NetBBS v7.19.1

NetBBS v7.19.1

This patch release makes chat-bot settings selectable in the SysOp console and
restores the catalogue menu formatting. Nothing migrates: the node database
stays at schema 130, and the Link, real-time, door API, career and world
versions are unchanged. Upgrading is a wheel swap and a restart; rolling back
to v7.19.0 is the reverse.

Bot settings are selectable (PR #1235)

Chat-bot settings that contain channels, boards or file areas now open a
picker. Multiple selections can be toggled while paging and searching, and
the draft remains unchanged until the bot editor is saved. A channel removal
also clears dependent grants and an announcement destination from that draft.
Unavailable existing grants remain visible so a SysOp can remove them without
silently regranting anything. The announcement destination has an explicit
(none) choice.

The picker now supports this toggle interaction as a reusable editor control.
Its catalogue title, breadcrumb and descriptions follow the console's current
menu preferences, including narrow-terminal fitting. Hidden, MRC and
ineligible inherited resources are excluded from new grants.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs, and no setting
or config key is added. Rolling back to v7.19.0 is the reverse.

Verification boundaries

• The bot settings UI and reusable picker regression tests cover selection,
  paging, search, discard-before-save, stale grants, dependent-grant cleanup,
  resource filtering and 40/80-column catalogue fitting.
• The focused bot and picker regression set passed: 61 passed. The full
  Windows suite produced 11,754 passed and 136 skipped, with one unrelated
  failure in test_link_key_rotation.py::test_a_backup_checksums_the_retired_keys
  because the existing user-level Voidrunner save directory rejected creation
  of .maintenance.lock (PermissionError).
• NetBSD, real-terminal and live multi-node operational checks remain manual
  evidence; this patch does not change those boundaries.

NetBBS v7.19.0

NetBBS v7.19.0

This release covers everything merged since v7.18.6. It has three parts.

• Chat bots (design #1208, implementation #1210). A SysOp can run Baud,
  the bundled house bot, or an external bot program in chat channels. Every
  bot is off until a SysOp configures it, and every ability beyond answering
  messages addressed to it is a separate grant: reading whole channels,
  greetings, statistics and last-seen queries, board and file
  announcements, Linked channels, and an optional language model.
• The bundled games come from their own repositories (#1214, #1216,
  #1223, #1226, #1227, #1228). Voidrunner, Retro Trivia and War Dialer are
  now developed in Thiesi/Voidrunner, Thiesi/RetroTrivia and
  Thiesi/WarDialer, which can also host them on other BBS software. NetBBS
  ships one tagged release of each, unchanged: Voidrunner v1.1.0, Retro
  Trivia v1.0.0 and War Dialer v1.1.0.
• Chat fixes. The chat is drawn again after a resize (#1207), and
  command hints colour their brackets and parameter names differently
  (#1233).

It migrates: the node database goes from schema 123 to 130. Other
versions stay as they were: NETBBS_PROTOCOL_VERSION is 1,
REALTIME_PROTOCOL_VERSION is 4, DOOR_API_VERSION is 4, Voidrunner careers
are save schema 2 and War Dialer worlds are world schema 11. netbbs.toml has
no new keys. There is a new optional extra, netbbs[bots], needed only for
model conversation. Rolling back needs a restore, and Voidrunner careers saved
by this release cannot be read by 7.18.6 (see Upgrade and rollback).

Chat bots (#1208, #1210)

