62 files changed, 2578 insertions, 298 deletions

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..c26956c
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,89 @@
+# Contributing to CCCMS
+
+## Stack
+Rails 8.1, Ruby 3.2, PostgreSQL 16, ImageMagick 7 (`magick`, not `convert`).
+No Sprockets pipeline for public or admin static assets except
+`admin_bundle.js` — everything else is served straight from `public/` and
+cache-busted via file mtime (`ApplicationHelper#mtime_busted_path`), not
+fingerprinted content hashing.
+
+## Content model
+- **Node** — the tree structure (`awesome_nested_set`-derived, migrating
+  toward a plain `parent_id` model — both may be present during that
+  transition). Holds three separate Page references: `head` (published),
+  `draft` (being worked on), `autosave` (in-progress typing).
+- **Page** — one revision's content. `belongs_to :node`, except `autosave`
+  layers specifically: their `node_id` is deliberately `nil`, which is what
+  keeps them out of `node.pages` (the real revision history) entirely —
+  an autosave is not a revision.
+- **Page::Translation** — Globalize's own generated class (`translates
+  :title, :abstract, :body` on `Page`). Not a top-level `PageTranslation`
+  constant, and it has `page_id`, not a `page` association reader.
+
+## Publishing lifecycle
+There is exactly one path from an edit to a published change:
+`autosave!` (writes into the autosave layer, creating it via
+`clone_attributes_from` on the previous head/draft if it doesn't exist yet)
+→ `save_draft!` (clones the *entire* autosave into the draft layer,
+wholesale — every locale, not just the one just edited) → `publish_draft!`
+(promotes draft to head). Nothing writes to `draft` or `head` directly.
+Locking (`lock_for_editing!`, raising `LockedByAnotherUser`) gates every
+step; a lock can exist with no draft or autosave at all (acquisition is
+deliberately separate from content creation).
+
+## Locale architecture
+Presentation locale (which language the admin chrome or public page
+renders in) and content-target locale (which translation a given screen is
+reading or writing) are two different concerns and never share a
+mechanism. The route's `:locale` segment governs the former only. The
+primary node editor always targets the default locale, enforced via
+`Globalize.with_locale` (never `I18n.locale`, which would leak into
+generated URLs through `default_url_options`). Non-default-locale editing
+uses a separately-named route param (`:translation_locale`), deliberately
+distinct from `:locale` so the two can never be conflated by a link helper.
+Globalize's configured fallback chain is correct for public rendering and
+wrong for editing — anywhere a screen needs to know a translation's real,
+unborrowed state, read the `Page::Translation` row directly rather than the
+locale-dependent attribute accessor.
+
+## Assets
+`FileAttachment` (`app/models/concerns/file_attachment.rb`) is a from-
+scratch Paperclip replacement. `STYLES` is a hash of style name to a full
+ImageMagick argument array (not just a geometry string — some styles need
+`-gravity`/`-extent` alongside `-resize`, which a single string can't
+express). `generate_variants` loops over `STYLES` generically; adding a
+style needs no other code change, only `bundle exec rake
+assets:regenerate_variants` to backfill existing assets. The URL contract
+(`/system/uploads/:id/:style/:filename`) is stable and safe to parse
+directly (the numeric id is always the second path segment) rather than
+reconstructed through model methods.
+
+## Aggregator / shortcode system
+`[aggregate ...]` in page body text is parsed by
+`ContentHelper#aggregate?` into an options hash, then executed by
+`Page.aggregate`. Only `tags`, `children` (`"direct"`/`"all"`, combined
+with the current node), `order_by`/`order_direction`, and `limit` are
+actually consumed.  Only the first `[aggregate ...]` in a given body is
+ever processed (`aggregate?` does a single, non-global match).
+
+## TinyMCE integration
+`extended_valid_elements` must define a parent element and its commonly-
+nested children symmetrically and explicitly together — leaving one
+element on the schema's default rule while the other is explicitly
+redefined can cause content loss on save, even when the child would be
+perfectly valid under the untouched default alone. `valid_classes` denies
+all classes by default (`'*': ''`); anything meant to render needs an
+explicit per-element allowance. `content_style` injects CSS into the
+editing iframe directly — the app's real public stylesheet is never loaded
+there, so anything that needs to render correctly while editing needs its
+own rule supplied this way. Constrained-input features (fixed placement
+choices, for instance) are built as custom toolbar buttons with their own
+dialog and `editor.insertContent()`, not the native image dialog or
+`file_picker_callback` — those bring their own resize/edit affordances that
+would undermine a genuinely fixed set of choices.
+
+## Testing
+Shared test-only convenience methods (that need to operate across many
+model/controller test files) live directly on `ActiveSupport::TestCase`,
+in `test/test_helper.rb` — the framework's own designated extension point
+for exactly this, not a monkey-patch of a production model class.
diff --git a/Gemfile b/Gemfile
index 97257a9..cad34df 100644
--- a/Gemfile
+++ b/Gemfile
@@ -38,6 +38,7 @@ gem 'rails_icons'
 gem 'globalize',      '~> 7.0'    # translated model attributes (Page title/abstract/body)
 gem 'acts_as_list'                # page revision ordering
 gem 'will_paginate',  '~> 3.0'
+gem 'bcrypt',         '~> 3.1'
 
 # Pinned to git until a release widens the activerecord < 8.1 ceiling.
 # Both gems work correctly on Rails 8.1; the gemspec constraint is overly conservative.
diff --git a/Gemfile.lock b/Gemfile.lock
index e113726..8e4d5af 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -95,6 +95,7 @@ GEM
       activerecord (>= 6.1)
       activesupport (>= 6.1)
     base64 (0.3.0)
+    bcrypt (3.1.22)
     bigdecimal (4.1.2)
     builder (3.3.0)
     coffee-rails (4.2.2)
@@ -334,6 +335,7 @@ PLATFORMS
 DEPENDENCIES
   acts-as-taggable-on!
   acts_as_list
+  bcrypt (~> 3.1)
   chaos_calendar!
   coffee-rails (~> 4.0)
   concurrent-ruby (~> 1.3)
@@ -375,6 +377,7 @@ CHECKSUMS
   acts-as-taggable-on (13.0.0)
   acts_as_list (1.2.6) sha256=8345380900b7bee620c07ad00991ccee59af3d8c9e8574f426e321da2865fdc8
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bcrypt (3.1.22) sha256=1f0072e88c2d705d94aff7f2c5cb02eb3f1ec4b8368671e19112527489f29032
   bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
   builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f
   bundler (4.0.15) sha256=a4ceb882fe94a0e0ac63cd0813932bbfd631a14e5ac0b7975189b19a4d28d9e7
diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 37fd78b..d9cf1be 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -6,7 +6,7 @@ class AdminController < ApplicationController
 
   def index
     @drafts = Node.drafts_and_autosaves(current_user_id: current_user.id).limit(5)
-    @recent_changes = Node.recently_changed.limit(5)
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc).limit(5)
   end
 
   def conventions
@@ -71,4 +71,11 @@ class AdminController < ApplicationController
       end
     end
   end
+
+  # Deliberately raises, to verify the error-log tripwire end to end.
+  # Behind login_required like the rest of the controller; harmless --
+  # the visitor gets the ordinary 500 page.
+  def boom
+    raise "Deliberate test exception via admin/boom"
+  end
 end
diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 8d33105..8be4bfb 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -31,7 +31,7 @@ class ContentController < ApplicationController
   def render_gallery
     unless @page.nil?
       @images = @page.assets.images
-      render :file => "content/gallery"
+      render :template => 'content/gallery'
     else
       head :not_found
     end
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..5a3b55e
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,22 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      CSP_LOGGER.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      CSP_LOGGER.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
+    head :no_content
+  end
+end
diff --git a/app/controllers/node_actions_controller.rb b/app/controllers/node_actions_controller.rb
new file mode 100644
index 0000000..6e46719
--- /dev/null
+++ b/app/controllers/node_actions_controller.rb
@@ -0,0 +1,14 @@
+class NodeActionsController < ApplicationController
+
+  before_action :login_required
+
+  layout 'admin'
+
+  def index
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc)
+    @actions = @actions.where(:node_id => params[:node_id]) if params[:node_id].present?
+    @actions = @actions.where(:user_id => params[:user_id]) if params[:user_id].present?
+    @actions = @actions.includes(:node, :user)
+                       .paginate(:page => params[:page], :per_page => 50)
+  end
+end
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index bff1733..6caa827 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -13,7 +13,9 @@ class NodesController < ApplicationController
                               :publish,
                               :unlock,
                               :autosave,
-                              :revert
+                              :revert,
+                              :trash,
+                              :restore_from_trash
                             ]
 
   around_action :pin_to_default_locale, :only => [:show, :edit, :update, :autosave]
@@ -27,10 +29,7 @@ class NodesController < ApplicationController
   def new
     @node = Node.new node_params
     @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-    if params.has_key?(:parent_id)
-      @parent_id = params[:parent_id]
-      @parent_name = Node.find(@parent_id).title
-    end
+    @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
   end
 
   def create
@@ -48,14 +47,14 @@ class NodesController < ApplicationController
       @node.draft.save!
 
       @node.update!(default_template_name: config[:template]) if config && config[:template]
+      NodeAction.record!(:node => @node, :page => @node.draft, :user => current_user,
+                          :action => "create",
+                          :title => params[:title], :path => @node.unique_name)
 
       redirect_to(edit_node_path(@node))
     else
       @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-      if params[:parent_id].present?
-        @parent_id = params[:parent_id]
-        @parent_name = Node.find(@parent_id).title
-      end
+      @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
       render :new
     end
   end
@@ -63,6 +62,9 @@ class NodesController < ApplicationController
   def show
     @page = @node.draft || @node.head
     @translations = @page.translation_summary
+    @page_actions = NodeAction.where(:page_id => @node.pages.select(:id))
+                              .order(:occurred_at, :id)
+                              .group_by(&:page_id)
   end
 
   def edit
@@ -142,12 +144,44 @@ class NodesController < ApplicationController
     redirect_to node_path(@node)
   end
 
+ def trash
+    if @node.trash!(current_user)
+      flash[:notice] = "Page has been moved to the Trash"
+      redirect_to trashed_nodes_path
+    else
+      flash[:notice] = "Page is already in the Trash"
+      redirect_to node_path(@node)
+    end
+  rescue ActiveRecord::RecordInvalid, LockedByAnotherUser => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
+  def restore_from_trash
+    parent = Node.find(params[:parent_id])
+    @node.restore_from_trash!(parent, current_user)
+    flash[:notice] = "Page has been restored from the Trash"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordNotFound
+    flash[:error] = "Restore target not found"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
   def destroy
-    @node.destroy
+    @node.destroy_from_trash!(current_user)
+    flash[:notice] = "Page has been permanently deleted"
+    redirect_to trashed_nodes_path
+
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
   end
 
   def publish
-    @node.publish_draft!
+    @node.publish_draft!(current_user)
     flash[:notice] = "Draft has been published"
     redirect_to node_path(@node)
   end
@@ -217,6 +251,11 @@ class NodesController < ApplicationController
     @sitemap_descendant_counts = descendant_counts_for(@sitemap)
   end
 
+  def trashed
+    @nodes = Node.trash.children.order(:slug)
+                 .paginate(:page => params[:page], :per_page => 50)
+  end
+
   private
 
     def slug_for(title)
diff --git a/app/controllers/revisions_controller.rb b/app/controllers/revisions_controller.rb
index c5932a4..c1237a9 100644
--- a/app/controllers/revisions_controller.rb
+++ b/app/controllers/revisions_controller.rb
@@ -49,7 +49,7 @@ class RevisionsController < ApplicationController
 
   def restore
     page = Page.find(params[:id])
-    page.node.restore_revision! page.revision
+    page.node.restore_revision! page.revision, current_user
     flash[:notice] = "Revision #{page.revision} restored"
     redirect_to node_path(page.node)
   end
diff --git a/app/helpers/node_actions_helper.rb b/app/helpers/node_actions_helper.rb
new file mode 100644
index 0000000..fd8cc36
--- /dev/null
+++ b/app/helpers/node_actions_helper.rb
@@ -0,0 +1,183 @@
+module NodeActionsHelper
+  include ERB::Util
+
+  # One glyph per verb, rendered before the sentence in _action_row.
+  # Unknown verbs get the dashed circle -- the unknown-verb principle
+  # extended to iconography: the log outlives its vocabulary.
+  VERB_ICONS = {
+    "create"             => "file-plus",
+    "publish"            => "send",
+    "move"               => "arrows-move",
+    "trash"              => "trash",
+    "restore_from_trash" => "arrow-back-up",
+    "destroy"            => "trash-x",
+    "discard_autosave"   => "eraser",
+    "destroy_draft"      => "eraser",
+  }.freeze
+
+  def verb_icon action
+    name = if action.action == "publish" && action.metadata["via"] == "revision"
+      "history"
+    else
+      VERB_ICONS.fetch(action.action, "circle-dashed")
+    end
+    content_tag(:span, icon(name, library: "tabler", "aria-hidden": true),
+                :class => "node_action_icon node_action_icon--#{name}",
+                :title => action.action)
+  end
+
+  # One sentence per entry, rendered from metadata alone, so entries
+  # stay renderable after the rows they reference are gone. Live
+  # associations only upgrade plain names to links. Every metadata
+  # value passes through h() here -- this helper is the escaping
+  # boundary; the locale sentences are trusted, the data never is.
+  def action_summary action
+    renderer = "summarize_#{action.action}"
+    return send(renderer, action) if respond_to?(renderer, true)
+
+    # Unknown-verb fallback: the log outlives the vocabulary. A renamed
+    # or future verb degrades to an ugly sentence, never to a 500.
+    t("node_actions.unknown", :actor => actor_ref(action),
+       :action => h(action.action), :subject => subject_ref(action)).html_safe
+  end
+
+
+  def action_details? action
+    m = action.metadata
+    return true if m["translation_diff"].present?
+    return true if m["title"].is_a?(Hash) && m.dig("title", "from") != m.dig("title", "to")
+    %w[author tags template_changed assets_changed
+       abstract_changed body_changed].any? { |key| m[key].present? }
+  end
+
+  # Plain strings by design -- safe_join in the template escapes them.
+  def default_locale_changes action
+    m = action.metadata
+    items = []
+    if m["title"].is_a?(Hash) && m.dig("title", "from") && m.dig("title", "from") != m.dig("title", "to")
+      items << t("node_actions.detail_title",
+                  :from => m.dig("title", "from"), :to => m.dig("title", "to"))
+    end
+    items << t("node_actions.detail_author",
+                :from => m.dig("author", "from"), :to => m.dig("author", "to")) if m["author"]
+    items << t("node_actions.detail_tags",
+                :from => Array(m.dig("tags", "from")).join(", "),
+                :to   => Array(m.dig("tags", "to")).join(", ")) if m["tags"]
+    items << t("node_actions.abstract_changed") if m["abstract_changed"]
+    items << t("node_actions.body_changed")     if m["body_changed"]
+    items << t("node_actions.template_changed") if m["template_changed"]
+    items << t("node_actions.assets_changed")   if m["assets_changed"]
+    items
+  end
+
+  def translation_changes diff
+    case diff["status"]
+    when "added"   then [t("node_actions.locale_added",   :title => diff.dig("title", "to"))]
+    when "removed" then [t("node_actions.locale_removed", :title => diff.dig("title", "from"))]
+    else
+      items = []
+      items << t("node_actions.detail_title",
+                  :from => diff.dig("title", "from"), :to => diff.dig("title", "to")) if diff["title"]
+      items << t("node_actions.abstract_changed") if diff["abstract_changed"]
+      items << t("node_actions.body_changed")     if diff["body_changed"]
+      items
+    end
+  end
+
+  def revision_lifecycle_badges actions
+    return "" if actions.blank?
+
+    badges = actions.map do |action|
+      key = case action.action
+            when "create"  then "node_actions.revision_created"
+            when "publish" then action.metadata["via"] == "revision" ?
+                                  "node_actions.revision_restored" :
+                                  "node_actions.revision_published"
+            end
+      next unless key
+
+      badge = h(t(key, :date => action.occurred_at.strftime("%Y-%m-%d"),
+                       :actor => action.actor_name))
+      if action.inferred_from
+        badge = safe_join([badge, content_tag(:span, t("node_actions.backfilled"),
+                                               :class => "node_action_inferred",
+                                               :title => action.inferred_from)], " ")
+      end
+      badge
+    end.compact
+
+    return "" if badges.empty?
+    safe_join(["— ", safe_join(badges, " · ")])
+  end
+
+  private
+
+  def revision_ref action, key
+    label = t(key)
+    return label unless action.node && action.page
+    link_to(label, node_revision_path(action.node, action.page))
+  end
+
+  def actor_ref action
+    action.user ? link_to(h(action.actor_name), admin_log_path(:user_id => action.user_id))
+                : h(action.actor_name)
+  end
+
+  def subject_ref action
+    action.node ? link_to(h(action.subject_name), node_path(action.node))
+                : h(action.subject_name)
+  end
+
+  def summarize_publish action
+    if action.metadata["via"] == "revision"
+      t("node_actions.publish_rollback",
+         :actor => actor_ref(action), :subject => subject_ref(action),
+         :revision => revision_ref(action, "node_actions.revision_earlier")).html_safe
+    elsif action.metadata.dig("title", "from").nil?
+      author = action.metadata.dig("author", "to")
+      key = author ? "node_actions.publish_first_with_author" : "node_actions.publish_first"
+      t(key, :actor => actor_ref(action), :subject => subject_ref(action),
+              :author => h(author)).html_safe
+    else
+      t("node_actions.publish",
+         :actor => actor_ref(action), :subject => subject_ref(action),
+         :revision => revision_ref(action, "node_actions.revision_new")).html_safe
+    end
+  end
+
+  def summarize_move action
+    t("node_actions.move", :actor => actor_ref(action), :subject => subject_ref(action),
+       :from => h(action.metadata.dig("path", "from")),
+       :to   => h(action.metadata.dig("path", "to"))).html_safe
+  end
+
+  def summarize_create action
+    t("node_actions.create", :actor => actor_ref(action), :subject => subject_ref(action),
+       :path => h(action.metadata["path"])).html_safe
+  end
+
+  def summarize_discard_autosave action
+    t("node_actions.discard_autosave",
+       :actor => actor_ref(action), :subject => subject_ref(action)).html_safe
+  end
+
+  def summarize_destroy_draft action
+    t("node_actions.destroy_draft",
+       :actor => actor_ref(action), :subject => subject_ref(action)).html_safe
+  end
+
+  def summarize_trash action
+    t("node_actions.trash", :actor => actor_ref(action), :subject => subject_ref(action),
+       :from => h(action.metadata.dig("path", "from"))).html_safe
+  end
+
+  def summarize_restore_from_trash action
+    t("node_actions.restore_from_trash", :actor => actor_ref(action), :subject => subject_ref(action),
+       :to => h(action.metadata.dig("path", "to"))).html_safe
+  end
+
+  def summarize_destroy action
+    t("node_actions.destroy", :actor => actor_ref(action), :subject => subject_ref(action),
+       :path => h(action.metadata["path"])).html_safe
+  end
+end
diff --git a/app/models/concerns/nested_tree.rb b/app/models/concerns/nested_tree.rb
index 9a2eb0e..befcdb3 100644
--- a/app/models/concerns/nested_tree.rb
+++ b/app/models/concerns/nested_tree.rb
@@ -9,8 +9,6 @@ module NestedTree
   included do
     belongs_to :parent, class_name: name, foreign_key: :parent_id, optional: true, inverse_of: :children
     has_many :children, -> { order(:id) }, class_name: name, foreign_key: :parent_id, inverse_of: :parent
-
-    before_destroy :delete_descendants
   end
 
