Verify five README claims against code and config

Context

These must be checked by reading the code or running something before the README edits are applied:

Does the audit log genuinely exist? (api/services/audit.py, the audit_log table)
What does Terraform actually deploy for the database? (infra/*.tf)
What is the real Tier P/I/S/E scenario split? (evals/scenarios/; CI run 40182260409 shows P 23, I 1, S 1, E 1)
Is FastAPI pinned? (api/requirements.txt)
Does docs/VCRM.md align with the DID-V&V-DEF-VCRM content?

Each claim is marked confirmed, corrected or removed, with file or run evidence quoted.

Automated verification: FAIL (verify_issues.py, 2026-10-25)

no decision recorded: no comment from the owner and the issue is open. Evidence gathered so far is in the comment below.

Evidence gathered on 2026-10-25 against main @ 269ffe2 (file reads, not runs):

Audit log: audit_log exists (api/db.py:215, GET /api/audit/log in api/routers/audit_routes.py) but records deletions only. Upload audit (api/services/audit.py) is not on main; it arrives with PR Gap remediation pass O-01..O-12 and ADR-0001 #44. README line 29 ("every import is registered") describes the csv_files registry, not audit_log.
Terraform DB: the dev stack (infra/terraform/main.tf:179) runs PostgreSQL as an Azure Container App; prod, test and staging use azurerm_postgresql_flexible_server. Test and staging are code only (One-time cloud setup needed before infra/terraform-test and infra/terraform-staging can be applied #31).
Tier split: evals/datasets/ on main has tier_p 23, tier_i 1, tier_s 1. Tier E (1 scenario) is on PR Gap remediation pass O-01..O-12 and ADR-0001 #44. CI run 40182260409 shows 23/1/1/1.
FastAPI pinning: pinned to a range, fastapi>=0.140.7,<0.142.0, but the README badge says "FastAPI-latest". Mismatch.
VCRM vs DID-V&V-DEF-VCRM: not verifiable here; the DID content is not in the repo.

Generated by Claude Code

Verification run 2026-10-26 against main @ 59aab1a. These were checked by code read; none were exercised against a database.

#	Claim (4 Oct decision ref)	Finding	Resolves to
1	Audit log exists (1.1, D)	True. `api/services/audit.py` writes an `audit_log` row for every mutating action, including uploads (`record_audit` in `csv_routes.py:87`). `GET /api/audit/log` pages it. Row counts and timestamps are also in the `csv_files` registry (`GET /api/csv/files`). The README API table still calls it "Paginated deletion history" (README:146), which is stale.	Per the 1.1 record, "if true": fix the API table description
2	What Terraform deploys for the DB (1.3, D)	`infra/terraform/main.tf` deploys `postgres:16-alpine` as a Container App. A comment at line 177 says to migrate to Azure Database for PostgreSQL Flexible Server for prod. `terraform-prod`, `-staging` and `-test` were not inspected.	Rewrite per 1.3 once the prod Terraform is checked
3	Tier P/I/S split (3.1, A)	`evals/datasets`: Tier P 23, I 1, S 1, E 1, X 1 (27 scenarios). The path is `evals/`, not `eval/scenarios/`.	Use these counts
4	FastAPI pinned (3.2, A)	Range-pinned: `fastapi>=0.140.7,<0.142.0` in `api/requirements.txt`. The README badge says "FastAPI-latest" (README:9).	Badge contradicts the pin
5	VCRM.md vs DID-V&V-DEF-VCRM	Not checked. The DID content is not in the repo.	Still open

The README wording changes are #58 and are the product owner's call.

Generated by Claude Code