What callers and SysOps gain

• Baud, under SysOp → Content → Open chat bots. Create an instance,
  choose its channels, optionally make it their default bot, enable it and
  Save. Callers type Baud.bot: help, or !help where it is the default.
  It sets public reminders (!remind 10m check the oven, !reminders,
  !cancel 1) that survive restarts. Friendly, terse and retro temperaments
  change its phrasing (#1212).
• External bots use the same versioned JSON-lines API and the same host
  checks as Baud, documented in the new bot API guide.
  They run as the NetBBS OS user; the API bounds what they can do through
  NetBBS, but it is not an operating-system sandbox. Install only programs
  you trust.
• Bots are marked and controllable (#1211, #1212). A bot author is a
  reserved .bot name shown with [BOT] in live chat, history and rosters.
  /bots all|local|none sets which bots a channel shows on this node.
  Moderators can /mute Baud.bot. The catalogue shows each bot's status,
  with Kill selected, Stop all and Delete selected (#1215,
  #1232). Output limits apply per bot and channel and survive a restart.
• Separate grants, all off by default:
  • Linked channels (#1213). With a per-channel Linked approvals
    entry, callers on other nodes address Baud.bot@Node: help. New Link
    frames are offered only to peers that announce the chat_bots_v1
    capability; older peers keep receiving ordinary chat.
  • Statistics and last seen (#1218): stats gives the node name,
    uptime and how many people are online; seen <account> gives public
    online status or the last recorded login or logout. Hidden session
    history stays hidden.
  • Reading whole channels, joins and leaves, and greetings (#1219). The
    editor asks before Save, and the channel heading and /who tell callers
    which bots read the channel.
  • Post and file announcements (#1220) from boards and file areas that
    everyone can read, into one announcement channel per bot. They carry
    titles and names, never bodies or files, and they are best-effort
    notices, not a guaranteed delivery queue.
  • Model conversation (#1222). A node-wide provider switch under
    Chat bots → Model settings and a per-bot grant, both off. Any
    OpenAI-compatible endpoint works, for example a local Ollama server;
    NetBBS installs no model. A caller's first request only shows a notice
    naming the provider and is not sent. Replies are public, and context is
    limited to that caller's recent exchange with the bot in that channel.
    Token budgets, optional money caps, per-caller quotas and channel rates
    bound it, and Usage shows what was spent. Prompt logging is off by
    default. API keys stay in the node database and are never passed to a
    bot program.
• Bot state is backed up (#1215). Reminders and other bot state in
  <db>.bots/ are part of node backups and restore with the database.

The games' own repositories (#1214, #1223)

The three games keep running exactly as before inside NetBBS, from the same
Gallery entries. What changes is where they are developed: each repository has
its own tests, design notes and releases. NetBBS bundles a tagged release
unchanged, recorded in src/netbbs/doors/bundled/VENDORED.json, and its tests
refuse a modified copy. Report game bugs in the game's repository; world,
save, backup and resize behaviour inside NetBBS is still reported to NetBBS.

What the new releases change for NetBBS callers:

• Voidrunner v1.1.0 shows how long is left before the door's time limit
  ends the session, warns before it runs out, and saves before handing the
  caller back. The limit is the door profile's time_limit, or an hour for
  a door without a profile; a limit of 0 means none, and nothing is shown. Its Display
  Options screen names the encoding as managed by NetBBS. Every save now
  records a display encoding, which matters on rollback (below).
• War Dialer v1.1.0 plays its launch splash on Windows nodes too. It
  already played on other systems, and Windows now detects input waiting
  in a pipe.
• Retro Trivia v1.0.0 no longer fails to start on a Windows node running
  Python 3.11 (RetroTrivia#7), where the copy in 7.18.6 asked for a call
  that Python version lacks on Windows. Otherwise it plays the same inside
  NetBBS; its new features (DOOR.SYS and DOOR32.SYS, CP437, DOOR32 sockets)
  are for other BBS software.

War Dialer's season and reset controls now live in the door, behind its own
--admin command (#1227). The SysOp console's [W]orld screen and
python -m netbbs.doors.war_dialer_admin work as before: NetBBS still checks
that the world belongs to the node and still takes and verifies a complete
node backup before a season close or reset.

Chat fixes

• Resizing a chat window keeps the conversation (#1207). Making the
  window taller or shorter redrew only the status and input rows and left
  the history blank. The chat now redraws its most recent lines (up to 500
  are kept) at the new size, in both channel and MRC chat and in direct chat.
• Command hints are easier to read (#1233). In Usage: lines and
  /help, brackets and | are grey and parameter names light blue.

Upgrade and rollback

Take a backup, stop NetBBS, replace the wheel and start it. Seven additive
migrations run on the node database, taking it from schema 123 to 130. All
are part of #1210:

• 124: a per-channel bot display policy (channels.bot_policy, default
  all) and the author kind of stored chat lines
  (channel_messages.author_kind, default user).
• 125: bot instances, their channel grants and persistent output
  history.
• 126: per-channel Linked approval (bot_channels.linked_approved,
  default off) and mutes of remote bots.
• 127: statistics and last-seen query grants (chat_bots.queries_json,
  default none).
• 128: channel reading, presence events and greetings, all off.
• 129: the announcement channel and its post and file toggles (off),
  board and file-area event sources, and the bounded event journal.
• 130: the model conversation grant (off), model usage accounting and
  limits.

netbbs.toml has no new keys; bot and model settings are stored in the node
database and set from the console. For model conversation only, install the
bots extra (pip install "netbbs[bots]==7.19.0"), or have web installed,
which already brings its HTTP client. The systemd and NetBSD rc.d examples did
not change.

