[Wave 3] Medium — Docs: docs/qms/statement_of_applicability.md #581

Wave 3 · 7 finding(s) in 7 fix package(s). One pass over this document; keep the Turkish mirror in sync.

Findings

• DOC-BNUM-001 (docs, Medium) — docs/qms/statement_of_applicability.md: stale — A.8.29 evidence: pytest ~1493 tests
  severity Medium
  Where. docs/qms/statement_of_applicability.md:137; docs/reference/iso27001_control_mapping.md:130 (TR: statement_of_applicability-tr.md:138, iso27001_control_mapping-tr.md:129) · type: stale
  The document says. A.8.29 evidence: pytest 1493 tests
  What the code does. pytest --collect-only -q on the snapshot collects 4770 tests, about 3.2 times the figure. The '' does not cover that gap.
  Code references. docs/qms/statement_of_applicability.md:137
  Proposed correction. Cite the current count, or remove the number and point to CI. The SoA is an audit-facing document.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-018 (docs, Medium) — docs/qms/statement_of_applicability.md: wrong detail — A.5.13: model_card.md
  severity Medium
  Where. docs/qms/statement_of_applicability.md:42 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:43) · type: wrong detail
  The document says. A.5.13: model_card.md
  What the code does. The model card is final_model/README.md.
  Code references. forgelm/model_card.py:342
  Proposed correction. "model card (final_model/README.md)"
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-020 (docs, Medium) — docs/qms/statement_of_applicability.md: wrong detail — A.5.25: data.erasure_failed, pipeline.failed, audit.classifier_load_failed events with error_class + error_message
  severity Medium
  Where. docs/qms/statement_of_applicability.md:54 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:55) · type: wrong detail
  The document says. A.5.25: data.erasure_failed, pipeline.failed, audit.classifier_load_failed events with error_class + error_message
  What the code does. Only data.erasure_failed carries error_class/error_message. pipeline.failed carries error, and audit.classifier_load_failed carries classifier, reason.
  Code references. forgelm/trainer.py:1702, forgelm/safety/_classifier.py:203-207, forgelm/cli/subcommands/_purge.py:557-573
  Proposed correction. List each event with its actual fields.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-021 (docs, Medium) — docs/qms/statement_of_applicability.md: false claim — A.5.32: License extraction in SBOM
  severity Medium
  Where. docs/qms/statement_of_applicability.md:61 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:62) · type: false claim
  The document says. A.5.32: License extraction in SBOM
  What the code does. The SBOM has no license fields.
  Code references. tools/generate_sbom.py:77-88
  Proposed correction. Remove or implement.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-022 (docs, Medium) — docs/qms/statement_of_applicability.md: wrong detail — A.5.34: forgelm audit PII detection + masking; A.8.11 Data masking: forgelm audit regex + Presidio ML-NER
  severity Medium
  Where. docs/qms/statement_of_applicability.md:63,119 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:64,120) · type: wrong detail
  The document says. A.5.34: forgelm audit PII detection + masking; A.8.11 Data masking: forgelm audit regex + Presidio ML-NER
  What the code does. forgelm audit only detects. Masking is forgelm ingest --pii-mask/--secrets-mask/--all-mask.
  Code references. forgelm/ingestion.py:2107-2135
  Proposed correction. Name forgelm ingest --pii-mask/--secrets-mask for masking and forgelm audit for detection.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-023 (docs, Medium) — docs/qms/statement_of_applicability.md: misleading — A.8.2: 'approval gate non-trainer operator'
  severity Medium
  Where. docs/qms/statement_of_applicability.md:110 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:111) · type: misleading
  The document says. A.8.2: 'approval gate non-trainer operator'
  What the code does. The gate does not require a non-trainer operator. A.5.3 in this same SoA states correctly that ForgeLM does not reject self-approval.
  Code references. forgelm/cli/subcommands/_approve.py:597-621
  Proposed correction. "approver identity recorded (non-trainer enforced at IdP)"
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D1B06-024 (docs, Medium) — docs/qms/statement_of_applicability.md: wrong detail — A.8.13: forgelm --compliance-export ZIP
  severity Medium
  Where. docs/qms/statement_of_applicability.md:121 (Turkish mirror: docs/qms/statement_of_applicability-tr.md:122) · type: wrong detail
  The document says. A.8.13: forgelm --compliance-export ZIP
  What the code does. --compliance-export writes a directory of files. No ZIP is produced on any CLI path.
  Code references. forgelm/cli/_no_train_modes.py:248-262, forgelm/compliance.py:2299
  Proposed correction. "forgelm --compliance-export DIR artefact directory"
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}