The second audit of stages S00-S19.8 split its findings into eight fix windows. This commit carries all of them: every finding was re-checked in code before its fix, the forks the contracts left open were decided by the user and written into the owning documents, and the plan of docs/node is complete.

Core changes:

1. Public form security - S20.1 (modules/node/index.php, core/classes/node/query.php, core/classes/node/service.php):

2. A guest passes the comment captcha on every POST before any file is read; uploads of the public form need checkEditorUploadAccess() and respect the role max and maxfiles, inactive and link roles take no file

3. A new per-IP window limits.send (60 seconds) answers NodeException::LIMITED with 429, the moderator of the type is exempt; a closed category answers 404 through NodeQuery::checkNodeCategory()

4. Search titles of Node are decoded once and escaped once
5. Installer and 6.3 update - S20.2 (setup/index.php, core/classes/pdo.php, setup/lang, UPGRADING.md):

6. The form never prints the database password, an empty field keeps the stored one, a refusal keeps config/setup.unlock

7. The table prefix must match [A-Za-z0-9_]{1,32} and the admin file name goes through filterVar()

8. setUpdateModules() keeps the switches a 6.2 site stored in _modules over the shipped config/modules.php; checkUpdateBase() refuses a clean install over existing tables of the prefix and an update without _users and _admins

9. Integrity of comments, points and categories - S20.3 (core/classes/comment.php, core/classes/node/service.php, admin/modules/categories.php):
10. deleteNode() refuses with STORAGE when Point cannot confirm the compensation of an award

11. A premoderated comment of a Node material locks the material; NodeService::checkTypeRegistry() guards the category screen, which now answers _ERROR_UP instead of a raw SQL failure

12. Document tree - S20.4 (modules/node/index.php, templates/lite, setup/sql):

13. A type with features.tree shows the tree of its documents with the current node, previous and next links and a paged remainder, read in batches of NodeQuery::TREEPART

14. _nodes gets the index tree (tid, status, id) in table.sql and table_update6_3.sql
15. The moderate action and small rendering fixes - S20.5 (core/classes/node/service.php, core/classes/comment.php, core/classes/node/view.php):

16. Approving a material, a comment or an asset report writes a Point event moderate with the aid of the moderator; comment event scopes live in one place

17. NodeView renders only card for a NodeTarget, the unused fragment node/search.html is removed, the sitemap reads Node in batches of limits.syncbatch, related cards no longer count views

18. Display modes - S20.6 (modules/node/index.php, templates/lite, tools/ui-contract.php):
19. docs, faq, files and media get their own card and view templates, media also its list

20. Cards and og:image prefer the poster role, the list card carries download, every view gets download_label and hits_label

21. Code rules and consolidation - S20.7 (core/system.php, modules/node, core/classes, admin/modules, setup/index.php, tools/node-profile.php):

22. getNodeReader(), getNodeWriter() and addNodeMail() live in the core next to getNodeHandler(); support and admin mail go through addNodeMail()

23. render_blocks() becomes setBlockView(int $bid); arrow functions and parameters of the plan code are typed, redundant casts are removed

24. Plan documents - S20.8 (docs/node):

25. Status lines, the test structure of 13 and 02, the NodeContext and target signatures of 05, the cover label of 06 and the module tree of 04 follow the code

Benefits:

• Every finding of the second audit is fixed or recorded with its reason in docs/node/PROGRESS.md
• Promised but missing features of the plan - the document tree, moderate and display modes - are shipped

Technical notes:

• Schema: KEY tree (tid, status, id) on _nodes in table.sql and table_update6_3.sql
• Config: config/node.php gets limits.send = 60; NodeException gains LIMITED = 6

• API: render_blocks() is replaced by setBlockView(int $bid); getConst() resolves only names with a leading underscore; checkUpdateBase() takes bool $fresh; NodeService::checkTypeRegistry() is new; getNodeReader(), getNodeWriter() and addNodeMail() are core functions

• Breaking: the installer refuses a prefix outside [A-Za-z0-9_]{1,32}, so a 6.2 site with such a prefix cannot pass the update; the theme fragment fragments/node/search.html is gone; NodeView accepts only card for targets

The audit of stages S00-S18 read the implementation in seven slices against the Node contracts and the project rules. Its findings enter the plan as stage S19, split into eight windows S19.1-S19.8, so each fix follows the same one-window-one-stage protocol and closes with its own verification.