On the first start after the upgrade:

• No bot runs until you create, configure and enable one, and nothing
  reaches a model until you enable a provider and grant it to a bot.
• Every channel shows all bots (/bots all), which is harmless until a
  bot exists. Set local or none per channel to show fewer.
• A local account whose name already ends in .bot stays a person. New
  accounts cannot take such names.
• MANUAL — before granting model conversation, read the bot API guide's
  Optional model conversation. Set the token budget, caller quotas and
  any money caps first, and use HTTPS for a remote provider.

Rolling back needs a restore. A 7.18.6 wheel refuses a schema-130
database. MANUAL — to roll back: stop NetBBS, install the 7.18.6 wheel,
then restore the backup taken before the upgrade. Anything since the upgrade
is lost with it. In particular:

• Voidrunner careers played since the upgrade are refused by 7.18.6's
  Voidrunner ("The saved career contains unsupported fields"), because
  v1.1.0 adds a display encoding to every save. Restoring the pre-upgrade
  backup brings back the careers as they were then, so progress made since
  is lost. War Dialer worlds are unaffected: 7.18.6's War Dialer ignores the
  new preference.
• MANUAL — delete the bot state directory, <db>.bots/, after the
  restore. 7.18.6's restore predates bots and leaves it in place, and a bot
  created under the same name after a later upgrade would pick up its old
  reminders. The bots themselves go with the restored database.

Verification boundaries

• The release gate: the full suite (pytest -n auto) on the tree that
  was merged as #1230, #1231 and #1232: 11,726 passed, 136 skipped, 1
  failed under load. The failure
  (...

NetBBS v7.18.6

NetBBS v7.18.6

A patch release for v7.18.5 with one fix to the file listing. Nothing
migrates: the node database stays at schema 123, and every protocol, door
API, save and world version is unchanged. Upgrading is a wheel swap and a
restart; rolling back to v7.18.5 is the reverse.

A refused key on a file listing leaves the prompt alone (PR #1203)

In a file area, < on the oldest page and > on the newest each left a
second Choice: under the first. The listing echoed every key it knew, with
a newline, before it checked that the action was possible, and a refusal then
had to put the prompt back. Board listings already checked first.

The file listing now checks first too. A key whose action is not on offer is
refused like an unknown key: a bell, nothing echoed, and the cursor stays at
the Choice: it was at. On a connection without cursor keys, where the key
has already been echoed by the time it is read, the refusal erases it.

This applies to every key the listing knows but does not always offer:

• < and > (and PgUp/PgDn, ←→) at either end of the listing, and [R]ecent
  on the newest page;
• [U]pload without write access to the area;
• [W]eb transfer on a connection that cannot carry Zmodem;
• [E]dit description, [L]ink catalogue, [Q]ueue, [O]n top and
  [K]eep where they are not offered.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs, and no setting
or config key is added. Rolling back to v7.18.5 is the reverse.

Verification boundaries

• Tested where it is shown: <, >, PgUp and PgDn refused at the ends of
  a one-page listing leave a single prompt, ring the bell and echo nothing;
  without cursor keys, a refused < is erased and no second prompt follows.
  The other keys share the same check but have no refusal test of their own.
• The release gate: the full suite on PR #1203's tree, 14,784 passed,
  139 skipped, 0 failed; the timing-sensitive tests 5/5.
• Not exercised on a live node yet: checked through the test suite's
  terminal emulation, not on Reliable Link.

NetBBS v7.18.5

NetBBS v7.18.5

A patch release for v7.18.4: a typed field is now edited where it is drawn,
the MRC bridge and the FTN gateway carry the same name on the Node menu as
under Settings, and the browser terminal has an icon. Nothing migrates: the node database stays at schema 123, and
every protocol, door API, save and world version is unchanged. Upgrading is a
wheel swap and a restart; rolling back to v7.18.4 is the reverse.

A typed field is edited where it is drawn (PRs #1197, #1198)

On a screen with numbered fields, choosing a field that takes typed input (by
its number, or by moving the cursor to it and pressing Enter) is meant to put
the cursor in that field's value, with a short hint on the Choice: row. Many
fields did, but a number of them still drew a prompt of their own below
Choice: instead, and some asked a yes/no question before the typing. With
redraw-in-place on, all of these now edit in place:

