## Problem/Motivation Found in a beta-readiness review of 1.x at `7092689`. Each security finding was reproduced as a kernel test by somebody with database write access and no signing secret. ### Security 1. **A purged segment excuses any row whose id falls in its range.** Row ids are not hashed, so rows can be renumbered as long as their order holds. Free an id inside a transient-purged segment (move another chain's row out of it), slide the next or previous row of the chain into the range, and empty its transient bucket: the walk takes it for one more row the purge reached. A Strict full verification reported `Chain "webdav" verified: 5 entries intact.` 2. **Compaction signs a changed archive or spine into the consolidated segment.** Before folding a run, compaction checks each member's identity and lifecycle signatures, but not its archive signature or its spine step. It then sums the row counts into a new archive signature, adopts the newest member's spine head and deletes the members. A row count changed by hand turned a broken verdict into a verified one. The spine has no key, so a head rewritten from the run's first member up was folded the same way. 3. **A timestamp verifies once its anchored row is gone.** `ChainTimestamper` returns OK when no row sits at the id the timestamp anchored. Rewriting the chain past its timestamp only takes moving that row off its id: a genuine response then read `TSR verification OK`, counted as neither failed nor unchecked. ### Correctness 4. **A secret that has signed can be deleted outside its form.** Only the delete form refuses it. `$secret->delete()` and `drush entity:delete` remove it, and every reader of a signature then calls what it signed forged, which stops retention. 5. **`audit_trail_segment.row_count` is 32 bits.** A compacted segment sums a whole chain's history, which climbs toward the ceiling `audit_trail.id` was widened to 64 bits for. ## Proposed resolution 1. A segment accounts for a live row only while the row at its `from_id` still links to `anchor_before` and the row at its `to_id` still hashes to `anchor_after`. One indexed read per segment per walk, only for segments an emptied row asks about. 2. Compaction checks each member's archive signature and spine step. Each member is checked against the one below it in memory; only the first reads the segment below the run. 3. A timestamp whose anchored row is gone is inconclusive: not OK, counted as unchecked. 4. `AuditTrailSecret::preDelete()` refuses a used secret. A configuration import and an uninstall are exempt, as they are from the Key refusal. 5. The column is 64 bits. Tests (each fails without its fix): - A row slid into a purged range from either side is reported, at Strict and at None. - Compaction refuses a member whose row count or spine head changed, one taken off the spine, and a spine rewritten from the first member up. - A genuine timestamp over a rewritten, then renumbered, head is inconclusive and counted as unchecked. - Deleting a used secret through the entity is refused; an unused one is deleted. Performance: - A full Strict walk over 3,000 rows cut into 300 transient-purged segments goes from 90 ms to 102 ms. That is the densest case, one segment every 10 rows. - Compacting 200 members takes 8.7 ms instead of 6.7 ms. - Peak memory is unchanged. A restore that puts back rows which do not link was also reported. It is left as is: the restore reports it on purpose, and the form and the Drush command both warn. ## Remaining tasks None. ## User interface changes A timestamp over a row that is no longer live is shown as a warning (unchecked) instead of OK. ## API changes - `SegmentAttestations::findSegmentsSealedOverRow()`. - `SpineReplay::doesSegmentFoldOverPreviousHead()`. - `ChainArchiver` takes the spine replay service. ## Data model changes `audit_trail_segment.row_count` becomes a big integer. There is no update hook before 1.0, so an existing site widens the column itself. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it.)