21 files changed, 600 insertions, 147 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 37fd78b..8bd99ac 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -6,7 +6,7 @@ class AdminController < ApplicationController
 
   def index
     @drafts = Node.drafts_and_autosaves(current_user_id: current_user.id).limit(5)
-    @recent_changes = Node.recently_changed.limit(5)
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc).limit(5)
   end
 
   def conventions
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..08cbc98
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,10 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    report = request.body.read(8192)
+    Rails.logger.warn("CSP violation: #{report}") if report.present?
+    head :no_content
+  end
+end
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index 9834a17..6caa827 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -13,7 +13,9 @@ class NodesController < ApplicationController
                               :publish,
                               :unlock,
                               :autosave,
-                              :revert
+                              :revert,
+                              :trash,
+                              :restore_from_trash
                             ]
 
   around_action :pin_to_default_locale, :only => [:show, :edit, :update, :autosave]
@@ -60,6 +62,9 @@ class NodesController < ApplicationController
   def show
     @page = @node.draft || @node.head
     @translations = @page.translation_summary
+    @page_actions = NodeAction.where(:page_id => @node.pages.select(:id))
+                              .order(:occurred_at, :id)
+                              .group_by(&:page_id)
   end
 
   def edit
@@ -139,8 +144,40 @@ class NodesController < ApplicationController
     redirect_to node_path(@node)
   end
 
+ def trash
+    if @node.trash!(current_user)
+      flash[:notice] = "Page has been moved to the Trash"
+      redirect_to trashed_nodes_path
+    else
+      flash[:notice] = "Page is already in the Trash"
+      redirect_to node_path(@node)
+    end
+  rescue ActiveRecord::RecordInvalid, LockedByAnotherUser => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
+  def restore_from_trash
+    parent = Node.find(params[:parent_id])
+    @node.restore_from_trash!(parent, current_user)
+    flash[:notice] = "Page has been restored from the Trash"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordNotFound
+    flash[:error] = "Restore target not found"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
   def destroy
-    @node.destroy
+    @node.destroy_from_trash!(current_user)
+    flash[:notice] = "Page has been permanently deleted"
+    redirect_to trashed_nodes_path
+
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
   end
 
   def publish
@@ -214,6 +251,11 @@ class NodesController < ApplicationController
     @sitemap_descendant_counts = descendant_counts_for(@sitemap)
   end
 
+  def trashed
+    @nodes = Node.trash.children.order(:slug)
+                 .paginate(:page => params[:page], :per_page => 50)
+  end
+
   private
 
     def slug_for(title)
diff --git a/app/helpers/node_actions_helper.rb b/app/helpers/node_actions_helper.rb
index 996f98d..fd8cc36 100644
--- a/app/helpers/node_actions_helper.rb
+++ b/app/helpers/node_actions_helper.rb
@@ -1,6 +1,31 @@
 module NodeActionsHelper
   include ERB::Util
 
+  # One glyph per verb, rendered before the sentence in _action_row.
+  # Unknown verbs get the dashed circle -- the unknown-verb principle
+  # extended to iconography: the log outlives its vocabulary.
+  VERB_ICONS = {
+    "create"             => "file-plus",
+    "publish"            => "send",
+    "move"               => "arrows-move",
+    "trash"              => "trash",
+    "restore_from_trash" => "arrow-back-up",
+    "destroy"            => "trash-x",
+    "discard_autosave"   => "eraser",
+    "destroy_draft"      => "eraser",
+  }.freeze
+
+  def verb_icon action
+    name = if action.action == "publish" && action.metadata["via"] == "revision"
+      "history"
+    else
+      VERB_ICONS.fetch(action.action, "circle-dashed")
+    end
+    content_tag(:span, icon(name, library: "tabler", "aria-hidden": true),
+                :class => "node_action_icon node_action_icon--#{name}",
+                :title => action.action)
+  end
+
   # One sentence per entry, rendered from metadata alone, so entries
   # stay renderable after the rows they reference are gone. Live
   # associations only upgrade plain names to links. Every metadata
@@ -59,6 +84,32 @@ module NodeActionsHelper
     end
   end
 
+  def revision_lifecycle_badges actions
+    return "" if actions.blank?
+
+    badges = actions.map do |action|
+      key = case action.action
+            when "create"  then "node_actions.revision_created"
+            when "publish" then action.metadata["via"] == "revision" ?
+                                  "node_actions.revision_restored" :
+                                  "node_actions.revision_published"
+            end
+      next unless key
+
+      badge = h(t(key, :date => action.occurred_at.strftime("%Y-%m-%d"),
+                       :actor => action.actor_name))
+      if action.inferred_from
+        badge = safe_join([badge, content_tag(:span, t("node_actions.backfilled"),
+                                               :class => "node_action_inferred",
+                                               :title => action.inferred_from)], " ")
+      end
+      badge
+    end.compact
+
+    return "" if badges.empty?
+    safe_join(["— ", safe_join(badges, " · ")])
+  end
+
   private
 