   class_methods do
@@ -77,10 +75,4 @@ module NestedTree
   def move_to_child_of(new_parent)
     update!(parent_id: new_parent.id)
   end
-
-  private
-
-  def delete_descendants
-    self.class.where(id: descendants.pluck(:id)).delete_all
-  end
 end
diff --git a/app/models/concerns/rrule_humanizer.rb b/app/models/concerns/rrule_humanizer.rb
index 8231de8..07141c1 100644
--- a/app/models/concerns/rrule_humanizer.rb
+++ b/app/models/concerns/rrule_humanizer.rb
@@ -15,8 +15,8 @@ module RruleHumanizer
   }.freeze
 
   ORDINAL_NAMES = {
-    de: { 1=>"ersten", 2=>"zweiten", 3=>"dritten", 4=>"vierten", -1=>"letzten", -2=>"vorletzten" },
-    en: { 1=>"first", 2=>"second", 3=>"third", 4=>"fourth", -1=>"last", -2=>"second-to-last" }
+    de: { 1=>"ersten", 2=>"zweiten", 3=>"dritten", 4=>"vierten", 5=>"fünften", -1=>"letzten", -2=>"vorletzten" },
+    en: { 1=>"first", 2=>"second", 3=>"third", 4=>"fourth", 5=>"fifth", -1=>"last", -2=>"second-to-last" }
   }.freeze
 
   MONTH_NAMES = {
@@ -35,7 +35,8 @@ module RruleHumanizer
     ordinals = ORDINAL_NAMES[loc] || ORDINAL_NAMES[:en]
     months   = MONTH_NAMES[loc]   || MONTH_NAMES[:en]
 
-    days = byday&.split(",")&.map do |d|
+    byday_values = byday&.split(",")
+    days = byday_values&.map do |d|
      if d =~ /^(-?\d+)([A-Z]{2})$/
         "#{ordinals[$1.to_i]} #{weekdays[$2]}"
       else
@@ -43,6 +44,32 @@ module RruleHumanizer
       end
     end
 
+    excluded_monthly_ordinal = nil
+    excluded_monthly_weekday = nil
+    selected_monthly_ordinals = nil
+    selected_monthly_weekday = nil
+    if freq == "MONTHLY" && byday_values.present?
+      ordinal_days = byday_values.map { |d| d.match(/^([1-5])([A-Z]{2})$/) }
+      if ordinal_days.all?
+        positions = ordinal_days.map { |match| match[1].to_i }.uniq.sort
+        weekdays_in_rule = ordinal_days.map { |match| match[2] }.uniq
+        if weekdays_in_rule.size == 1
+          selected_monthly_ordinals = positions
+          selected_monthly_weekday = weekdays_in_rule.first
+          missing_positions = (1..5).to_a - positions
+          if positions.size == 4 && missing_positions.size == 1
+            excluded_monthly_ordinal = missing_positions.first
+            excluded_monthly_weekday = selected_monthly_weekday
+          end
+        end
+      end
+    end
+
+    join_ordinals = lambda do |ordinal_values, conjunction|
+      names = ordinal_values.map { |ordinal| ordinals[ordinal] }
+      names.size > 1 ? "#{names[0..-2].join(', ')} #{conjunction} #{names.last}" : names.first
+    end
+
     base =
       case loc
       when :de
@@ -59,14 +86,26 @@ module RruleHumanizer
             interval == 2 ? "Alle zwei Wochen" : "Wöchentlich"
           end
         when "MONTHLY"
-          days ? "Jeden #{days.join(' und ')} im Monat" : "Monatlich"
+          if excluded_monthly_ordinal
+            "Jeden #{weekdays[excluded_monthly_weekday]} im Monat, außer dem #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Jeden #{join_ordinals.call(selected_monthly_ordinals, 'und')} #{weekdays[selected_monthly_weekday]} im Monat"
+          else
+            days ? "Jeden #{days.join(' und ')} im Monat" : "Monatlich"
+          end
         end
       else
         case freq
         when "WEEKLY"
           days ? "#{interval == 2 ? 'Every other' : 'Every'} #{days.join(' and ')}" : (interval == 2 ? "Every other week" : "Weekly")
         when "MONTHLY"
-          days ? "Every #{days.join(' and ')} of the month" : "Monthly"
+          if excluded_monthly_ordinal
+            "Every #{weekdays[excluded_monthly_weekday]} of the month, except the #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Every #{join_ordinals.call(selected_monthly_ordinals, 'and')} #{weekdays[selected_monthly_weekday]} of the month"
+          else
+            days ? "Every #{days.join(' and ')} of the month" : "Monthly"
+          end
         end
       end
     return nil unless base
diff --git a/app/models/node.rb b/app/models/node.rb
index 311c5c0..a440c2f 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -4,17 +4,23 @@ class Node < ApplicationRecord
 
   # Associations
   has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
-  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy, optional: true
-  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy, optional: true
+  has_many    :node_actions, :dependent => :nullify
+  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, optional: true
+  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, optional: true
+  # Autosave pages carry no node_id, so has_many :pages does not cover
+  # them -- this dependent: :destroy is their only cleanup on node destroy.
   belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
+
   has_many    :permissions, :dependent => :destroy
   has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
   # Callbacks
-  after_create  :initialize_empty_page
-  before_save   :check_for_changed_slug
-  after_save    :update_unique_names_of_children
+  after_create   :initialize_empty_page
+  before_save    :check_for_changed_slug
+  after_save     :update_unique_names_of_children
+  before_destroy :refuse_destroy_with_children
+  before_destroy :refuse_destroying_trash_node
 
   # Validations
   validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? || slug.blank? }
@@ -22,6 +28,21 @@ class Node < ApplicationRecord
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
+  validate :reserved_slug_stays_reserved
+  validate :no_head_inside_trash
+  validates :default_template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :default_template_name_changed?
+
+  # Everything outside the Trash subtree, the Trash node included.
+  # Relies on unique_name being authoritative for tree position --
+  # the same trust public routing places in it.
+  scope :not_in_trash, -> {
+    where.not(:unique_name => CccConventions::TRASH_SLUG)
+      .where("unique_name NOT LIKE ?", "#{CccConventions::TRASH_SLUG}/%")
+  }
+
   # Class methods
 
   # Returns a page for a given node. If no revision is supplied, it returns
@@ -48,6 +69,19 @@ class Node < ApplicationRecord
     nil
   end
 
+  # The Trash container node. Lazily self-creating and idempotent, so
+  # every environment acquires it on first touch.
+  # Never call from validations. the positional predicates below
+  # exist for that.
+  def self.trash
+    root.children.find_by(:slug => CccConventions::TRASH_SLUG) ||
+      root.children.create!(:slug => CccConventions::TRASH_SLUG).tap do |node|
+        Globalize.with_locale(I18n.default_locale) do
+          node.draft.update!(:title => "Trash")
+        end
+      end
+  end
+
   # Instance Methods
 
   # Acquires (or reaffirms) the editing lock without creating a draft or
@@ -170,10 +204,12 @@ class Node < ApplicationRecord
       self.autosave.destroy
       self.autosave_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "discard_autosave")
     elsif self.draft && self.head
       self.draft.destroy
       self.draft_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy_draft")
     end
 
     self.unlock! unless self.draft
@@ -188,54 +224,189 @@ class Node < ApplicationRecord
     end
   end
 
-  def publish_draft!
+  def publish_draft! current_user = nil
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
-    if self.draft
-      self.head = self.draft
-      self.head.published_at ||= Time.now
-      self.head.save!
-      self.draft = nil
+    if in_trash? || trash_node?
+      raise ActiveRecord::RecordInvalid.new(self), "Cannot publish a node in the Trash"
     end
 
-    if staged_slug && (staged_slug != slug)
-      self.slug = staged_slug
-      self.staged_slug = nil
-    end
+    path_before = self.unique_name
+
+    ActiveRecord::Base.transaction do
+      if self.draft
+        outgoing_head = self.head
+        self.head = self.draft
+        self.head.published_at ||= Time.now
+        self.head.save!
+        self.draft = nil
+
+        NodeAction.record!(:node => self, :page => self.head, :user => current_user,
+                            :action => "publish", :via => "draft",
+                            **NodeAction.head_diff(outgoing_head, self.head))
+      end
+
+      if staged_slug && (staged_slug != slug)
+        self.slug = staged_slug
+        self.staged_slug = nil
+      end
 
-    if staged_parent_id && (staged_parent_id != parent_id)
-      new_parent = Node.find(staged_parent_id)
+      if staged_parent_id && (staged_parent_id != parent_id)
+        new_parent = Node.find(staged_parent_id)
+
+        if new_parent == self || self.descendants.include?(new_parent)
+          raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+        end
+
+        self.staged_parent_id = nil
+        self.save!
+        self.move_to_child_of(new_parent)
+      else
+        unless self.save
+          raise ActiveRecord::RecordInvalid.new(self)
+        end
+      end
 
-      if new_parent == self || self.descendants.include?(new_parent)
-        raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+      self.reload
+      self.update_unique_name
+      self.send(:update_unique_names_of_children)
+      if self.unique_name != path_before
+        NodeAction.record!(:node => self, :user => current_user, :action => "move",
+                            :path => { "from" => path_before, "to" => self.unique_name })
       end
+      self.unlock!
+      self
+    end
+  end
+
+  def restore_revision! revision, current_user = nil
+    page = self.pages.find_by_revision(revision)
+    return nil unless page
 
-      self.staged_parent_id = nil
+    ActiveRecord::Base.transaction do
+      outgoing_head = self.head
+      self.head = page
       self.save!
-      self.move_to_child_of(new_parent)
-    else
-      unless self.save
-        raise ActiveRecord::RecordInvalid.new(self)
+
+      NodeAction.record!(:node => self, :page => page, :user => current_user,
+                          :action => "publish", :via => "revision",
+                          **NodeAction.head_diff(outgoing_head, page))
+      self
+    end
+  end
+
+
+  # Moves this node and its subtree into the Trash. Demotes every head
+  # in the subtree first (aggregators and search operate on heads
+  # regardless of tree position); where a node has no draft, the former
+  # head becomes its draft so content stays editable and restorable --
+  # otherwise the former head remains a plain revision. One log entry,
+  # at the root, carrying the leaving-public-view snapshot.
+  def trash! current_user = nil
+    return nil if in_trash?
+    raise ActiveRecord::RecordInvalid.new(self), "The Trash node itself cannot be trashed" if trash_node?
+
+    ActiveRecord::Base.transaction do
+      path_before        = unique_name
+      was_published      = head_id.present?
+      final_published_at = head&.published_at
+
+      demoted = 0
+      ([self] + descendants.to_a).each do |node|
+        next unless node.head_id
+        former        = node.head
+        node.head     = nil
+        node.draft_id = former.id if node.draft_id.nil?
+        node.save!
+        demoted += 1
       end
+
+      self.reload
+      move_to_child_of(Node.trash)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+      unlock!
+
+      metadata = { :path => { "from" => path_before, "to" => unique_name } }
+      metadata[:was_published]      = true if was_published
+      metadata[:final_published_at] = final_published_at.iso8601 if final_published_at
+      metadata[:demoted_heads]      = demoted if demoted > 0
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "trash", **metadata)
+      self
+    end
+  end
+
+  # Returns the node to the living tree under a chosen parent. The
+  # subtree comes back exactly as it sits in the Trash: all drafts,
+  # nothing published. Republication is a separate, witnessed act
+  # per node.
+  def restore_from_trash! new_parent, current_user = nil
+    return nil unless in_trash?
+
+    if new_parent.nil? || new_parent == self || descendants.include?(new_parent) ||
+       new_parent.trash_node? || new_parent.in_trash?
+      raise ActiveRecord::RecordInvalid.new(self), "Restore target must be a living node"
     end
 
-    self.reload
-    self.update_unique_name
-    self.send(:update_unique_names_of_children)
-    self.unlock!
-    self
+    ActiveRecord::Base.transaction do
+      path_before = unique_name
+      move_to_child_of(new_parent)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "restore_from_trash",
+                          :path => { "from" => path_before, "to" => unique_name })
+      self
+    end
   end
 
