[Wave 4] Low/info — Docs: docs/guides/gdpr_erasure.md #724

Wave 4 · 5 finding(s) in 5 fix package(s). One pass over this document; keep the Turkish mirror in sync.

Findings

• DOC-D2B02-052 (docs, Low) — docs/guides/gdpr_erasure.md: stale — The HMAC key derivation is at forgelm/compliance.py:104-114.
  severity Low
  Where. docs/guides/gdpr_erasure.md:41 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:41) · type: stale
  The document says. The HMAC key derivation is at forgelm/compliance.py:104-114.
  What the code does. compliance.py:104-114 holds verify-audit failure-class constants. The per-run HMAC key SHA-256(secret‖run_id) is derived around compliance.py:230-258.
  Code references. forgelm/compliance.py:230-258, forgelm/compliance.py:113-119
  Proposed correction. Cite forgelm/compliance.py AuditLogger.__init__ (HMAC key derivation) instead of a line range.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B02-053 (docs, Low) — docs/guides/gdpr_erasure.md: wrong detail — Step 5 emits the warning events, then step 6 writes data.erasure_completed.
  severity Low
  Where. docs/guides/gdpr_erasure.md:45 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:45-46) · type: wrong detail
  The document says. Step 5 emits the warning events, then step 6 writes data.erasure_completed.
  What the code does. Warning conditions are detected first, but data.erasure_completed is appended before the warning events. Reproduced order: requested, completed, memorisation, synthetic, external_copies.
  Code references. forgelm/cli/subcommands/_purge.py:660-684
  Proposed correction. Swap steps 5 and 6: "5. Writes data.erasure_completed… 6. Emits the matching warning events (each carries all completed fields)."
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B02-054 (docs, Low) — docs/guides/gdpr_erasure.md: misleading — --dry-run previews the deletion and emits the audit chain without modifying disk.
  severity Low
  Where. docs/guides/gdpr_erasure.md:50 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:50) · type: misleading
  The document says. --dry-run previews the deletion and emits the audit chain without modifying disk.
  What the code does. Dry-run leaves the corpus untouched. It still creates output_dir and the 0600 .forgelm_audit_salt file, and appends requested and completed (dry_run=true) events to audit_log.jsonl. It emits no warning events.
  Code references. forgelm/cli/subcommands/_purge.py:702-716, forgelm/cli/subcommands/_purge.py:585-618
  Proposed correction. "…without modifying the corpus (dry-run still creates <output_dir>/.forgelm_audit_salt and appends the intent events to audit_log.jsonl)."
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B02-058 (docs, Low) — docs/guides/gdpr_erasure.md: stale — Exit 1 also covers 'conflicting staging_ttl_days values'.
  severity Low
  Where. docs/guides/gdpr_erasure.md:112 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:112) · type: stale
  The document says. Exit 1 also covers 'conflicting staging_ttl_days values'.
  What the code does. evaluation.staging_ttl_days was removed and EvaluationConfig is extra='forbid', so no conflict can arise. Setting the old key is simply an unknown-field error. Reproduced with dry-run: exit 1, extra_forbidden.
  Code references. forgelm/config.py:1189, forgelm/config.py:1224-1226
  Proposed correction. Replace with "…a config that still sets the removed evaluation.staging_ttl_days…".
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-D2B02-059 (docs, Low) — docs/guides/gdpr_erasure.md: false claim — sop_data_management.md includes the retention and erasure procedures; usermanuals/en/compliance/overview.md links to this guide.
  severity Low
  Where. docs/guides/gdpr_erasure.md:178 (Turkish mirror: docs/guides/gdpr_erasure-tr.md:179-180) · type: false claim
  The document says. sop_data_management.md includes the retention and erasure procedures; usermanuals/en/compliance/overview.md links to this guide.
  What the code does. sop_data_management.md mentions neither erasure nor purge (§6 only says to retain training data for at least 5 years). overview.md contains no reference to purge or to the GDPR erasure page.
  Code references. docs/qms/sop_data_management.md:110-115
  Proposed correction. Drop both descriptions, or add the missing SOP subsection and overview link.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}