Core changes:

1. Roadmap cards (docs/node/14-roadmap.md):

2. An S19 introduction: where the findings come from, lines pinned to 70224f65, each finding re-checked in code before a fix, and two decisions asked of the user before code

3. Eight cards with dependency, reading list, findings with file:line and function, files and acceptance

   • S19.1 input and output security: Node title XSS in search, field save over GET or a truncated POST,

Node delete without the type check, favorite point farming, Node categories outside the service

• S19.2 the 6.3 update: the site stays open because config/local.php outlives close, DDL errors do not stop

the branch, newsletter recipients, the MariaDB 10.5.2 floor, the 6.2 Pro configuration format

• S19.3 data integrity, S19.4 cache and locks, S19.5 rendering, S19.6 read performance, S19.7 leftovers

of the nine removed modules, S19.8 code rules

1. Progress (docs/node/PROGRESS.md):
2. Eight not-started rows in the stage table; the protocol ends the plan after S19.8

3. The handoff block names S19.1 as the next window, records the check results at audit time and drops the stale note that S17-S18 were uncommitted

Benefits:

• Every audit finding has an owner window, a verification and a place in the plan instead of the chat
• Open product decisions are marked as such and cannot be settled silently by an executor

Technical notes:

• Documentation only; no code, schema or configuration changes

Stages S14 to S16 of docs/node connect the registered Node types to the rest of the system: comments and the private requests of the support extension, the external materials of the sync extension with their scheduler job, and every remaining shared owner - the rating of node.<name>, favorites, polls, search, RSS, the sitemap, the file block and the figures of the showcase. The shared code names no type: each integration is switched on by the settings of the type.

Core changes:

1. Comments and support (core/classes/comment.php, core/classes/node/ext/support.php, modules/node/):

2. Comment resolves a Node target through NodeQuery and keeps comnum, the extension reaction and the points of it

   • the lists outside the target page leave out comments of materials the viewer may not read

3. NodeSupport is the ticket system: owner scope, waiting side, priority, assignment, mail through the queue

   • the owner closes and reopens, the moderator works the card and the queue in the administration
4. External materials (core/classes/node/ext/sync.php, core/classes/feed.php, config/scheduler.php, setup/index.php):

5. NodeSync keeps one source per material and writes the body only on a changed answer, under a version condition

   • the nodesync job checks due sources, a failure waits with a growing delay
6. Feed::getFeedUrl() is public so the stored address is exactly the one Feed requests
7. Rating and favorites (core/system.php, core/user.php, core/classes/node/service.php, admin/modules/ratings.php):

8. The scope node.<name> is resolved through Node; the new NodeService::getLockedTarget() locks the type and the material before anything is read, so two concurrent votes never end in a storage failure

   • the extension may refuse a vote and follows a stored one in the same transaction; Point takes no part

9. A favorite of a material is one transaction with the rights, the feature and the extension of its type

   • the lists read the titles through getNodeTitleMap() and hide what the viewer may not read
   • deleting a material deletes its favorites
10. Polls, search, RSS and sitemap (modules/voting, modules/search, modules/rss, modules/sitemap, core/system.php):
11. Deleting a poll clears the links of its materials through NodeService::deleteNodePoll() under the named poll lock

12. Search, RSS and the sitemap read the types whose own integration is on; the search and sitemap screens toggle it inside the type through updateNodeTypePart()

13. The sitemap is written as it is produced, a new file after 50000 URLs, Node materials in cursor batches of 500 read as a guest, addresses escaped for XML; the HTML map shows a type with its open categories

14. Blocks and figures (blocks/node.php, admin/modules/blocks.php, setup/sql/, modules/presentation, admin/modules/monitor.php):

15. One file block node.php takes type, mode and limit from the new column _blocks.param of its instance

    • getNodeBlockParam() checks it on save and on output; an invalid instance stays off

16. The showcase, the monitor tiles and the header marquee of the lite theme find their type by view.mode through getNodeModeType()

Benefits:

• Every shared subsystem reaches Node through one reader and one writer, with the rights and the extension of the type
• Votes, favorites and poll links are single transactions that roll back as a whole
• The sitemap no longer holds the whole site in memory

Technical notes:

• BREAKING: _blocks gains param VARCHAR(255) NOT NULL DEFAULT ''; setup/sql/insert.sql and table_update6_3.sql carry it, INSERT INTO _blocks without a column list needs the new value