-  def restore_revision! revision
-    if page = self.pages.find_by_revision(revision)
-      self.head = page
-      self.save
-    else
-      nil
+  # Final deletion -- only from inside the Trash. Removes the whole
+  # subtree, deepest first, each node through a real destroy! so every
+  # per-node cascade runs (the categorical difference from the old
+  # delete_all nuke). refuse_destroy_with_children on bare destroy is
+  # untouched
+  # One log entry at the root, per the subtree rule, written before the
+  # rows die.
+  def destroy_from_trash! current_user = nil
+    raise ActiveRecord::RecordInvalid.new(self), "Nodes are only destroyed from the Trash" unless in_trash?
+
+    ActiveRecord::Base.transaction do
+      doomed = self_and_descendants_ordered_with_level
+                 .sort_by { |_, level| -level }
+                 .map(&:first)
+
+      metadata = { :path => unique_name }
+      metadata[:destroyed_descendants] = doomed.size - 1 if doomed.size > 1
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy", **metadata)
+      doomed.each(&:destroy!)
     end
   end
 
+  # The most recent trash entry. Its path.from is the restore hint.
+  def last_trash_entry
+    node_actions.where(:action => "trash").order(:occurred_at => :desc, :id => :desc).first
+  end
+
+  # The node's pre-trash parent, if a living node still answers to
+  # that path. Nil when the parent was itself trashed (its unique_name
+  # changed) or deleted; a different node that has since taken over
+  # the path is a legitimate suggestion.
+  def suggested_restore_parent
+    from = last_trash_entry&.metadata&.dig("path", "from")
+    return nil unless from
+
+    parent_path = from.rpartition("/").first
+    return Node.root if parent_path.empty?
+
+    candidate = Node.find_by(:unique_name => parent_path)
+    candidate unless candidate.nil? || candidate.in_trash? || candidate.trash_node?
+  end
+
   # returns an array with all parts of a unique_name rather than a string
   def unique_path
     unique_name.to_s.split("/")
@@ -246,9 +417,12 @@ class Node < ApplicationRecord
     parent.nil? ? [slug] : parent.path_to_root.push(slug)
   end
 
+  def computed_unique_name
+    path_to_root[1..-1].join("/") # excluding root
+  end
+
   def current_unique_name
-    path = path_to_root[1..-1] # excluding root
-    self.unique_name = path.join("/")
+    self.unique_name = computed_unique_name
   end
 
   def update_unique_name
@@ -288,6 +462,20 @@ class Node < ApplicationRecord
     autosave || draft || head
   end
 
+  def trash_node?
+    parent&.root? && slug == CccConventions::TRASH_SLUG
+  end
+
+  # Inside the Trash subtree. False for the Trash node itself.
+  def in_trash?
+    current = parent
+    while current
+      return true if current.trash_node?
+      current = current.parent
+    end
+    false
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -328,7 +516,7 @@ class Node < ApplicationRecord
   end
 
   def self.drafts_and_autosaves(current_user_id: nil)
-    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL")
+    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL").not_in_trash
     return scope.order("updated_at DESC") unless current_user_id
 
     scope.order(
@@ -336,6 +524,15 @@ class Node < ApplicationRecord
     )
   end
 
+  # Nodes are never destroyed recursively
+  # Descendants must be removed or reparented individually first.
+  # The Trash feature will be the ordinary path to deletion.
+  def refuse_destroy_with_children
+    return unless children.exists?
+    errors.add(:base, "Cannot destroy a node that still has children")
+    throw :abort
+  end
+
   def self.recently_changed
     includes(:head).where(
       "pages.updated_at < ? AND pages.updated_at > ? AND nodes.parent_id IS NOT NULL",
@@ -392,4 +589,36 @@ class Node < ApplicationRecord
         end
       end
     end
+
+  private
+
+    def reserved_slug_stays_reserved
+      if parent&.root? && !trash_node_already_me?
+        errors.add(:slug, "is reserved for the Trash") if slug == CccConventions::TRASH_SLUG
+        errors.add(:staged_slug, "is reserved for the Trash") if staged_slug == CccConventions::TRASH_SLUG
+      end
+
+      if persisted? && slug_was == CccConventions::TRASH_SLUG && Node.find(id).trash_node?
+        errors.add(:slug, "of the Trash node cannot change") if slug_changed?
+        errors.add(:parent_id, "of the Trash node cannot change") if parent_id_changed?
+        errors.add(:staged_slug, "must stay empty on the Trash node") if staged_slug.present?
+        errors.add(:staged_parent_id, "must stay empty on the Trash node") if staged_parent_id.present?
+      end
+    end
+
+    def trash_node_already_me?
+      existing = Node.root&.children&.find_by(:slug => CccConventions::TRASH_SLUG)
+      existing.nil? || existing.id == id
+    end
+
+    def no_head_inside_trash
+      return unless head_id.present?
+      errors.add(:head_id, "cannot exist inside the Trash") if in_trash? || trash_node?
+    end
+
+    def refuse_destroying_trash_node
+      return unless trash_node?
+      errors.add(:base, "The Trash node cannot be destroyed")
+      throw :abort
+    end
 end
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
new file mode 100644
index 0000000..13bd5ba
--- /dev/null
+++ b/app/models/node_action.rb
@@ -0,0 +1,169 @@
+class NodeAction < ApplicationRecord
+  belongs_to :node, optional: true
+  belongs_to :page, optional: true
+  belongs_to :user, optional: true
+
+  validates :action, presence: true
+  validates :occurred_at, presence: true
+
+  # == Metadata contract ==
+  #
+  # metadata is written once at creation, never updated. It is the
+  # single place anything that must survive deletion of the referenced
+  # rows lives; node_id/page_id/user_id are lookup and ordering only.
+  # All keys are strings. Pairs are always {"from" => x, "to" => y}.
+  # Optional pairs only when the sides differ; booleans only when
+  # true; required keys always present. Titles and names are read
+  # pinned to I18n.default_locale unless inside a locale-keyed block.
+  #
+  # Baseline, every entry (written here, not by call sites):
+  #   "username"                 -- actor's login at write time
+  #   "human_readable_node_name" -- node title, default locale
+  #
+  # "create":
+  #   "title" -- initial title, flat string (NOT a pair)
+  #   "path"  -- unique path at creation, flat string. Historical
+  #              value only; never a join key.
+  #
+  # "publish" (any promotion to head; diff computed BEFORE head is
+  # re-pointed, over the union of both pages' locales, by head_diff --
+  # shared with the backfill):
+  #   "via"    -- "draft" | "revision" (rollback). Always written;
+  #               absent means a pre-contract entry.
+  #   "title"  -- pair, always; "from" null on first publish
+  #   "author" -- pair, when the byline changed (incl. first publish)
+  #   "tags"   -- pair of arrays, when changed
+  #   "assets_changed", "template_changed",
+  #   "abstract_changed", "body_changed"
+  #            -- the last two for the default locale; page_id links
+  #               to the revision for the real diff (never stored)
+  #   "translation_diff" -- only when a non-default locale differs:
+  #     { "<locale>" => {
+  #         "status" -- "added" | "removed" | "changed"
+  #         "title"  -- pair, only when it differs; "from" null when
+  #                     added, "to" null when removed
+  #         "abstract_changed", "body_changed" -- status "changed" only
+  #     } }
+  #
+  # "move" (reparent and/or path change; one entry at the subtree
+  # root, descendants get none):
+  #   "path" -- pair
+  #
+  # "trash" (subtree into the Trash; every head in the subtree is
+  # demoted first; one entry at the root; snapshots the
+  # leaving-public-view state, since Trash holds no heads and destroy
+  # can no longer know):
+  #   "path"               -- pair; "from" doubles as the restore hint
+  #   "was_published"      -- boolean
+  #   "demoted_heads"      -- integer count, only when positive
+  #   "final_published_at" -- ISO8601 string, only when present
+  #
+  # "restore_from_trash" (reparent back to a living node; returns as
+  # drafts, republication is a separate witnessed act):
+  #   "path" -- pair
+  #
+  # "destroy" (only from inside the Trash, never with children; the
+  # entry is written in the same transaction before the row dies):
+  #   "path" -- final path, flat string (create-symmetric)
+  #   "destroyed_descendants" -- integer, only when positive; one entry
+  #                              at the root, per the subtree rule.
+  #
+  # Reserved: "demote" (via "trash" | "depublish") for an explicit
+  # depublish workflow, if ever built.
+  #
+  # Backfilled entries mirror this vocabulary; diff content is
+  # computed, only actor (page.editor) and occurred_at are inferred,
+  # inferred_from names the heuristic ("from_node_created_at",
+  # "from_page_revision"). Null = witnessed live.
+  #
+  # The "locale" column is written by no verb; retained.
+  #
+  # This log records; it does not undo. No IP, session, or user
+  # agent, ever. Success only.
+
+  def self.record!(node:, action:, user: nil, page: nil, locale: nil,
+                    occurred_at: nil, inferred_from: nil, **extra)
+    create!(
+      :node          => node,
+      :page          => page,
+      :user          => user,
+      :action        => action,
+      :locale        => locale,
+      :occurred_at   => occurred_at || Time.now,
+      :inferred_from => inferred_from,
+      :metadata      => {
+        "username"                 => user&.login,
+        "human_readable_node_name" => Globalize.with_locale(I18n.default_locale) {
+                                        node&.head&.title || node&.draft&.title
+                                      },
+      }.merge(extra.stringify_keys)
+    )
+  end
+
+  # Computes the publish-entry diff between an outgoing head and the
+  # page replacing it, in the exact metadata shape the contract above
+  # specifies. Pure function of its two arguments -- shared verbatim by
+  # publish_draft!, restore_revision!, and the backfill task. Reads
+  # translation rows directly, never locale-dependent accessors, so a
+  # fallback value is never mistaken for real content. Returns
+  # symbol-keyed top level for splatting into record!; nested keys are
+  # strings and jsonb serialization stringifies the rest at write time.
+  def self.head_diff old_page, new_page
+    default = I18n.default_locale
+
+    title_of = ->(page) { page&.translations&.find_by(:locale => default)&.title }
+    diff = { :title => { "from" => title_of.call(old_page),
+                         "to"   => title_of.call(new_page) } }
+    unless old_page
+      diff[:author] = { "from" => nil, "to" => new_page.user&.login } if new_page.user
+      return diff
+    end
+
+    old_author, new_author = old_page.user&.login, new_page.user&.login
+    diff[:author] = { "from" => old_author, "to" => new_author } if old_author != new_author
+
+    old_tags, new_tags = old_page.tag_list.sort, new_page.tag_list.sort
+    diff[:tags] = { "from" => old_tags, "to" => new_tags } if old_tags != new_tags
+
+    diff[:template_changed] = true if old_page.template_name != new_page.template_name
+    diff[:assets_changed]   = true if old_page.assets.map(&:id) != new_page.assets.map(&:id)
+
+    old_t = old_page.translations.find_by(:locale => default)
+    new_t = new_page.translations.find_by(:locale => default)
+    diff[:abstract_changed] = true if old_t&.abstract != new_t&.abstract
+    diff[:body_changed]     = true if old_t&.body != new_t&.body
+
+    locales = (old_page.translated_locales | new_page.translated_locales) - [default]
+    translation_diff = {}
+
+    locales.sort_by(&:to_s).each do |locale|
+      o = old_page.translations.find_by(:locale => locale)
+      n = new_page.translations.find_by(:locale => locale)
+
+      if o.nil?
+        translation_diff[locale.to_s] = { "status" => "added",
+                                          "title" => { "from" => nil, "to" => n.title } }
+      elsif n.nil?
+        translation_diff[locale.to_s] = { "status" => "removed",
+                                          "title" => { "from" => o.title, "to" => nil } }
+      elsif o.title != n.title || o.abstract != n.abstract || o.body != n.body
+        entry = { "status" => "changed" }
+        entry["title"]            = { "from" => o.title, "to" => n.title } if o.title != n.title
+        entry["abstract_changed"] = true if o.abstract != n.abstract
+        entry["body_changed"]     = true if o.body != n.body
+        translation_diff[locale.to_s] = entry
+      end
+    end
+
+    diff[:translation_diff] = translation_diff if translation_diff.any?
+    diff
+  end
+
+  def actor_name
+    metadata["username"] || "unknown"
+  end
+
+  def subject_name
+    metadata["human_readable_node_name"] || node&.unique_name || "deleted node"
+  end
+end
diff --git a/app/models/page.rb b/app/models/page.rb
index e5a8d9d..f33d88d 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -11,11 +11,21 @@ class Page < ApplicationRecord
 
   translates :title, :abstract, :body # Globalize2
 
+  # Template names render as filesystem paths; only names actually
+  # present in the public template directory are acceptable. Validated
+  # only on change so legacy rows whose template file has since
+  # vanished stay saveable -- valid_template already falls back to
+  # standard_template for those at render time.
+  validates :template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :template_name_changed?
+
   # Associations
   belongs_to :node, optional: true
   belongs_to :user, optional: true
   belongs_to :editor, :class_name => "User", optional: true
-  has_many   :related_assets
+  has_many   :related_assets, :dependent => :destroy
   has_many   :assets, -> { order("position ASC") }, :through => :related_assets
 
   # Named scopes
@@ -77,7 +87,10 @@ class Page < ApplicationRecord
         .paginate(:page => page, :per_page => options[:limit])
     end
 
-    scope.order("#{options[:order_by]} #{direction}")
+    column = options[:order_by].to_s.sub(/\Apages\./, "")
+    column = "id" unless %w[id published_at created_at updated_at].include?(column)
+
+    scope.order("pages.#{column} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 92ac33a..5e47ae7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,10 @@
 require 'digest/sha1'
 
 class User < ApplicationRecord
+  has_secure_password(validations: false)
+
+  alias_method :authenticate_bcrypt, :authenticate
+
   # Mixins and Plugins
   include Authentication
   include Authentication::ByPassword
@@ -23,9 +27,30 @@ class User < ApplicationRecord
 
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
-    return nil if login.blank? || password.blank?
-    u = find_by_login(login) # need to get the salt
-    u && u.authenticated?(password) ? u : nil
+    return if login.blank? || password.blank?
+
+    user = find_by(login: login)
+    return unless user
+
+    user&.authenticate(password)
+  end
+
+  def authenticate(password)
+    if password_digest.present?
+      return self if authenticate_bcrypt(password)
+      return nil
+    end
+
+    return nil unless authenticate_legacy(password)
+
+    transaction do
+      self.password = password
+      self.crypted_password = nil
+      self.salt = nil
+      save!(validate: false)
+    end
+
+    self
   end
 
   # TODO: Do we really want to have downcase logins only?
diff --git a/app/views/admin/_recent_changes.html.erb b/app/views/admin/_recent_changes.html.erb
deleted file mode 100644
index 88b5e93..0000000
--- a/app/views/admin/_recent_changes.html.erb
+++ /dev/null
@@ -1,24 +0,0 @@
-<h2>Recent Changes</h2>
-<div id="draft_list">
-  <table>
-    <tr class="header">
-      <th>Title</th>
-      <th>path</th>
-      <th>user</th>
-      <th>date</th>
-      <th></th>
-    </tr>
-    <% @recent_changes.each do |node| %>
-    <tr>
-      <td><%= truncated_title_for_node node %></td>
-      <td><%= node.unique_name %></td>
-      <td><%= node.draft.user.login rescue "" %></td>
-      <td><%= node.updated_at.to_fs(:db) %></td>
-      <td class="actions">
-        <%= link_to 'Show', node_path(node) %>
-        <%= link_to "Revisions", revision_path(:id => node.id) %>
-      </td>
-    </tr>
-    <% end %>
-  </table>
-</div>
\ No newline at end of file
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb
index bdb555e..319530d 100644
--- a/app/views/admin/index.html.erb
+++ b/app/views/admin/index.html.erb
@@ -42,21 +42,12 @@
 
