7 files changed, 526 insertions, 108 deletions

diff --git a/app/models/concerns/file_attachment.rb b/app/models/concerns/file_attachment.rb
index 0e99fa2..3c09456 100644
--- a/app/models/concerns/file_attachment.rb
+++ b/app/models/concerns/file_attachment.rb
@@ -23,9 +23,10 @@ module FileAttachment
   extend ActiveSupport::Concern
 
   STYLES = {
-    medium:   { geometry: "300x300>",  format: nil },
-    thumb:    { geometry: "100x100>",  format: nil },
-    headline: { geometry: "460x250!",  format: nil }
+    medium:   { args: ["-resize", "300x300>"] },
+    thumb:    { args: ["-resize", "100x100>"] },
+    headline: { args: ["-resize", "460x250^", "-gravity", "center", "-extent", "460x250"] },
+    large:    { args: ["-resize", "1600x1600>"] }
   }.freeze
 
   IMAGE_CONTENT_TYPES    = %w[image/jpeg image/gif image/png image/webp].freeze
@@ -80,7 +81,7 @@ module FileAttachment
     STYLES.each do |style, options|
       dest_path = file_path(style)
       FileUtils.mkdir_p(File.dirname(dest_path))
-      system("magick", original_path, "-resize", options[:geometry], dest_path)
+      system("magick", original_path, *options[:args], dest_path)
     end
   end
 
@@ -105,7 +106,8 @@ module FileAttachment
   end
 
   def sanitize_filename(filename)
-    File.basename(filename).gsub(/[^\w\.\-]/, '_')
+    name = File.basename(filename).unicode_normalize(:nfc)
+    name.gsub(/(?u)[^\w\.\-]/, '_')
   end
 
   # Proxy object returned by asset.upload, providing the Paperclip-compatible
diff --git a/app/models/concerns/nested_tree.rb b/app/models/concerns/nested_tree.rb
index 9a2eb0e..befcdb3 100644
--- a/app/models/concerns/nested_tree.rb
+++ b/app/models/concerns/nested_tree.rb
@@ -9,8 +9,6 @@ module NestedTree
   included do
     belongs_to :parent, class_name: name, foreign_key: :parent_id, optional: true, inverse_of: :children
     has_many :children, -> { order(:id) }, class_name: name, foreign_key: :parent_id, inverse_of: :parent
-
-    before_destroy :delete_descendants
   end
 
   class_methods do
@@ -77,10 +75,4 @@ module NestedTree
   def move_to_child_of(new_parent)
     update!(parent_id: new_parent.id)
   end
-
-  private
-
-  def delete_descendants
-    self.class.where(id: descendants.pluck(:id)).delete_all
-  end
 end
diff --git a/app/models/concerns/rrule_humanizer.rb b/app/models/concerns/rrule_humanizer.rb
index 8231de8..07141c1 100644
--- a/app/models/concerns/rrule_humanizer.rb
+++ b/app/models/concerns/rrule_humanizer.rb
@@ -15,8 +15,8 @@ module RruleHumanizer
   }.freeze
 
   ORDINAL_NAMES = {
-    de: { 1=>"ersten", 2=>"zweiten", 3=>"dritten", 4=>"vierten", -1=>"letzten", -2=>"vorletzten" },
-    en: { 1=>"first", 2=>"second", 3=>"third", 4=>"fourth", -1=>"last", -2=>"second-to-last" }
+    de: { 1=>"ersten", 2=>"zweiten", 3=>"dritten", 4=>"vierten", 5=>"fünften", -1=>"letzten", -2=>"vorletzten" },
+    en: { 1=>"first", 2=>"second", 3=>"third", 4=>"fourth", 5=>"fifth", -1=>"last", -2=>"second-to-last" }
   }.freeze
 
   MONTH_NAMES = {
@@ -35,7 +35,8 @@ module RruleHumanizer
     ordinals = ORDINAL_NAMES[loc] || ORDINAL_NAMES[:en]
     months   = MONTH_NAMES[loc]   || MONTH_NAMES[:en]
 
