>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3619101. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !79 >>> <p>An audit over duplicated logic, security, performance, documentation and translations, run against 1.x after the naming release changed 241 files. Security and performance came back clean and the evidence is recorded below so the next audit starts from it rather than re-deriving it.</p> <h3>Translations: 82 strings had no French</h3> <p>This is the first authoritative potx run on the module: 873 strings from 254 files, which is also the proof it did not crash, since a crashed potx reports zero. 82 of them had no French at all, and almost all were declared in YAML rather than passed to t(): 70 config schema labels, module names and descriptions, three route titles and two permission strings.</p> <p>Earlier audits reported "0 untranslated msgids" and were not wrong, they were answering the other question. That check confirms every msgid has a msgstr; it structurally cannot see a translatable string that never reached the file. Both directions need different tools, and only one of them is potx.</p> <p>All 82 are translated, reusing the vocabulary the existing French already established (coffre-fort, &eacute;l&eacute;ment, service, KEK ma&icirc;tre) rather than introducing a second one. Three false-positive families were excluded by hand rather than translated, and are named here so the number can be trusted: 81 logger and audit keys such as pdv.grant.granted, which potx extracts and a .po correctly omits; 13 config/install labels, which are config translation and are already shipped under config/install/language/fr/; and 12 copies of "Security", which is the package: value and core's string, not this module's.</p> <p>pdv_message now ships translations/fr.po and declares the interface translation keys. It was the only submodule of twelve missing both without saying why, so its name and description were untranslatable while all ten siblings' were. pdv_consumer_console still ships neither and still explains in its own info.yml that this is deliberate. Found by looping over every module rather than reading the list, which is how the pdv_vault mismatch was found before alpha8.</p> <h3>Naming: 24 audit-trail settings were labeled with a machine name</h3> <p>pdv_audit_trail's per-event booleans used the event's machine name as its schema label, so an operator toggling one read pdv.item.created instead of Created under Item lifecycle events. The group label already names the subject, so each boolean needs only its action, which also collapses 24 strings to 16 distinct ones.</p> <h3>Duplicated logic: one real case in 429 methods</h3> <p>GarbageCollector::reapExpiredGrants() and reapExpiredTrusts() were twelve lines each and differed only in the entity type id. Both now call one reapExpired(); the two docblocks stay, because they explain why each expiry is safe to reap, which is the part that genuinely differs.</p> <p>That was the only real case. Every non-test method body was hashed twice, once normalized and once blinded, and the result over 429 methods was 0 byte-identical bodies and 1 same-shape group once Drupal's own create() and buildHeader() idioms are excluded. The two AuditTrailSubscriber classes share a name and a purpose but not a body.</p> <h3>Documentation: the metrics page described a codebase two releases old</h3> <p>docs/metrics.md claimed 380 files, with 241 files changed since it was written. Regenerated and run to a fixed point, because the page counts its own Markdown: three passes to converge. Every invariant checked afterwards, since several of them have been wrong before: production plus test equals code, code plus comment plus blank equals the total, both tables sum to the totals, every submodule row adds up, the svg tags balance, no rect is wider than its viewBox, and a blank line precedes every heading.</p> <p>The test-suite and architecture-surface sections are deliberately untouched. They were re-counted exact before alpha8 and this release adds and removes no test class, route or form. A recount of the service column said 34 against the committed 52, and the committed number is the right one: service ids here are FQCNs carrying backslashes, which a naive character class silently drops.</p> <h3>Security and performance: verified, not inherited</h3> <p>Re-run rather than carried over, because the naming release touched every log key and five stored column names. 61 routes carry 71 requirements and none is _access: TRUE; no secret appears in any log or exception; no SQL is interpolated; and all ten index and unique-key definitions resolve against base fields the entities actually declare, including the renamed master_kek_id. That last one is the check worth keeping: a renamed base field can leave an index pointing at a column that no longer exists, which fails only on a fresh install and so survives every test on an existing site.</p> <p>No N+1 was found; every entity load inside a loop is either a batched loadMultiple() or an iteration over one query's rows. Three call sites load every consumer entity to build a select, which is unbounded in principle though not in any shape pdv is deployed in. Measured query counts under load remain unmeasured, as they were before alpha8: that needs the load rig rather than a static pass, and it is the honest gap in this lane.</p> <p>AI-Generated: Yes (Claude Code was used to run this audit, draft this issue summary, and write the fixes and translations on the merge request. I reviewed and ran the work myself before posting it.)</p>