   <div class="dashboard_widget">
     <h3>Recent changes</h3>
-    <ul>
-    <% @recent_changes.each do |node| %>
-      <li>
-        <div>
-          <%= link_to title_for_node(node), node_path(node) %>
-          <span class="field_hint"><%= link_to_path("#{node.unique_name} ↗", node.unique_name) %></span>
-        </div>
-        <span class="dashboard_widget_meta">
-          <%= (editor = node_head_editor(node)) ? t("published_by", editor: editor) : t("published") %>, <%= relative_time_phrase(node.head.updated_at) %>
-        </span>
-      </li>
-    <% end %>
-    </ul>
-    <%= link_to "See all recent changes →", recent_nodes_path %>
+    <table id="node_action_list">
+      <%= render partial: "node_actions/action_row", collection: @actions, as: :action %>
+    </table>
+    <%= link_to "See all recent changes →", admin_log_path %>
   </div>
+
 </div>
 
 <div id="dashboard_housekeeping">
@@ -77,5 +68,9 @@
     <%= link_to menu_items_path, class: "action_button" do %>
       <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> Navigation
     <% end %>
+    <% trash_count = Node.trash.children.count %>
+    <%= link_to trashed_nodes_path, class: "action_button" do %>
+      <%= icon("trash", library: "tabler", "aria-hidden": true) %> Trash<%= " (#{trash_count})" if trash_count > 0 %>
+    <% end %>
   </div>
 </div>
diff --git a/app/views/events/_rrule_builder.html.erb b/app/views/events/_rrule_builder.html.erb
new file mode 100644
index 0000000..1ffec0a
--- /dev/null
+++ b/app/views/events/_rrule_builder.html.erb
@@ -0,0 +1,33 @@
+<div id="rrule_builder">
+  <p>
+    <label><%= radio_button_tag "rrule_freq", "weekly", true %> Weekly</label>
+    <label><%= radio_button_tag "rrule_freq", "monthly" %> Monthly</label>
+  </p>
+  <div id="rrule_weekly_options">
+    <p><label><%= check_box_tag "rrule_biweekly" %> Every 2 weeks</label></p>
+    <p>
+      <% %w[MO TU WE TH FR SA SU].each do |code| %>
+        <label><%= check_box_tag "rrule_byday_#{code}" %> <%= RruleHumanizer::WEEKDAY_NAMES_ABBR[:de][code] %></label>
+      <% end %>
+    </p>
+  </div>
+  <div id="rrule_monthly_options" style="display: none;">
+    <p><label><%= check_box_tag "rrule_monthly_ordinal" %> On a specific weekday each month</label></p>
+    <p id="rrule_ordinal_fields" style="display: none;">
+      <%= select_tag "rrule_ordinal", options_for_select([["1.", 1], ["2.", 2], ["3.", 3], ["4.", 4], ["letzter", -1], ["vorletzter", -2], ["Selected weeks", "custom"]]) %>
+      <%= select_tag "rrule_ordinal_day", options_for_select(%w[MO TU WE TH FR SA SU].map { |c| [RruleHumanizer::WEEKDAY_NAMES[:de][c], c] }) %>
+    </p>
+    <p id="rrule_custom_ordinal_fields" style="display: none;">
+      Weeks of the month:
+      <% (1..5).each do |ordinal| %>
+        <label><%= check_box_tag "rrule_custom_ordinal_#{ordinal}" %> <%= ordinal %>.</label>
+      <% end %>
+    </p>
+  </div>
+  <p>
+    <label><%= check_box_tag "rrule_exclude_month" %> Except in one month</label>
+    <%= select_tag "rrule_excluded_month", options_for_select((1..12).map { |m| [RruleHumanizer::MONTH_NAMES[:de][m-1], m] }), style: "display: none;" %>
+  </p>
+  <span class="field_hint">Builds the field below automatically. If your pattern is more complex than this covers, just edit it directly below - these controls won't touch it unless you use them.</span>
+</div>
+<%= f.text_field :rrule, id: "event_rrule" %>
diff --git a/app/views/events/edit.html.erb b/app/views/events/edit.html.erb
index b6564a4..4532ff2 100644
--- a/app/views/events/edit.html.erb
+++ b/app/views/events/edit.html.erb
@@ -40,33 +40,7 @@
 
       <div class="node_description">Recurrence</div>
       <div class="node_content">
-        <div id="rrule_builder">
-          <p>
-            <label><%= radio_button_tag "rrule_freq", "weekly", true %> Weekly</label>
-            <label><%= radio_button_tag "rrule_freq", "monthly" %> Monthly</label>
-          </p>
-          <div id="rrule_weekly_options">
-            <p><label><%= check_box_tag "rrule_biweekly" %> Every 2 weeks</label></p>
-            <p>
-              <% %w[MO TU WE TH FR SA SU].each do |code| %>
-                <label><%= check_box_tag "rrule_byday_#{code}" %> <%= RruleHumanizer::WEEKDAY_NAMES_ABBR[:de][code] %></label>
-              <% end %>
-            </p>
-          </div>
-          <div id="rrule_monthly_options" style="display: none;">
-            <p><label><%= check_box_tag "rrule_monthly_ordinal" %> On a specific weekday each month</label></p>
-            <p id="rrule_ordinal_fields" style="display: none;">
-              <%= select_tag "rrule_ordinal", options_for_select([["1.", 1], ["2.", 2], ["3.", 3], ["4.", 4], ["letzter", -1], ["vorletzter", -2]]) %>
-              <%= select_tag "rrule_ordinal_day", options_for_select(%w[MO TU WE TH FR SA SU].map { |c| [RruleHumanizer::WEEKDAY_NAMES[:de][c], c] }) %>
-            </p>
-          </div>
-          <p>
-            <label><%= check_box_tag "rrule_exclude_month" %> Except in one month</label>
-            <%= select_tag "rrule_excluded_month", options_for_select((1..12).map { |m| [RruleHumanizer::MONTH_NAMES[:de][m-1], m] }), style: "display: none;" %>
-          </p>
-          <span class="field_hint">Builds the field below automatically. If your pattern is more complex than this covers, just edit it directly below - these controls won't touch it unless you use them.</span>
-        </div>
-        <%= f.text_field :rrule, id: "event_rrule" %>
+        <%= render "rrule_builder", f: f %>
       </div>
 
       <div class="node_description">Title</div>
diff --git a/app/views/events/new.html.erb b/app/views/events/new.html.erb
index 7a1ee7a..028fce7 100644
--- a/app/views/events/new.html.erb
+++ b/app/views/events/new.html.erb
@@ -21,8 +21,8 @@
       <div class="node_description">End time</div>
       <div class="node_content"><%= f.datetime_select :end_time %></div>
 
-      <div class="node_description">Rrule</div>
-      <div class="node_content"><%= f.text_field :rrule %></div>
+      <div class="node_description">Recurrence</div>
+      <div class="node_content"><%= render "rrule_builder", f: f %></div>
 
       <div class="node_description">Title</div>
       <div class="node_content">
@@ -53,4 +53,3 @@
     </div>
   </div>
 <% end %>
-
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
index 0856a0f..e220beb 100644
--- a/app/views/layouts/admin.html.erb
+++ b/app/views/layouts/admin.html.erb
@@ -7,19 +7,18 @@
     <%= csrf_meta_tags %>
   
     <title><%= "#{params[:controller]} | #{params[:action]}" %></title>
-    <%= javascript_tag "var AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %>
     <%= javascript_include_tag 'admin_bundle' %>
     <%= tinymce_assets %>
     <link rel="stylesheet" href="<%= mtime_busted_path('/stylesheets/admin.css') %>">
     <script src="<%= mtime_busted_path('/javascripts/admin_search.js') %>"></script>
     <script src="<%= mtime_busted_path('/javascripts/admin_interface.js') %>"></script>
     <script src="<%= mtime_busted_path('/javascripts/related_assets.js') %>"></script>
-    <script>
+    <%= javascript_tag nonce: true do %>
       var ADMIN_SEARCH_URL = "<%= admin_search_path %>";
       var ADMIN_MENU_SEARCH_URL = "<%= admin_menu_search_path %>";
       var PARAMETERIZE_PREVIEW_URL = "<%= parameterize_preview_nodes_path %>";
       var DASHBOARD_SEARCH_URL = "<%= admin_dashboard_search_path %>";
-    </script>
+    <% end %>
   </head>
   
   <body>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index d7681af..ca867ab 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -18,12 +18,12 @@
     <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %>
     <%= auto_discovery_link_tag(:rss,  '/rss/updates.rdf', title: "RSS") %>
 
-    <script>
-      (function() { document.addEventListener("DOMContentLoaded", function() {
-        if (localStorage.getItem('override-prefers-color-scheme', false))
+    <%= javascript_tag nonce: true do %>
+      document.addEventListener("DOMContentLoaded", function() {
+        if (localStorage.getItem('override-prefers-color-scheme'))
           document.getElementById("light-mode").checked = true;
-      }); })();
-    </script>
+      });
+    <% end %>
 
   </head>
 
diff --git a/app/views/node_actions/_action_row.html.erb b/app/views/node_actions/_action_row.html.erb
new file mode 100644
index 0000000..a9a3b8d
--- /dev/null
+++ b/app/views/node_actions/_action_row.html.erb
@@ -0,0 +1,18 @@
+<tr class="node_action node_action--<%= action.action %>">
+  <td class="node_action_time">
+    <span class="node_action_date"><%= action.occurred_at.strftime("%Y-%m-%d") %></span>
+    <%= verb_icon(action) %>
+    <span class="node_action_clock"><%= action.occurred_at.strftime("%H:%M") %></span>
+  </td>
+  <td class="node_action_body">
+    <%= action_summary(action) %>
+    <% if action.node_id && params[:node_id].blank? %>
+      <%= link_to t("node_actions.node_history"), admin_log_path(:node_id => action.node_id), :class => "node_action_zoom" %>
+    <% end %>
+    <% if action.inferred_from %>
+      <span class="node_action_inferred" title="<%= action.inferred_from %>"><%= t("node_actions.backfilled") %></span>
+    <% end %>
+    <%= render "node_actions/change_details", :action_entry => action if action_details?(action) %>
+  </td>
+</tr>
+
diff --git a/app/views/node_actions/_change_details.html.erb b/app/views/node_actions/_change_details.html.erb
new file mode 100644
index 0000000..2583e8b
--- /dev/null
+++ b/app/views/node_actions/_change_details.html.erb
@@ -0,0 +1,27 @@
+<details class="node_action_details">
+  <summary><%= t("node_actions.show_changes") %></summary>
+  <table>
+    <% if (default_items = default_locale_changes(action_entry)).any? %>
+      <tr>
+        <th><%= I18n.default_locale.to_s.upcase %></th>
+        <td>
+          <%= safe_join(default_items, ", ") %>
+          <% if action_entry.page && action_entry.node %>
+            <%= link_to t("node_actions.view_revision"), node_revision_path(action_entry.node, action_entry.page) %>
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+    <% (action_entry.metadata["translation_diff"] || {}).each do |locale, diff| %>
+      <tr>
+        <th><%= locale.upcase %></th>
+        <td>
+          <%= safe_join(translation_changes(diff), ", ") %>
+          <% if action_entry.page && action_entry.node %>
+            <%= link_to t("node_actions.view_revision"), node_revision_path(action_entry.node, action_entry.page, :locale => locale) %>
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+  </table>
+</details>
diff --git a/app/views/node_actions/index.html.erb b/app/views/node_actions/index.html.erb
new file mode 100644
index 0000000..20ef5b3
--- /dev/null
+++ b/app/views/node_actions/index.html.erb
@@ -0,0 +1,13 @@
+<h1><%= t("node_actions.heading") %></h1>
+
+<% if params[:node_id].present? || params[:user_id].present? %>
+  <p><%= link_to t("node_actions.show_all"), admin_log_path %></p>
+<% end %>
+
+<%= will_paginate @actions %>
+
+<table id="node_action_list">
+  <%= render partial: "node_actions/action_row", collection: @actions, as: :action %>
+</table>
+
+<%= will_paginate @actions %>
diff --git a/app/views/nodes/_recent_change_item.html.erb b/app/views/nodes/_recent_change_item.html.erb
new file mode 100644
index 0000000..754a775
--- /dev/null
+++ b/app/views/nodes/_recent_change_item.html.erb
@@ -0,0 +1,9 @@
+<li>
+  <div>
+    <%= link_to title_for_node(node), node_path(node) %>
+    <span class="field_hint"><%= link_to_path("#{node.unique_name} ↗", node.unique_name) %></span>
+  </div>
+  <span class="dashboard_widget_meta">
+    <%= (editor = node_head_editor(node)) ? t("last_edited_by", editor: editor) : t("last_edited") %>, <%= relative_time_phrase(node.head.updated_at) %>
+  </span>
+</li>
diff --git a/app/views/nodes/destroy.html.erb b/app/views/nodes/destroy.html.erb
deleted file mode 100644
index 065cf1d..0000000
--- a/app/views/nodes/destroy.html.erb
+++ /dev/null
@@ -1,2 +0,0 @@
-<h1>Nodes#destroy</h1>
-<p>Find me in app/views/nodes/destroy.html.erb</p>
diff --git a/app/views/nodes/new.html.erb b/app/views/nodes/new.html.erb
index b63a606..890d46e 100644
--- a/app/views/nodes/new.html.erb
+++ b/app/views/nodes/new.html.erb
@@ -32,8 +32,8 @@
   <div id="parent_search_field" style="<%= @selected_kind == "generic" ? "" : "display: none;" %>">
     <div class="node_description">Parent</div>
     <div class="node_content">
-      <%= text_field_tag :parent_search_term, @parent_name %>
-      <%= hidden_field_tag :parent_id, @parent_id %>
+      <%= text_field_tag :parent_search_term, @parent&.title %>
+      <%= hidden_field_tag :parent_id, @parent&.id, data: { unique_name: @parent&.computed_unique_name } %>
       <div id="parent_search_results" class="search_results"></div>
     </div>
   </div>
diff --git a/app/views/nodes/recent.html.erb b/app/views/nodes/recent.html.erb
index 3602775..d256253 100644
--- a/app/views/nodes/recent.html.erb
+++ b/app/views/nodes/recent.html.erb
@@ -1,3 +1,7 @@
 <h1>Recently changed</h1>
 
-<%= render 'node_list' %>
+<%= will_paginate @nodes %>
+<ul id="recent_changes_full_list">
+  <%= render partial: "nodes/recent_change_item", collection: @nodes, as: :node %>
+</ul>
+<%= will_paginate @nodes %>
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 66f04f9..af05778 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -46,7 +46,7 @@
         <% end %>
 
         <% unless locked_by_other %>
-          <% if @node.draft && !@node.autosave %>
+          <% if @node.draft && !@node.autosave && !@node.in_trash? && !@node.trash_node? %>
             <div class="node_info_item">
               <%= button_to 'Publish', publish_node_path(@node), method: :put,
                     form: { data: { confirm: "Publish this draft?" }, class: 'button_to state_changing' } %>
@@ -62,6 +62,15 @@
             <% end %>
             </div>
           <% end %>
+          <% unless @node.trash_node? || @node.in_trash? || @node.root? %>
+            <div class="node_info_item">
+              <%= button_to trash_node_path(@node), method: :put,
+                    form: { data: { confirm: "Move this page and everything beneath it to the Trash? All published content in it will go offline." }, class: 'button_to destructive' } do %>
+                <%= icon("trash", library: "tabler", "aria-hidden": true) %>
+                Move to Trash
+              <% end %>
+            </div>
+          <% end %>
         <% end %>
       </div>
 
