65ce7687 shipped config/fields.php without its account and forum sections. The fields unit of the 6.3 update reads a named file as the 6.3 format and requires each of its three areas to be a definition list, so a 6.2 site without a field configuration of its own stopped with a refusal before its schema ran.

Core changes:

1. Shipped field definitions (config/fields.php):

2. account and forum ship as empty definition lists instead of being absent

   • The demo fields stay removed; order keeps its example with field1 not required

Benefits:

• The 6.2 update finishes on the first run again (UpdateSiteTest)
• A clean installation carries no demo profile or forum fields

Technical notes:

• Configuration only; setUpdateFields() in setup/index.php is unchanged
• The stand keeps its own config/fields.php, only the shipped copy changes

The Node plan left open records outside its acceptance: defects of shop, order, forum, account, the core and the installer that its windows met and were not allowed to fix. This commit closes all of them in ten batches, each with a test that fails without its fix, and widens the gates so the code rules and the tooling hold.

Core changes:

1. Shipped configuration and admin security (config/, admin/modules/.php, modules//admin/index.php):
2. The debug panel ships closed (var_view 0) and getVariables() escapes every value
3. The test bans of the stand leave config/security.php; the demo fields of account and forum leave config/fields.php

4. Every state-changing admin handler checks checkAdminPost() with its module scope; row actions post

   • GET, header and query tokens are refused, AdminGuardTest scans every admin file
5. The admin file rename accepts a plain name only and reports a failed rename
6. Form fields named name are renamed, category parents refuse cycles, setForumLast() ends on a stored cycle
7. Shop, order, forum and contact (modules/shop, order, forum, money, contact):
8. The checkout reads the cart through getCartCookie() and clears it with setCookiesDelete()
9. getTplPager() takes a known count; the product list qualifies p.status; mass actions split categories and modes
10. Point compensations roll the owner back on false, as docs/POINTS.md now describes
11. The CSV import leaves votes and comments alone, opens only files of its own directory, and stops repeating the id
12. Settings texts of shop, order, money and contact use the editor field and the breaks format, so a save is stable
13. Core writes, cache and templates (core/classes/template.php, pdo.php, cache.php, comment.php, core/system.php):
14. Compiled templates and scheduler state files are written through a temporary file and a rename under a lock
15. The panel bumps the page cache on its first write and once more at shutdown; _session writes no longer bump
16. Comment::updateBody() and the deferred recount run under the write guard; silent failures log their reason
17. Cache::setDirPath() creates every cache directory and tolerates a lost mkdir race
18. Node (core/classes/node/*.php, modules/node/):
19. getTreeRows() limits replies per root in one light walk; batch sizes follow NodeQuery::getTargetSize()
20. Comment::getThread() reads a support thread at once; stored types normalise a late rule on read
21. view.mode is a closed list, the report switch follows the mode, categories and sitemap follow the language
22. A non-moderator without pre-moderation gets no external address field; import failures answer their reason
23. Installer and the 6.3 update (setup/index.php, setup/sql/table_update6_3.sql):
24. Duplicate rating rows are removed before the unique key, the 6.2 loader is replaced by the shipped panel
25. checkSetupCode() counts failures under a lock and removes the key after the fifth

26. The update carries an early 6.2 schema, NULL addresses, negative balances and MySQL 8 zero dates

    • New fixture tests/Fixtures/update62early; the fixtures' site.sql is kept by .gitignore
27. Interface and language (templates/, lang/, plugins/system/slaed.js):
28. Favourite buttons post without an href, POST-only ops answer 405, the admin pager shows its total
29. _BACK means back in Polish and Ukrainian; the rating widget reads the checked rule and answers blocked scopes
30. The forum repair of counters is a POST button; auto_links reads banners of the site theme
31. Code rules sweep (whole tree, tests/PhpFileFormatTest.php, .php-cs-fixer.dist.php):
32. Comments leave function bodies, one line above a class, no period, no Cyrillic, 180 characters per line
33. list_syntax and indentation_type join the fixer; shop and whois are indented with spaces
34. Gate tooling (tools/ui-shots.mjs, tests/Support/tree_walk.php, tests/bootstrap.php, tools/upload-route-check.php):
35. ui-shots signs the modes in one after another with one retry; --before --only keeps the rest of the pair
36. Every source gate walks the tree through getTreeFiles(), which never enters storage or a scratch theme
37. In-process tests log into a directory of their run instead of the site log of the stand
38. setFailTrigger() is defined again; PointTest and RatingTest fail on a broken probe instead of skipping

Benefits:

• A clean installation no longer exposes cookies and sessions or carries test bans
• Admin state changes need a POST of their own scope
• The full suite and ui:gates can run side by side without false failures

Technical notes:

• Schema: table_update6_3.sql removes duplicate _rating rows and aligns the early 6.2 column shapes

• API: getTplPager() accepts count, NodeQuery::getTargetSize(), NodeQuery::MODES, Comment::getThread(), Rating::getRule() and the blocked code 503, Point::$active readable, checkCatRight() replaces checkCatRead()

• Breaking: admin handlers refuse tokens outside a POST of their scope; a stored forum or category cycle is refused on save; view.mode support requires the support extension

The third audit (S21) and the fourth (S22) of the Node implementation were split into fix windows; the final acceptance of S22.6 opened S23, which proved its two findings unreachable. Every finding was re-checked in code before its fix, and every fork was decided by the project owner.