   def revision_ref action, key
@@ -114,4 +165,19 @@ module NodeActionsHelper
     t("node_actions.destroy_draft",
        :actor => actor_ref(action), :subject => subject_ref(action)).html_safe
   end
+
+  def summarize_trash action
+    t("node_actions.trash", :actor => actor_ref(action), :subject => subject_ref(action),
+       :from => h(action.metadata.dig("path", "from"))).html_safe
+  end
+
+  def summarize_restore_from_trash action
+    t("node_actions.restore_from_trash", :actor => actor_ref(action), :subject => subject_ref(action),
+       :to => h(action.metadata.dig("path", "to"))).html_safe
+  end
+
+  def summarize_destroy action
+    t("node_actions.destroy", :actor => actor_ref(action), :subject => subject_ref(action),
+       :path => h(action.metadata["path"])).html_safe
+  end
 end
diff --git a/app/models/concerns/nested_tree.rb b/app/models/concerns/nested_tree.rb
index 9a2eb0e..befcdb3 100644
--- a/app/models/concerns/nested_tree.rb
+++ b/app/models/concerns/nested_tree.rb
@@ -9,8 +9,6 @@ module NestedTree
   included do
     belongs_to :parent, class_name: name, foreign_key: :parent_id, optional: true, inverse_of: :children
     has_many :children, -> { order(:id) }, class_name: name, foreign_key: :parent_id, inverse_of: :parent
-
-    before_destroy :delete_descendants
   end
 
   class_methods do
@@ -77,10 +75,4 @@ module NestedTree
   def move_to_child_of(new_parent)
     update!(parent_id: new_parent.id)
   end
-
-  private
-
-  def delete_descendants
-    self.class.where(id: descendants.pluck(:id)).delete_all
-  end
 end
diff --git a/app/models/node.rb b/app/models/node.rb
index 717f5b4..a440c2f 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -4,17 +4,23 @@ class Node < ApplicationRecord
 
   # Associations
   has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
-  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy, optional: true
-  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy, optional: true
+  has_many    :node_actions, :dependent => :nullify
+  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, optional: true
+  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, optional: true
+  # Autosave pages carry no node_id, so has_many :pages does not cover
+  # them -- this dependent: :destroy is their only cleanup on node destroy.
   belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
+
   has_many    :permissions, :dependent => :destroy
   has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
   # Callbacks
-  after_create  :initialize_empty_page
-  before_save   :check_for_changed_slug
-  after_save    :update_unique_names_of_children
+  after_create   :initialize_empty_page
+  before_save    :check_for_changed_slug
+  after_save     :update_unique_names_of_children
+  before_destroy :refuse_destroy_with_children
+  before_destroy :refuse_destroying_trash_node
 
   # Validations
   validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? || slug.blank? }
@@ -22,6 +28,21 @@ class Node < ApplicationRecord
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
+  validate :reserved_slug_stays_reserved
+  validate :no_head_inside_trash
+  validates :default_template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :default_template_name_changed?
+
+  # Everything outside the Trash subtree, the Trash node included.
+  # Relies on unique_name being authoritative for tree position --
+  # the same trust public routing places in it.
+  scope :not_in_trash, -> {
+    where.not(:unique_name => CccConventions::TRASH_SLUG)
+      .where("unique_name NOT LIKE ?", "#{CccConventions::TRASH_SLUG}/%")
+  }
+
   # Class methods
 
   # Returns a page for a given node. If no revision is supplied, it returns
@@ -48,6 +69,19 @@ class Node < ApplicationRecord
     nil
   end
 
+  # The Trash container node. Lazily self-creating and idempotent, so
+  # every environment acquires it on first touch.
+  # Never call from validations. the positional predicates below
+  # exist for that.
+  def self.trash
+    root.children.find_by(:slug => CccConventions::TRASH_SLUG) ||
+      root.children.create!(:slug => CccConventions::TRASH_SLUG).tap do |node|
+        Globalize.with_locale(I18n.default_locale) do
+          node.draft.update!(:title => "Trash")
+        end
+      end
+  end
+
   # Instance Methods
 
   # Acquires (or reaffirms) the editing lock without creating a draft or
@@ -194,6 +228,10 @@ class Node < ApplicationRecord
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
+    if in_trash? || trash_node?
+      raise ActiveRecord::RecordInvalid.new(self), "Cannot publish a node in the Trash"
+    end
+
     path_before = self.unique_name
 
     ActiveRecord::Base.transaction do
@@ -258,6 +296,117 @@ class Node < ApplicationRecord
     end
   end
 