@@ -70,6 +79,48 @@
       <% end %>
     </div>
 
+    <% if @node.in_trash? %>
+      <div class="node_description">Trash</div>
+      <div class="node_content node_info_group">
+        <div class="node_info_group_items">
+          <% if (entry = @node.last_trash_entry) && entry.metadata.dig("path", "from") %>
+            <div class="node_info_item">
+              <span class="node_info_label">Was at</span>
+              <%= entry.metadata.dig("path", "from") %>
+            </div>
+          <% end %>
+          <div class="node_info_item">
+            <span class="node_info_label">Restore to</span>
+            <% suggestion = @node.suggested_restore_parent %>
+            <%= form_tag restore_from_trash_node_path(@node), :method => :put, :class => "aligned_action_row" do %>
+              <div class="restore_picker">
+                <%= text_field_tag :restore_search_term,
+                      suggestion && (suggestion.head&.title || suggestion.draft&.title || suggestion.slug),
+                      :placeholder => "Search for a new parent…" %>
+                <div id="restore_search_results" class="search_results"></div>
+              </div>
+              <%= hidden_field_tag :parent_id, suggestion&.id %>
+              <%= submit_tag "Restore here", :class => "action_button action_button_no_margin_top" %>
+            <% end %>
+            <span class="field_hint">Restored pages come back unpublished. Republish each page deliberately.</span>
+          </div>
+        </div>
+        <div class="node_info_group_items">
+          <div class="node_info_item">
+            <% doomed_below = @node.descendants.count %>
+            <%= button_to node_path(@node), method: :delete,
+                  form: { data: { confirm: doomed_below > 0 ?
+                            "Delete this page and the #{doomed_below} pages beneath it permanently? This cannot be undone." :
+                            "Delete this page permanently? This cannot be undone." },
+                          class: 'button_to destructive' } do %>
+              <%= icon("trash-x", library: "tabler", "aria-hidden": true) %>
+              Delete permanently<%= " (including #{doomed_below} beneath)" if doomed_below > 0 %>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    <% end %>
+
     <div class="node_description">Translations</div>
     <div class="node_content node_info_group">
       <div class="node_info_group_items">
@@ -170,19 +221,22 @@
       </div>
     </div>
 
-    <div class="node_description">Revisions</div>
+    <div class="node_description">History</div>
     <div class="node_content node_info_group">
       <details>
         <summary>
-          <%= pluralize(@node.pages.count, 'revision', 'revisions') %>
+          <%= pluralize(@node.pages.count, 'published revision', 'published revisions') %>
         </summary>
         <ul>
           <% @node.pages.order(:revision).each do |page| %>
-            <li><%= link_to "##{page.revision} — #{page.title} (#{page.editor.try(:login)}, #{page.updated_at})", node_revision_path(@node, page) %></li>
+            <li>
+              <%= link_to "##{page.revision} — #{page.title} (#{page.editor.try(:login)}, #{page.updated_at})", node_revision_path(@node, page) %>
+              <span class="revision_lifecycle"><%= revision_lifecycle_badges(@page_actions[page.id]) %></span>
+            </li>
           <% end %>
         </ul>
       </details>
-      <p class="revisions_full_history_link"><%= link_to 'Full history (diff / restore)', node_revisions_path(@node) %></p>
+      <p class="revisions_full_history_link"><%= link_to 'Revision history (diff / restore)', node_revisions_path(@node) %> | <%= link_to t("node_actions.heading"), admin_log_path(:node_id => @node.id) %></p>
     </div>
 
 
diff --git a/app/views/nodes/trashed.html.erb b/app/views/nodes/trashed.html.erb
new file mode 100644
index 0000000..9a4808e
--- /dev/null
+++ b/app/views/nodes/trashed.html.erb
@@ -0,0 +1,42 @@
+<h1>Trash</h1>
+
+<% if @nodes.empty? %>
+  <p class="field_hint">The Trash is empty.</p>
+<% else %>
+  <%= will_paginate @nodes %>
+  <table id="trashed_node_list">
+    <tr>
+      <th>Title</th>
+      <th>Was at</th>
+      <th>Trashed</th>
+      <th>Actions</th>
+    </tr>
+    <% @nodes.each do |node| %>
+      <% entry = node.last_trash_entry %>
+      <tr>
+        <% doomed_below = node.descendants.count %>
+        <td>
+          <%= link_to (node.draft&.title || node.slug), node_path(node) %><%= " (+ #{doomed_below} beneath)" if doomed_below > 0 %>
+        </td>
+        <td><%= entry&.metadata&.dig("path", "from") %></td>
+        <td>
+          <% if entry %>
+            <%= entry.occurred_at.strftime("%Y-%m-%d %H:%M") %> by <%= entry.actor_name %>
+          <% end %>
+        </td>
+        <td>
+          <%= button_to node_path(node), method: :delete,
+                        form: { data: { confirm: doomed_below > 0 ?
+                          "Delete \"#{node.draft&.title || node.slug}\" and the #{doomed_below} pages beneath it permanently? This cannot be undone." :
+                          "Delete \"#{node.draft&.title || node.slug}\" permanently? This cannot be undone." },
+                        class: 'button_to destructive' } do %>
+            <%= icon("trash-x", library: "tabler", "aria-hidden": true) %>
+            Delete permanently
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+  </table>
+  <%= will_paginate @nodes %>
+  <p class="field_hint">To restore a page, open it and pick a new parent in its Trash section.</p>
+<% end %>
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index d51d713..1569942 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -4,26 +4,29 @@
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header
 
-# Rails.application.configure do
-#   config.content_security_policy do |policy|
-#     policy.default_src :self, :https
-#     policy.font_src    :self, :https, :data
-#     policy.img_src     :self, :https, :data
-#     policy.object_src  :none
-#     policy.script_src  :self, :https
-#     policy.style_src   :self, :https
-#     # Specify URI for violation reports
-#     # policy.report_uri "/csp-violation-report-endpoint"
-#   end
-#
-#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
-#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-#   config.content_security_policy_nonce_directives = %w(script-src style-src)
-#
-#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
-#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
-#   # config.content_security_policy_nonce_auto = true
-#
-#   # Report violations without enforcing the policy.
-#   # config.content_security_policy_report_only = true
-# end
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src    :self
+    policy.script_src     :self
+    policy.style_src      :self, :unsafe_inline
+    policy.img_src        :self, :data
+    policy.font_src       :self
+    policy.object_src     :none
+    policy.frame_ancestors :none
+    policy.base_uri       :self
+    policy.form_action    :self
+    policy.report_uri     "/csp_reports"
+  end
+
+  # Per-request nonce; script-src only. style-src keeps unsafe_inline
+  # deliberately: TinyMCE emits img[style] in body content and the
+  # public layout carries style attributes -- CSS injection is a
+  # low-yield channel, script-src is where the protection lives.
+  config.content_security_policy_nonce_generator  = ->(request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src]
+
+  # Report-only: nothing blocks. Enforcement is a later, deliberate
+  # flip once the reports have mapped reality (admin inline scripts,
+  # legacy hotlinked images in old bodies, embeds).
+  config.content_security_policy_report_only = true
+end
diff --git a/config/initializers/csp_log.rb b/config/initializers/csp_log.rb
new file mode 100644
index 0000000..1dde9c4
--- /dev/null
+++ b/config/initializers/csp_log.rb
@@ -0,0 +1,4 @@
+# CSP violation reports get their own file, independent of config.logger.
+CSP_LOGGER = Rails.env.production? ?
+  ActiveSupport::Logger.new(Rails.root.join("log", "csp_violations.log")) :
+  Rails.logger
diff --git a/config/initializers/error_log.rb b/config/initializers/error_log.rb
new file mode 100644
index 0000000..74117cb
--- /dev/null
+++ b/config/initializers/error_log.rb
@@ -0,0 +1,20 @@
+# Every controller-level exception (the 500s) in one lean file,
+# independent of the base log level -- log/production.log can stay
+# quiet without losing error visibility.
+if Rails.env.production?
+  error_logger = ActiveSupport::Logger.new(Rails.root.join("log", "errors.log"))
+
+  ActiveSupport::Notifications.subscribe("process_action.action_controller") do |*, payload|
+    if (exception = payload[:exception_object])
+      status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception.class.name)
+      next if status < 500
+
+      error_logger.error(
+        "#{Time.now.iso8601} [#{status}] #{payload[:controller]}##{payload[:action]} #{payload[:path]} " \
+        "-- #{exception.class}: #{exception.message}\n    " +
+        Array(exception.backtrace).first(5).join("\n    ")
+      )
+    end
+  end
+end
+
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 550ccb3..f64f6cd 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -16,6 +16,8 @@ de:
   open_today: "Das Chaos, lokal und heute offen"
   published: "veröffentlicht"
   published_by: "veröffentlicht durch %{editor}"
+  last_edited: "zuletzt bearbeitet"
+  last_edited_by: "zuletzt bearbeitet durch %{editor}"
   editor_self: "du"
   publisher_self: "dich"
   date:
@@ -80,3 +82,37 @@ de:
     page_gap: "&hellip;"
     container_aria_label: "Seitennavigation"
     page_aria_label: "Seite %{page}"
+
+  node_actions:
+    heading: "Letzte Änderungen"
+    show_all: "Alle Einträge zeigen"
+    backfilled: "rekonstruiert"
+    show_changes: "Änderungen an Übersetzungen"
+    view_revision: "Diese Revision ansehen"
+    unknown: "%{actor} hat %{action} auf %{subject} ausgeführt"
+    publish: "%{actor} hat %{revision} von %{subject} veröffentlicht"
+    publish_rollback: "%{actor} hat %{subject} auf %{revision} zurückgesetzt"
+    publish_first: "%{actor} hat %{subject} zum ersten Mal veröffentlicht"
+    publish_first_with_author: "%{actor} hat %{subject} zum ersten Mal veröffentlicht (Autor: %{author})"
+    create: "%{actor} hat %{subject} unter %{path} angelegt"
+    move: "%{actor} hat %{subject} von %{from} nach %{to} verschoben"
+    discard_autosave: "%{actor} hat ungespeicherte Änderungen an %{subject} verworfen"
+    destroy_draft: "%{actor} hat den Entwurf von %{subject} verworfen"
+    locale_added: "Übersetzung angelegt, Titel \"%{title}\""
+    locale_removed: "Übersetzung entfernt, letzter Titel \"%{title}\""
+    abstract_changed: "Abstract geändert"
+    body_changed: "Text geändert"
+    revision_new: "eine neue Revision"
+    revision_earlier: "eine frühere Revision"
+    node_history: "Chronik"
+    detail_title: "Titel „%{from}“ → „%{to}“"
+    detail_author: "Autor %{from} → %{to}"
+    detail_tags: "Tags %{from} → %{to}"
+    template_changed: "Template geändert"
+    assets_changed: "Bildliste geändert"
+    trash: "%{actor} hat %{subject} in den Papierkorb verschoben (vorher unter %{from})"
+    restore_from_trash: "%{actor} hat %{subject} aus dem Papierkorb nach %{to} wiederhergestellt"
+    destroy: "%{actor} hat %{subject} endgültig gelöscht (zuletzt unter %{path})"
+    revision_created: "angelegt am %{date} von %{actor}"
+    revision_published: "veröffentlicht am %{date} von %{actor}"
+    revision_restored: "wiederhergestellt am %{date} von %{actor}"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 73271ed..8a8acc1 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -17,6 +17,8 @@ en:
   open_today: "Open today"
   published: "published"
   published_by: "published by %{editor}"
+  last_edited: "last edited"
+  last_edited_by: "last edited by %{editor}"
   publisher_self: "you"
   editor_self: "you"
 
@@ -32,3 +34,37 @@ en:
     page_gap: "&hellip;"
     container_aria_label: "Pagination"
     page_aria_label: "Page %{page}"
+
+  node_actions:
+    heading: "Action log"
+    show_all: "Show all entries"
+    backfilled: "backfilled"
+    show_changes: "translation changes"
+    view_revision: "view this revision"
+    unknown: "%{actor} did %{action} on %{subject}"
+    publish: "%{actor} published %{revision} of %{subject}"
+    publish_rollback: "%{actor} rolled %{subject} back to %{revision}"
+    publish_first: "%{actor} published %{subject} for the first time"
+    publish_first_with_author: "%{actor} published %{subject} for the first time (author: %{author})"
+    create: "%{actor} created %{subject} at %{path}"
+    move: "%{actor} moved %{subject} from %{from} to %{to}"
+    discard_autosave: "%{actor} discarded unsaved changes on %{subject}"
+    destroy_draft: "%{actor} discarded the draft of %{subject}"
+    locale_added: "translation added, titled \"%{title}\""
+    locale_removed: "translation removed, last titled \"%{title}\""
+    abstract_changed: "abstract changed"
+    body_changed: "body changed"
+    revision_new: "a new revision"
+    revision_earlier: "an earlier revision"
+    node_history: "node history"
+    detail_title: "title \"%{from}\" → \"%{to}\""
+    detail_author: "author %{from} → %{to}"
+    detail_tags: "tags %{from} → %{to}"
+    template_changed: "template changed"
+    assets_changed: "attached images changed"
+    trash: "%{actor} moved %{subject} to the Trash (was at %{from})"
+    restore_from_trash: "%{actor} restored %{subject} from the Trash to %{to}"
+    destroy: "%{actor} permanently deleted %{subject} (last at %{path})"
+    revision_created: "created %{date} by %{actor}"
+    revision_published: "published %{date} by %{actor}"
+    revision_restored: "restored %{date} by %{actor}"
diff --git a/config/routes.rb b/config/routes.rb
index 8e5ff23..6ddf48c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -9,6 +9,8 @@ Cccms::Application.routes.draw do
       defaults: { page_path: ['home'] },
       constraints: { locale: /de|en/ }
 
+  post 'csp_reports' => 'csp_reports#create'
+
   # All application routes are scoped under an optional two-letter locale
   # prefix: /de/... and /en/... Both forms are valid; the prefix is omitted
   # for the default locale (:de) in generated URLs via default_url_options
@@ -44,6 +46,7 @@ Cccms::Application.routes.draw do
           get :mine
           get :chapters
           get :sitemap
+          get :trashed
         end
 
         member do
@@ -53,6 +56,8 @@ Cccms::Application.routes.draw do
           put :revoke_shared_preview
           put :autosave
           put :revert
+          put :trash
+          put :restore_from_trash
         end
 
         resources :translations, controller: 'page_translations',
@@ -86,6 +91,8 @@ Cccms::Application.routes.draw do
       match 'menu_search'      => 'admin#menu_search',      :as => :admin_menu_search,      :via => :get
       match 'conventions'      => 'admin#conventions',      :as => :admin_conventions,      :via => :get
       match 'dashboard_search' => 'admin#dashboard_search', :as => :admin_dashboard_search, :via => :get
+      match 'log'              => 'node_actions#index',     :as => :admin_log,              :via => :get
+      match 'boom'             => 'admin#boom',             :as => :admin_boom,             :via => :get
     end
 
     match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
@@ -102,11 +109,11 @@ Cccms::Application.routes.draw do
 
     resource :session
 
-    get  'rss/updates',         :to => 'rss#updates', :as => :rss
-    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed,
+    get  'rss/updates',         :to => 'rss#updates', :as => :rss,      :defaults => { :format => :xml }
+    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml|rdf/ }
-    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag
-    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed,
+    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag, :defaults => { :format => :xml }
+    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml/ }
 
     match 'galleries/*page_path' => 'content#render_gallery', :via => :get
diff --git a/db/migrate/20260714233414_create_node_actions.rb b/db/migrate/20260714233414_create_node_actions.rb
new file mode 100644
index 0000000..6c18285
--- /dev/null
+++ b/db/migrate/20260714233414_create_node_actions.rb
@@ -0,0 +1,19 @@
+class CreateNodeActions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :node_actions do |t|
+      t.references :node, foreign_key: { on_delete: :nullify }
+      t.references :page, foreign_key: { on_delete: :nullify }
+      t.references :user, foreign_key: { on_delete: :nullify }
+      t.string   :action, null: false
+      t.string   :locale
+      t.string   :inferred_from
+      t.jsonb    :metadata, null: false
+      t.datetime :occurred_at, null: false
+
+      t.timestamps
+    end
+
+    add_index :node_actions, [:node_id, :occurred_at]
+    add_index :node_actions, :action
+  end
+end
diff --git a/db/migrate/20260716165542_add_password_digest_to_users.rb b/db/migrate/20260716165542_add_password_digest_to_users.rb
new file mode 100644
index 0000000..df711d7
--- /dev/null
+++ b/db/migrate/20260716165542_add_password_digest_to_users.rb
@@ -0,0 +1,5 @@
+class AddPasswordDigestToUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :users, :password_digest, :string
+  end
+end
diff --git a/db/migrate/20260717192043_drop_nested_set_columns_from_nodes.rb b/db/migrate/20260717192043_drop_nested_set_columns_from_nodes.rb
new file mode 100644
index 0000000..697ab77
--- /dev/null
+++ b/db/migrate/20260717192043_drop_nested_set_columns_from_nodes.rb
@@ -0,0 +1,6 @@
+class DropNestedSetColumnsFromNodes < ActiveRecord::Migration[8.1]
+  def change
+    remove_column :nodes, :lft, :integer
+    remove_column :nodes, :rgt, :integer
+  end
+end
diff --git a/lib/authentication.rb b/lib/authentication.rb
index a936589..4d8a5ae 100644
--- a/lib/authentication.rb
+++ b/lib/authentication.rb
@@ -31,7 +31,7 @@ module Authentication
     end
 
     def make_token
-      secure_digest(Time.now, (1..10).map{ rand.to_s })
+      SecureRandom.hex(20)
     end
   end # class methods
 
