### Problem Eleven tests, spread over nine classes, do not exercise the module. They open the module's own source files, stylesheets, YAML and `docs/*.md` from disk and assert about the text: that a word appears, that a count spelled out in a sentence matches a count read from a file, that a constant is declared in exactly one file, that a CSS block naming a background also names a color. Every one of them walks `src/`, `modules/` or `docs/` on every run, and none of them can fail on behaviour. | Test | What it reads | |---|---| | `Unit\DocumentedSurfacesTest` (7 methods) | `docs/commands.md`, `docs/architecture.md`, `docs/security.md`, `docs/verification.md`, `docs/configuration.md`, every `*Commands.php`, `*.permissions.yml`, `*.routing.yml`, the schema, and a regex over every PHP file for a constant declaration | | `Unit\SegmentSignatureDescriptionTest` | `docs/security.md` and the column descriptions in `audit_trail_schema()` | | `Unit\AdminCssColorPairingTest` | every shipped `.css`, through a hand-written CSS parser | | `Unit\StatusMessageShapeTest` | every PHP file, counting the string `'#status_headings' =>` | | `Unit\LinkPlaceholderTest` | every PHP file, through `token_get_all()` | | `Unit\ControllerDependencyTest` | every controller and trait, searching for `$this->name` | | `Unit\IsoDurationTest::testNothingElseParsesAnIsoDuration` | every PHP file, for `new \DateInterval` | | `Unit\RetentionOrderTraitTest::testTheSequenceReadsTheSameWayWhereverItIsWritten` | every PHP file under `src/`, for one HTML-escaped sentence | | `Unit\CanonicalJsonTest::testOnlyTheDeclaredCanonicalizationNamesAppear` | every PHP, YAML and Markdown file, for the words `canonical(` / `canonicalize(` | | `Kernel\OperatorDiagnosticTest::testEveryLoggerCallDeclaresTheChainOptOut` and `::testTheLoggerCallScanFindsTheCallSites` | every PHP file, extracting logger call arguments by balancing parentheses | | `Kernel\UninstallStateTest::testEveryPerChainStatePrefixIsListedForUninstall` and `Kernel\TsaUninstallStateTest::scanPerChainStatePrefixes()` | every PHP file, for `STATE_*` constant declarations | Three things are wrong with them as a set: - **They test words, not code.** PHP cannot evaluate a CSS cascade, so a stylesheet read as text proves nothing about contrast; a sentence in `docs/verification.md` that says "runs five checks" is prose, and a prose problem is fixed in the prose. Each of these started as a fix to one stale sentence and was then kept as a guard over the sentence. - **They did not catch the stale prose the audit found.** `README.md` still promises "all thirteen drush commands" against sixteen declared, `docs/architecture.md` still says "four cron runs … four thresholds" and "`transient_purge_after` is the only optional threshold" against the five thresholds `docs/configuration.md` states, and the entity bridge's own docblocks describe a comparison the code no longer makes (filed separately). The guards cover the sentences they were written for and nothing else. - **They cost every run.** Each one lists and reads the whole tree, `docs/` included; on drupal.org CI that tree sits inside a full Drupal build, which is why several of them carry paragraphs explaining which directories they must not walk. The CSS one asserts that no stylesheet may contain an `@`, so the first media query added to the module fails a unit test. ### Proposed resolution Delete the seven classes that consist only of scans (`DocumentedSurfacesTest`, `SegmentSignatureDescriptionTest`, `AdminCssColorPairingTest`, `StatusMessageShapeTest`, `LinkPlaceholderTest`, `ControllerDependencyTest`), and remove the scanning methods and their private helpers from the four mixed classes, keeping every method that calls the code (`IsoDurationTest`, `RetentionOrderTraitTest`, `CanonicalJsonTest`, `OperatorDiagnosticTest`, `UninstallStateTest`, `TsaUninstallStateTest`). Where a scan fed a behavioural assertion, feed it from the constant it was scanning for (`AuditTrailTsaCronHooks::STATE_LAST_RUN_AT`). `ComposerIntegrationTest` is left alone: it parses `composer.json` and the `*.info.yml` manifests structurally and checks that every project a shipped module depends on is declared, which is a fact about the package rather than about a sentence. What these scans were standing in for is a linter's job (phpcs, phpstan, stylelint, cspell), and the pipeline already runs those. ### Disclosure This issue was written by an AI assistant (Claude Code) as part of a complete audit of the module requested by the maintainer. The list was established by reading every test file for `file_get_contents`, `glob` and `RecursiveDirectoryIterator` calls; the merge request was written by the same assistant and is reviewed by the maintainer.