+
+  # Moves this node and its subtree into the Trash. Demotes every head
+  # in the subtree first (aggregators and search operate on heads
+  # regardless of tree position); where a node has no draft, the former
+  # head becomes its draft so content stays editable and restorable --
+  # otherwise the former head remains a plain revision. One log entry,
+  # at the root, carrying the leaving-public-view snapshot.
+  def trash! current_user = nil
+    return nil if in_trash?
+    raise ActiveRecord::RecordInvalid.new(self), "The Trash node itself cannot be trashed" if trash_node?
+
+    ActiveRecord::Base.transaction do
+      path_before        = unique_name
+      was_published      = head_id.present?
+      final_published_at = head&.published_at
+
+      demoted = 0
+      ([self] + descendants.to_a).each do |node|
+        next unless node.head_id
+        former        = node.head
+        node.head     = nil
+        node.draft_id = former.id if node.draft_id.nil?
+        node.save!
+        demoted += 1
+      end
+
+      self.reload
+      move_to_child_of(Node.trash)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+      unlock!
+
+      metadata = { :path => { "from" => path_before, "to" => unique_name } }
+      metadata[:was_published]      = true if was_published
+      metadata[:final_published_at] = final_published_at.iso8601 if final_published_at
+      metadata[:demoted_heads]      = demoted if demoted > 0
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "trash", **metadata)
+      self
+    end
+  end
+
+  # Returns the node to the living tree under a chosen parent. The
+  # subtree comes back exactly as it sits in the Trash: all drafts,
+  # nothing published. Republication is a separate, witnessed act
+  # per node.
+  def restore_from_trash! new_parent, current_user = nil
+    return nil unless in_trash?
+
+    if new_parent.nil? || new_parent == self || descendants.include?(new_parent) ||
+       new_parent.trash_node? || new_parent.in_trash?
+      raise ActiveRecord::RecordInvalid.new(self), "Restore target must be a living node"
+    end
+
+    ActiveRecord::Base.transaction do
+      path_before = unique_name
+      move_to_child_of(new_parent)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "restore_from_trash",
+                          :path => { "from" => path_before, "to" => unique_name })
+      self
+    end
+  end
+
+  # Final deletion -- only from inside the Trash. Removes the whole
+  # subtree, deepest first, each node through a real destroy! so every
+  # per-node cascade runs (the categorical difference from the old
+  # delete_all nuke). refuse_destroy_with_children on bare destroy is
+  # untouched
+  # One log entry at the root, per the subtree rule, written before the
+  # rows die.
+  def destroy_from_trash! current_user = nil
+    raise ActiveRecord::RecordInvalid.new(self), "Nodes are only destroyed from the Trash" unless in_trash?
+
+    ActiveRecord::Base.transaction do
+      doomed = self_and_descendants_ordered_with_level
+                 .sort_by { |_, level| -level }
+                 .map(&:first)
+
+      metadata = { :path => unique_name }
+      metadata[:destroyed_descendants] = doomed.size - 1 if doomed.size > 1
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy", **metadata)
+      doomed.each(&:destroy!)
+    end
+  end
+
+  # The most recent trash entry. Its path.from is the restore hint.
+  def last_trash_entry
+    node_actions.where(:action => "trash").order(:occurred_at => :desc, :id => :desc).first
+  end
+
+  # The node's pre-trash parent, if a living node still answers to
+  # that path. Nil when the parent was itself trashed (its unique_name
+  # changed) or deleted; a different node that has since taken over
+  # the path is a legitimate suggestion.
+  def suggested_restore_parent
+    from = last_trash_entry&.metadata&.dig("path", "from")
+    return nil unless from
+
+    parent_path = from.rpartition("/").first
+    return Node.root if parent_path.empty?
+
+    candidate = Node.find_by(:unique_name => parent_path)
+    candidate unless candidate.nil? || candidate.in_trash? || candidate.trash_node?
+  end
+
   # returns an array with all parts of a unique_name rather than a string
   def unique_path
     unique_name.to_s.split("/")
@@ -269,7 +418,7 @@ class Node < ApplicationRecord
   end
 
   def computed_unique_name
-    path = path_to_root[1..-1].join("/") # excluding root
+    path_to_root[1..-1].join("/") # excluding root
   end
 
   def current_unique_name
@@ -313,6 +462,20 @@ class Node < ApplicationRecord
     autosave || draft || head
   end
 
+  def trash_node?
+    parent&.root? && slug == CccConventions::TRASH_SLUG
+  end
+
+  # Inside the Trash subtree. False for the Trash node itself.
+  def in_trash?
+    current = parent
+    while current
+      return true if current.trash_node?
+      current = current.parent
+    end
+    false
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -353,7 +516,7 @@ class Node < ApplicationRecord
   end
 
   def self.drafts_and_autosaves(current_user_id: nil)
-    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL")
+    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL").not_in_trash
     return scope.order("updated_at DESC") unless current_user_id
 
     scope.order(
@@ -361,6 +524,15 @@ class Node < ApplicationRecord
     )
   end
 
+  # Nodes are never destroyed recursively
+  # Descendants must be removed or reparented individually first.
+  # The Trash feature will be the ordinary path to deletion.
+  def refuse_destroy_with_children
+    return unless children.exists?
+    errors.add(:base, "Cannot destroy a node that still has children")
+    throw :abort
+  end
+
   def self.recently_changed
     includes(:head).where(
       "pages.updated_at < ? AND pages.updated_at > ? AND nodes.parent_id IS NOT NULL",
@@ -417,4 +589,36 @@ class Node < ApplicationRecord
         end
       end
     end
+
+  private
+
+    def reserved_slug_stays_reserved
+      if parent&.root? && !trash_node_already_me?
+        errors.add(:slug, "is reserved for the Trash") if slug == CccConventions::TRASH_SLUG
+        errors.add(:staged_slug, "is reserved for the Trash") if staged_slug == CccConventions::TRASH_SLUG
+      end
+
+      if persisted? && slug_was == CccConventions::TRASH_SLUG && Node.find(id).trash_node?
+        errors.add(:slug, "of the Trash node cannot change") if slug_changed?
+        errors.add(:parent_id, "of the Trash node cannot change") if parent_id_changed?
+        errors.add(:staged_slug, "must stay empty on the Trash node") if staged_slug.present?
+        errors.add(:staged_parent_id, "must stay empty on the Trash node") if staged_parent_id.present?
+      end
+    end
+
+    def trash_node_already_me?
+      existing = Node.root&.children&.find_by(:slug => CccConventions::TRASH_SLUG)
+      existing.nil? || existing.id == id
+    end
+
+    def no_head_inside_trash
+      return unless head_id.present?
+      errors.add(:head_id, "cannot exist inside the Trash") if in_trash? || trash_node?
+    end
+
+    def refuse_destroying_trash_node
+      return unless trash_node?
+      errors.add(:base, "The Trash node cannot be destroyed")
+      throw :abort
+    end
 end
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
index 792ae1e..13bd5ba 100644
--- a/app/models/node_action.rb
+++ b/app/models/node_action.rb
@@ -8,79 +8,78 @@ class NodeAction < ApplicationRecord
 