Core changes:

1. Security of Node - S21.1, S22.3 (core/system.php, modules/node/index.php, core/classes/node/service.php, core/user.php):

2. addAdminMail() escapes the material title; the form offers only categories the writer may view and post into (NodeQuery::getNodePostCats()), and the writer checks pview and ppost itself

3. Relations and the parent must be readable targets, so preview is no oracle for hidden or scheduled materials

4. addFavorite and deleteFavorite are POST-only with the token in X-CSRF-TOKEN; the profile import checks the extension

5. op=asset redirects to an external address only for the link and download roles, and a non-moderator sets a new external address only in a material that goes to pre-moderation

6. Installer and the 6.3 update - S21.2, S22.1, S22.2 (setup/index.php, setup/sql/table_update6_3.sql, config/modules.php, UPGRADING.md):

7. config/setup.unlock carries an owner code of at least 8 characters, verified by password_verify() before the first write and replaced by its hash on the first request

8. update6_3 removes the shipped types without a _node_types row, renames the shipped admin.php to the entered name, keeps the language and address of the 6.2 site and switches off the blocks of the removed modules

9. setConfigFile() results are checked, a failed module SQL leaves no modules mark

10. Found on a real 6.2 schema: the UNIQUE key mid_modul_uid of _rating is dropped, whois.hometext becomes body before MODIFY, admins.editor NULL becomes 0, and the _nodes counter reads the auto_increment column of the old tables

11. The clients module ships without a group; UPGRADING.md lists what the update changes in the data
12. Model integrity - S21.3, S22.3 (core/classes/node/service.php, core/classes/comment.php, core/classes/node/ext/sync.php, admin/modules/categories.php):
13. Deleting a category takes its whole subtree; stored category loops no longer spin forms, screens or RSS
14. A type cannot switch off categories, tree or related while it holds such data
15. A moderator's own report earns no report points; a replaced resource loses its metadata and hits

16. The profile comment count follows the visibility of the feed; the sync extension refuses features.submit; deleteNode() reads the material before BEGIN

17. Routes, head and page cache - S21.4, S22.4 (modules/node/index.php, core/system.php, templates/lite/index.php, blocks/node.php):
18. Reader refusals answer their status code, a page past the list bound answers 404
19. Flash notices show on public pages; the FAQ marquee binds the cached page to its deadline

20. Header and breadcrumb categories follow the read right; canonical of the start page with a category or page is the type address; letter navigation keeps the category; report is limited to download and link roles, the published order is open to every type, feeds come from getRssFeeds()

21. Code rules - S21.5, S22.5 (core, modules, setup, admin, tests/PhpFileFormatTest.php):
22. Wrapped # comments are rewritten as independent lines and PhpFileFormatTest refuses new ones

23. Redundant casts are removed; code comments name docs/NODE.md, docs/POINTS.md and docs/RATINGS.md instead of the retired plan and its stage ids

24. Tests - S22.2, S22.6, S23 (tests/Fixtures/update62, tests/Unit/UpdateSiteTest.php, tests/Support/.php, tests/Unit/.php):

25. tests/Fixtures/update62 is an invented 6.2 site on the real 6.2 DDL; UpdateSiteTest runs the installer update over it in every phpunit run

26. The first administrator of the update probe gets the probe address; an author who does not moderate the type is refused by updateNode(), also when moderating another type

Benefits:

• The update is proven on a real 6.2 schema instead of a stand already migrated by earlier builds

• Every finding of the third and fourth audits is fixed; the open remainder is planned in docs/NODE-FINDINGS-2026.md

Technical notes:

• Schema: table_update6_3.sql drops mid_modul_uid of _rating and repairs whois and admins before MODIFY; table.sql unchanged in structure

• API: getLetterNavi(string $mod, int $cat = 0); NodeQuery::getNodePostCats(); getFavoriteList readable without token; checkTypeAssets() becomes checkTypeStore()

• Breaking: addFavorite and deleteFavorite accept only POST; a type cannot switch off categories, tree or related while data uses them; op=asset of image, gallery, player and none roles answers 404 for external addresses

• config/security.php is not part of this commit; the shipped secret stays empty

• Verification: php -l, phpstan, php-cs-fixer check, full phpunit 1558 tests with 22872 assertions and 7 environment skips, npm run ui:gates 234 tests

The second audit of stages S00-S19.8 split its findings into eight fix windows. This commit carries all of them: every finding was re-checked in code before its fix, the forks the contracts left open were decided by the user and written into the owning documents, and the plan of docs/node is complete.