• Door compatibility (SysOp console, a door's compatibility editor): none
  of its typed fields could edit in place, because the editor never asked for
  the SysOp's redraw setting. All of them can now. Import JSON takes the
  path in its field too, and a failed import is shown on the next draw instead
  of on a screen of its own that waited for a key.
• Settings: the timestamp Format and the three node Colors
  (accent, header, clock). Each opens on its current value: a colour reads
  R,G,B or default, and entering default for a colour that already is
  the default now changes nothing without a message.
• Policy trust → Domains: the Domain ID.
• Node → Shutdown, Drain and Lock & drain: the Delay.
• Settings → Managed DNS: the Subdomain name, which opens on the name
  it has.
• FTN network passwords (session, packet, AreaFix): typed unseen at the
  field, rather than after the hint on the prompt row.
• Users → Create: the Password is typed unseen straight into its
  field and once more to confirm, and the Public key is pasted into its
  field; an empty answer clears either. Neither asks "Set a password?" or "Add
  a public key?" first any more. A mismatched password or a key that does not
  parse keeps what the draft had and says why.
• The user editor (Users → an account): Level, Display name and
  Birthdate.
• The review after writing a post or mail: To (mail) and Subject.
  A subject that is too long is said on the Choice: row and the field
  reopens in place.

If the terminal is resized while a field is open, the edit is cancelled, the
value is kept, and the next draw says so.

Where the old prompt stays: with redraw-in-place off, the prompt still
opens below Choice:. A form taller than the terminal shows just the rows
around the field while it is edited. The user editor and the review keep their
old prompt when the screen does not fit; the review also keeps it when the
value wraps or a row is wider than the terminal. Fields that open a
picker or a list of their own (a trust anchor's node, the MRC room blocklist)
are not typed fields; a bio or signature opens its editor; and the level
ladder's [N]ame and [G]o to level act on a row of the list and keep their
prompt.

The same name for the MRC bridge and the FTN gateway (PR #1196)

The MRC bridge was Inter-BBS chat (MRC) under Settings, where it is set
up, and Chat bridge (MRC) under Node, where its live status is, so nothing
said the two were the same thing. The FTN gateway was Echomail & netmail
(FTN) against FTN mail. The Node menu now uses the Settings names and
keys, and the status screens their titles:

	Settings	Node, before	Node, now
MRC	[I]nter-BBS chat (MRC)	[C]hat bridge (MRC)	[I]nter-BBS chat (MRC)
FTN	[E]chomail & netmail (FTN)	[F]TN mail	[E]chomail & netmail (FTN)

The Node menu's [C] and [F] no longer open anything.

Menu hints end on a whole word. Where a menu shows each entry's short
description beside it and the column is too narrow for all of it, the
description used to be cut mid-word ("Banners and m"). It now ends on the last
whole word that fits, and is left out if not even the first word fits; the
full text is in the screen's help.

The browser terminal has an icon (#1199, PR #1200)

The browser terminal every node serves linked no icon, and the paths browsers
ask for on their own were 404s, so the tab showed a blank icon. Found on
Reliable Link. It now shows the same icon as www.netbbs.org: a small terminal
with a >_ prompt.

• The page links it, and the web listener serves it where browsers and phones
  look without reading the page: /favicon.ico, /favicon.svg,
  /apple-touch-icon.png and /apple-touch-icon-precomposed.png, each with
  its image type.
• Behind a reverse proxy that passes everything to the web listener, as
  Reliable Link's Apache does, nothing needs changing: the icon comes through
  with the page. A proxy that forwards only /, /ws and /static/ has to
  pass these four paths too.
• The icon is the project's, not your board's own; there is no setting to
  replace it yet.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs, and no setting
or config key is added. Rolling back to v7.18.4 is the reverse.

Verification boundaries

• The release gate: the full suite on this release's tree, 14,784 passed,
  139 skipped, 0 failed; the timing-sensitive tests 5/5.
• Tested where it is shown: the delay, colour, password and public-key
  fields, the user editor's Level and Display name, and the review's To and
  Subject edit at their own row and column; the password reads unseen twice at
  the same place; the user editor and the review open their old prompt with
  redraw-in-place off; a resize during an in-place review edit says so on the
  next draw; the Node menu's [I] opens the MRC status screen; a too-long menu
  hint ends on a whole word. The timestamp format, domain ID, subdomain name,
  FTN passwords, the door editor's fields and the birthdate use the same
  in-place path but have no test of their own.
• Not exercised on a live node yet: these screens have been checked through
  the test suite's terminal emulation, not on ReLink.
• The icon: the four paths return 200 with their image types and the
  exact files, the page links them, and the browser terminal's copies are the
  same bytes as the website's; all three are in the wheel.
• Website: two captures on the MRC page still show the old Node title,
  Chat bridge (MRC); they are regenerated on the next website update.

