated: Yes (Claude Code was used to help draft this issue summary, and to write the fix and its test cases in the merge request. I reviewed both; each new test was confirmed to fail without its fix and to pass with it.)