@@ -46,7 +46,6 @@ module Authentication
         include ModelInstanceMethods
         
         # Virtual attribute for the unencrypted password
-        attr_accessor :password
         validates_presence_of     :password,                   :if => :password_required?
         validates_presence_of     :password_confirmation,      :if => :password_required?
         validates_confirmation_of :password,                   :if => :password_required?
@@ -85,19 +84,22 @@ module Authentication
         self.class.password_digest(password, salt)
       end
       
-      def authenticated?(password)
+      def authenticate_legacy(password)
         crypted_password == encrypt(password)
       end
-      
+
       # before filter 
       def encrypt_password
         return if password.blank?
-        self.salt = self.class.make_token if new_record?
+        return if password_digest.present?
+
+        self.salt ||= self.class.make_token
         self.crypted_password = encrypt(password)
       end
+
       def password_required?
-        crypted_password.blank? || !password.blank?
+        (crypted_password.blank? && password_digest.blank?) || !password.blank?
       end
     end # instance methods
   end
-end
\ No newline at end of file
+end
diff --git a/lib/ccc_conventions.rb b/lib/ccc_conventions.rb
index 352dd3c..7ff5a3a 100644
--- a/lib/ccc_conventions.rb
+++ b/lib/ccc_conventions.rb
@@ -1,6 +1,7 @@
 module CccConventions
-  ERFA_PARENT_NAME       = "club/erfas"
-  CHAOSTREFF_PARENT_NAME = "club/chaostreffs"
+  TRASH_SLUG              = "trash"
+  ERFA_PARENT_NAME        = "club/erfas"
+  CHAOSTREFF_PARENT_NAME  = "club/chaostreffs"
   SITEMAP_COLLAPSED_PATHS = %w[updates club/erfas club/chaostreffs disclosure].freeze
 
   NODE_KINDS = {
diff --git a/lib/tasks/node_actions.rake b/lib/tasks/node_actions.rake
new file mode 100644
index 0000000..fdd286c
--- /dev/null
+++ b/lib/tasks/node_actions.rake
@@ -0,0 +1,61 @@
+namespace :node_actions do
+  desc "Rebuild inferred NodeAction entries from existing revisions and " \
+       "node timestamps. Witnessed entries (inferred_from IS NULL) are " \
+       "never touched; previously inferred ones are deleted and " \
+       "regenerated, so the task is idempotent. Scope with NODE_ID=n."
+  task :backfill => :environment do
+    scope = Node.where.not(:parent_id => nil)
+    scope = scope.where(:id => ENV["NODE_ID"]) if ENV["NODE_ID"]
+
+    created = 0
+
+    ActiveRecord::Base.transaction do
+      stale = NodeAction.where.not(:inferred_from => nil)
+      stale = stale.where(:node_id => ENV["NODE_ID"]) if ENV["NODE_ID"]
+      puts "Removing #{stale.count} previously inferred entries"
+      stale.delete_all
+
+      witnessed_creates  = NodeAction.where(:action => "create",  :inferred_from => nil).pluck(:node_id).to_set
+      witnessed_promotes = NodeAction.where(:action => "publish", :inferred_from => nil).pluck(:page_id).to_set
+
+      scope.find_each do |node|
+        # Every page row except the current draft was once promoted to
+        # head. Autosaves never carry node_id, so they cannot appear.
+        revisions  = node.pages.to_a.reject { |page| page.id == node.draft_id }
+        first_page = node.pages.first
+
+        unless witnessed_creates.include?(node.id)
+          NodeAction.record!(
+            :node => node, :page => first_page, :user => first_page&.editor,
+            :action        => "create",
+            :occurred_at   => node.created_at,
+            :inferred_from => "from_node_created_at",
+            :title => first_page&.translations&.find_by(:locale => I18n.default_locale)&.title,
+            :path  => node.unique_name,
+            :human_readable_node_name =>
+              first_page&.translations&.find_by(:locale => I18n.default_locale)&.title)
+          created += 1
+        end
+
+        previous = nil
+        revisions.each do |page|
+          unless witnessed_promotes.include?(page.id)
+            diff = NodeAction.head_diff(previous, page)
+            NodeAction.record!(
+              :node => node, :page => page, :user => page.editor,
+              :action        => "publish",
+              :occurred_at   => page.updated_at,
+              :inferred_from => "from_page_revision",
+              :via           => "draft",
+              :human_readable_node_name => diff[:title]["to"],
+              **diff)
+            created += 1
+          end
+          previous = page
+        end
+      end
+    end
+
+    puts "Created #{created} inferred entries"
+  end
+end
diff --git a/public/javascripts/admin_interface.js b/public/javascripts/admin_interface.js
index 0c9ec66..b7bdc10 100644
--- a/public/javascripts/admin_interface.js
+++ b/public/javascripts/admin_interface.js
@@ -1,15 +1,3 @@
-function hide_all() {
-    $('#recent_changes_toggle').attr("class", "unselected");
-    $('#my_work_toggle').attr("class", "unselected");
-    $('#current_drafts_toggle').attr("class", "unselected");
-    $('#admin_sitemap_toggle').attr("class", "unselected");
-
-    $('#current_drafts_table').hide();
-    $('#my_work_table').hide();
-    $('#recent_changes_table').hide();
-    $('#admin_sitemap_table').hide();
-}
-
 $(document).ready(function () {
   admin_search.initialize();
 
@@ -69,6 +57,10 @@ $(document).ready(function () {
     move_to_search.initialize_search();
   }
 
+  if ($("#restore_search_term").length != 0) {
+    restore_search.initialize_search();
+  }
+
   if ($("#event_node_search_term").length != 0) {
     event_search.initialize_search();
   }
@@ -85,63 +77,13 @@ $(document).ready(function () {
     cccms.preview.initialize();
   }
 
-  if ($('#recent_changes_toggle').length != 0) {
-    hide_all();
-    $('#recent_changes_toggle').attr("class", "selected");
-    $('#recent_changes_table').show();
-
-    $('#recent_changes_toggle').bind("click", function(){
-      hide_all();
-      $('#recent_changes_toggle').attr("class", "selected");
-      $('#recent_changes_table').show();
-      return false;
-    });
-
-    $('#my_work_toggle').bind("click", function(){
-      hide_all();
-      $('#my_work_toggle').attr("class", "selected");
-      $('#my_work_table').show();
-      return false;
-    });
-
-    $('#admin_wizard_my_work').bind("click", function(){
-      hide_all();
-      $('#my_work_toggle').attr("class", "selected");
-      $('#my_work_table').show();
-      return false;
-    });
-
-    $('#current_drafts_toggle').bind("click", function(){
-      hide_all();
-      $('#current_drafts_toggle').attr("class", "selected");
-      $('#current_drafts_table').show();
-      return false;
-    });
-
-    $('#admin_sitemap_toggle').bind("click", function(){
-      hide_all();
-      $('#admin_sitemap_toggle').attr("class", "selected");
-      $('#admin_sitemap_table').show();
-      return false;
-    });
-
-    $('#admin_wizard_create_page').bind("click", function(){
-      hide_all();
-      $('#admin_sitemap_toggle').attr("class", "selected");
-      $('#admin_sitemap_table').show();
-      return false;
-    });
-  }
-
   jQuery.ajaxSetup({
     'beforeSend': function(xhr) {xhr.setRequestHeader("Accept", "text/javascript");}
   });
 
   $(document).ajaxSend(function(event, request, settings) {
-    if (typeof(AUTH_TOKEN) == "undefined") return;
-    // settings.data is a serialized string like "foo=bar&baz=boink" (or null)
-    settings.data = settings.data || "";
-    settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(AUTH_TOKEN);
+    var meta = document.querySelector("meta[name='csrf-token']");
+    if (meta) request.setRequestHeader("X-CSRF-Token", meta.content);
   });
 
 });
@@ -475,8 +417,10 @@ rrule_builder = {
     });
     $("#rrule_monthly_ordinal").bind("change", function() {
       $("#rrule_ordinal_fields").toggle($(this).is(":checked"));
+      rrule_builder.toggle_custom_ordinal_fields();
       rrule_builder.sync();
     });
+    $("#rrule_ordinal").bind("change", rrule_builder.toggle_custom_ordinal_fields);
     $("#rrule_exclude_month").bind("change", function() {
       $("#rrule_excluded_month").toggle($(this).is(":checked"));
       rrule_builder.sync();
@@ -493,6 +437,12 @@ rrule_builder = {
     $("#rrule_monthly_options").show();
   },
 
+  toggle_custom_ordinal_fields : function() {
+    $("#rrule_custom_ordinal_fields").toggle(
+      $("#rrule_monthly_ordinal").is(":checked") && $("#rrule_ordinal").val() === "custom"
+    );
+  },
+
   sync : function() {
     var freq = $("input[name='rrule_freq']:checked").val();
     var parts = [];
@@ -508,7 +458,16 @@ rrule_builder = {
     } else {
       parts.push("FREQ=MONTHLY");
       if ($("#rrule_monthly_ordinal").is(":checked")) {
-        parts.push("BYDAY=" + $("#rrule_ordinal").val() + $("#rrule_ordinal_day").val());
+        var ordinal = $("#rrule_ordinal").val();
+        if (ordinal === "custom") {
+          var customDays = [];
+          $("input[id^='rrule_custom_ordinal_']:checked").each(function() {
+            customDays.push($(this).attr("id").replace("rrule_custom_ordinal_", "") + $("#rrule_ordinal_day").val());
+          });
+          if (customDays.length > 0) parts.push("BYDAY=" + customDays.join(","));
+        } else {
+          parts.push("BYDAY=" + ordinal + $("#rrule_ordinal_day").val());
+        }
       }
     }
 
@@ -543,8 +502,33 @@ rrule_builder = {
     } else if (parts.FREQ === "MONTHLY") {
       $("input[name='rrule_freq'][value='monthly']").prop("checked", true);
       rrule_builder.show_monthly_options();
+      var ordinalDays = parts.BYDAY && parts.BYDAY.split(",");
+      var customOrdinalDay = null;
+      var customOrdinals = [];
+      var customOrdinalsValid = ordinalDays && ordinalDays.length > 0;
+      if (customOrdinalsValid) {
+        ordinalDays.forEach(function(value) {
+          var customMatch = value.match(/^([1-5])([A-Z]{2})$/);
+          if (!customMatch || (customOrdinalDay && customOrdinalDay !== customMatch[2])) {
+            customOrdinalsValid = false;
+            return;
+          }
+          customOrdinalDay = customMatch[2];
+          customOrdinals.push(customMatch[1]);
+        });
+      }
+
       var match = parts.BYDAY && parts.BYDAY.match(/^(-?\d+)([A-Z]{2})$/);
-      if (match) {
+      if (customOrdinalsValid && (customOrdinals.length > 1 || customOrdinals[0] === "5")) {
+        $("#rrule_monthly_ordinal").prop("checked", true);
+        $("#rrule_ordinal_fields").show();
+        $("#rrule_ordinal").val("custom");
+        $("#rrule_ordinal_day").val(customOrdinalDay);
+        customOrdinals.forEach(function(ordinal) {
+          $("#rrule_custom_ordinal_" + ordinal).prop("checked", true);
+        });
+        rrule_builder.toggle_custom_ordinal_fields();
+      } else if (match) {
         $("#rrule_monthly_ordinal").prop("checked", true);
         $("#rrule_ordinal_fields").show();
         $("#rrule_ordinal").val(match[1]);
diff --git a/public/javascripts/admin_search.js b/public/javascripts/admin_search.js
index 7604bb7..b53c931 100644
--- a/public/javascripts/admin_search.js
+++ b/public/javascripts/admin_search.js
@@ -72,24 +72,20 @@ function initSearchPicker(options) {
           found = false;
           for (var i = 0; i < data.length; i++) {
             (function(node) {
-              var link;
+              var anchor = $("<a>").attr("href", onSelect ? "#" : node.node_path);
+              anchor.append(document.createTextNode(node.title || ""));
+              anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+              var link = $("<p>").append(anchor);
+
               if (onSelect) {
-                link = $(
-                  "<p><a href='#'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
-                link.find("a").bind("click", function() {
+                anchor.bind("click", function() {
                   onSelect(node);
                   results.slideUp();
                   results.empty();
                   return false;
                 });
-              } else {
-                link = $(
-                  "<p><a href='" + node.node_path + "'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
               }
+
               results.append(link);
               found = true;
             })(data[i]);
@@ -150,7 +146,9 @@ dashboard_search = {
           results.append("<p class='search_group_label'>Tags</p>");
           var tag_row = $("<div class='search_tag_row'></div>");
           data.tags.forEach(function(tag) {
-            tag_row.append("<a class='search_tag_pill' href='" + tag.tag_path + "'>" + tag.name + "</a>");
+            tag_row.append(
+              $("<a>", { "class": "search_tag_pill" }).attr("href", tag.tag_path).text(tag.name || "")
+            );
             found = true;
           });
           results.append(tag_row);
@@ -159,10 +157,10 @@ dashboard_search = {
         if (data.nodes.length) {
           results.append("<p class='search_group_label'>Pages</p>");
           data.nodes.forEach(function(node) {
-            results.append(
-              "<p><a href='" + node.node_path + "'>" + node.title +
-                "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-            );
+            var anchor = $("<a>").attr("href", node.node_path);
+            anchor.append(document.createTextNode(node.title || ""));
+            anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+            results.append($("<p>").append(anchor));
             found = true;
           });
         }
@@ -264,6 +262,19 @@ move_to_search = {
   }
 };
 
+restore_search = {
+  initialize_search : function() {
+    initSearchPicker({
+      inputSelector: "#restore_search_term",
+      resultsSelector: "#restore_search_results",
+      onSelect: function(node) {
+        $("#restore_search_term").val(node.title);
+        $("#parent_id").val(node.node_id);
+      }
+    });
+  }
+};
+
 event_search = {
   initialize_search : function() {
     initSearchPicker({
diff --git a/public/javascripts/related_assets.js b/public/javascripts/related_assets.js
index 803332f..3340fa7 100644
--- a/public/javascripts/related_assets.js
+++ b/public/javascripts/related_assets.js
@@ -15,12 +15,9 @@ related_assets = {
       renderResults: function(data, results) {
         var found = false;
         data.forEach(function(asset) {
-          var item = $(
-            "<a href='#' class='related_asset_result'>" +
-              "<img src='" + asset.thumb_url + "' alt=''>" +
-              "<span>" + asset.name + "</span>" +
-            "</a>"
-          );
+          var item = $("<a>", { href: "#", "class": "related_asset_result" });
+          item.append($("<img>", { src: asset.thumb_url, alt: "" }));
+          item.append($("<span>").text(asset.name || ""));
           item.bind("click", function() {
             related_assets.attach(asset.id, createUrl, list);
             return false;
diff --git a/public/stylesheets/admin.css b/public/stylesheets/admin.css
index b5b8707..0e11747 100644
--- a/public/stylesheets/admin.css
+++ b/public/stylesheets/admin.css
@@ -37,10 +37,13 @@ td {
    depend on this rule for vertical padding. table.node_table td resets
    padding-top/bottom to 0 explicitly and does not depend on it. */
 