• BREAKING: render_blocks() takes a last parameter $param; getSearchList() in modules/search takes the total count

• New tests: NodeSupportTest, NodeSyncTest and NodeIntegTest drive real HTTP on disposable MariaDB databases; the full suite keeps the one earlier failure of CommentIsolationTest on a demo string of modules/presentation

• config/fields.php and config/security.php of the stand are not part of this commit

Stage S06 of the Node plan. The positional extra fields of account, forum and order give way to one shared, stateless Field class: a closed registry of ten types, an atomic check of definitions, one normalization behind the check and the filter, and values stored as one canonical JSON object per row. The 6.3 data update converts the old definitions and every stored value without guessing, and the running system knows the new format only.

Core changes:

1. Shared class (core/classes/field.php, core/system.php):

2. final class Field with six public methods, no constructor and no state

   • getFieldTypeList, filterFieldList, checkFieldValues, filterFieldValues, getFieldForm, getFieldView
   • a refused definition set throws InvalidArgumentException with the path of its first error
   • six machine codes for a refused value: required, type, format, choice, min, max
   • hard ceilings no option raises: 256 definitions, 256 options, 64 choices, 1 MiB of JSON
3. getFieldView() calls the parser in its safe mode, because values are stored as raw text
4. one global instance $fld
5. Owners and helpers (core/helpers.php, modules/account, modules/forum, modules/order, core/security.php):

6. getFieldRules() reads the definitions and getFieldsPost() writes the values, both behind the update.fields mark

   • without the mark no form shows a field and a save hands the stored text back untouched
   • a set that fails the shared check keeps the stored values as well
   • posted texts lose [usehtml] and [usephp] at storage, the tag being the capability itself
   • a switched off field keeps its value through a save, a stored name without a definition is dropped
7. getFieldsInRows, getTplFieldsIn, getTplAddFieldRows and getTplViewFieldRows rebuilt on the class
8. the hand-made form builder of the account administration and the field filter of getVar() are gone
9. the forum prints the rendered field rows as they are and no longer hands them to a trusted parse
10. Field manager (admin/modules/fields.php, admin/lang, lang):
11. structured definitions per area, select options as a table, stored names, option keys and types locked
12. a refused set comes back with the path of its first error and the posted text, the file stays untouched
13. six FIELDS messages in six site locales, twelve FIELDS captions and a new _FIELDINFO in six admin locales
14. Data update (setup/index.php, setup/sql/table.sql, setup/sql/table_update6_3.sql):

15. setUpdateFields() with getUpdateRules() and getUpdateValue() runs after the ratings unit

    • a preflight of every definition and every row before the first write, reported by table, id and reason
    • keys field1..N and option1..N by original position, the full and the short layout, one confirmed result
    • a 0 in a select, date or datetime position is the placeholder of an empty choice and becomes absence
    • batches of 500 by cursor, each row equal to its source or its target, resumable from its manifest

16. users.field, forum.field and order.info are MEDIUMTEXT in the fresh schema and in the reconciling MODIFY statements, which used to set them back to TEXT on every run

17. the installer writer keeps native types on request, as the definitions need bool, int and null
18. Tests (tests/Unit, tests/Support):

19. FieldTest, FieldViewTest and UpdateFieldsTest; update_probe.php gets the fields unit, contract_probe.php the fieldpost scenario; EditorRoomTest drops order.info

Benefits:

• one path for form, normalization, validation and view, shared by every present and future owner of fields
• stored values survive a disabled field, a refused set and a missing update mark
• the update never guesses: ambiguous data stops it with a report instead of a wrong meaning

Technical notes:

• BREAKING: config/fields.php holds named definition arrays, and users.field, forum.field and order.info hold JSON; a 6.2 site reaches this format only through the update6_3 branch of setup

• form controls are named field[<name>] instead of the positional field[]
• config/fields.php ships the former demo definitions in the new format
• no runtime reader of the positional format remains

The implementation of docs/node starts: the Point and Rating classes, the shared configuration pipeline with file locks, the early removal of the nine modules Node replaces, and the connection of Point to every remaining owner of a rewarded event. Points are now named actions written to a journal next to the fast balance, the positional list and its numeric helpers are gone together with their callers, and the 6.3 data update keeps the starting balances. Stage S04 is connected and the stand is updated, but its acceptance is not finished; docs/node/PROGRESS.md lists the exact remainder. The admin dashboard demos travel in the same commit.