NetBBS v7.18.4

NetBBS v7.18.4

A patch release for v7.18.3 with two changes: a SysOp can set what every guest
starts with, through [E]dit profile on the guest account; and the MRC hub's
replies to a caller, such as /BBSES, now arrive whole instead of stopping
after about 40 lines. Nothing migrates: the node database stays at schema
123, and every protocol, door API, save and world version is unchanged.
Upgrading is a wheel swap and a restart; rolling back to v7.18.3 is the
reverse.

Guest defaults (PR #1193)

A guest's own setting changes last only for their call, layered over what the
guest account stores. Until now no screen set those stored values: the only
route was the handbook's workaround of signing in as the guest account, and
v7.18.3's [E]dit profile was not offered on it.

Now a SysOp can open the guest account in Users and press [E]dit profile. The screen is titled Guest defaults, and what it sets is what
every guest starts with:

• Display settings (character set, colour depth, menu descriptions,
  in-place redraw, banner animations, colours in posts and mail, MRC colours,
  the MRC nick colour, location style), the fullscreen editor and stylized MRC names. Each
  guest can still change these for their own call, except the MRC nick colour.
• The shared account's public face: its bio and who may see it, its
  signature, whether it takes direct messages, who it blocks (that person's
  live messages to guests are refused; the account has no mailbox), private MRC
  messages, MRC last seen, and whether its name is shown to other callers.
  These are the same for every guest, who cannot change them.
• Not offered: Name & details, read receipts (the guest account has no
  mail), sort preferences (Profile can only clear them, and a guest's sort
  choices last only for their call, so there is nothing to set), SSH keys and
  the password.

Only a SysOp can set the guest defaults, since they apply to the whole node.
Staff with Manage accounts are not offered the key on the guest account,
and the database check refuses them. Each change goes into the guest account's
admin history ([H]istory), as on any account.

The SysOp Handbook's Guest access section described a workaround: turn
guest login off and sign in as the guest account to change its profile. That
route also opened Name & details, including a birthdate. The handbook now
describes [E]dit profile instead.

MRC: the hub's reply to a caller arrives whole (PR #1194)

/BBSES lists every board connected to the MRC hub, one line each. On a
NetBBS node it showed the header and the first 39 boards, then skipped to a
stray line or two, with nothing said about the rest. Every line from the hub
paid one node-wide allowance (a burst of 40 lines, then 20 a second), and a line
past it was dropped silently. A long reply arrives as one burst, so the rest of
the listing was lost.

• A reply to one caller (/BBSES, LIST, HELP, INFO and the like),
  which is shown to that caller alone, now pays that caller's own reply
  allowance instead (STATS aside, which the bridge also acts on). That allowance is raised from 60 to 300 lines, so a full
  listing fits. Past it, the caller sees "the hub's reply was cut short", as
  before.
• Everything else keeps the node-wide allowance: room chat, and every hub
  command the bridge acts on by name, such as room topics, rosters and room or
  nick corrections, even when it names a caller. A test reads the bridge's
  command handling and fails if a new command would skip both allowances.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs, and no setting
or config key is added. Rolling back to v7.18.3 is the reverse. Guest defaults
already set stay stored on the guest account, and v7.18.3 still shows them to
guests; it just offers no screen to change them.

Verification boundaries

• The release gate: the full suite on this release's tree, 14,768 passed,
  139 skipped, 0 failed; the timing-sensitive tests 5/5.
• Tested where it is shown: who is offered and allowed the guest defaults
  (a SysOp yes; a manager and a SysOp disabled while the screen is open, no;
  plain staff are refused on any account, though not tested on this one), the fields the screen offers and leaves out, a guest starting with
  a SysOp-set default and keeping their own change to the call, a 150-line hub
  reply reaching its caller whole, and room traffic and room-topic floods still
  cut at the node-wide allowance.
• Not exercised on a live node yet: the guest defaults screen has been
  checked through the test suite's terminal, and the MRC change against a fake
  hub, not on ReLink or the live MRC network.

NetBBS v7.18.3

NetBBS v7.18.3

A patch release for v7.18.2 with four changes: a SysOp can now edit a member's
whole Profile from the user editor; key bars that wrap line their hotkeys up in
columns; the user editor fits those columns at 80x24; and a rejected key no
longer eats a character of the prompt. Nothing migrates: the node database
stays at schema 123, and every protocol, door API, save and world version is
unchanged. Upgrading is a wheel swap and a restart; rolling back to v7.18.2 is
the reverse.