   # == Metadata contract ==
   #
-  # metadata is written once at creation and never updated. It is the
+  # metadata is written once at creation, never updated. It is the
   # single place anything that must survive deletion of the referenced
   # rows lives; node_id/page_id/user_id are lookup and ordering only.
-  # All keys are strings. Pairs are always {"from" => x, "to" => y} --
-  # never _old/_new suffixes. Optional pairs are written only when the
-  # two sides differ; required keys are always present. All titles and
-  # names are read pinned to I18n.default_locale unless inside a
-  # locale-keyed block.
+  # All keys are strings. Pairs are always {"from" => x, "to" => y}.
+  # Optional pairs only when the sides differ; booleans only when
+  # true; required keys always present. Titles and names are read
+  # pinned to I18n.default_locale unless inside a locale-keyed block.
   #
   # Baseline, every entry (written here, not by call sites):
   #   "username"                 -- actor's login at write time
   #   "human_readable_node_name" -- node title, default locale
   #
   # "create":
-  #   "title" -- initial title, default locale
-  #   "path"  -- unique path at creation time. Historical value only:
-  #              later renames/moves do NOT update old entries. Never
-  #              use as a join key; node_id is the join key while the
-  #              node lives.
+  #   "title" -- initial title, flat string (NOT a pair)
+  #   "path"  -- unique path at creation, flat string. Historical
+  #              value only; never a join key.
   #
-  # "publish" (any promotion of a page to head; the diff against the
-  # outgoing head is computed BEFORE head is re-pointed, over the
-  # union of both pages' locales, by the shared diff function also
-  # used by the backfill):
-  #   "via"    -- "draft" (ordinary publish) | "revision" (rollback
-  #               via restore_revision!). Always written; absent
-  #               means a pre-contract entry.
-  #   "title"  -- pair, always present. "from" is null on a first
-  #               publish (no outgoing head).
-  #   "author" -- pair, only when the byline (page.user) changed
-  #   "tags"   -- pair of arrays, only when changed
-  #   "assets_changed", "template_changed"
-  #            -- booleans, only when true; page_id links to the
-  #               revision for the real diff (never stored here)
+  # "publish" (any promotion to head; diff computed BEFORE head is
+  # re-pointed, over the union of both pages' locales, by head_diff --
+  # shared with the backfill):
+  #   "via"    -- "draft" | "revision" (rollback). Always written;
+  #               absent means a pre-contract entry.
+  #   "title"  -- pair, always; "from" null on first publish
+  #   "author" -- pair, when the byline changed (incl. first publish)
+  #   "tags"   -- pair of arrays, when changed
+  #   "assets_changed", "template_changed",
   #   "abstract_changed", "body_changed"
-  #            -- booleans for the default locale, only when true
-  #   "translation_diff" -- only when any non-default locale differs:
+  #            -- the last two for the default locale; page_id links
+  #               to the revision for the real diff (never stored)
+  #   "translation_diff" -- only when a non-default locale differs:
   #     { "<locale>" => {
-  #         "status"           -- "added" | "removed" | "changed"
-  #         "title"            -- pair; "from" null when added,
-  #                               "to" null when removed
-  #         "abstract_changed", "body_changed" -- booleans, only when
-  #                               true, only for status "changed"
+  #         "status" -- "added" | "removed" | "changed"
+  #         "title"  -- pair, only when it differs; "from" null when
+  #                     added, "to" null when removed
+  #         "abstract_changed", "body_changed" -- status "changed" only
   #     } }
   #
-  # "move" (reparenting and/or unique-path change; one entry at the
-  # subtree root, descendants get none -- a descendant's own zoomed
-  # view will not show path history):
-  #   "path"  -- pair
+  # "move" (reparent and/or path change; one entry at the subtree
+  # root, descendants get none):
+  #   "path" -- pair
   #
-  # Reserved for the Trash feature, final shape decided there:
-  # "demote" (via "trash" | "depublish"; carries the leaving-public-
-  # view snapshot: head presence, final published_at), "trash",
-  # "restore_from_trash", "destroy" (final path only; publish-state
-  # snapshot lives on the entry that removed it from public view).
-  # Whether trash logs one entry or a trash+demote pair is decided
-  # with that feature.
+  # "trash" (subtree into the Trash; every head in the subtree is
+  # demoted first; one entry at the root; snapshots the
+  # leaving-public-view state, since Trash holds no heads and destroy
+  # can no longer know):
+  #   "path"               -- pair; "from" doubles as the restore hint
+  #   "was_published"      -- boolean
+  #   "demoted_heads"      -- integer count, only when positive
+  #   "final_published_at" -- ISO8601 string, only when present
   #
-  # Backfilled entries mirror this vocabulary exactly. Their diff
-  # content is computed, not guessed (consecutive revisions still
-  # exist); only actor (from page.editor) and occurred_at are
-  # inferred, and inferred_from names the heuristic per entry
-  # ("from_page_revision", "from_published_at_heuristic").
-  # inferred_from null = witnessed live.
+  # "restore_from_trash" (reparent back to a living node; returns as
+  # drafts, republication is a separate witnessed act):
+  #   "path" -- pair
   #
-  # The "locale" column is currently written by no verb (it belonged
-  # to the retired translation_destroy) and is retained for backfill
-  # or future draft-scoped verbs.
+  # "destroy" (only from inside the Trash, never with children; the
+  # entry is written in the same transaction before the row dies):
+  #   "path" -- final path, flat string (create-symmetric)
+  #   "destroyed_descendants" -- integer, only when positive; one entry
+  #                              at the root, per the subtree rule.
   #
-  # This log records; it does not undo. Reversibility stays in
-  # restore_revision! and the revisions system. No IP, session, or
-  # user agent, ever. Success only -- rejected attempts are not
-  # logged.
+  # Reserved: "demote" (via "trash" | "depublish") for an explicit
+  # depublish workflow, if ever built.
+  #
+  # Backfilled entries mirror this vocabulary; diff content is
+  # computed, only actor (page.editor) and occurred_at are inferred,
+  # inferred_from names the heuristic ("from_node_created_at",
+  # "from_page_revision"). Null = witnessed live.
+  #
+  # The "locale" column is written by no verb; retained.
+  #
+  # This log records; it does not undo. No IP, session, or user
+  # agent, ever. Success only.
 