-    days = byday&.split(",")&.map do |d|
+    byday_values = byday&.split(",")
+    days = byday_values&.map do |d|
      if d =~ /^(-?\d+)([A-Z]{2})$/
         "#{ordinals[$1.to_i]} #{weekdays[$2]}"
       else
@@ -43,6 +44,32 @@ module RruleHumanizer
       end
     end
 
+    excluded_monthly_ordinal = nil
+    excluded_monthly_weekday = nil
+    selected_monthly_ordinals = nil
+    selected_monthly_weekday = nil
+    if freq == "MONTHLY" && byday_values.present?
+      ordinal_days = byday_values.map { |d| d.match(/^([1-5])([A-Z]{2})$/) }
+      if ordinal_days.all?
+        positions = ordinal_days.map { |match| match[1].to_i }.uniq.sort
+        weekdays_in_rule = ordinal_days.map { |match| match[2] }.uniq
+        if weekdays_in_rule.size == 1
+          selected_monthly_ordinals = positions
+          selected_monthly_weekday = weekdays_in_rule.first
+          missing_positions = (1..5).to_a - positions
+          if positions.size == 4 && missing_positions.size == 1
+            excluded_monthly_ordinal = missing_positions.first
+            excluded_monthly_weekday = selected_monthly_weekday
+          end
+        end
+      end
+    end
+
+    join_ordinals = lambda do |ordinal_values, conjunction|
+      names = ordinal_values.map { |ordinal| ordinals[ordinal] }
+      names.size > 1 ? "#{names[0..-2].join(', ')} #{conjunction} #{names.last}" : names.first
+    end
+
     base =
       case loc
       when :de
@@ -59,14 +86,26 @@ module RruleHumanizer
             interval == 2 ? "Alle zwei Wochen" : "Wöchentlich"
           end
         when "MONTHLY"
-          days ? "Jeden #{days.join(' und ')} im Monat" : "Monatlich"
+          if excluded_monthly_ordinal
+            "Jeden #{weekdays[excluded_monthly_weekday]} im Monat, außer dem #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Jeden #{join_ordinals.call(selected_monthly_ordinals, 'und')} #{weekdays[selected_monthly_weekday]} im Monat"
+          else
+            days ? "Jeden #{days.join(' und ')} im Monat" : "Monatlich"
+          end
         end
       else
         case freq
         when "WEEKLY"
           days ? "#{interval == 2 ? 'Every other' : 'Every'} #{days.join(' and ')}" : (interval == 2 ? "Every other week" : "Weekly")
         when "MONTHLY"
-          days ? "Every #{days.join(' and ')} of the month" : "Monthly"
+          if excluded_monthly_ordinal
+            "Every #{weekdays[excluded_monthly_weekday]} of the month, except the #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Every #{join_ordinals.call(selected_monthly_ordinals, 'and')} #{weekdays[selected_monthly_weekday]} of the month"
+          else
+            days ? "Every #{days.join(' and ')} of the month" : "Monthly"
+          end
         end
       end
     return nil unless base
diff --git a/app/models/node.rb b/app/models/node.rb
index 73eefd1..a440c2f 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -4,17 +4,23 @@ class Node < ApplicationRecord
 
   # Associations
   has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
-  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy, optional: true
-  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy, optional: true
+  has_many    :node_actions, :dependent => :nullify
+  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, optional: true
+  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, optional: true
+  # Autosave pages carry no node_id, so has_many :pages does not cover
+  # them -- this dependent: :destroy is their only cleanup on node destroy.
   belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
+
   has_many    :permissions, :dependent => :destroy
   has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
   # Callbacks
-  after_create  :initialize_empty_page
-  before_save   :check_for_changed_slug
-  after_save    :update_unique_names_of_children
+  after_create   :initialize_empty_page
+  before_save    :check_for_changed_slug
+  after_save     :update_unique_names_of_children
+  before_destroy :refuse_destroy_with_children
+  before_destroy :refuse_destroying_trash_node
 