Edit a member's Profile from the user editor (PR #1189)

The user editor (SysOp console > Users > an account) has a new key,
[E]dit profile. It opens the member's own Profile screen, acting on their
account: the same fields, sections and help they see. That covers their bio,
signature, name and details (location and who may see them), the people they
block, and their display, mail and chat settings. Until now the user editor
covered the account itself (level, status, name, birthdate, password, keys,
staff rights) but none of the settings a member sets in their own Profile.

• Who: a SysOp, on any account; a staff member with Manage accounts,
  on an account below level 255 that holds no staff permissions, the rule the
  display name and birthdate already follow. It is not offered on your own
  account (your Profile is on the main menu) or on the guest account, whose
  settings belong to each guest's own call.
• Every change is checked and recorded. Each write checks the editor's
  permission again in the database; a permission taken away while the screen
  is open refuses the next change with "Not changed: …". Each change goes into
  the account's admin history ([H]istory) as edit_profile, in the same
  database transaction as the change itself. Settings are recorded with their
  new value. Private text is recorded only as changed, never quoted: the bio,
  the signature, the location and who they block. A cleared sort preference is
  recorded with which one it was. The display name, birthdate, password and
  SSH keys keep the records they already had (set_display_name,
  set_birthdate and the password and key entries).
• The screen draws with your settings, not theirs. Your display settings
  (menu descriptions, redraw-in-place, line style, breadcrumbs) and your own
  session's character set apply. A change to the
  member's character set or banner animations is stored for them and never
  touches your own session. The "Transport report" line, which describes your
  connection, is left off.
• What stays theirs or the SysOp's alone. Whether a verified age or name is
  shared over NetBBS Link stays the member's own choice; staff cannot switch
  it on (a SysOp can still revoke a verification with [V]). SSH keys stay
  SysOp-only, as on the user editor. The username is shown, not editable.
• Bio and signature open in your preferred editor. Your unsaved draft is
  kept apart from the member's own, so neither of you recovers the other's
  text.

The SysOp Handbook's user-editor section had old names: the keys "Display
[n]ame" and "Birthdat[e]", and the main menu's "Staff list". It now says
[N]ame, [W]hen born and Operators, as the screens do.

Key bars that wrap line their hotkeys up (PRs #1188, #1190)

Many screens show their keys on a packed bar: with menu descriptions off, on
detail panels, and wherever a described menu would not fit. When the bar was
too wide for one row it wrapped, and each row's keys started wherever the
row before ended, which made them hard to scan. A bar that needs more than one
row is now laid out in aligned columns, in reading order, each column as wide
as its widest entry:

[L]evel     [U]se promotion rules    [T]oggle enable/disabled
[N]ame      [W]hen born              [E]dit profile
[S]taff     [I]dentity verification  [K]ey
[P]assword  [R]estrict login         [H]istory
[D]elete    [B]ack

Columns cost rows: that bar takes 5 rows where packing took 3. So a bar is
aligned only while it takes at most a quarter of the terminal's height (6 rows
at 24 lines, 3 at 12); past that it stays packed, as before. A bar on one row
is unchanged. This applies to every NetBBS screen with such a bar, for callers
and SysOps alike; the bundled doors draw their own and are unchanged.

Screens that must keep their content on screen take the packed bar when the
aligned one would not fit:

• a detail panel or the review screen after writing a post or mail, when its
  page would otherwise be cut below its minimum;
• a SysOp console screen with a panel above its keys, when the aligned bar
  would not fit under that panel.

The user editor fits at 80x24. Its read-only facts (member since, admin
actions, moderator grants) now follow the account's fields directly, with no
RECORD heading or blank row of their own. That frees the two rows the aligned
bar needs: with redraw-in-place on, the screen is exactly 24 rows. With
redraw-in-place off, with a result line shown above the prompt, or for a
pending signup that left a signup answer (now shown below the record), the bar
stays packed.

A rejected key no longer eats a character of the prompt (PR #1187)

On some screens, pressing a key the screen does not use moved the cursor back
one character before the bell rang, erasing part of the prompt each time. The
screens read keys without echoing them, but rejected them as if the key had
been printed. Affected were the SysOp user editor, every Create/Edit screen
(message boards, chat channels, file areas and the rest, and Profile), and the
review screen after writing a post or mail. An unknown key there now only rings
the bell.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs, and no setting
or config key is added. Rolling back to v7.18.2 is the reverse; any
edit_profile entries already in an account's admin history stay there and
are still listed.

