## Problem None of this ships to a site. All of it decides what the next audit can rely on. ## What happens **One PHP file is never type-checked.** The template runs PHPStan from the project root, and a PHPStan directory scan skips dot-directories, so `.tugboat/setup.php` is invisible to it. phpcs behaves the *opposite* way and descends into them, so the file is style-checked and never type-checked. Both ends are reproducible: analysing the module reports no errors, while pointing PHPStan at `.tugboat` directly reports six. That file is not trivial. It calls `AuditTrailInterface::event()`, `ChainArchiver::ensureSegmentCoverage()` and `archiveChainRange()`, and `ChainTimestamper::timestampChain()`, and three of its phases end in a `catch (\Throwable)` that logs one line and continues. Rename or re-sign any of those APIs and nothing in the pipeline fails. The public demo silently loses its archived segment or its TSA row, while the front-page copy the same file writes keeps promising them. **The metrics job is the check its own script forbids.** `scripts/generate-metrics.py`'s docstring says plainly: "do not use a re-run diff as a check that the page is current", because the count includes the page it writes. The job does exactly that, so the warning fires on a correctly refreshed page, which makes the next genuinely stale page read identically. **And the page is not reproducible across `cloc` versions**, while the job installs whichever one Debian packages. Measured on the tagged tree with only the binary changing: 2.08 and 1.98 reproduce the committed page byte-for-byte; **1.90 differs by 103 lines**, because it emits no `Text` language at all. Debian bookworm packages 1.90. ## Findings - **A01-F5** `.tugboat/setup.php`: the one PHP file PHPStan never sees. Fixed: the seed moves to `scripts/tugboat-demo-seed.php` and `.tugboat/setup.php` becomes the entry point that requires it, so the analysis reaches it. A config `paths:` key cannot fix this, because the explicit path the template passes overrides it. The three `catch (\Throwable)` blocks stay: they exist for a FreeTSA outage or a blocked egress, they report into the build log rather than swallowing, and the silent-rename risk that made them dangerous is what the analyser now covers. - **A01-F3** `.gitlab-ci.yml`: the metrics job is the re-run diff the script's docstring forbids. Fixed: the job prints the diff and asserts nothing, and its header comment no longer describes a check, a warning, or how to clear one. - **A01-F4** `.gitlab-ci.yml`: the page is not reproducible across `cloc` versions and the job installs an unpinned one. Fixed by printing `cloc --version` before the diff, with the measured differences written down next to it, rather than by asserting a version the job does not control. - **A01-F12** `phpstan.neon`: the global `reportUnmatchedIgnoredErrors: false` would hide the next stale ignore. Fixed: removed, keeping the per-entry `reportUnmatched: false` and the reason it is needed. - **A01-F9** `.cspell-project-words.txt`: dictionary words matching nothing in the repository, `analyse` among them. Fixed: 19 removed, each checked against `git grep`, in place and without re-sorting. - **A01-F16** `scripts/generate-metrics.py`: the published **Event subscribers** row is counted by path substring and is structurally zero. Fixed: dropped. - **A01-F10** `.gitlab-ci.yml`: `_CSPELL_IGNORE_PATHS` names paths that do not exist. Fixed: two dead entries removed, the two real ones kept. - **A01-F11** `.gitignore` and `measure_files()`: neither `site/` nor `node_modules/` is ignored, and the measurement reads the working tree rather than the commit. Fixed: both ignored, and both cloc runs take `git ls-files`, so a checkout with `vendor/` or a docs preview in it measures what CI measures. The count was 22 dead dictionary words when this issue was filed and is 19 now; the rest went with the merges since. ## Folded in from deploying #3594328 Deploying the merged masking to a site installed before it exposed a hole in that feature, and the fix is in this MR rather than a follow-up. `config/install` reaches a fresh install and nothing else, so such a site has neither `redact_query_keys` nor `redact_path_prefixes`. The writer handles it, falling back to the shipped lists, and masking works. The settings form read active config directly, so it rendered both fields **empty** — and two empty lists are how a site turns masking off, so opening the settings page and pressing Save switched off password-reset masking without saying so. Fixed by reading the lists in one place: `ForensicStamp` answers `queryKeysToRedact()` and `pathPrefixesToRedact()`, the form asks it, and the private readers fold the same lists into the shapes the matcher wants. The fallback still answers only an absent key, so a site that turned masking off still sees two empty fields. That accessor is also what a module extending the lists needs: appending to the raw key on a site that has none stores a one-entry list and takes the shipped patterns with it, which is what `audit_trail_webdav`'s install hook would have done, and the docs pages describing that extension point now say so. Also from the same review: the operator-facing strings said "web address" for what Drupal calls a URL, and the two keys were missing from `docs/configuration.md`, where an operator looks up what lives in `audit_trail.settings`. ## Still open, for the maintainer Whether the demo is meant to exercise the entity bridge at all. `audit_trail_entity` ships with `types: {}` and the seed never sets it, so the bridge is enabled and inert and a reviewer sees no rows from entity saves. If it should, the fix is in the seed; if not, it is in the `config.yml` comment that currently explains the absence. Follows on from #3620302, which added the metrics currency check. --- Found by a full-tree audit of `1.x` pinned at `7bae553` (tag `1.0.0-alpha9`), reading all 271 tracked files. Every claim above was checked against the source, and where a claim could only be settled by running something, the issue says so. AI-Generated: Yes (Claude Code was used to help draft this issue summary and the merge request. I reviewed both before posting.)