   # Validations
   validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? || slug.blank? }
@@ -22,6 +28,21 @@ class Node < ApplicationRecord
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
+  validate :reserved_slug_stays_reserved
+  validate :no_head_inside_trash
+  validates :default_template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :default_template_name_changed?
+
+  # Everything outside the Trash subtree, the Trash node included.
+  # Relies on unique_name being authoritative for tree position --
+  # the same trust public routing places in it.
+  scope :not_in_trash, -> {
+    where.not(:unique_name => CccConventions::TRASH_SLUG)
+      .where("unique_name NOT LIKE ?", "#{CccConventions::TRASH_SLUG}/%")
+  }
+
   # Class methods
 
   # Returns a page for a given node. If no revision is supplied, it returns
@@ -48,6 +69,19 @@ class Node < ApplicationRecord
     nil
   end
 
+  # The Trash container node. Lazily self-creating and idempotent, so
+  # every environment acquires it on first touch.
+  # Never call from validations. the positional predicates below
+  # exist for that.
+  def self.trash
+    root.children.find_by(:slug => CccConventions::TRASH_SLUG) ||
+      root.children.create!(:slug => CccConventions::TRASH_SLUG).tap do |node|
+        Globalize.with_locale(I18n.default_locale) do
+          node.draft.update!(:title => "Trash")
+        end
+      end
+  end
+
   # Instance Methods
 
   # Acquires (or reaffirms) the editing lock without creating a draft or
@@ -145,28 +179,6 @@ class Node < ApplicationRecord
     pairs
   end
 
-  def find_or_create_draft current_user
-    self.wipe_draft!
-    if draft && self.lock_owner == current_user
-      draft
-    elsif draft && self.lock_owner.nil?
-      lock_for! current_user
-      draft.user    = current_user if draft.user.nil?
-      draft.editor  = current_user
-      draft.save
-      draft
-    elsif draft && self.lock_owner != current_user
-      raise(
-        LockedByAnotherUser,
-        "Page is locked by another user who is working on it! " \
-        "Last modification: #{draft.updated_at.to_fs(:db)}"
-      )
-    else
-      lock_for! current_user
-      create_new_draft current_user
-    end
-  end
-
   def create_new_draft user
     empty_page        = self.pages.create!
     empty_page.user   = (self.head ? self.head.user : user)
@@ -192,10 +204,12 @@ class Node < ApplicationRecord
       self.autosave.destroy
       self.autosave_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "discard_autosave")
     elsif self.draft && self.head
       self.draft.destroy
       self.draft_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy_draft")
     end
 
     self.unlock! unless self.draft
@@ -210,81 +224,187 @@ class Node < ApplicationRecord
     end
   end
 
-  def publish_draft!
+  def publish_draft! current_user = nil
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
-    if self.draft
-      self.head = self.draft
-      self.head.published_at ||= Time.now
-      self.head.save!
-      self.draft = nil
+    if in_trash? || trash_node?
+      raise ActiveRecord::RecordInvalid.new(self), "Cannot publish a node in the Trash"
     end
 
-    if staged_slug && (staged_slug != slug)
-      self.slug = staged_slug
-      self.staged_slug = nil
-    end
+    path_before = self.unique_name
 
-    if staged_parent_id && (staged_parent_id != parent_id)
-      new_parent = Node.find(staged_parent_id)
+    ActiveRecord::Base.transaction do
+      if self.draft
+        outgoing_head = self.head
+        self.head = self.draft
+        self.head.published_at ||= Time.now
+        self.head.save!
+        self.draft = nil
 
-      if new_parent == self || self.descendants.include?(new_parent)
-        raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+        NodeAction.record!(:node => self, :page => self.head, :user => current_user,
+                            :action => "publish", :via => "draft",
+                            **NodeAction.head_diff(outgoing_head, self.head))
       end
 
