## Problem Prose claims that the code contradicts. Several are load-bearing: an operator reads the threat model and the schema descriptions to decide what the module guarantees, and reads the README to decide whether it will install. ## What happens **Drupal 12.** `README.md:58` says "Drupal 11.3 or later, or Drupal 12", unqualified, and the `^11.3 || ^12` declaration appears in `composer.json` and all six `info.yml` files. But `drupal/key` is a **hard dependency**, and no published key release allows core 12. The newest two, `8.x-1.22` and `2.0.0-alpha1`, declare `core_version_requirement: '^9.1 || ^10 || ^11'`, and the releases before them cap at 11 through `>=8.9 <12`. That is confirmed both by `updates.drupal.org/release-history/key/current` and by the installed `key.info.yml`. The next-major lane is green because `_LENIENT_ALLOW_LIST: 'key,paragraphs'` makes the template `sed` key's `core_version_requirement` to `^12` before the tests run, and because `.gitlab-ci/next-major-patches.json` applies two unmerged key merge requests. Neither mechanism exists on an operator's site: `composer require drupal/audit_trail` will not resolve on D12, and a forced install leaves Drupal refusing to enable `key`, hence `audit_trail`. The CI file states this in its own words at lines 20-24; nothing an operator reads does. **The write API.** `composer.json`'s description advertises a "canonical write API (created / updated / deleted / event)". The interface has three methods: `event()`, `markPendingWrites()`, `discardPendingWritesSince()`. `grep -rnE "function (created|updated|deleted)\("` over the whole tree returns nothing. The sibling `info.yml` was corrected to "Canonical `event()` write API" and this was not, and `composer.json`'s description is the text drupal.org and Packagist render. ## Findings in this issue - **A01-F1** `README.md:58, composer.json:14-15, all six info.yml`: the module advertises Drupal 12 support that no released dependency can satisfy, with no caveat anywhere an operator reads. Verified against `updates.drupal.org` and the installed `key.info.yml`. - **A01-F2** `composer.json:3`: the description advertises a `created / updated / deleted` write API that does not exist. Verified by enumerating the interface and grepping the tree. - finding `config/schema/audit_trail.schema.yml`: the `hash` and `hmac` descriptions do not describe what the writer computes. - **M5** `config/schema, docs/`: the schema's account of the hash chain is not the writer's; rotation is documented as "minting" and "atomic" when it promotes a pending entity and mints nothing. - finding `docs/threat-model.md`: states guarantees the code does not provide, most sharply the "DB write, no secret" case, which a deleted tail defeats. - finding `docs/commands.md`: documents wrong exit codes and omits nine commands. - finding `modules/audit_trail_tsa/README.md`: describes parsed fields the code never parses. - **A01-F13** `composer.json:13`: `"php": ">=8.2"` can never bind: core 11.3 and 11.4 both require `>=8.3.0`. - **A01-F14** `.gitlab-ci.yml:20-21, .deprecation-ignore.txt:17-19`: `paragraphs` is called a dev dependency of the submodule that hard-depends on it. Removing it breaks a shipped submodule, not just tests. - **A01-F6** `.deprecation-ignore.txt:27-34`: the applied patch is attributed to #3484086, which is **Postponed** and applied by nothing here; the lane actually applies #3483550 and #3599449. So the pattern's own drop condition cannot be checked. - **A01-F7** `.tugboat/setup.php:15-34`: the `@file` block describes a seed the file no longer is: a `default`/`php` chain where the code creates `demo`, two resource types where there are three, an idempotency claim that unconditional `Node::create()` and a `system.site` rewrite falsify, and a side-effects list omitting four of the biggest (a `navigation` uninstall, a live FreeTSA fetch, a node type, an `olivero.settings` overwrite). - **A01-F8** `.tugboat/config.yml:67-69`: says the seed tracks user entity changes; `audit_trail_entity.settings` ships as `types: {}` and the seed never touches it, so the bridge is enabled and inert and a reviewer following the demo sees no row. - **A02-F1** `docs/index.md:3`: the published documentation's landing page carries the same unqualified "for Drupal 11.3 and 12" promise, so correcting the README alone leaves the claim standing where the documentation is read. - **A02-F2** `composer.json:17-20`: `paragraphs` is a runtime dependency of the shipped `audit_trail_entity_paragraphs`, and `composer.json` names it only under `require-dev`, which no site installing this module resolves. An operator who enables that bridge meets Drupal's missing-dependency refusal with nothing telling them which project to require. - **A01-F15** `.gitlab-ci.yml:35-71`: a 37-line comment explaining the deprecation-helper workaround sits above the wrong job, so the rationale is filed under `composer (next major)` while the four shell lines it explains are in `phpunit (next major)`. ## Proposed fix Take the D12 claim first, because it is the one that costs an operator an upgrade window: keep the `^12` declarations (they are what makes the lane useful) but state the gate where operators read it: `README.md`'s requirements and the `docs/index.md` landing page, naming `drupal/key` as the blocker. Then revisit `"drupal/key": "^1.18"` once a D12-capable key branch is named; note that #3599449 is written against `2.0.x-dev`, which `^1.18` excludes. The rest is a straightforward truth sweep: bring `composer.json:3` in line with `info.yml:3`, correct the schema descriptions and the rotation prose, rewrite the threat model per attacker rather than per mechanism (the deleted-tail case is the one it gets wrong), regenerate `docs/commands.md` against the actual commands and the exit-code contract, rewrite the `setup.php` side-effects list from the eight steps as they now stand, and move the CI comment above the job it explains. Related: #3614385 declared the D12 compatibility this issue says is unsatisfiable. --- Found by a full-tree audit of `1.x` pinned at `7bae553` (tag `1.0.0-alpha9`), reading all 271 tracked files. Every claim above was checked against the source, and where a claim could only be settled by running something, the issue says so. AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the change and its test on the merge request. I reviewed and ran the work myself before posting it.)