Core changes:

1. Point class and its connection (core/classes/point.php, config/points.php, core/system.php, core/classes/comment.php):

2. Point writes the _points journal and _users.points in one unit, with fifteen closed actions, a strict string configuration, per-action period and limit, compensation by rid and administrator adjust

3. The core builds $pnt before Comment and keeps it closed until config/update.php carries the points mark
4. Comment awards the first visible state, moves no points on hide and compensates the award on removal

5. updatePoints() and addPointsAction() are removed; the page view award and the rating award are removed without a replacement

6. Owners of rewarded events (core/user.php, modules/forum, contact, recommend, auto_links, order, shop, account):

7. forum topics and posts, private messages, favorites, feedback, recommendations, link visits, polls, logins and registrations call Point with a server-made source

8. an order is rewarded when the administrator confirms it and compensated when the confirmation is taken back or the order is removed; _order gains the uid column, shop rewards the activation of a _clients row

9. Administration (admin/modules/groups.php, modules/account/admin/index.php, modules/users/index.php):

10. the rules screen edits points, period and limit of fourteen actions and the one points.active switch, and shows the journal with independent filters by user, action and day, fifty rows a page

11. the user form shows the balance read-only and changes it by a signed difference with a mandatory reason
12. the general reset debits balances through adjust events in batches of 500 with a resumable operation id
13. the public rules page and the points column follow points.active; refusals of the user form are shown again
14. Rating class and the page cache protocol (core/classes/rating.php, core/classes/cache.php, core/system.php):
15. Rating with three tables, a trusted target adapter, nonce, cooldown and annulment; not connected yet
16. write guards, generation and markers in checkPageCache(), getPageHash() and setFoot()
17. Configuration and file locks (core/system.php, core/classes/filemanager.php, admin/modules/config.php):

18. setConfigFile() takes a string or a Closure, answers bool, journals every save and can be restored from admin.php?name=config&op=restore; getPathLock() and deletePathLock() are re-entrant within a request

19. Removal of nine legacy modules (modules/, blocks/, config/, setup/sql/):

20. news, pages, faq, help, jokes, content, links, files and media leave the tree with their configs, ten blocks, seed rows, nine tables and their update statements; the start page is presentation

21. shared helpers keep only the remaining modules, setContentActive() is removed
22. Setup and schema (setup/index.php, setup/sql/table.sql, setup/sql/table_update6_3.sql, .gitignore):

23. the update6_3 branch gains a preflight (closed site, server version, InnoDB), the points unit with a hashed snapshot of balances, a manifest and the config/update.php mark; a fresh install writes all three marks

24. _points with its named constraints and _order.uid are declared for a fresh install and for the upgrade
25. config/update.php is ignored: a shipped mark would open a subsystem that was never updated
26. Languages, help and tests (lang/.php, admin/lang/.php, admin/info, tests/):

27. seventeen POINTS* labels replace ninety positional _POINTSnn and _DESCnn constants, nine admin constants and eight CONFIG* constants are added in all six locales; the points help pages describe the current screens

28. PointTest, RatingTest and ConfigFileTest run in isolated processes on one-off schemas and scratch directories; comment, schema and structure tests follow the new contracts

29. Plan and demos (docs/node/, docs/, demo/):

30. docs/node carries the audited plan, decisions NOD-224 to NOD-235, the implementation notes of every stage and the hand-over block the next window starts from

31. demo/ gains the admin dashboard studies adm-01 to adm-07 with their own stylesheet and script

Benefits:

• every change of a balance is a journal row with its action, scope, source, administrator and reason
• one event is rewarded once for the life of its target, and removals take back exactly what was awarded
• a configuration save is one journaled, restorable unit instead of an unchecked file write

Technical notes:

• BREAKING: modules news, pages, faq, help, jokes, content, links, files and media are removed; their tables leave table.sql, site data and uploads of an existing installation are not touched

• BREAKING: users.point and users.points leave config/users.php, points.active replaces them; constants _POINTS01-_POINTS45 and _DESC01-_DESC45 are removed; Comment::__construct() takes Point as its third argument

• BREAKING: points stay closed for writing until setup has run the update6_3 branch on a closed site

• Not verified yet: the general reset, auto_links over HTTP, the remaining owners over HTTP and the resume branches of the points unit; one test outside these stages still fails on a demo SQL string in modules/presentation