The third audit (S21) and the fourth (S22) of the Node implementation were split into fix windows; the final acceptance of S22.6 opened S23, which proved its two findings unreachable. Every finding was re-checked in code before its fix, and every fork was decided by the project owner.

Core changes:

1. Security of Node - S21.1, S22.3 (core/system.php, modules/node/index.php, core/classes/node/service.php, core/user.php):

2. addAdminMail() escapes the material title; the form offers only categories the writer may view and post into (NodeQuery::getNodePostCats()), and the writer checks pview and ppost itself

3. Relations and the parent must be readable targets, so preview is no oracle for hidden or scheduled materials

4. addFavorite and deleteFavorite are POST-only with the token in X-CSRF-TOKEN; the profile import checks the extension

5. op=asset redirects to an external address only for the link and download roles, and a non-moderator sets a new external address only in a material that goes to pre-moderation

6. Installer and the 6.3 update - S21.2, S22.1, S22.2 (setup/index.php, setup/sql/table_update6_3.sql, config/modules.php, UPGRADING.md):

7. config/setup.unlock carries an owner code of at least 8 characters, verified by password_verify() before the first write and replaced by its hash on the first request

8. update6_3 removes the shipped types without a _node_types row, renames the shipped admin.php to the entered name, keeps the language and address of the 6.2 site and switches off the blocks of the removed modules

9. setConfigFile() results are checked, a failed module SQL leaves no modules mark

10. Found on a real 6.2 schema: the UNIQUE key mid_modul_uid of _rating is dropped, whois.hometext becomes body before MODIFY, admins.editor NULL becomes 0, and the _nodes counter reads the auto_increment column of the old tables

11. The clients module ships without a group; UPGRADING.md lists what the update changes in the data
12. Model integrity - S21.3, S22.3 (core/classes/node/service.php, core/classes/comment.php, core/classes/node/ext/sync.php, admin/modules/categories.php):
13. Deleting a category takes its whole subtree; stored category loops no longer spin forms, screens or RSS
14. A type cannot switch off categories, tree or related while it holds such data
15. A moderator's own report earns no report points; a replaced resource loses its metadata and hits

16. The profile comment count follows the visibility of the feed; the sync extension refuses features.submit; deleteNode() reads the material before BEGIN

17. Routes, head and page cache - S21.4, S22.4 (modules/node/index.php, core/system.php, templates/lite/index.php, blocks/node.php):
18. Reader refusals answer their status code, a page past the list bound answers 404
19. Flash notices show on public pages; the FAQ marquee binds the cached page to its deadline

20. Header and breadcrumb categories follow the read right; canonical of the start page with a category or page is the type address; letter navigation keeps the category; report is limited to download and link roles, the published order is open to every type, feeds come from getRssFeeds()

21. Code rules - S21.5, S22.5 (core, modules, setup, admin, tests/PhpFileFormatTest.php):
22. Wrapped # comments are rewritten as independent lines and PhpFileFormatTest refuses new ones

23. Redundant casts are removed; code comments name docs/NODE.md, docs/POINTS.md and docs/RATINGS.md instead of the retired plan and its stage ids

24. Tests - S22.2, S22.6, S23 (tests/Fixtures/update62, tests/Unit/UpdateSiteTest.php, tests/Support/.php, tests/Unit/.php):

25. tests/Fixtures/update62 is an invented 6.2 site on the real 6.2 DDL; UpdateSiteTest runs the installer update over it in every phpunit run

26. The first administrator of the update probe gets the probe address; an author who does not moderate the type is refused by updateNode(), also when moderating another type

Benefits:

• The update is proven on a real 6.2 schema instead of a stand already migrated by earlier builds

• Every finding of the third and fourth audits is fixed; the open remainder is planned in docs/NODE-FINDINGS-2026.md

Technical notes:

• Schema: table_update6_3.sql drops mid_modul_uid of _rating and repairs whois and admins before MODIFY; table.sql unchanged in structure

• API: getLetterNavi(string $mod, int $cat = 0); NodeQuery::getNodePostCats(); getFavoriteList readable without token; checkTypeAssets() becomes checkTypeStore()

• Breaking: addFavorite and deleteFavorite accept only POST; a type cannot switch off categories, tree or related while data uses them; op=asset of image, gallery, player and none roles answers 404 for external addresses

• config/security.php is not part of this commit; the shipped secret stays empty

• Verification: php -l, phpstan, php-cs-fixer check, full phpunit 1558 tests with 22872 assertions and 7 environment skips, npm run ui:gates 234 tests

The second audit of stages S00-S19.8 split its findings into eight fix windows. This commit carries all of them: every finding was re-checked in code before its fix, the forks the contracts left open were decided by the user and written into the owning documents, and the plan of docs/node is complete.