Verification boundaries

• The release gate: the full suite on this release's tree, 14,762 passed,
  139 skipped, 0 failed; the timing-sensitive tests 5/5.
• Tested where it is shown: the user editor's key gating (SysOp, Manage
  accounts, plain staff, your own account, the guest account), a staff edit
  landing on the member and in their history, a failed history entry undoing
  its change, the character set staying off the SysOp's session, the aligned
  and packed bars at the widths and heights above, the user editor at 80x24
  with redraw-in-place on and off, and the bell-only rejection on all three
  screens.
• Not exercised on a live node yet: the new user-editor layout and
  [E]dit profile have been checked through the test suite's terminal, not on
  ReLink.

NetBBS v7.18.2

NetBBS v7.18.2

A patch release for v7.18.1 that finishes a rename from v7.18.0. Nothing
migrates: the node database stays at schema 123, and every protocol, door
API, save and world version is unchanged. Upgrading is a wheel swap and a
restart; rolling back to v7.18.1 is the reverse.

Messages name the main menu's Operators, Approvals and Topics (#1183, PR #1185)

v7.18.0 renamed main-menu items: the staff list became [O]perators,
Moderation became [A]pprovals and Communities became [T]opics.
Several messages still sent people to the old names, which their menu no
longer shows. They now name the current items:

• A board, file area or channel that needs a verified age or real name
  now says to ask the SysOp, and that "Operators on the main menu shows who to
  ask".
• A SysOp's away notice (Time away): its help and its confirmation say
  members see the notice under Operators.
• The SysOp console says staff and moderators are shown to members under
  Operators when it grants them, and the identity hint names Operators too.
• The main menu's "not available in this context" notices name Operators
  and Approvals.
• The console's Communities screen says callers reach Communities under
  Topics on the main menu.

A source check now keeps screen text from naming a renamed main-menu item
again.

Documentation: how "known since" is dated (#1181, PR #1182)

The node pages show "Known to Reliable Link since" from Reliable Link's
records. For peers a node met before v7.18.0, that date is approximate, often
the day of the upgrade, because no record holds the true first contact. The
design doc now says so. Reliable Link's dates were corrected by hand, so the
pages are right. No code changed.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs. Rolling back
to v7.18.1 is the reverse.

Verification boundaries

• The changed messages are tested where they are shown: the age and
  real-name gate refusals, the away notice and the grant notes.
• The release gate: the full suite (pytest -n auto) on PR #1185's
  first commit: 14,726 passed, 139 skipped, none failed; the
  timing_sensitive tests pass 5/5. The PR's second commit (the Topics
  line and the wider source check) was covered by its own tests, not a
  second full suite.

NetBBS v7.18.1

NetBBS v7.18.1

A patch release for v7.18.0 with two changes: paced banner and menu art now
plays to the end at the speed the SysOp chose, with an optional time limit;
and the node page setting stays reachable after a managed name lapses.
Nothing migrates: the node database
stays at schema 123, and every protocol, door API, save and world version is
unchanged. Upgrading is a wheel swap and a restart; rolling back to v7.18.0
is the reverse.

Paced art plays to the end; the time limit is your choice (PR #1180)

A banner, the main menu's art or a list's art can be given a Speed (2400,
9600 or 38400 bps), and NetBBS then draws it the way a modem of the day would
have. Until now every such draw stopped after a fixed 5 seconds and dumped the
rest at once, which cut a slow piece off mid-draw and looked broken.

• No speed (the default): the art is drawn at once, as before.
• A speed: the art now plays to the end at that speed.
• New: [T]ime limit, next to [S]peed on each art screen (welcome
  banner, main menu, Boards, file areas and Chat lists). It steps through
  off (the default), 10, 30 and 60 seconds; past the limit the rest is
  drawn at once. The menu shows the current setting, [T]ime limit: off, and
  each change is in the audit log (set_art_time_limit).
• Any key still skips to the end, and the key is used up, as before.
• Preview plays the art with its speed and time limit, as callers see it.

If you set a speed on a large piece, it now takes as long as that speed
needs. At 2400 bps a line carries 240 characters a second, so a full 80x24
ANSI screen, with its colour codes, takes from about 10 to 30 seconds or
more. Set a time limit if you'd rather callers not wait for it.

The web-page setting stays reachable after a name lapses (#1177, PR #1178)

A node with a managed netbbs.org name will have a public page at
https://www.netbbs.org/~<name> once the node pages go live. A name that is
given up (abandoned) or released keeps its page, marked as having left NetBBS
Link, until the SysOp turns it off. In v7.18.0, though, the DNS screen
offered [W]eb page, the only way to turn a page off, only while the name
was pending or matured. Once a name lapsed, its SysOp had a published page
and no way to take it down.