-input[type=text], textarea {
+input[type=text],
+input[type=password],
+textarea {
   font-size: 1rem;
   font-family: Helvetica;
   border: 1px solid #989898;
+  border-radius: 2px;
 }
 
 select {
@@ -881,6 +884,10 @@ form.button_to button[type="submit"] {
   margin-top: -5px;
 }
 
+.aligned_action_row .action_button.action_button_no_margin_top {
+  margin-top: 0;
+}
+
 /* ============================================================
    Page editor / metadata forms
    ============================================================ */
@@ -1121,6 +1128,25 @@ div#draft_list table td.actions a {
   font-size: 0.9em;
 }
 
+#recent_changes_full_list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+#recent_changes_full_list li {
+  padding: 0.75rem 0;
+  border-bottom: 1px solid #eee;
+}
+
+#recent_changes_full_list li:last-child {
+  border-bottom: none;
+}
+
+#recent_changes_full_list li > div {
+  margin-bottom: 0.25rem;
+}
+
 /* ============================================================
    Search widgets
    ============================================================ */
@@ -1475,3 +1501,92 @@ div#image_browser ul li {
   gap: 8px;
   flex-wrap: wrap;
 }
+
+/* ============================================================
+   Action log
+   ============================================================ */
+
+#node_action_list td.node_action_body {
+  border-bottom: 1px solid #f1f1f1;
+}
+
+#node_action_list td.node_action_time {
+  white-space: nowrap;
+  vertical-align: top;
+  font-size: 0.8em;
+  color: #777;
+  padding-right: 1em;
+}
+
+#node_action_list .node_action_date {
+  display: block;
+}
+
+#node_action_list .node_action_clock {
+  float: right;
+  margin-top: 0.2rem;
+}
+
+#node_action_list td.node_action_body {
+  vertical-align: top;
+}
+
+.node_action_inferred {
+  opacity: 0.5;
+  font-size: smaller;
+  margin-left: 0.5em;
+}
+
+.node_action_zoom {
+  font-size: smaller;
+  margin-left: 0.5em;
+}
+
+.node_action_details summary {
+  margin-top: 0.2rem;
+  cursor: pointer;
+  font-size: smaller;
+  color: #777;
+}
+
+.node_action_icon {
+  color: #777;
+  margin-right: 0.35em;
+  vertical-align: text-top;
+}
+
+.revision_lifecycle {
+  font-size: 0.85rem;
+  color: #777;
+}
+
+/* ============================================================
+   Trash section
+   ============================================================ */
+
+.restore_form {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.restore_picker {
+  position: relative;
+}
+
+.restore_picker input[type=text] {
+  width: 22em;
+}
+
+.restore_picker .search_results {
+  position: absolute;
+  top: 100%;
+  left: 0;
+  right: 0;
+  z-index: 10;
+  background: #fff;
+  border: 1px solid #989898;
+  border-top: none;
+  max-height: 20em;
+  overflow-y: auto;
+}
diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..9731d08 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
@@ -105,6 +104,16 @@ class ContentControllerTest < ActionController::TestCase
     assert_response :success
     File.write("/tmp/no_fill_response.html", @response.body)
   end
+
+  test "render_gallery renders for a published page" do
+    node = Node.root.children.create!(:slug => "gallery_render_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Galerie") }
+    node.publish_draft!
+
+    get :render_gallery, params: { :page_path => "gallery_render_test", :locale => "de" }
+
+    assert_response :success
+  end
   
   protected
   
diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/controllers/node_actions_controller_test.rb b/test/controllers/node_actions_controller_test.rb
new file mode 100644
index 0000000..8bc68ec
--- /dev/null
+++ b/test/controllers/node_actions_controller_test.rb
@@ -0,0 +1,51 @@
+require 'test_helper'
+
+class NodeActionsControllerTest < ActionController::TestCase
+
+  def setup
+    login_as :quentin
+  end
+
+  def logged_node slug, title
+    node = Node.root.children.create!(:slug => slug)
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => title) }
+    node
+  end
+
+  test "index renders" do
+    get :index
+    assert_response :success
+  end
+
+  test "index filters by node" do
+    node_a = logged_node("log_filter_a", "Alpha Subject")
+    node_b = logged_node("log_filter_b", "Beta Subject")
+    NodeAction.record!(:node => node_a, :action => "create", :user => users(:quentin))
+    NodeAction.record!(:node => node_b, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :node_id => node_a.id }
+
+    assert_response :success
+    assert_includes    @response.body, "Alpha Subject"
+    assert_not_includes @response.body, "Beta Subject"
+  end
+
+  test "index filters by user" do
+    node = logged_node("log_filter_user", "Gamma Subject")
+    NodeAction.record!(:node => node, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :user_id => users(:quentin).id }
+    assert_includes @response.body, "Gamma Subject"
+
+    other = User.where.not(:id => users(:quentin).id).first
+    get :index, params: { :user_id => other.id }
+    assert_not_includes @response.body, "Gamma Subject"
+  end
+
+  test "index requires login" do
+    session[:user_id] = nil
+    @controller.instance_variable_set(:@current_user, nil)
+    get :index
+    assert_response :redirect
+  end
+end
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 9da9514..ddc4565 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
@@ -417,11 +427,11 @@ class NodesControllerTest < ActionController::TestCase
   test "show never renders a destroy link for events" do
     login_as :quentin
     node = create_node_with_published_page
-    Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
+    event = Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
 
     get :show, params: { id: node.id }
     assert_response :success
-    assert_select "form.button_to.destructive", count: 0
+    assert_select "form[action=?]", event_path(event), count: 0
   end
 
   test "reverting from nodes#show returns to the show page, not the editor, even if a draft remains" do
@@ -469,7 +479,8 @@ class NodesControllerTest < ActionController::TestCase
     login_as :quentin
     get :show, params: { :id => node.id }
     assert_response :success
-    assert_select "form.destructive", :count => 0
+    assert_select "form[action=?]", revert_node_path(node), count: 0
+    assert_select "form[action=?]", trash_node_path(node), count: 1
   end
 
   test "drafts includes a never-published node with only a draft" do
@@ -647,4 +658,103 @@ class NodesControllerTest < ActionController::TestCase
     assert_select ".sitemap_node_actions", :text => /Create Child/
     assert_select ".sitemap_node_actions", :text => /Revisions/, :count => 0
   end
+
+  test "create logs a create NodeAction with path and title" do
+    login_as :quentin
+
+    assert_difference "NodeAction.count" do
+      post :create, params: { :kind => "generic", :title => "Brand New", :parent_id => Node.root.id }
+    end
+
+    action = NodeAction.last
+    assert_equal "create",               action.action
+    assert_equal users(:quentin),        action.user
+    assert_equal Node.last,              action.node
+    assert_equal "Brand New",            action.metadata["title"]
+    assert_equal Node.last.unique_name,  action.metadata["path"]
+  end
+
+  test "trash moves the node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "trash_me")
+
+    put :trash, params: { :id => node.id }
+
+    assert_redirected_to trashed_nodes_path
+    assert node.reload.in_trash?
+  end
+
+  test "trashing the Trash node itself is refused" do
+    login_as :quentin
+
+    put :trash, params: { :id => Node.trash.id }
+
+    assert_redirected_to node_path(Node.trash)
+    assert flash[:error].present?
+  end
+
+  test "restore_from_trash reparents to the given parent" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "restore_me")
+    node.trash!(users(:quentin))
+    target = Node.root.children.create!(:slug => "restore_home")
+
+    put :restore_from_trash, params: { :id => node.id, :parent_id => target.id }
+
+    assert_redirected_to node_path(node)
+    assert_equal target, node.reload.parent
+  end
+
+  test "destroy refuses a node outside the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "not_deletable_here")
+
+    delete :destroy, params: { :id => node.id }
+
+    assert Node.exists?(node.id)
+    assert flash[:error].present?
+  end
+
+  test "destroy deletes a trashed node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "deletable")
+    node.trash!(users(:quentin))
+
+    delete :destroy, params: { :id => node.id }
+
+    assert_not Node.exists?(node.id)
+    assert_redirected_to trashed_nodes_path
+  end
+
+  test "trash lists trashed subtree roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "listed_in_trash")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_response :success
+    assert_select "a[href=?]", node_path(node)
+  end
+
+  test "trashed rows carry provenance and a delete for childless roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "provenance_test")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_select "td", /quentin/
+    assert_select "form[action=?]", node_path(node), count: 1
+  end
+
+test "show annotates history rows with their lifecycle" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "history_annotation_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Annotated") }
+    node.publish_draft!(users(:quentin))
+
+    get :show, params: { :id => node.id }
+
+    assert_response :success
+    assert_select "span.revision_lifecycle", /quentin/
+  end
 end
diff --git a/test/controllers/page_translations_controller_test.rb b/test/controllers/page_translations_controller_test.rb
index 8fa732f..feaacd0 100644
--- a/test/controllers/page_translations_controller_test.rb
+++ b/test/controllers/page_translations_controller_test.rb
@@ -82,4 +82,16 @@ class PageTranslationsControllerTest < ActionController::TestCase
     assert_equal page_count_before, node.pages.count
     assert_equal "in progress", Globalize.with_locale(:en) { node.autosave.title }
   end
+
+  test "destroy removes the translation, logs nothing, and redirects" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "translation_destroy_log_test")
+    Globalize.with_locale(:en) { node.draft.update!(:title => "English title") }
+
+    assert_no_difference "NodeAction.count" do
+      delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+    end
+
+    assert_redirected_to node_path(node)
+  end
 end
diff --git a/test/fixtures/nodes.yml b/test/fixtures/nodes.yml
index 9ca325e..e94f10f 100644
--- a/test/fixtures/nodes.yml
+++ b/test/fixtures/nodes.yml
@@ -2,8 +2,6 @@
 
 root:
   id: 1
-  lft: 1
-  rgt: 10
   parent_id:
   slug:
   unique_name:
@@ -11,8 +9,6 @@ root:
 
 first_child:
   id: 2
-  lft: 2
-  rgt: 3
   parent_id: 1
   draft_id: 100
   slug: first_child
@@ -20,8 +16,6 @@ first_child:
 
 second_child:
   id: 3
-  lft: 4
-  rgt: 5
   parent_id: 1
   draft_id: 101
   slug: second_child
@@ -29,8 +23,6 @@ second_child:
   
 third_child:
   id: 4
-  lft: 6
-  rgt: 7
   parent_id: 1
   draft_id: 102
   slug: third_child
@@ -38,8 +30,6 @@ third_child:
   
 fourth_child:
   id: 5
-  lft: 8
-  rgt: 9
   parent_id: 1
   slug: fourth_child
   unique_name: fourth_child
diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end
diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 279ff73..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -47,6 +47,24 @@ class RruleHumanizerTest < ActiveSupport::TestCase
     assert_equal "Every second-to-last Thursday of the month", humanize("FREQ=MONTHLY;BYDAY=-2TH", :en)
   end
 