-      self.staged_parent_id = nil
-      self.save!
-      self.move_to_child_of(new_parent)
-    else
-      unless self.save
-        raise ActiveRecord::RecordInvalid.new(self)
+      if staged_slug && (staged_slug != slug)
+        self.slug = staged_slug
+        self.staged_slug = nil
       end
-    end
 
-    self.reload
-    self.update_unique_name
-    self.send(:update_unique_names_of_children)
-    self.unlock!
-    self
-  end
+      if staged_parent_id && (staged_parent_id != parent_id)
+        new_parent = Node.find(staged_parent_id)
 
-  # Releases whatever's stale and abandoned; never anything actively in
-  # use. Three independent cases share one rule -- nothing is touched
-  # unless it's been sitting untouched for over a day:
-  #  - a lock held with no draft or autosave at all (the editor opened
-  #    the page and never actually wrote anything)
-  #  - a fresh autosave older than a day, never promoted to a draft
-  #  - a draft older than a day that's still identical to head
-  def wipe_draft!
-    return if self.autosave && self.autosave.updated_at > 1.day.ago
+        if new_parent == self || self.descendants.include?(new_parent)
+          raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+        end
 
-    unless self.draft
-      return if self.autosave.nil? && self.locked? && self.updated_at > 1.day.ago
-      self.autosave&.destroy
-      self.autosave_id = nil
+        self.staged_parent_id = nil
+        self.save!
+        self.move_to_child_of(new_parent)
+      else
+        unless self.save
+          raise ActiveRecord::RecordInvalid.new(self)
+        end
+      end
+
+      self.reload
+      self.update_unique_name
+      self.send(:update_unique_names_of_children)
+      if self.unique_name != path_before
+        NodeAction.record!(:node => self, :user => current_user, :action => "move",
+                            :path => { "from" => path_before, "to" => self.unique_name })
+      end
       self.unlock!
+      self
+    end
+  end
+
+  def restore_revision! revision, current_user = nil
+    page = self.pages.find_by_revision(revision)
+    return nil unless page
+
+    ActiveRecord::Base.transaction do
+      outgoing_head = self.head
+      self.head = page
       self.save!
-      return
+
+      NodeAction.record!(:node => self, :page => page, :user => current_user,
+                          :action => "publish", :via => "revision",
+                          **NodeAction.head_diff(outgoing_head, page))
+      self
     end
-    return unless self.head
-    return unless self.draft.updated_at < 1.day.ago
-    return if self.head.has_changes_to? self.draft
+  end
 
-    self.draft.destroy
-    self.draft_id = nil
-    self.unlock!
-    self.save!
-    self.reload
+
+  # Moves this node and its subtree into the Trash. Demotes every head
+  # in the subtree first (aggregators and search operate on heads
+  # regardless of tree position); where a node has no draft, the former
+  # head becomes its draft so content stays editable and restorable --
+  # otherwise the former head remains a plain revision. One log entry,
+  # at the root, carrying the leaving-public-view snapshot.
+  def trash! current_user = nil
+    return nil if in_trash?
+    raise ActiveRecord::RecordInvalid.new(self), "The Trash node itself cannot be trashed" if trash_node?
+
+    ActiveRecord::Base.transaction do
+      path_before        = unique_name
+      was_published      = head_id.present?
+      final_published_at = head&.published_at
+
+      demoted = 0
+      ([self] + descendants.to_a).each do |node|
+        next unless node.head_id
+        former        = node.head
+        node.head     = nil
+        node.draft_id = former.id if node.draft_id.nil?
+        node.save!
+        demoted += 1
+      end
+
+      self.reload
+      move_to_child_of(Node.trash)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+      unlock!
+
+      metadata = { :path => { "from" => path_before, "to" => unique_name } }
+      metadata[:was_published]      = true if was_published
+      metadata[:final_published_at] = final_published_at.iso8601 if final_published_at
+      metadata[:demoted_heads]      = demoted if demoted > 0
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "trash", **metadata)
+      self
+    end
   end
 