Core changes:

1. Public form security - S20.1 (modules/node/index.php, core/classes/node/query.php, core/classes/node/service.php):

2. A guest passes the comment captcha on every POST before any file is read; uploads of the public form need checkEditorUploadAccess() and respect the role max and maxfiles, inactive and link roles take no file

3. A new per-IP window limits.send (60 seconds) answers NodeException::LIMITED with 429, the moderator of the type is exempt; a closed category answers 404 through NodeQuery::checkNodeCategory()

4. Search titles of Node are decoded once and escaped once
5. Installer and 6.3 update - S20.2 (setup/index.php, core/classes/pdo.php, setup/lang, UPGRADING.md):

6. The form never prints the database password, an empty field keeps the stored one, a refusal keeps config/setup.unlock

7. The table prefix must match [A-Za-z0-9_]{1,32} and the admin file name goes through filterVar()

8. setUpdateModules() keeps the switches a 6.2 site stored in _modules over the shipped config/modules.php; checkUpdateBase() refuses a clean install over existing tables of the prefix and an update without _users and _admins

9. Integrity of comments, points and categories - S20.3 (core/classes/comment.php, core/classes/node/service.php, admin/modules/categories.php):
10. deleteNode() refuses with STORAGE when Point cannot confirm the compensation of an award

11. A premoderated comment of a Node material locks the material; NodeService::checkTypeRegistry() guards the category screen, which now answers _ERROR_UP instead of a raw SQL failure

12. Document tree - S20.4 (modules/node/index.php, templates/lite, setup/sql):

13. A type with features.tree shows the tree of its documents with the current node, previous and next links and a paged remainder, read in batches of NodeQuery::TREEPART

14. _nodes gets the index tree (tid, status, id) in table.sql and table_update6_3.sql
15. The moderate action and small rendering fixes - S20.5 (core/classes/node/service.php, core/classes/comment.php, core/classes/node/view.php):

16. Approving a material, a comment or an asset report writes a Point event moderate with the aid of the moderator; comment event scopes live in one place

17. NodeView renders only card for a NodeTarget, the unused fragment node/search.html is removed, the sitemap reads Node in batches of limits.syncbatch, related cards no longer count views

18. Display modes - S20.6 (modules/node/index.php, templates/lite, tools/ui-contract.php):
19. docs, faq, files and media get their own card and view templates, media also its list

20. Cards and og:image prefer the poster role, the list card carries download, every view gets download_label and hits_label

21. Code rules and consolidation - S20.7 (core/system.php, modules/node, core/classes, admin/modules, setup/index.php, tools/node-profile.php):

22. getNodeReader(), getNodeWriter() and addNodeMail() live in the core next to getNodeHandler(); support and admin mail go through addNodeMail()

23. render_blocks() becomes setBlockView(int $bid); arrow functions and parameters of the plan code are typed, redundant casts are removed

24. Plan documents - S20.8 (docs/node):

25. Status lines, the test structure of 13 and 02, the NodeContext and target signatures of 05, the cover label of 06 and the module tree of 04 follow the code

Benefits:

• Every finding of the second audit is fixed or recorded with its reason in docs/node/PROGRESS.md
• Promised but missing features of the plan - the document tree, moderate and display modes - are shipped

Technical notes:

• Schema: KEY tree (tid, status, id) on _nodes in table.sql and table_update6_3.sql
• Config: config/node.php gets limits.send = 60; NodeException gains LIMITED = 6

• API: render_blocks() is replaced by setBlockView(int $bid); getConst() resolves only names with a leading underscore; checkUpdateBase() takes bool $fresh; NodeService::checkTypeRegistry() is new; getNodeReader(), getNodeWriter() and addNodeMail() are core functions

• Breaking: the installer refuses a prefix outside [A-Za-z0-9_]{1,32}, so a 6.2 site with such a prefix cannot pass the update; the theme fragment fragments/node/search.html is gone; NodeView accepts only card for targets

The audit of stages S00-S18 read the implementation in seven slices against the Node contracts and the project rules. Its findings enter the plan as stage S19, split into eight windows S19.1-S19.8, so each fix follows the same one-window-one-stage protocol and closes with its own verification.