   def self.record!(node:, action:, user: nil, page: nil, locale: nil,
                     occurred_at: nil, inferred_from: nil, **extra)
diff --git a/app/models/page.rb b/app/models/page.rb
index e5a8d9d..f33d88d 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -11,11 +11,21 @@ class Page < ApplicationRecord
 
   translates :title, :abstract, :body # Globalize2
 
+  # Template names render as filesystem paths; only names actually
+  # present in the public template directory are acceptable. Validated
+  # only on change so legacy rows whose template file has since
+  # vanished stay saveable -- valid_template already falls back to
+  # standard_template for those at render time.
+  validates :template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :template_name_changed?
+
   # Associations
   belongs_to :node, optional: true
   belongs_to :user, optional: true
   belongs_to :editor, :class_name => "User", optional: true
-  has_many   :related_assets
+  has_many   :related_assets, :dependent => :destroy
   has_many   :assets, -> { order("position ASC") }, :through => :related_assets
 
   # Named scopes
@@ -77,7 +87,10 @@ class Page < ApplicationRecord
         .paginate(:page => page, :per_page => options[:limit])
     end
 
-    scope.order("#{options[:order_by]} #{direction}")
+    column = options[:order_by].to_s.sub(/\Apages\./, "")
+    column = "id" unless %w[id published_at created_at updated_at].include?(column)
+
+    scope.order("pages.#{column} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 92ac33a..5e47ae7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,10 @@
 require 'digest/sha1'
 
 class User < ApplicationRecord
+  has_secure_password(validations: false)
+
+  alias_method :authenticate_bcrypt, :authenticate
+
   # Mixins and Plugins
   include Authentication
   include Authentication::ByPassword
@@ -23,9 +27,30 @@ class User < ApplicationRecord
 
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
-    return nil if login.blank? || password.blank?
-    u = find_by_login(login) # need to get the salt
-    u && u.authenticated?(password) ? u : nil
+    return if login.blank? || password.blank?
+
+    user = find_by(login: login)
+    return unless user
+
+    user&.authenticate(password)
+  end
+
+  def authenticate(password)
+    if password_digest.present?
+      return self if authenticate_bcrypt(password)
+      return nil
+    end
+
+    return nil unless authenticate_legacy(password)
+
+    transaction do
+      self.password = password
+      self.crypted_password = nil
+      self.salt = nil
+      save!(validate: false)
+    end
+
+    self
   end
 
   # TODO: Do we really want to have downcase logins only?
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb
index a9c0512..319530d 100644
--- a/app/views/admin/index.html.erb
+++ b/app/views/admin/index.html.erb
@@ -42,11 +42,12 @@
 
   <div class="dashboard_widget">
     <h3>Recent changes</h3>
-    <ul>
-      <%= render partial: "nodes/recent_change_item", collection: @recent_changes, as: :node %>
-    </ul>
-    <%= link_to "See all recent changes →", recent_nodes_path %>
+    <table id="node_action_list">
+      <%= render partial: "node_actions/action_row", collection: @actions, as: :action %>
+    </table>
+    <%= link_to "See all recent changes →", admin_log_path %>
   </div>
+
 </div>
 
