### Problem A file-by-file read of the module found statements, in docblocks, help texts, schema descriptions, YAML comments and `docs/*.md`, that describe code the module no longer has, or count things it has a different number of. None changes behaviour; every one misleads the next reader, and several contradict each other on the same page. Grouped by where they sit: **Counts that drifted** - `README.md`: "`docs/commands.md` lists all thirteen drush commands". Sixteen are declared. - `docs/architecture.md` § Retention lifecycle: "Four cron runs carry rows through retention, gated by four thresholds", "`transient_purge_after` is the only optional threshold", "A segment is bare when all four stamps are zero". `docs/configuration.md` states five thresholds with two optional (`compact_after` too), and `docs/commands.md` says "the six stages run from cron". The settings-form sentence there omits `compact_after` as well. - `docs/roadmap.md` lists thirteen drush commands (missing `reindex-acknowledgments`, `reindex-segments`, `rewrite-archive`) and promises "400+ tests" against the 1,265 methods `docs/metrics.md` counts. - `EntityAuditSettingsForm::getTrackableEntityTypes()`: "Excludes types that fall in one of four categories", then lists three. - `AuditTrailUserAuthSettingsForm` class docblock: "sites that don't use password-reset can disable the two reset events". There are four. **Descriptions of code that has moved on** - `AuditTrailChainInterface`: `isActive()` and "all of it in `context_permanent`"; `AuditTrailChainForm` contributors description "in `context_permanent`"; `ContextContributorInterface` step 3 "dispatches to the logger"; `KeyBackedSecretRepository::getSigningSecretId()` cascade-delete comment; `ChainArchiver` class docblock and `audit_trail.install` (acknowledgment table described as a "superset" carrying `hmac` / `secret_id`); `createBareSegment()` ("ack count", "requires non-empty archive_secret_id"); `purgeSegmentTransientContext()` ("bare creation is silent"); `archiveSegment()` "first first"; `SegmentReader::verifyArchivedSegment()` and the drush `archive-verify` option ("path stored on the archive row"); `file_sha256` schema and `SegmentReader` ("when gzip support lands"); install line 187 naming `AuditTrailLogger / ChainArchiver` as the lock holders; `AuditTrailHelpHooks::buildSecretsListHelp()` listing acknowledgments among what references a secret; the settings form docblock and `audit_trail.links.menu.yml` "chain selection mode"; granularity documented as `day|week|month` where `hour` exists; `SegmentStageQuery` docblock naming `eligible()`; `AuditTrailChainWriterInterface` "future signed retire-secret attestations". - `EntitySnapshot`: `NOISE_FIELDS` and `getDefaultExcludedFields()` are "public because `AuditTrailEntityHooks` also strips them prior to its full `toArray()` comparison"; the hook compares `getStoredDigest()` and strips nothing. `getStoredDigest()` mirrors "the same guard in `snapshot()`", a method that is now `build()` / `getMainPropertyDeltas()`. The class docblock says `isNoOpUpdate()` short-circuits saves that "didn't actually change a selected field"; the selection deliberately does not enter that comparison. - `audit_trail_entity.schema.yml`, `skip_no_op_updates`: "reads Drupal's full entity serialization minus auto-bumped noise fields". It reads the stored-column digest. - `EntityAuditSettingsForm::buildForm()`: "The hidden values are NOT submitted (Drupal's form layer skips invisible elements)". `#states` hides an element client-side and its value is submitted; both `validateForm()` and `submitForm()` already branch on `per_bundle`, which is why nothing breaks. The `selected_fields` description names `created` in the noise list; `EntitySnapshot` keeps `created` on purpose and says so. - `AuditTrailUserAuthHooks`: the docblock "Adds a last-position validate handler to the login form" sits detached above a second docblock, so `userLoginFormAlter()` is documented by the wrong one. - `audit_trail_tsa`: `ChainTimestamper` class docblock says the row "is signed … via the standard AuditTrailLogger path" (it calls the chain writer); the `TSR_CONTENT_TYPE` / `TSQ_CONTENT_TYPE` constants are "Mock-TSA" headers; `timestampChain()`'s `@return` omits `tsa_id`; `AuditTrailTsaRequirementsHooks` lists "`enabled` is on but `url` is empty" (the URL moved to providers) and misses the two signals it does report (no active provider, credential over plaintext); `audit_trail_tsa.services.yml` speaks of "the procedural `hook_cron` shim in .module" (there is no `.module`); the cron hook's comment cites "line ~160"; `TsaProviderAvailableWarningTrait` sends the operator to "activate it via rotation"; `AuditTrailTsaProviderInterface` documents a `status` key where the property is `provider_status`; `AuditTrailTsaHelpHooks` puts the "per-chain opt-in" on the settings form (it is on the chain form); the settings form intro reads "which the TSA operator does, not you"; `modules/audit_trail_tsa/README.md` names a test file as documentation and lists the PHP OpenSSL extension as a dependency (only the `openssl` binary is used). - `docs/consumers.md`: heading "Subject `$live` is `mixed` by design" over text saying `?object`; the private-key table omits `_audit_trail_entity_record_config_values` and `_audit_trail_entity_redact_config`. ### Proposed resolution Fix each sentence where it stands. No test: prose is corrected in the prose. ### Disclosure This issue was written by an AI assistant (Claude Code) as part of a complete audit of the module requested by the maintainer; each statement above was checked against the code it describes, and the merge request was written by the same assistant and is reviewed by the maintainer.