cccms/app/models/node.rb, branch erdgeist-modernize-auth

Split current_unique_name in a setter and an accessor

2026-07-16T13:12:07Z

Also clean up some instance variable assignments on the way.

Record the full lifecycle contract in NodeAction entries

2026-07-16T00:40:03Z

A contract comment above NodeAction.record! now specifies every verb's metadata shape. NodeAction.head_diff computes the publish diff between an outgoing head and its replacement -- default-locale title pair always, author/tags pairs and template/assets/abstract/ body flags only when changed, and a per-locale translation_diff with added/removed/changed status. It is a pure function of its two pages, shared by publish, rollback, and the future backfill, and reads translation rows directly so fallbacks never masquerade as content. publish entries carry via ("draft" or "revision"); restore_revision! is now transactional, takes the acting user, and logs through the same diff. Staged slug/parent changes applied at publish log a move entry with the path pair. Node creation logs a create entry with initial title and path. The draft-scoped translation_destroy writer is retired -- locale removal is recorded by the publish diff, where it becomes public fact.

Add NodeAction: an append-only log of who did what to a node

2026-07-15T02:23:09Z

node_id/page_id/user_id are lookup and ordering only -- all three nullify on delete, so an entry outlives its actor and its subject. Everything that must survive those deletions lives in a mandatory metadata jsonb written once at creation: the actor's username, the node's human-readable name (pinned to the default locale), and action-specific extras such as publish's title from/to. NodeAction.record! is the single constructor, so every entry gets the same baseline metadata without each call site re-implementing it. occurred_at is one field for live and backfilled entries alike; inferred_from distinguishes them -- nil means witnessed at the moment it happened, populated names how a backfilled entry was estimated. Instrumented so far: publish (crediting the actual publisher, threaded through from the controller -- previously nobody had the act of publishing recorded anywhere), revert's discard_autosave and destroy_draft branches, and translation destroy. publish_draft! now runs in a transaction so the promotion and its log entry land together. The remaining verbs follow once this mechanism has proven itself.

Retire wipe_draft! and find_or_create_draft from production code

2026-07-14T12:31:18Z

Both had already lost their reason to exist as production API: wipe_draft!'s one remaining callsite (nodes#show) was removed two sessions ago, and find_or_create_draft had zero production callers left at all -- confirmed by a fresh grep, not assumed -- every one of its ~65 call sites was test setup, unrelated to what those tests actually cover. wipe_draft! is deleted outright, along with its two tests -- the lock/draft/autosave cleanup it silently performed already has explicit, always-visible manual equivalents (Unlock, Discard Autosave, Destroy Draft), so nothing real is lost. find_or_create_draft moves to test_helper.rb as a plain method on ActiveSupport::TestCase, alongside the create_node_with_draft/ create_node_with_published_page helpers already living there -- extending the framework's own designated test-extension point rather than reopening the Node model from test code. Its three tests of real dispatch behavior (idempotency on repeat calls, and raising when a second user contends for the lock) are kept, since ~65 other tests depend on this helper actually working correctly; only the call syntax changed, from node.find_or_create_draft(user) to find_or_create_draft(node, user).

wipe_draft!: add a grace period to the lock-with-no-draft branch

2026-07-13T14:36:06Z

Its other two branches both require a day's inactivity before touching anything; this one didn't, so a lock acquired seconds ago with nothing drafted yet looked identical to one abandoned for a week -- confirmed with a throwaway script showing a lock cleared inside a single method call. Guarded on autosave.nil? specifically, since the method's first line already guarantees any autosave reaching this branch is a day old by construction.

Carry over other-locale translations when creating an autosave

2026-07-13T12:12:33Z

Node#autosave! only copied assets forward onto a newly created autosave, not translations. Invisible for single-locale nodes, but a node with an existing multi-locale head/draft that gets locked and edited in one locale would silently drop every other locale's translation from the new autosave -- and from there into the draft and eventually head, since save_draft! faithfully clones whatever the autosave actually holds. Fixed by using clone_attributes_from, which already does a complete clone (translations, assets, tags, template, published_at) -- the same method save_draft! already relies on two branches later, so no new mechanism, just closing the one place still doing a partial, hand-rolled version of it.

Asset picker: attach/detach/reorder UI, read-only view, autosave fix

2026-07-13T02:54:33Z

Replaces nodes#edit's old Images section -- a hidden panel dumping every image asset in the system unfiltered (#image_browser) plus a raw drag-and-drop box (#image_box) -- with a small search-and-click picker built on the endpoint from the last two commits. Attaching posts immediately and appends the new thumbnail via a cloned