Per TDobes' comments:

* INSTALL.txt corrected to use 4.3.3, not 4.33.
* .htaccess: removed allow_call_time_pass_reference. two confirmations that a) the setting was wrong in the first place, b) there were no adverse affects for the incorrect setting, c) the PHP docs say it is deprecated.
* .htaccess: removed short_open_tag. Running grep -r "<? " * across the entire directory tree of both core and contributions only brought up contributions and no core. I agree that the fuller form is better. The following contributions will need to be updated: modules/edit_template/edit_template.module, sandbox/garym/themes/marvin_2k/templates/page.tpl.php, sandbox/killes/compare.php, sandbox/paolino/import/click.php, themes/spreadfirefox/block.tpl.php. For error's sake, I also did a manual verification for "<?" (no space) across core and came up against nothing in addition to the above contribs.

Per Goba's comments:

* .htaccess: Moved session.auto_start back.
* sites/default/settings.php: Removed track_vars.

Per mailing list comments:

* INSTALL.txt: Added text about the files/ directory, creating it, and permissions.
* INSTALL.txt: Added an example of why Drupal requires cron (the search.module) in an attempt to justify why a crontab is a good, nay, required step.

And my own further analities:

* .htaccess: cleaned up some whitespace valleys (i hate 'em, hate 'em!) and fixed a few stray colons.
* settings.php: minor whitespace error.

- Patch #17303 by tangent: moved the session settings into /sites/default/settings.php so that subsites can have better control over them. One of the advantages of the site specific settings.php file is that it will never get overwritten during upgrades and having these settings here should prove to be more friendly.

- Oops.

- Patch #10425 by ccourtne and walkah: added admin screens to maintain forums instead of forcing the user to add a taxonomy.

- Theme system changes.  Please consult http://drupal.org/node/view/9576 for details.

- Direct 404s to Drupal.  Suggested by Goba.

- Reworked 404 (page not found) handling.  Patch by walkah.  You can specify a
  custom 404 page in the administration page.  As a result, error.php could be
  removed.

- Added some Apache 2 specific instructions.

- Gerhard's uid 0 patches.  These patches bring various performance
  improvements.  Requires a database update.

- Set session.gc_maxlifetime to something more sensible than the default
  1440 seconds.

- Set some additional options to avoid installation pains.

to avoid XSS attacks!  Patch by Al, Moshe, Marco, Kjartan and me.

- Bugfix: the admin module does now import drupal.css prior to admin.css.
Patch by me.

- Bugfix: the admin module was still emitting a <base href=""> tag.  I
removed this as it is been taken care of by theme_head();  Patch by me.

- Bugfix: made the tracker module's pager only consider published pages.
Patch by Moshe.

- Bugfix: cured some typos in the comment module's help function.  Patch by
Marco.

- Bugfix: fixed a typo in the pager_display() that caused optional
attributes to be discarded.

- Bugfix: made the Xtemplate emit empty boxes like any other theme does.
Patch by Al.

- Bugfix: fixed broken link on the statistics module's log page.
Reported by Kjartan.

- CSS improvements: made the HTML output emitted by the tracker module
look nicer.  Patch by Moshe and Al.

- CSS improvements: added CSS classes for form elements.  Patch by Al.

- CSS improvements: added a vertical gap between the last form item and the
submit button.  Patch by Al.  Note that Opera 6 is not picking up this
CSS but apparently others browsers such as Konqueror do.

- Xtemplate improvements: changed the color of the selected day in the
archive module's calendar.  Patch by Al.

- Usability improvements: made the "birthday" field of the profile module
look nicer.  Patch by Al.

------

- TODO: it might be a good idea to emit the following meta tag in the
theme_head() function:

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />

Currently, some themes (and modules!) emit this while others don't.  This
would also make it possible to change the charset site-wide.

- TODO: now we added support for td.dark and td.light to drupal.css, maybe
it can be removed from admin.css as well as xtemplate.css?

- Fixed a typo in the PostgreSQL database scheme.  Patch by Michael Frankowski.

- Fixed a typo in the MSSQL database scheme.  Patch by Michael Frankowski.

- Removed dependency on "register_globals = on"!  Patches by Michael Frankowski.

  Notes:

  + Updated the patches to use $foo["bar"] instead of $foo['bar'].
  + Updated the INSTALL and CHANGELOG files as well.

- Tiny improvement to the "./scripts/code-clean.sh" script.

- Some .htaccess file fixes/improvements.  Thanks Ax.

- The .htaccess file will now correct the majority of the external referers
  that still use the old URL scheme!  Thanks Ax and Gerhard for providing a
  better upgrade path.

- Bugfix: made the pager work when clean URLs are enabled.  Patch by Ax.

- Clean URLs.

- Changed the RewriteRule in .htaccess.
- Fixed form_select() matching incorrectly.
- Added missing $Id$ to menu.inc

- Added 'php_value arg_separator.output  "&"' as suggested by Curtis.

- Made sure session.cache_limiter is set to "none" as suggested by Moshe
  and Ax.

- Added "short_open_tag 1" to the PHP settings.

- some interface changes in block admin page.

  http://list.drupal.org/drupal-devel/2002-February/thread.html#6678
  http://list.drupal.org/drupal-devel/2002-February/thread.html#6629
- removed references to $this->user() from themes.
- removed $BaseTheme->user(). It was deprecated a while back.

NOTE: this update will break custom themes, so make sure you update your
themes before updating!

- Made the "http://foo.com/blog/username" URL syntax work again.  Patch by
  Foxen.

  filters more specific.

  easier. Also changed the <? tag to <?php in some cases.

  session_set_save_handler() in user.module.

- Renamed syndication.module to import.module.

- Removed headline.module: it became obsolete.

- Removed backend.class: it became obsolete.

- Added export.module.

  For now, you can use:
    1. http://drupal/export.php?headlines.rss
    2. http://drupal/export.php?headlines.rdf

- Renamed export to export.php.

  For now, you can use:
    1. http://drupal/export.php?headlines.rss
    2. http://drupal/export.php?headlines.rdf

  Renaming this file has main 3 advantages:
    1. We no longer rely on .htaccess for being able to export.
    2. It is more conform with the general naming conventions.
    3. It removes a pseudo-hack with formatting the URI.

- Made import.module export blocks with feeds.

  Apache, but seems that the latest versions are not as forgiving.

- fixed bug in common.inc: throttle()
- streamlined method invocation in node.inc
- added node_status() function to modules
- added NEW (mostly static) page module
- added NEW settings module