Safe application logging

Request or response bodies and provider credentials must never be logged. Exception messages may contain secrets; only fixed safe error identifiers and validated non-secret correlation/profile/version identifiers belong in logs. Ordinary Drupal logging is best effort and is not durable audit evidence.

A mapped review-result expiry keeps HTTP 410 review_result_expired and records the expected expired lifecycle outcome at Info, including HEAD responses. Authentication/authorization failures, ordinary missing results and server failures retain Error severity. Logging failure does not change the response.