 <div id="dashboard_housekeeping">
@@ -67,5 +68,9 @@
     <%= link_to menu_items_path, class: "action_button" do %>
       <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> Navigation
     <% end %>
+    <% trash_count = Node.trash.children.count %>
+    <%= link_to trashed_nodes_path, class: "action_button" do %>
+      <%= icon("trash", library: "tabler", "aria-hidden": true) %> Trash<%= " (#{trash_count})" if trash_count > 0 %>
+    <% end %>
   </div>
 </div>
diff --git a/app/views/events/_rrule_builder.html.erb b/app/views/events/_rrule_builder.html.erb
new file mode 100644
index 0000000..1ffec0a
--- /dev/null
+++ b/app/views/events/_rrule_builder.html.erb
@@ -0,0 +1,33 @@
+<div id="rrule_builder">
+  <p>
+    <label><%= radio_button_tag "rrule_freq", "weekly", true %> Weekly</label>
+    <label><%= radio_button_tag "rrule_freq", "monthly" %> Monthly</label>
+  </p>
+  <div id="rrule_weekly_options">
+    <p><label><%= check_box_tag "rrule_biweekly" %> Every 2 weeks</label></p>
+    <p>
+      <% %w[MO TU WE TH FR SA SU].each do |code| %>
+        <label><%= check_box_tag "rrule_byday_#{code}" %> <%= RruleHumanizer::WEEKDAY_NAMES_ABBR[:de][code] %></label>
+      <% end %>
+    </p>
+  </div>
+  <div id="rrule_monthly_options" style="display: none;">
+    <p><label><%= check_box_tag "rrule_monthly_ordinal" %> On a specific weekday each month</label></p>
+    <p id="rrule_ordinal_fields" style="display: none;">
+      <%= select_tag "rrule_ordinal", options_for_select([["1.", 1], ["2.", 2], ["3.", 3], ["4.", 4], ["letzter", -1], ["vorletzter", -2], ["Selected weeks", "custom"]]) %>
+      <%= select_tag "rrule_ordinal_day", options_for_select(%w[MO TU WE TH FR SA SU].map { |c| [RruleHumanizer::WEEKDAY_NAMES[:de][c], c] }) %>
+    </p>
+    <p id="rrule_custom_ordinal_fields" style="display: none;">
+      Weeks of the month:
+      <% (1..5).each do |ordinal| %>
+        <label><%= check_box_tag "rrule_custom_ordinal_#{ordinal}" %> <%= ordinal %>.</label>
+      <% end %>
+    </p>
+  </div>
+  <p>
+    <label><%= check_box_tag "rrule_exclude_month" %> Except in one month</label>
+    <%= select_tag "rrule_excluded_month", options_for_select((1..12).map { |m| [RruleHumanizer::MONTH_NAMES[:de][m-1], m] }), style: "display: none;" %>
+  </p>
+  <span class="field_hint">Builds the field below automatically. If your pattern is more complex than this covers, just edit it directly below - these controls won't touch it unless you use them.</span>
+</div>
+<%= f.text_field :rrule, id: "event_rrule" %>
diff --git a/app/views/events/edit.html.erb b/app/views/events/edit.html.erb
index bf8cb35..4532ff2 100644
--- a/app/views/events/edit.html.erb
+++ b/app/views/events/edit.html.erb
@@ -40,39 +40,7 @@
 
       <div class="node_description">Recurrence</div>
       <div class="node_content">
-        <div id="rrule_builder">
-          <p>
-            <label><%= radio_button_tag "rrule_freq", "weekly", true %> Weekly</label>
-            <label><%= radio_button_tag "rrule_freq", "monthly" %> Monthly</label>
-          </p>
-          <div id="rrule_weekly_options">
-            <p><label><%= check_box_tag "rrule_biweekly" %> Every 2 weeks</label></p>
-            <p>
-              <% %w[MO TU WE TH FR SA SU].each do |code| %>
-                <label><%= check_box_tag "rrule_byday_#{code}" %> <%= RruleHumanizer::WEEKDAY_NAMES_ABBR[:de][code] %></label>
-              <% end %>
-            </p>
-          </div>
-          <div id="rrule_monthly_options" style="display: none;">
-            <p><label><%= check_box_tag "rrule_monthly_ordinal" %> On a specific weekday each month</label></p>
-            <p id="rrule_ordinal_fields" style="display: none;">
-              <%= select_tag "rrule_ordinal", options_for_select([["1.", 1], ["2.", 2], ["3.", 3], ["4.", 4], ["letzter", -1], ["vorletzter", -2], ["Selected weeks", "custom"]]) %>
-              <%= select_tag "rrule_ordinal_day", options_for_select(%w[MO TU WE TH FR SA SU].map { |c| [RruleHumanizer::WEEKDAY_NAMES[:de][c], c] }) %>
-            </p>
-            <p id="rrule_custom_ordinal_fields" style="display: none;">
-              Weeks of the month:
-              <% (1..5).each do |ordinal| %>
-                <label><%= check_box_tag "rrule_custom_ordinal_#{ordinal}" %> <%= ordinal %>.</label>
-              <% end %>
-            </p>
-          </div>
-          <p>
-            <label><%= check_box_tag "rrule_exclude_month" %> Except in one month</label>
-            <%= select_tag "rrule_excluded_month", options_for_select((1..12).map { |m| [RruleHumanizer::MONTH_NAMES[:de][m-1], m] }), style: "display: none;" %>
-          </p>
-          <span class="field_hint">Builds the field below automatically. If your pattern is more complex than this covers, just edit it directly below - these controls won't touch it unless you use them.</span>
-        </div>
-        <%= f.text_field :rrule, id: "event_rrule" %>
+        <%= render "rrule_builder", f: f %>
       </div>
 
       <div class="node_description">Title</div>
diff --git a/app/views/events/new.html.erb b/app/views/events/new.html.erb
index 7a1ee7a..028fce7 100644
--- a/app/views/events/new.html.erb
+++ b/app/views/events/new.html.erb
@@ -21,8 +21,8 @@
       <div class="node_description">End time</div>
       <div class="node_content"><%= f.datetime_select :end_time %></div>
 
-      <div class="node_description">Rrule</div>
-      <div class="node_content"><%= f.text_field :rrule %></div>
+      <div class="node_description">Recurrence</div>
+      <div class="node_content"><%= render "rrule_builder", f: f %></div>
 
       <div class="node_description">Title</div>
       <div class="node_content">
@@ -53,4 +53,3 @@
     </div>
   </div>
 <% end %>
-
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
index 0856a0f..e220beb 100644
--- a/app/views/layouts/admin.html.erb
+++ b/app/views/layouts/admin.html.erb
@@ -7,19 +7,18 @@
     <%= csrf_meta_tags %>
   