-  def restore_revision! revision
-    if page = self.pages.find_by_revision(revision)
-      self.head = page
-      self.save
-    else
-      nil
+  # Returns the node to the living tree under a chosen parent. The
+  # subtree comes back exactly as it sits in the Trash: all drafts,
+  # nothing published. Republication is a separate, witnessed act
+  # per node.
+  def restore_from_trash! new_parent, current_user = nil
+    return nil unless in_trash?
+
+    if new_parent.nil? || new_parent == self || descendants.include?(new_parent) ||
+       new_parent.trash_node? || new_parent.in_trash?
+      raise ActiveRecord::RecordInvalid.new(self), "Restore target must be a living node"
     end
+
+    ActiveRecord::Base.transaction do
+      path_before = unique_name
+      move_to_child_of(new_parent)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "restore_from_trash",
+                          :path => { "from" => path_before, "to" => unique_name })
+      self
+    end
+  end
+
+  # Final deletion -- only from inside the Trash. Removes the whole
+  # subtree, deepest first, each node through a real destroy! so every
+  # per-node cascade runs (the categorical difference from the old
+  # delete_all nuke). refuse_destroy_with_children on bare destroy is
+  # untouched
+  # One log entry at the root, per the subtree rule, written before the
+  # rows die.
+  def destroy_from_trash! current_user = nil
+    raise ActiveRecord::RecordInvalid.new(self), "Nodes are only destroyed from the Trash" unless in_trash?
+
+    ActiveRecord::Base.transaction do
+      doomed = self_and_descendants_ordered_with_level
+                 .sort_by { |_, level| -level }
+                 .map(&:first)
+
+      metadata = { :path => unique_name }
+      metadata[:destroyed_descendants] = doomed.size - 1 if doomed.size > 1
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy", **metadata)
+      doomed.each(&:destroy!)
+    end
+  end
+
+  # The most recent trash entry. Its path.from is the restore hint.
+  def last_trash_entry
+    node_actions.where(:action => "trash").order(:occurred_at => :desc, :id => :desc).first
+  end
+
+  # The node's pre-trash parent, if a living node still answers to
+  # that path. Nil when the parent was itself trashed (its unique_name
+  # changed) or deleted; a different node that has since taken over
+  # the path is a legitimate suggestion.
+  def suggested_restore_parent
+    from = last_trash_entry&.metadata&.dig("path", "from")
+    return nil unless from
+
+    parent_path = from.rpartition("/").first
+    return Node.root if parent_path.empty?
+
+    candidate = Node.find_by(:unique_name => parent_path)
+    candidate unless candidate.nil? || candidate.in_trash? || candidate.trash_node?
   end
 
   # returns an array with all parts of a unique_name rather than a string
@@ -297,9 +417,12 @@ class Node < ApplicationRecord
     parent.nil? ? [slug] : parent.path_to_root.push(slug)
   end
 
+  def computed_unique_name
+    path_to_root[1..-1].join("/") # excluding root
+  end
+
   def current_unique_name
-    path = path_to_root[1..-1] # excluding root
-    self.unique_name = path.join("/")
+    self.unique_name = computed_unique_name
   end
 
   def update_unique_name
@@ -339,6 +462,20 @@ class Node < ApplicationRecord
     autosave || draft || head
   end
 
+  def trash_node?
+    parent&.root? && slug == CccConventions::TRASH_SLUG
+  end
+
+  # Inside the Trash subtree. False for the Trash node itself.
+  def in_trash?
+    current = parent
+    while current
+      return true if current.trash_node?
+      current = current.parent
+    end
+    false
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -379,7 +516,7 @@ class Node < ApplicationRecord
   end
 
   def self.drafts_and_autosaves(current_user_id: nil)
-    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL")
+    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL").not_in_trash
     return scope.order("updated_at DESC") unless current_user_id
 