Core changes:

1. Roadmap cards (docs/node/14-roadmap.md):

2. An S19 introduction: where the findings come from, lines pinned to 70224f65, each finding re-checked in code before a fix, and two decisions asked of the user before code

3. Eight cards with dependency, reading list, findings with file:line and function, files and acceptance

   • S19.1 input and output security: Node title XSS in search, field save over GET or a truncated POST,

Node delete without the type check, favorite point farming, Node categories outside the service

• S19.2 the 6.3 update: the site stays open because config/local.php outlives close, DDL errors do not stop

the branch, newsletter recipients, the MariaDB 10.5.2 floor, the 6.2 Pro configuration format

• S19.3 data integrity, S19.4 cache and locks, S19.5 rendering, S19.6 read performance, S19.7 leftovers

of the nine removed modules, S19.8 code rules

1. Progress (docs/node/PROGRESS.md):
2. Eight not-started rows in the stage table; the protocol ends the plan after S19.8

3. The handoff block names S19.1 as the next window, records the check results at audit time and drops the stale note that S17-S18 were uncommitted

Benefits:

• Every audit finding has an owner window, a verification and a place in the plan instead of the chat
• Open product decisions are marked as such and cannot be settled silently by an executor

Technical notes:

• Documentation only; no code, schema or configuration changes

Stages S14 to S16 of docs/node connect the registered Node types to the rest of the system: comments and the private requests of the support extension, the external materials of the sync extension with their scheduler job, and every remaining shared owner - the rating of node.<name>, favorites, polls, search, RSS, the sitemap, the file block and the figures of the showcase. The shared code names no type: each integration is switched on by the settings of the type.

Core changes:

1. Comments and support (core/classes/comment.php, core/classes/node/ext/support.php, modules/node/):

2. Comment resolves a Node target through NodeQuery and keeps comnum, the extension reaction and the points of it

   • the lists outside the target page leave out comments of materials the viewer may not read

3. NodeSupport is the ticket system: owner scope, waiting side, priority, assignment, mail through the queue

   • the owner closes and reopens, the moderator works the card and the queue in the administration
4. External materials (core/classes/node/ext/sync.php, core/classes/feed.php, config/scheduler.php, setup/index.php):

5. NodeSync keeps one source per material and writes the body only on a changed answer, under a version condition

   • the nodesync job checks due sources, a failure waits with a growing delay
6. Feed::getFeedUrl() is public so the stored address is exactly the one Feed requests
7. Rating and favorites (core/system.php, core/user.php, core/classes/node/service.php, admin/modules/ratings.php):

8. The scope node.<name> is resolved through Node; the new NodeService::getLockedTarget() locks the type and the material before anything is read, so two concurrent votes never end in a storage failure

   • the extension may refuse a vote and follows a stored one in the same transaction; Point takes no part

9. A favorite of a material is one transaction with the rights, the feature and the extension of its type

   • the lists read the titles through getNodeTitleMap() and hide what the viewer may not read
   • deleting a material deletes its favorites
10. Polls, search, RSS and sitemap (modules/voting, modules/search, modules/rss, modules/sitemap, core/system.php):
11. Deleting a poll clears the links of its materials through NodeService::deleteNodePoll() under the named poll lock

12. Search, RSS and the sitemap read the types whose own integration is on; the search and sitemap screens toggle it inside the type through updateNodeTypePart()

13. The sitemap is written as it is produced, a new file after 50000 URLs, Node materials in cursor batches of 500 read as a guest, addresses escaped for XML; the HTML map shows a type with its open categories

14. Blocks and figures (blocks/node.php, admin/modules/blocks.php, setup/sql/, modules/presentation, admin/modules/monitor.php):

15. One file block node.php takes type, mode and limit from the new column _blocks.param of its instance

    • getNodeBlockParam() checks it on save and on output; an invalid instance stays off

16. The showcase, the monitor tiles and the header marquee of the lite theme find their type by view.mode through getNodeModeType()

Benefits:

• Every shared subsystem reaches Node through one reader and one writer, with the rights and the extension of the type
• Votes, favorites and poll links are single transactions that roll back as a whole
• The sitemap no longer holds the whole site in memory

Technical notes:

• BREAKING: _blocks gains param VARCHAR(255) NOT NULL DEFAULT ''; setup/sql/insert.sql and table_update6_3.sql carry it, INSERT INTO _blocks without a column list needs the new value

• BREAKING: render_blocks() takes a last parameter $param; getSearchList() in modules/search takes the total count

• New tests: NodeSupportTest, NodeSyncTest and NodeIntegTest drive real HTTP on disposable MariaDB databases; the full suite keeps the one earlier failure of CommentIsolationTest on a demo string of modules/presentation

• config/fields.php and config/security.php of the stand are not part of this commit

Stage S06 of the Node plan. The positional extra fields of account, forum and order give way to one shared, stateless Field class: a closed registry of ten types, an atomic check of definitions, one normalization behind the check and the filter, and values stored as one canonical JSON object per row. The 6.3 data update converts the old definitions and every stored value without guessing, and the running system knows the new format only.

Core changes:

1. Shared class (core/classes/field.php, core/system.php):

2. final class Field with six public methods, no constructor and no state

   • getFieldTypeList, filterFieldList, checkFieldValues, filterFieldValues, getFieldForm, getFieldView
   • a refused definition set throws InvalidArgumentException with the path of its first error
   • six machine codes for a refused value: required, type, format, choice, min, max
   • hard ceilings no option raises: 256 definitions, 256 options, 64 choices, 1 MiB of JSON
3. getFieldView() calls the parser in its safe mode, because values are stored as raw text
4. one global instance $fld
5. Owners and helpers (core/helpers.php, modules/account, modules/forum, modules/order, core/security.php):

6. getFieldRules() reads the definitions and getFieldsPost() writes the values, both behind the update.fields mark

   • without the mark no form shows a field and a save hands the stored text back untouched
   • a set that fails the shared check keeps the stored values as well
   • posted texts lose [usehtml] and [usephp] at storage, the tag being the capability itself
   • a switched off field keeps its value through a save, a stored name without a definition is dropped
7. getFieldsInRows, getTplFieldsIn, getTplAddFieldRows and getTplViewFieldRows rebuilt on the class
8. the hand-made form builder of the account administration and the field filter of getVar() are gone
9. the forum prints the rendered field rows as they are and no longer hands them to a trusted parse
10. Field manager (admin/modules/fields.php, admin/lang, lang):
11. structured definitions per area, select options as a table, stored names, option keys and types locked
12. a refused set comes back with the path of its first error and the posted text, the file stays untouched
13. six FIELDS messages in six site locales, twelve FIELDS captions and a new _FIELDINFO in six admin locales
14. Data update (setup/index.php, setup/sql/table.sql, setup/sql/table_update6_3.sql):

15. setUpdateFields() with getUpdateRules() and getUpdateValue() runs after the ratings unit

    • a preflight of every definition and every row before the first write, reported by table, id and reason
    • keys field1..N and option1..N by original position, the full and the short layout, one confirmed result
    • a 0 in a select, date or datetime position is the placeholder of an empty choice and becomes absence
    • batches of 500 by cursor, each row equal to its source or its target, resumable from its manifest

16. users.field, forum.field and order.info are MEDIUMTEXT in the fresh schema and in the reconciling MODIFY statements, which used to set them back to TEXT on every run

17. the installer writer keeps native types on request, as the definitions need bool, int and null
18. Tests (tests/Unit, tests/Support):

19. FieldTest, FieldViewTest and UpdateFieldsTest; update_probe.php gets the fields unit, contract_probe.php the fieldpost scenario; EditorRoomTest drops order.info

Benefits:

• one path for form, normalization, validation and view, shared by every present and future owner of fields
• stored values survive a disabled field, a refused set and a missing update mark
• the update never guesses: ambiguous data stops it with a report instead of a wrong meaning

Technical notes:

• BREAKING: config/fields.php holds named definition arrays, and users.field, forum.field and order.info hold JSON; a 6.2 site reaches this format only through the update6_3 branch of setup

• form controls are named field[<name>] instead of the positional field[]
• config/fields.php ships the former demo definitions in the new format
• no runtime reader of the positional format remains