+  test "monthly selected weeks" do
+    assert_equal "Jeden ersten, zweiten und fünften Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU")
+    assert_equal "Every first, second and fifth Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU", :en)
+  end
+
+  test "monthly fifth weekday" do
+    assert_equal "Jeden fünften Dienstag im Monat", humanize("FREQ=MONTHLY;BYDAY=5TU")
+    assert_equal "Every fifth Tuesday of the month", humanize("FREQ=MONTHLY;BYDAY=5TU", :en)
+  end
+
+  test "monthly weekday excluding one ordinal" do
+    rrule = "FREQ=MONTHLY;BYDAY=1TU,3TU,4TU,5TU"
+    assert_equal "Jeden Dienstag im Monat, außer dem zweiten Dienstag", humanize(rrule)
+    assert_equal "Every Tuesday of the month, except the second Tuesday", humanize(rrule, :en)
+  end
+
   test "monthly no byday" do
     assert_equal "Monatlich", humanize("FREQ=MONTHLY")
     assert_equal "Monthly", humanize("FREQ=MONTHLY", :en)
@@ -96,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
new file mode 100644
index 0000000..1b72ec9
--- /dev/null
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -0,0 +1,146 @@
+require 'test_helper'
+
+class NodeActionsHelperTest < ActionView::TestCase
+  def setup
+    @original_locale = I18n.locale
+    I18n.locale = :en
+  end
+
+  def default_url_options
+    { :locale => nil }
+  end
+
+  def icon(_name, **)
+    '<svg class="stub-icon"></svg>'.html_safe
+  end
+
+  def teardown
+    I18n.locale = @original_locale
+  end
+
+  def entry action, metadata = {}, node: nil, user: nil, page: nil
+    NodeAction.create!(:node => node, :user => user, :page => page,
+                        :action => action, :occurred_at => Time.now,
+                        :metadata => { "username" => "quentin",
+                                       "human_readable_node_name" => "Subject" }.merge(metadata))
+  end
+
+  test "publish renders the revision sentence, not the titles" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_includes out, "quentin"
+    assert_includes out, "new revision"
+    assert_not_includes out, "Old"
+  end
+
+  test "first publish uses its own sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => nil, "to" => "New" } }))
+
+    assert_includes out, "for the first time"
+  end
+
+  test "rollback publishes get the rollback sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "revision", "title" => { "from" => "Now", "to" => "Then" } }))
+
+    assert_includes out, "rolled"
+  end
+
+  test "move renders the path pair" do
+    out = action_summary(entry("move",
+      { "path" => { "from" => "a/b", "to" => "a/c" } }))
+
+    assert_includes out, "a/b"
+    assert_includes out, "a/c"
+  end
+
+  test "unknown verbs degrade to a generic sentence, never an error" do
+    out = action_summary(entry("frobnicate"))
+
+    assert_includes out, "frobnicate"
+    assert_includes out, "quentin"
+  end
+
+  test "dead references render as plain names from metadata, no links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_not_includes out, "<a "
+    assert_includes out, "Subject"
+  end
+
+  test "metadata values are escaped" do
+    out = action_summary(entry("publish",
+      { "human_readable_node_name" => "<b>bold</b>" }))
+
+    assert_not_includes out, "<b>"
+  end
+
+  test "live associations upgrade names to links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } },
+      :user => users(:quentin)))
+
+    assert_includes out, "<a "
+  end
+
+  test "details are guarded off when nothing but an unchanged title is present" do
+    unchanged = entry("publish", { "title" => { "from" => "Same", "to" => "Same" } })
+    changed   = entry("publish", { "title" => { "from" => "Old",  "to" => "New" } })
+
+    assert_not action_details?(unchanged)
+    assert action_details?(changed)
+  end
+
+  test "first publish with a byline names the author" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => nil, "to" => "New" },
+        "author" => { "from" => nil, "to" => "quentin" } }))
+
+    assert_includes out, "author"
+  end
+
+  test "create entries with their flat title render and are guarded off details" do
+    e = entry("create", { "title" => "Initial", "path" => "a/b" })
+
+    assert_includes action_summary(e), "a/b"
+    assert_not action_details?(e)
+  end
+
+  test "trash, restore, and destroy render their paths" do
+    trash   = entry("trash",   { "path" => { "from" => "club/old", "to" => "trash/old" } })
+    restore = entry("restore_from_trash", { "path" => { "from" => "trash/old", "to" => "club/new" } })
+    doomed  = entry("destroy", { "path" => "trash/old" })
+
+    assert_includes action_summary(trash),   "club/old"
+    assert_includes action_summary(restore), "club/new"
+    assert_includes action_summary(doomed),  "trash/old"
+  end
+
+  test "revision lifecycle badges cover create, publish, rollback, and inference" do
+    created   = entry("create",  { "title" => "x", "path" => "a/b" })
+    published = entry("publish", { "via" => "draft",    "title" => { "from" => nil, "to" => "x" } })
+    restored  = entry("publish", { "via" => "revision", "title" => { "from" => "y", "to" => "x" } })
+    restored.update!(:inferred_from => "from_page_revision")
+
+    out = revision_lifecycle_badges([created, published, restored])
+
+    assert_includes out, "created"
+    assert_includes out, "published"
+    assert_includes out, "restored"
+    assert_includes out, "quentin"
+    assert_includes out, "node_action_inferred"
+    assert_includes out, "<span"
+    assert_not_includes out, "&lt;span"
+
+    assert_equal "", revision_lifecycle_badges(nil)
+  end
+
+  test "verb icons map known verbs, distinguish rollbacks, and fall back" do
+    assert_includes verb_icon(entry("trash", { "path" => { "from" => "a", "to" => "t/a" } })), "node_action_icon--trash"
+    assert_includes verb_icon(entry("publish", { "via" => "revision" })), "node_action_icon--history"
+    assert_includes verb_icon(entry("frobnicate")), "node_action_icon--circle-dashed"
+  end
+end
diff --git a/test/models/node_action_test.rb b/test/models/node_action_test.rb
new file mode 100644
index 0000000..b177cca
--- /dev/null
+++ b/test/models/node_action_test.rb
@@ -0,0 +1,128 @@
+require "test_helper"
+
+class NodeActionTest < ActiveSupport::TestCase
+
+  # Standalone pages, no node -- same pattern autosave relies on.
+  # Default-locale attributes are written pinned, never ambient.
+  def build_page en: nil, **attrs
+    page = Globalize.with_locale(I18n.default_locale) do
+      Page.create!({ :title => "Titel" }.merge(attrs))
+    end
+    page.translations.create!({ :locale => "en" }.merge(en)) if en
+    page.reload
+  end
+
+  test "first publish yields exactly the title pair, from nil" do
+    diff = NodeAction.head_diff(nil, build_page(:title => "Erstausgabe"))
+
+    assert_equal({ :title => { "from" => nil, "to" => "Erstausgabe" } }, diff)
+  end
+
+  test "first publish carries the byline when the page has one" do
+    diff = NodeAction.head_diff(nil, build_page(:user => users(:quentin)))
+
+    assert_equal({ "from" => nil, "to" => users(:quentin).login }, diff[:author])
+  end
+
+  test "title pair is always present, even when unchanged" do
+    diff = NodeAction.head_diff(build_page, build_page)
+
+    assert_equal "Titel", diff[:title]["from"]
+    assert_equal "Titel", diff[:title]["to"]
+  end
+
+  test "author pair present only when the byline changed" do
+    u1, u2 = users(:quentin), users(:aaron)
+
+    assert_nil NodeAction.head_diff(build_page(:user => u1), build_page(:user => u1))[:author]
+
+    changed = NodeAction.head_diff(build_page(:user => u1), build_page(:user => u2))
+    assert_equal({ "from" => u1.login, "to" => u2.login }, changed[:author])
+  end
+
+  test "tags pair present only when the tag set changed" do
+    old_page = build_page; old_page.tag_list = "alpha, beta";  old_page.save!
+    new_page = build_page; new_page.tag_list = "beta, gamma"; new_page.save!
+
+    diff = NodeAction.head_diff(old_page.reload, new_page.reload)
+    assert_equal %w[alpha beta],  diff[:tags]["from"]
+    assert_equal %w[beta gamma], diff[:tags]["to"]
+
+    same = NodeAction.head_diff(old_page, old_page)
+    assert_nil same[:tags]
+  end
+
+  test "template_changed flag only when true" do
+    old_page = build_page(:template_name => "standard_template")
+
+    assert NodeAction.head_diff(old_page, build_page(:template_name => "update"))[:template_changed]
+    assert_nil NodeAction.head_diff(old_page, build_page(:template_name => "standard_template"))[:template_changed]
+  end
+
+  test "assets_changed flag when the attached set differs" do
+    asset = Asset.create!(:name => "diff probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    old_page, new_page = build_page, build_page
+    new_page.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+
+    diff = NodeAction.head_diff(old_page, new_page.reload)
+    assert diff[:assets_changed]
+    assert_nil NodeAction.head_diff(old_page, old_page)[:assets_changed]
+  end
+
+  test "default-locale abstract and body changes become flags, only when true" do
+    diff = NodeAction.head_diff(build_page(:abstract => "a"), build_page(:abstract => "b"))
+
+    assert diff[:abstract_changed]
+    assert_nil diff[:body_changed]
+  end
+
+  test "added locale carries status and the new title" do
+    diff = NodeAction.head_diff(build_page, build_page(en: { :title => "English" }))
+
+    entry = diff[:translation_diff]["en"]
+    assert_equal "added", entry["status"]
+    assert_equal({ "from" => nil, "to" => "English" }, entry["title"])
+  end
+
+  test "removed locale keeps the vanished title" do
+    diff = NodeAction.head_diff(build_page(en: { :title => "English" }), build_page)
+
+    entry = diff[:translation_diff]["en"]
+    assert_equal "removed", entry["status"]
+    assert_equal "English", entry["title"]["from"]
+    assert_nil entry["title"]["to"]
+  end
+
+  test "changed locale carries only what actually differs" do
+    old_page = build_page(en: { :title => "Same", :body => "old" })
+    new_page = build_page(en: { :title => "Same", :body => "new" })
+
+    entry = NodeAction.head_diff(old_page, new_page)[:translation_diff]["en"]
+    assert_equal "changed", entry["status"]
+    assert_nil entry["title"]
+    assert entry["body_changed"]
+    assert_nil entry["abstract_changed"]
+  end
+
+  test "untouched locales are absent; identical pages yield no translation_diff at all" do
+    old_page = build_page(en: { :title => "Same" })
+    new_page = build_page(en: { :title => "Same" })
+
+    assert_nil NodeAction.head_diff(old_page, new_page)[:translation_diff]
+  end
+
+  test "record! passes provenance and historical timestamps through" do
+    long_ago = 2.years.ago
+    action = NodeAction.record!(:node => nil, :action => "publish",
+                                 :occurred_at => long_ago,
+                                 :inferred_from => "from_page_revision")
+
+    assert_equal "from_page_revision", action.inferred_from
+    assert_in_delta long_ago.to_f, action.occurred_at.to_f, 1.0
+  end
+end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index 959387d..ab66f81 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -621,4 +621,245 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Edited directly on autosave", Globalize.with_locale(:en) { autosave.title }
     assert_equal "v2",                          Globalize.with_locale(:de) { autosave.title }
   end
+
+  test "publish_draft! logs a NodeAction crediting the actual publisher" do
+    node = Node.root.children.create!(:slug => "publish_log_test")
+    node.draft.update!(:title => "Version one")
+
+    node.publish_draft!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal node.head, action.page
+    assert_equal @user1, action.user
+    assert_equal "publish", action.action
+    assert_equal "draft", action.metadata["via"]
+  end
+
+  test "publish_draft! called with no user logs no actor, not a guessed one" do
+    node = Node.root.children.create!(:slug => "publish_log_no_user_test")
+    node.draft.update!(:title => "Version one")
+
+    node.publish_draft!
+
+    action = NodeAction.last
+    assert_nil action.user
+    assert_nil action.metadata["username"]
+  end
+
+  test "publish_draft! with nothing pending creates no NodeAction" do
+    node = Node.root.children.create!(:slug => "publish_log_noop_test")
+    node.publish_draft!
+    count_before = NodeAction.count
+
+    result = node.publish_draft!
+
+    assert_nil result
+    assert_equal count_before, NodeAction.count
+  end
+
+  test "revert! logs discard_autosave for an in-progress autosave" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in progress"}, @user1)
+
+    node.revert!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal @user1, action.user
+    assert_equal "discard_autosave", action.action
+  end
+
+  test "revert! logs destroy_draft for a draft with a head behind it" do
+    node = create_node_with_published_page
+    find_or_create_draft(node, @user1)
+
+    node.revert!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal @user1, action.user
+    assert_equal "destroy_draft", action.action
+  end
+
+  test "revert! with nothing to revert logs nothing" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    count_before = NodeAction.count
+
+    node.revert!(@user1)
+
+    assert_equal count_before, NodeAction.count
+  end
+
+  test "publish_draft! records the title diff in metadata" do
+    node = create_node_with_published_page
+    Globalize.with_locale(:de) { node.head.update!(:title => "Original Title") }
+    find_or_create_draft(node, @user1)
+    Globalize.with_locale(:de) { node.draft.update!(:title => "New Title") }
+
+    node.publish_draft!(@user1)
+
+    action = NodeAction.last
+    assert_equal "draft",          action.metadata["via"]
+    assert_equal "Original Title", action.metadata.dig("title", "from")
+    assert_equal "New Title",      action.metadata.dig("title", "to")
+  end
+
+  test "publishing a staged slug change logs a move with the path pair" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+    node.staged_slug = "moved-#{node.slug}"
+    node.save!
+    publish_count_before = NodeAction.where(:action => "publish").count
+
+    node.publish_draft!(@user1)
+
+    node.reload
+    assert_not_equal path_before, node.unique_name
+
+    action = NodeAction.where(:action => "move").last
+    assert_equal node,             action.node
+    assert_equal @user1,           action.user
+    assert_equal path_before,      action.metadata.dig("path", "from")
+    assert_equal node.unique_name, action.metadata.dig("path", "to")
+
+    # No draft was pending: path change alone must not fabricate a publish.
+    assert_equal publish_count_before, NodeAction.where(:action => "publish").count
+  end
+
+  test "publishing a draft together with a staged move logs two entries" do
+    node = create_node_with_published_page
+    find_or_create_draft(node, @user1)
+    node.staged_slug = "relocated-#{node.slug}"
+    node.save!
+
+    assert_difference "NodeAction.count", 2 do
+      node.publish_draft!(@user1)
+    end
+
+    assert_equal %w[move publish],
+                 NodeAction.order(:id).last(2).map(&:action).sort
+  end
+
+  test "restore_revision! logs a publish via revision" do
+    node = create_node_with_published_page
+    Globalize.with_locale(:de) { node.head.update!(:title => "First") }
+    first_head = node.head
+    find_or_create_draft(node, @user1)
+    Globalize.with_locale(:de) { node.draft.update!(:title => "Second") }
+    node.publish_draft!(@user1)
+
+    node.restore_revision!(first_head.revision, @user1)
+
+    action = NodeAction.last
+    assert_equal "publish",   action.action
+    assert_equal "revision",  action.metadata["via"]
+    assert_equal first_head,  action.page
+    assert_equal @user1,      action.user
+    assert_equal "Second",    action.metadata.dig("title", "from")
+    assert_equal "First",     action.metadata.dig("title", "to")
+  end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+    assert_equal "Trash", Globalize.with_locale(I18n.default_locale) { Node.trash.draft.title }
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
+  end
 end
diff --git a/test/models/node_trash_test.rb b/test/models/node_trash_test.rb
new file mode 100644
index 0000000..52069d7
--- /dev/null
+++ b/test/models/node_trash_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+
+class NodeTrashTest < ActiveSupport::TestCase
+
+  def setup
+    @user1 = User.create!(:login => "trasher", :email => "t@example.com",
+                           :password => "foobar", :password_confirmation => "foobar")
+  end
+
+  test "trash! demotes the head into the draft slot when no draft exists" do
+    node = create_node_with_published_page
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal former_head, node.draft
+    assert node.in_trash?
+  end
+
+  test "trash! keeps an existing draft; the former head stays a plain revision" do
+    node = create_node_with_published_page
+    draft = find_or_create_draft(node, @user1)
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal draft, node.draft
+    assert_includes node.pages, former_head
+  end
+
+  test "trash! demotes descendant heads and counts them in the log entry" do
+    parent = create_node_with_published_page
+    child  = parent.children.create!(:slug => "trashed_child")
+    child.draft.update!(:title => "Child")
+    child.publish_draft!(@user1)
+
+    parent.trash!(@user1)
+
+    action = NodeAction.where(:action => "trash").last
+    assert_equal parent, action.node
+    assert_equal 2, action.metadata["demoted_heads"]
+    assert action.metadata["was_published"]
+    assert_nil child.reload.head_id
+    assert child.in_trash?
+  end
+
+  test "trash! logs one entry with the path pair and updates unique names" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+
+    assert_difference "NodeAction.count", 1 do
+      node.trash!(@user1)
+    end
+
+    action = NodeAction.last
+    assert_equal path_before, action.metadata.dig("path", "from")
+    assert_equal node.reload.unique_name, action.metadata.dig("path", "to")
+    assert action.metadata.dig("path", "to").start_with?(CccConventions::TRASH_SLUG)
+  end
+
+  test "trash! on an already trashed node is a logged-nothing no-op" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    assert_no_difference "NodeAction.count" do
+      assert_nil node.reload.trash!(@user1)
+    end
+  end
+
+  test "restore_from_trash! reparents as drafts without republishing" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    target = Node.root.children.create!(:slug => "restore_target")
+
+    node.reload.restore_from_trash!(target, @user1)
+    node.reload
+
+    assert_equal target, node.parent
+    assert_not node.in_trash?
+    assert_nil node.head_id
+    assert_not_nil node.draft_id
+    assert_equal "restore_from_trash", NodeAction.last.action
+  end
+
+  test "restore_from_trash! refuses targets inside the Trash and the Trash itself" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    other_trashed = Node.trash.children.create!(:slug => "also_trashed")
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(Node.trash, @user1) }
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(other_trashed, @user1) }
+  end
+
+  test "destroy_from_trash! refuses nodes outside the Trash" do
+    node = create_node_with_published_page
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.destroy_from_trash!(@user1) }
+    assert Node.exists?(node.id)
+  end
+
+  test "destroy_from_trash! removes the whole subtree bottom-up with one entry" do
+    parent = create_node_with_published_page
+    child = parent.children.create!(:slug => "doomed_child")
+    grandchild = child.children.create!(:slug => "doomed_grandchild")
+    page_ids = [parent, child, grandchild].flat_map { |n| n.pages.pluck(:id) }
+    parent.trash!(@user1)
+
+    assert_difference "NodeAction.count", 1 do
+      parent.reload.destroy_from_trash!(@user1)
+    end
+
+    assert_not Node.exists?(parent.id)
+    assert_not Node.exists?(child.id)
+    assert_not Node.exists?(grandchild.id)
+    assert_equal 0, Page.where(:id => page_ids).count
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_equal 2, action.metadata["destroyed_descendants"]
+    assert_nil action.node_id
+  end
+
+  test "destroy_from_trash! logs an entry that survives the node" do
+    node = create_node_with_published_page
+    Globalize.with_locale(I18n.default_locale) { node.head.update!(:title => "Doomed") }
+    node.trash!(@user1)
+    final_path = node.reload.unique_name
+
+    node.destroy_from_trash!(@user1)
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_nil action.node_id
+    assert_equal final_path, action.metadata["path"]
+    assert_equal "Doomed", action.subject_name
+    assert_equal @user1, action.user
+  end
+
+  test "suggested_restore_parent finds the old parent while it lives" do
+    parent = Node.root.children.create!(:slug => "old_home")
+    node = parent.children.create!(:slug => "comes_back")
+    node.trash!(@user1)
+
+    assert_equal parent, node.reload.suggested_restore_parent
+
+    parent.trash!(@user1)
+    assert_nil node.reload.suggested_restore_parent
+  end
+
+  test "suggested_restore_parent is root for trashed top-level nodes" do
+    node = Node.root.children.create!(:slug => "was_top_level")
+    node.trash!(@user1)
+
+    assert_equal Node.root, node.reload.suggested_restore_parent
+  end
+
+  test "trashed nodes and the Trash itself stay out of the drafts surfaces" do
+    Node.trash
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    ids = Node.drafts_and_autosaves.pluck(:id)
+    assert_not_includes ids, Node.trash.id
+    assert_not_includes ids, node.id
+  end
+end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..1f924f9 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,39 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+
+    page.template_name = ""
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})