     <title><%= "#{params[:controller]} | #{params[:action]}" %></title>
-    <%= javascript_tag "var AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %>
     <%= javascript_include_tag 'admin_bundle' %>
     <%= tinymce_assets %>
     <link rel="stylesheet" href="<%= mtime_busted_path('/stylesheets/admin.css') %>">
     <script src="<%= mtime_busted_path('/javascripts/admin_search.js') %>"></script>
     <script src="<%= mtime_busted_path('/javascripts/admin_interface.js') %>"></script>
     <script src="<%= mtime_busted_path('/javascripts/related_assets.js') %>"></script>
-    <script>
+    <%= javascript_tag nonce: true do %>
       var ADMIN_SEARCH_URL = "<%= admin_search_path %>";
       var ADMIN_MENU_SEARCH_URL = "<%= admin_menu_search_path %>";
       var PARAMETERIZE_PREVIEW_URL = "<%= parameterize_preview_nodes_path %>";
       var DASHBOARD_SEARCH_URL = "<%= admin_dashboard_search_path %>";
-    </script>
+    <% end %>
   </head>
   
   <body>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index d7681af..ca867ab 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -18,12 +18,12 @@
     <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %>
     <%= auto_discovery_link_tag(:rss,  '/rss/updates.rdf', title: "RSS") %>
 
-    <script>
-      (function() { document.addEventListener("DOMContentLoaded", function() {
-        if (localStorage.getItem('override-prefers-color-scheme', false))
+    <%= javascript_tag nonce: true do %>
+      document.addEventListener("DOMContentLoaded", function() {
+        if (localStorage.getItem('override-prefers-color-scheme'))
           document.getElementById("light-mode").checked = true;
-      }); })();
-    </script>
+      });
+    <% end %>
 
   </head>
 
diff --git a/app/views/node_actions/_action_row.html.erb b/app/views/node_actions/_action_row.html.erb
new file mode 100644
index 0000000..c640f0d
--- /dev/null
+++ b/app/views/node_actions/_action_row.html.erb
@@ -0,0 +1,18 @@
+<tr class="node_action node_action--<%= action.action %>">
+  <td class="node_action_time">
+    <span class="node_action_date"><%= action.occurred_at.strftime("%Y-%m-%d") %></span>
+    <span class="node_action_clock"><%= action.occurred_at.strftime("%H:%M") %></span>
+  </td>
+  <td class="node_action_body">
+    <%= verb_icon(action) %>
+    <%= action_summary(action) %>
+    <% if action.node_id && params[:node_id].blank? %>
+      <%= link_to t("node_actions.node_history"), admin_log_path(:node_id => action.node_id), :class => "node_action_zoom" %>
+    <% end %>
+    <% if action.inferred_from %>
+      <span class="node_action_inferred" title="<%= action.inferred_from %>"><%= t("node_actions.backfilled") %></span>
+    <% end %>
+    <%= render "node_actions/change_details", :action_entry => action if action_details?(action) %>
+  </td>
+</tr>
+
diff --git a/app/views/node_actions/index.html.erb b/app/views/node_actions/index.html.erb
index ee06213..20ef5b3 100644
--- a/app/views/node_actions/index.html.erb
+++ b/app/views/node_actions/index.html.erb
@@ -7,21 +7,7 @@
 <%= will_paginate @actions %>
 
 <table id="node_action_list">
-  <% @actions.each do |action| %>
-    <tr class="node_action node_action--<%= action.action %>">
-      <td class="node_action_time"><%= action.occurred_at.strftime("%Y-%m-%d %H:%M") %></td>
-      <td class="node_action_body">
-        <%= action_summary(action) %>
-        <% if action.node_id && params[:node_id].blank? %>
-          <%= link_to t("node_actions.node_history"), admin_log_path(:node_id => action.node_id), :class => "node_action_zoom" %>
-        <% end %>
-        <% if action.inferred_from %>
-          <span class="node_action_inferred" title="<%= action.inferred_from %>"><%= t("node_actions.backfilled") %></span>
-        <% end %>
-        <%= render "change_details", :action_entry => action if action_details?(action) %>
-      </td>
-    </tr>
-  <% end %>
+  <%= render partial: "node_actions/action_row", collection: @actions, as: :action %>
 </table>
 
 <%= will_paginate @actions %>
diff --git a/app/views/nodes/destroy.html.erb b/app/views/nodes/destroy.html.erb
deleted file mode 100644
index 065cf1d..0000000
--- a/app/views/nodes/destroy.html.erb
+++ /dev/null
@@ -1,2 +0,0 @@
-<h1>Nodes#destroy</h1>
-<p>Find me in app/views/nodes/destroy.html.erb</p>
diff --git a/app/views/nodes/new.html.erb b/app/views/nodes/new.html.erb
index 38eac84..890d46e 100644
--- a/app/views/nodes/new.html.erb
+++ b/app/views/nodes/new.html.erb
@@ -33,7 +33,7 @@
     <div class="node_description">Parent</div>
     <div class="node_content">
       <%= text_field_tag :parent_search_term, @parent&.title %>
-      <%= hidden_field_tag :parent_id, @parent&.id, data: { unique_name: @parent&.current_unique_name } %>
+      <%= hidden_field_tag :parent_id, @parent&.id, data: { unique_name: @parent&.computed_unique_name } %>
       <div id="parent_search_results" class="search_results"></div>
     </div>
   </div>
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index ae25571..af05778 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -46,7 +46,7 @@
         <% end %>
 