     scope.order(
@@ -387,6 +524,15 @@ class Node < ApplicationRecord
     )
   end
 
+  # Nodes are never destroyed recursively
+  # Descendants must be removed or reparented individually first.
+  # The Trash feature will be the ordinary path to deletion.
+  def refuse_destroy_with_children
+    return unless children.exists?
+    errors.add(:base, "Cannot destroy a node that still has children")
+    throw :abort
+  end
+
   def self.recently_changed
     includes(:head).where(
       "pages.updated_at < ? AND pages.updated_at > ? AND nodes.parent_id IS NOT NULL",
@@ -443,4 +589,36 @@ class Node < ApplicationRecord
         end
       end
     end
+
+  private
+
+    def reserved_slug_stays_reserved
+      if parent&.root? && !trash_node_already_me?
+        errors.add(:slug, "is reserved for the Trash") if slug == CccConventions::TRASH_SLUG
+        errors.add(:staged_slug, "is reserved for the Trash") if staged_slug == CccConventions::TRASH_SLUG
+      end
+
+      if persisted? && slug_was == CccConventions::TRASH_SLUG && Node.find(id).trash_node?
+        errors.add(:slug, "of the Trash node cannot change") if slug_changed?
+        errors.add(:parent_id, "of the Trash node cannot change") if parent_id_changed?
+        errors.add(:staged_slug, "must stay empty on the Trash node") if staged_slug.present?
+        errors.add(:staged_parent_id, "must stay empty on the Trash node") if staged_parent_id.present?
+      end
+    end
+
+    def trash_node_already_me?
+      existing = Node.root&.children&.find_by(:slug => CccConventions::TRASH_SLUG)
+      existing.nil? || existing.id == id
+    end
+
+    def no_head_inside_trash
+      return unless head_id.present?
+      errors.add(:head_id, "cannot exist inside the Trash") if in_trash? || trash_node?
+    end
+
+    def refuse_destroying_trash_node
+      return unless trash_node?
+      errors.add(:base, "The Trash node cannot be destroyed")
+      throw :abort
+    end
 end
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
new file mode 100644
index 0000000..13bd5ba
--- /dev/null
+++ b/app/models/node_action.rb
@@ -0,0 +1,169 @@
+class NodeAction < ApplicationRecord
+  belongs_to :node, optional: true
+  belongs_to :page, optional: true
+  belongs_to :user, optional: true
+
+  validates :action, presence: true
+  validates :occurred_at, presence: true
+
+  # == Metadata contract ==
+  #
+  # metadata is written once at creation, never updated. It is the
+  # single place anything that must survive deletion of the referenced
+  # rows lives; node_id/page_id/user_id are lookup and ordering only.
+  # All keys are strings. Pairs are always {"from" => x, "to" => y}.
+  # Optional pairs only when the sides differ; booleans only when
+  # true; required keys always present. Titles and names are read
+  # pinned to I18n.default_locale unless inside a locale-keyed block.
+  #
+  # Baseline, every entry (written here, not by call sites):
+  #   "username"                 -- actor's login at write time
+  #   "human_readable_node_name" -- node title, default locale
+  #
+  # "create":
+  #   "title" -- initial title, flat string (NOT a pair)
+  #   "path"  -- unique path at creation, flat string. Historical
+  #              value only; never a join key.
+  #
+  # "publish" (any promotion to head; diff computed BEFORE head is
+  # re-pointed, over the union of both pages' locales, by head_diff --
+  # shared with the backfill):
+  #   "via"    -- "draft" | "revision" (rollback). Always written;
+  #               absent means a pre-contract entry.
+  #   "title"  -- pair, always; "from" null on first publish
+  #   "author" -- pair, when the byline changed (incl. first publish)
+  #   "tags"   -- pair of arrays, when changed
+  #   "assets_changed", "template_changed",
+  #   "abstract_changed", "body_changed"
+  #            -- the last two for the default locale; page_id links
+  #               to the revision for the real diff (never stored)
+  #   "translation_diff" -- only when a non-default locale differs:
+  #     { "<locale>" => {
+  #         "status" -- "added" | "removed" | "changed"
+  #         "title"  -- pair, only when it differs; "from" null when
+  #                     added, "to" null when removed
+  #         "abstract_changed", "body_changed" -- status "changed" only
+  #     } }
+  #
+  # "move" (reparent and/or path change; one entry at the subtree
+  # root, descendants get none):
+  #   "path" -- pair
+  #
+  # "trash" (subtree into the Trash; every head in the subtree is
+  # demoted first; one entry at the root; snapshots the
+  # leaving-public-view state, since Trash holds no heads and destroy
+  # can no longer know):
+  #   "path"               -- pair; "from" doubles as the restore hint
+  #   "was_published"      -- boolean
+  #   "demoted_heads"      -- integer count, only when positive
+  #   "final_published_at" -- ISO8601 string, only when present
+  #
+  # "restore_from_trash" (reparent back to a living node; returns as