Core changes:

1. Public form security - S20.1 (modules/node/index.php, core/classes/node/query.php, core/classes/node/service.php):

2. A guest passes the comment captcha on every POST before any file is read; uploads of the public form need checkEditorUploadAccess() and respect the role max and maxfiles, inactive and link roles take no file

3. A new per-IP window limits.send (60 seconds) answers NodeException::LIMITED with 429, the moderator of the type is exempt; a closed category answers 404 through NodeQuery::checkNodeCategory()

4. Search titles of Node are decoded once and escaped once
5. Installer and 6.3 update - S20.2 (setup/index.php, core/classes/pdo.php, setup/lang, UPGRADING.md):

6. The form never prints the database password, an empty field keeps the stored one, a refusal keeps config/setup.unlock

7. The table prefix must match [A-Za-z0-9_]{1,32} and the admin file name goes through filterVar()

8. setUpdateModules() keeps the switches a 6.2 site stored in _modules over the shipped config/modules.php; checkUpdateBase() refuses a clean install over existing tables of the prefix and an update without _users and _admins

9. Integrity of comments, points and categories - S20.3 (core/classes/comment.php, core/classes/node/service.php, admin/modules/categories.php):
10. deleteNode() refuses with STORAGE when Point cannot confirm the compensation of an award

11. A premoderated comment of a Node material locks the material; NodeService::checkTypeRegistry() guards the category screen, which now answers _ERROR_UP instead of a raw SQL failure

12. Document tree - S20.4 (modules/node/index.php, templates/lite, setup/sql):

13. A type with features.tree shows the tree of its documents with the current node, previous and next links and a paged remainder, read in batches of NodeQuery::TREEPART

14. _nodes gets the index tree (tid, status, id) in table.sql and table_update6_3.sql
15. The moderate action and small rendering fixes - S20.5 (core/classes/node/service.php, core/classes/comment.php, core/classes/node/view.php):

16. Approving a material, a comment or an asset report writes a Point event moderate with the aid of the moderator; comment event scopes live in one place

17. NodeView renders only card for a NodeTarget, the unused fragment node/search.html is removed, the sitemap reads Node in batches of limits.syncbatch, related cards no longer count views

18. Display modes - S20.6 (modules/node/index.php, templates/lite, tools/ui-contract.php):
19. docs, faq, files and media get their own card and view templates, media also its list

20. Cards and og:image prefer the poster role, the list card carries download, every view gets download_label and hits_label

21. Code rules and consolidation - S20.7 (core/system.php, modules/node, core/classes, admin/modules, setup/index.php, tools/node-profile.php):

22. getNodeReader(), getNodeWriter() and addNodeMail() live in the core next to getNodeHandler(); support and admin mail go through addNodeMail()

23. render_blocks() becomes setBlockView(int $bid); arrow functions and parameters of the plan code are typed, redundant casts are removed

24. Plan documents - S20.8 (docs/node):

25. Status lines, the test structure of 13 and 02, the NodeContext and target signatures of 05, the cover label of 06 and the module tree of 04 follow the code

Benefits:

• Every finding of the second audit is fixed or recorded with its reason in docs/node/PROGRESS.md
• Promised but missing features of the plan - the document tree, moderate and display modes - are shipped

Technical notes:

• Schema: KEY tree (tid, status, id) on _nodes in table.sql and table_update6_3.sql
• Config: config/node.php gets limits.send = 60; NodeException gains LIMITED = 6

• API: render_blocks() is replaced by setBlockView(int $bid); getConst() resolves only names with a leading underscore; checkUpdateBase() takes bool $fresh; NodeService::checkTypeRegistry() is new; getNodeReader(), getNodeWriter() and addNodeMail() are core functions

• Breaking: the installer refuses a prefix outside [A-Za-z0-9_]{1,32}, so a 6.2 site with such a prefix cannot pass the update; the theme fragment fragments/node/search.html is gone; NodeView accepts only card for targets

The audit of stages S00-S18 read the implementation in seven slices against the Node contracts and the project rules. Its findings enter the plan as stage S19, split into eight windows S19.1-S19.8, so each fix follows the same one-window-one-stage protocol and closes with its own verification.

Core changes:

1. Roadmap cards (docs/node/14-roadmap.md):

2. An S19 introduction: where the findings come from, lines pinned to 70224f65, each finding re-checked in code before a fix, and two decisions asked of the user before code

3. Eight cards with dependency, reading list, findings with file:line and function, files and acceptance

   • S19.1 input and output security: Node title XSS in search, field save over GET or a truncated POST,

Node delete without the type check, favorite point farming, Node categories outside the service

• S19.2 the 6.3 update: the site stays open because config/local.php outlives close, DDL errors do not stop

the branch, newsletter recipients, the MariaDB 10.5.2 floor, the 6.2 Pro configuration format

• S19.3 data integrity, S19.4 cache and locks, S19.5 rendering, S19.6 read performance, S19.7 leftovers

of the nine removed modules, S19.8 code rules

1. Progress (docs/node/PROGRESS.md):
2. Eight not-started rows in the stage table; the protocol ends the plan after S19.8

3. The handoff block names S19.1 as the next window, records the check results at audit time and drops the stale note that S17-S18 were uncommitted

Benefits:

• Every audit finding has an owner window, a verification and a place in the plan instead of the chat
• Open product decisions are marked as such and cannot be settled silently by an executor

Technical notes:

• Documentation only; no code, schema or configuration changes