         <% unless locked_by_other %>
-          <% if @node.draft && !@node.autosave %>
+          <% if @node.draft && !@node.autosave && !@node.in_trash? && !@node.trash_node? %>
             <div class="node_info_item">
               <%= button_to 'Publish', publish_node_path(@node), method: :put,
                     form: { data: { confirm: "Publish this draft?" }, class: 'button_to state_changing' } %>
@@ -62,6 +62,15 @@
             <% end %>
             </div>
           <% end %>
+          <% unless @node.trash_node? || @node.in_trash? || @node.root? %>
+            <div class="node_info_item">
+              <%= button_to trash_node_path(@node), method: :put,
+                    form: { data: { confirm: "Move this page and everything beneath it to the Trash? All published content in it will go offline." }, class: 'button_to destructive' } do %>
+                <%= icon("trash", library: "tabler", "aria-hidden": true) %>
+                Move to Trash
+              <% end %>
+            </div>
+          <% end %>
         <% end %>
       </div>
 
@@ -70,6 +79,48 @@
       <% end %>
     </div>
 
+    <% if @node.in_trash? %>
+      <div class="node_description">Trash</div>
+      <div class="node_content node_info_group">
+        <div class="node_info_group_items">
+          <% if (entry = @node.last_trash_entry) && entry.metadata.dig("path", "from") %>
+            <div class="node_info_item">
+              <span class="node_info_label">Was at</span>
+              <%= entry.metadata.dig("path", "from") %>
+            </div>
+          <% end %>
+          <div class="node_info_item">
+            <span class="node_info_label">Restore to</span>
+            <% suggestion = @node.suggested_restore_parent %>
+            <%= form_tag restore_from_trash_node_path(@node), :method => :put, :class => "aligned_action_row" do %>
+              <div class="restore_picker">
+                <%= text_field_tag :restore_search_term,
+                      suggestion && (suggestion.head&.title || suggestion.draft&.title || suggestion.slug),
+                      :placeholder => "Search for a new parent…" %>
+                <div id="restore_search_results" class="search_results"></div>
+              </div>
+              <%= hidden_field_tag :parent_id, suggestion&.id %>
+              <%= submit_tag "Restore here", :class => "action_button action_button_no_margin_top" %>
+            <% end %>
+            <span class="field_hint">Restored pages come back unpublished. Republish each page deliberately.</span>
+          </div>
+        </div>
+        <div class="node_info_group_items">
+          <div class="node_info_item">
+            <% doomed_below = @node.descendants.count %>
+            <%= button_to node_path(@node), method: :delete,
+                  form: { data: { confirm: doomed_below > 0 ?
+                            "Delete this page and the #{doomed_below} pages beneath it permanently? This cannot be undone." :
+                            "Delete this page permanently? This cannot be undone." },
+                          class: 'button_to destructive' } do %>
+              <%= icon("trash-x", library: "tabler", "aria-hidden": true) %>
+              Delete permanently<%= " (including #{doomed_below} beneath)" if doomed_below > 0 %>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    <% end %>
+
     <div class="node_description">Translations</div>
     <div class="node_content node_info_group">
       <div class="node_info_group_items">
@@ -178,7 +229,10 @@
         </summary>
         <ul>
           <% @node.pages.order(:revision).each do |page| %>
-            <li><%= link_to "##{page.revision} — #{page.title} (#{page.editor.try(:login)}, #{page.updated_at})", node_revision_path(@node, page) %></li>
+            <li>
+              <%= link_to "##{page.revision} — #{page.title} (#{page.editor.try(:login)}, #{page.updated_at})", node_revision_path(@node, page) %>
+              <span class="revision_lifecycle"><%= revision_lifecycle_badges(@page_actions[page.id]) %></span>
+            </li>
           <% end %>
         </ul>
       </details>
diff --git a/app/views/nodes/trashed.html.erb b/app/views/nodes/trashed.html.erb
new file mode 100644
index 0000000..9a4808e
--- /dev/null
+++ b/app/views/nodes/trashed.html.erb
@@ -0,0 +1,42 @@
+<h1>Trash</h1>
+
+<% if @nodes.empty? %>
+  <p class="field_hint">The Trash is empty.</p>
+<% else %>
+  <%= will_paginate @nodes %>
+  <table id="trashed_node_list">
+    <tr>
+      <th>Title</th>
+      <th>Was at</th>
+      <th>Trashed</th>
+      <th>Actions</th>
+    </tr>
+    <% @nodes.each do |node| %>
+      <% entry = node.last_trash_entry %>
+      <tr>
+        <% doomed_below = node.descendants.count %>
+        <td>
+          <%= link_to (node.draft&.title || node.slug), node_path(node) %><%= " (+ #{doomed_below} beneath)" if doomed_below > 0 %>
+        </td>
+        <td><%= entry&.metadata&.dig("path", "from") %></td>
+        <td>
+          <% if entry %>
+            <%= entry.occurred_at.strftime("%Y-%m-%d %H:%M") %> by <%= entry.actor_name %>
+          <% end %>
+        </td>
+        <td>
+          <%= button_to node_path(node), method: :delete,
+                        form: { data: { confirm: doomed_below > 0 ?
+                          "Delete \"#{node.draft&.title || node.slug}\" and the #{doomed_below} pages beneath it permanently? This cannot be undone." :
+                          "Delete \"#{node.draft&.title || node.slug}\" permanently? This cannot be undone." },
+                        class: 'button_to destructive' } do %>
+            <%= icon("trash-x", library: "tabler", "aria-hidden": true) %>
+            Delete permanently
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+  </table>
+  <%= will_paginate @nodes %>
+  <p class="field_hint">To restore a page, open it and pick a new parent in its Trash section.</p>
+<% end %>