+  # drafts, republication is a separate witnessed act):
+  #   "path" -- pair
+  #
+  # "destroy" (only from inside the Trash, never with children; the
+  # entry is written in the same transaction before the row dies):
+  #   "path" -- final path, flat string (create-symmetric)
+  #   "destroyed_descendants" -- integer, only when positive; one entry
+  #                              at the root, per the subtree rule.
+  #
+  # Reserved: "demote" (via "trash" | "depublish") for an explicit
+  # depublish workflow, if ever built.
+  #
+  # Backfilled entries mirror this vocabulary; diff content is
+  # computed, only actor (page.editor) and occurred_at are inferred,
+  # inferred_from names the heuristic ("from_node_created_at",
+  # "from_page_revision"). Null = witnessed live.
+  #
+  # The "locale" column is written by no verb; retained.
+  #
+  # This log records; it does not undo. No IP, session, or user
+  # agent, ever. Success only.
+
+  def self.record!(node:, action:, user: nil, page: nil, locale: nil,
+                    occurred_at: nil, inferred_from: nil, **extra)
+    create!(
+      :node          => node,
+      :page          => page,
+      :user          => user,
+      :action        => action,
+      :locale        => locale,
+      :occurred_at   => occurred_at || Time.now,
+      :inferred_from => inferred_from,
+      :metadata      => {
+        "username"                 => user&.login,
+        "human_readable_node_name" => Globalize.with_locale(I18n.default_locale) {
+                                        node&.head&.title || node&.draft&.title
+                                      },
+      }.merge(extra.stringify_keys)
+    )
+  end
+
+  # Computes the publish-entry diff between an outgoing head and the
+  # page replacing it, in the exact metadata shape the contract above
+  # specifies. Pure function of its two arguments -- shared verbatim by
+  # publish_draft!, restore_revision!, and the backfill task. Reads
+  # translation rows directly, never locale-dependent accessors, so a
+  # fallback value is never mistaken for real content. Returns
+  # symbol-keyed top level for splatting into record!; nested keys are
+  # strings and jsonb serialization stringifies the rest at write time.
+  def self.head_diff old_page, new_page
+    default = I18n.default_locale
+
+    title_of = ->(page) { page&.translations&.find_by(:locale => default)&.title }
+    diff = { :title => { "from" => title_of.call(old_page),
+                         "to"   => title_of.call(new_page) } }
+    unless old_page
+      diff[:author] = { "from" => nil, "to" => new_page.user&.login } if new_page.user
+      return diff
+    end
+
+    old_author, new_author = old_page.user&.login, new_page.user&.login
+    diff[:author] = { "from" => old_author, "to" => new_author } if old_author != new_author
+
+    old_tags, new_tags = old_page.tag_list.sort, new_page.tag_list.sort
+    diff[:tags] = { "from" => old_tags, "to" => new_tags } if old_tags != new_tags
+
+    diff[:template_changed] = true if old_page.template_name != new_page.template_name
+    diff[:assets_changed]   = true if old_page.assets.map(&:id) != new_page.assets.map(&:id)
+
+    old_t = old_page.translations.find_by(:locale => default)
+    new_t = new_page.translations.find_by(:locale => default)
+    diff[:abstract_changed] = true if old_t&.abstract != new_t&.abstract
+    diff[:body_changed]     = true if old_t&.body != new_t&.body
+
+    locales = (old_page.translated_locales | new_page.translated_locales) - [default]
+    translation_diff = {}
+
+    locales.sort_by(&:to_s).each do |locale|
+      o = old_page.translations.find_by(:locale => locale)
+      n = new_page.translations.find_by(:locale => locale)
+
+      if o.nil?
+        translation_diff[locale.to_s] = { "status" => "added",
+                                          "title" => { "from" => nil, "to" => n.title } }
+      elsif n.nil?
+        translation_diff[locale.to_s] = { "status" => "removed",
+                                          "title" => { "from" => o.title, "to" => nil } }
+      elsif o.title != n.title || o.abstract != n.abstract || o.body != n.body
+        entry = { "status" => "changed" }
+        entry["title"]            = { "from" => o.title, "to" => n.title } if o.title != n.title
+        entry["abstract_changed"] = true if o.abstract != n.abstract
+        entry["body_changed"]     = true if o.body != n.body
+        translation_diff[locale.to_s] = entry
+      end
+    end
+
+    diff[:translation_diff] = translation_diff if translation_diff.any?
+    diff
+  end
+
+  def actor_name
+    metadata["username"] || "unknown"
+  end
+
+  def subject_name
+    metadata["human_readable_node_name"] || node&.unique_name || "deleted node"
+  end
+end
diff --git a/app/models/page.rb b/app/models/page.rb
index e5a8d9d..f33d88d 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -11,11 +11,21 @@ class Page < ApplicationRecord
 
