`audit_trail_segment` is an index over facts the chain already records, and the module does not treat it as one. Its sibling table does, and the contrast is the whole issue. ## The chain already says what the segment set is Every `segment_*` event carries `segment_id`, `chain`, `from_id` and `to_id` in its permanent bucket, on all six actions (`segment_archived`, `segment_transient_purged`, `segment_live_purged`, `segment_file_purged`, `segment_restored`, `segment_compacted`). The archive event carries `row_count`, `file_sha256` and both anchors besides. Those rows are signed and linked like any other, so the chain is the record and the table is a lookup over it. `audit_trail_acknowledgment` is the same shape and is handled correctly. Its schema says so outright: "An INDEX of the operator acknowledgments the chain records… The record is the chain, not this table." It has `replayAcknowledgmentEvents()`, `compareIndexToChain()`, `drush audit_trail:reindex-acknowledgments`, and `AuditTrailRequirementsHooks::checkAcknowledgmentIndex()` reporting a disagreement on the status report as an Error. Segments have none of the four. ## What that costs Losing a segment row breaks the chain immediately. Probed on `1.x` with six rows, `[1, 4]` archived, then the segment row deleted and nothing else touched: ``` AFTER ARCHIVE: ok=true Chain "webdav" verified: 7 entries intact. (4 of 4 live rows still present: archive does not purge) SEGMENT ROW LOST: ok=false Chain "webdav" broken at id 7: segment_archived references segment #1 which does not exist. ``` The verdict is correct and it is unhelpful. `verifySegmentEventCrossReference()` has the range in hand from the event it is reading, and reports a tamper. Nothing says the index is what is missing, nothing compares the two, and nothing rebuilds it. An operator whose segment table came back short from a partial restore is told their chain is broken and left to work out why. Three consequences follow, and they are what an earlier pass mistook for separate defects: 1. **A segment can be created in the past.** `ensureSegmentCoverage()` reads its obstacles from the index alone, so with a row missing it sees those rows as unclaimed and mints a bare segment over a range the chain already attests. A segment whose range lies at or below one the chain has already recorded can never be legitimate. 2. **The import can stack a second claim.** `SegmentRestorer::importFromFile()` refuses only an exact `(chain, from_id, to_id)` duplicate, so it adds an overlapping row on top. Filed separately as #3620356; the guard belongs here instead, as the last line rather than the first. 3. **A missing segment is indistinguishable from a tamper.** Both surface as "references segment #N which does not exist", so the innocent case and the adversarial one read the same. ## Scope 1. **Replay.** `segment_*` events to the segment set the chain describes, in `audit_trail.id` order, with `segment_compacted`'s `compacted_from` absorbing the originals it folded, exactly as `isSegmentCompactionSuperseded()` already treats them so a compacted segment is not reported missing. 2. **Compare, and say so.** A `compareIndexToChain()` for segments, and a status-report entry naming the chains whose index disagrees, at the severity the acknowledgment one uses. This is what turns "chain BROKEN" into "segment #1 covering rows 1-4 is missing from the index". 3. **Refuse to mint in the past.** Coverage must not create a segment below the highest `to_id` the chain has attested, read from the chain rather than from the index. This makes consequence (1) unreachable at its source. 4. **The overlap guard from #3620356**, folded in here as the backstop it is. ## What is deliberately NOT in scope A byte-identical rebuild of a lost segment row. The events do not carry the segment's own `created` or its `secret_id`, so the identity HMAC cannot be recomputed from the chain alone, and inventing one would sign a row the operator never made. The archive file's `archive_record` footer does carry both, which is what `SegmentRestorer::importFromFile()` already reads: the rebuild path exists, it is the file, and what is missing is knowing that you need it. AI-Generated: Yes (Claude Code was used to help draft this issue summary and the probe quoted in it. I reviewed both before posting.)