>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3618657. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !74 !73 >>> <h3>Problem/Motivation</h3> <p>A pre-alpha8 audit across security, performance, accessibility, documentation and translations. Security and performance came back clean and are summarized at the bottom; the six findings below are the ones that needed fixing, and they are small and unrelated enough to belong in one issue rather than six.</p> <h3>Proposed resolution</h3> <p><strong>1. pdv_vault ships French that Drupal never loads.</strong> It has translations/fr.po with seven strings, and its info.yml declares neither `interface translation project` nor `interface translation server pattern`, so the locale system never imports the file. It is the only mismatch across the eleven submodules. Two lines.</p> <p><strong>2. The .po files drifted out of sync with the code.</strong> 33 entries whose msgid appears nowhere in the source, and 33 strings in the code with no entry. Most are the same strings twice: 17 are rewordings (mainly "service" to "consumer" in developer-facing field descriptions) and keep their existing French with only the msgid changed; 16 are genuinely dead, superseded by the tenant-scoped Master KEK wording whose replacements were already translated; 17 are new and now translated. One outlier normalized: the French for a tenant is "tenant" in 96 places and was "locataire" in one.</p> <p><strong>3. pdv_test_console has 73 translatable strings and no .po.</strong> Deliberate, and now written down in its info.yml rather than looking like the same oversight as finding 1: the module is hidden, dev-only, and never reaches an operator on a production site.</p> <p><strong>4. The inert Master KEK rotation control is not announced as disabled.</strong> It renders as a button-styled span carrying aria-disabled, and aria-disabled is only honoured on an element with a widget role, so on a bare span an assistive technology drops it and the state reaches sighted users only. role=button carries it; the span still takes no focus.</p> <p><strong>5. The changelog documents one release out of seven,</strong> while claiming to record all notable changes and follow Keep a Changelog. alpha2 through alpha7 written up from what shipped between the tags, with release dates.</p> <p><strong>6. OwnerOrAdminManageTrait asks for a readonly property.</strong> Those became protected and non-readonly in <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/pdv/-/work_items/3618633" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/pdv/-/work_items/3618633</a></span> and had to: DependencySerializationTrait restores a cached form by assignment from the FormBase scope, which reaches neither a private nor a readonly property. The docblock was telling the next implementer to reintroduce the bug.</p> <h3>Remaining tasks</h3> <p>What the audit checked and found clean, recorded so the next one can start from it: all 61 routes carry an access requirement with no _access: TRUE, and the per-item routes enforce ownership in code; no secret is ever compared, because session keys are looked up by hash and handles are AEAD-decrypted with per-consumer derived keys, which is stronger than a constant-time compare; the return-URL guard is fail-closed and cross-site returns pass an origin allowlist; the entity types declare no link templates and no access handler, so core denies by default; no interpolated SQL, and no secret reaches a log, an exception or a message; and pdv.install adds three unique constraints and eight secondary indexes covering the columns the queries filter on.</p> <p>Not covered, and worth their own pass: measured query counts under load, an authoritative potx run (potx is not installed in the environment used, so the missing-string count above came from a source scan), reading the fifteen docs pages against current behaviour, and browser-level accessibility testing.</p> <h3>User interface changes</h3> <p>The inert rotation control is announced as a disabled button. French strings appear where they were missing, and pdv_vault's French now loads at all.</p> <h3>API changes</h3> <p>None.</p> <p>AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the changes. I reviewed them. The translation resync was verified with msgfmt --check, an orphan search in both directions and a check that every msgid carries a non-empty translation; phpcs, PHPStan at level 3 and cspell are clean, and the affected kernel classes pass on MySQL.)</p>