   translates :title, :abstract, :body # Globalize2
 
+  # Template names render as filesystem paths; only names actually
+  # present in the public template directory are acceptable. Validated
+  # only on change so legacy rows whose template file has since
+  # vanished stay saveable -- valid_template already falls back to
+  # standard_template for those at render time.
+  validates :template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :template_name_changed?
+
   # Associations
   belongs_to :node, optional: true
   belongs_to :user, optional: true
   belongs_to :editor, :class_name => "User", optional: true
-  has_many   :related_assets
+  has_many   :related_assets, :dependent => :destroy
   has_many   :assets, -> { order("position ASC") }, :through => :related_assets
 
   # Named scopes
@@ -77,7 +87,10 @@ class Page < ApplicationRecord
         .paginate(:page => page, :per_page => options[:limit])
     end
 
-    scope.order("#{options[:order_by]} #{direction}")
+    column = options[:order_by].to_s.sub(/\Apages\./, "")
+    column = "id" unless %w[id published_at created_at updated_at].include?(column)
+
+    scope.order("pages.#{column} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 92ac33a..5e47ae7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,10 @@
 require 'digest/sha1'
 
 class User < ApplicationRecord
+  has_secure_password(validations: false)
+
+  alias_method :authenticate_bcrypt, :authenticate
+
   # Mixins and Plugins
   include Authentication
   include Authentication::ByPassword
@@ -23,9 +27,30 @@ class User < ApplicationRecord
 
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
-    return nil if login.blank? || password.blank?
-    u = find_by_login(login) # need to get the salt
-    u && u.authenticated?(password) ? u : nil
+    return if login.blank? || password.blank?
+
+    user = find_by(login: login)
+    return unless user
+
+    user&.authenticate(password)
+  end
+
+  def authenticate(password)
+    if password_digest.present?
+      return self if authenticate_bcrypt(password)
+      return nil
+    end
+
+    return nil unless authenticate_legacy(password)
+
+    transaction do
+      self.password = password
+      self.crypted_password = nil
+      self.salt = nil
+      save!(validate: false)
+    end
+
+    self
   end
 
   # TODO: Do we really want to have downcase logins only?