## Problem `AuditTrail::record()` documents at length that a contributor plugin which throws must not cascade into the entity save that triggered the audit event. The catch that keeps that promise stamps the failure onto the row, and the forensic stamp writes its own record of what it overrode. Neither key was the module's alone: - `_contributor_errors`, the orchestrator's marker. - `_caller_supplied` (`ForensicStamp::CALLER_KEY`), the stamp's record of the caller values it displaced. Both sat outside the `_audit_trail_` namespace `record()` strips from caller context, so a caller could send either one. Two consequences on that path: 1. The value is persisted verbatim into `context_transient`. The comment beside the stamp tells operators to grep `context_transient LIKE '%_contributor_errors%'` to find rows a contributor failed on; that query then answers with rows where nothing failed. 2. When the caller's value is a scalar and a contributor then throws, the append raises `Error: [] operator not supported for strings` inside the catch block. The Error escapes `record()` and reaches the host save: exactly the cascade the catch exists to prevent. The namespace is not the whole answer, because the two ingress paths strip differently. `\Drupal::logger()` deliberately keeps a caller's `_audit_trail_*` keys so bridges can thread their own metadata through it, which `docs/consumers.md` documents and `FirstClassColumnsTest::testThePsr3PathKeepsPrivateKeysOnTheRow()` pins. On that path — the one most callers use — both keys stayed the caller's to set. A row written through it could carry: ``` _audit_trail_caller_supplied = {"uid":4242,"ip":"10.0.0.1"} while the stamp recorded uid 0 _audit_trail_contributor_errors = [{"plugin_id":"invented", ...}] where no contributor ever runs ``` The first is the worse of the two: the forensic envelope exists so that who acted, from where and on what path are the framework's observations rather than the call site's, and a row claiming the framework displaced a uid it never saw undoes that. ## What changed Both markers moved into the `_audit_trail_` namespace, behind named constants, so `record()` removes a caller's copy with the rest of the prefix before either is written. Each is then dropped by whatever writes it, whoever put it there, which is what covers the PSR-3 path as well: - `ForensicStamp::apply()` discards an incoming `CALLER_KEY` before it computes what was displaced. The stamp is that key's only writer and runs on both paths, so one place covers both. The merge with an existing value that used to follow is gone with it: there is no existing value any more. - `AuditTrailLogger::log()` drops the contributor marker alongside the other module-owned keys it already removes. No contributor runs on that path, so a row on it can never legitimately carry one. `docs/consumers.md`, `architecture.md`, `security.md` and `threat-model.md` are updated, and the test prose that cited the old key as an example of one that persists is corrected. No update path: this is transient-bucket diagnostic metadata, not signed identity, and the module ships no update hooks before 1.0. ## Test coverage Each confirmed to fail against the unfixed code and to pass with the change: - `AuditTrailContributorIsolationTest::testCallerCannotSeedTheContributorFailureMarker` — the scalar-plus-throw case, which errors with the production message without the fix. - `AuditTrailContributorIsolationTest::testCallerKeepsKeysOutsideTheReservedPrefix` — the control, that a key outside the prefix still persists. - `FirstClassColumnsTest::testThePsr3PathRefusesTheKeysTheModuleStamps` — the PSR-3 path, asserted against both keys and against a bridge key that must survive. Each half was disabled on its own and fails on its own key. Measured, best of 5 × 300 chained writes: 72.3 µs/row before, 71.6 µs/row after. --- AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the fix and its test cases. I reviewed both, and the new tests were confirmed to fail against the unfixed code and to pass with the change.)