[W]eb page, the screen's Web page section and the screen's help now
cover an abandoned or released name too. For such a name the section adds:

This name is no longer registered, but its page stays, marked as left. Set
it to off here to take the page down.

During a rename the page shown is the current name's, which stays live, so
that note never appears there, whatever has become of the new name. A
revoked name loses its page, so it still shows no setting. Nothing else
changes: the three choices (shown but not indexed, shown and indexed, off),
the default, and the audit entry are as in v7.18.0.

The node pages are still not live (#1165). This release is the one
Reliable Link and other nodes should run when they go live.

Upgrade and rollback

Stop NetBBS, replace the wheel and start it. No migration runs; the art time
limits are stored as node settings and start off, so paced art plays to the
end after the upgrade. Rolling back to v7.18.0 is the reverse: v7.18.0 ignores
the time-limit settings and caps every paced draw at 5 seconds again, and a
page set to off stays off, since that setting itself is unchanged.

Verification boundaries

• The fix is tested on the DNS screen through scripted console sessions:
  an abandoned and a released name each show the address, the setting and the
  note, and stepping the setting turns the page off; a lapsed name's help
  lists the key; a rename whose new name was abandoned shows no note on the
  live page; a revoked name shows neither row nor key. Each of these fails
  without the fix.
• Paced art is tested with a simulated clock: with no limit a long piece
  plays to the end, a limit sends the rest at that point, a key still skips,
  and every writer and list passes the limit on. It has not been watched in a
  real terminal at each speed for this release.
• The release gate: the full suite (pytest -n auto) on PR #1180's tree,
  which includes #1178: 14,724 passed, 139 skipped, none failed; the
  timing_sensitive tests pass 5/5.
• The node pages themselves have still not been built from Reliable Link's
  real node map or deployed; see the v7.18.0 notes.

NetBBS v7.18.0

NetBBS v7.18.0

This release covers everything merged since v7.17.1. Most of it is one
change, the hotkey overhaul (tracker #1158): the same keys now do the same
thing on every screen, and a menu key is always the first letter of its
item. That moves keys callers have learned, so read Keys that moved before
upgrading. It has three parts.

• Keys that work everywhere (#1159–#1164, #1170, #1175). < > page,
  / finds, ?, F1 and Ctrl-H open help, and B or Esc goes back, on every
  hotkey screen. Every menu key is its label's first letter, list rows are
  numbered 01, 02 …, and settings fields are chosen by number. Each
  existing account sees a one-time screen explaining the change.
• Styled MRC names (#1156, PR #1157). Each caller chooses how an MRC
  sender's decorated handle, such as +Nick+[CASTLE BBS], is shown.
• Node pages on www.netbbs.org (tracker #1165: #1166–#1169, #1174). A
  node with a managed netbbs.org name that Reliable Link has met can have a
  public page at https://www.netbbs.org/~<name>, with a member badge for
  its own website. The node signs its choice (shown, indexed or off) into
  its Link descriptor. The pages are not live yet: the release ships the
  setting, the export and the generator; the deploy on the project's server
  follows this release (see "Verification boundaries").

It migrates: the node database goes from schema 120 to 123. Other
versions stay as they were: NETBBS_PROTOCOL_VERSION is 1,
REALTIME_PROTOCOL_VERSION is 4, DOOR_API_VERSION is 4, Voidrunner careers
are save schema 2 with tactical and outclassed ruleset 3, and War Dialer worlds
are world schema 11. netbbs.toml has no new keys. The Link wire gains three
optional fields in the signed endpoint descriptor, which older nodes accept
and ignore: node_page, software_version and public_boards; see
Upgrade and rollback. Rolling back needs a restore.

Keys that moved. Every rename is a clean switch: the old key is gone
with no hidden alias, and on most screens it now does something else or
rings the bell.

• Paging is < > (also PgUp/PgDn, and ←→ on lists) everywhere. The
  letters that used to page are gone: [N]ext/[P]rev on pickers, the
  mailbox and the post/letter review screen, [O]lder/[N]ewer on the post
  and file lists, and n/p on detail panels. The board reader's [N]ext post and [P]revious post stay.
• Find is [/] in the mailbox too ([F]ind is gone).
• Main menu: Communities C[o]mmunities → [T]opics; the staff list
  S[t]aff list → [O]perators; P[r]evious callers →
  [R]ecent callers; Moder[a]tion → [A]pprovals. O and T
  swapped places; R and A kept their letters.
• Mail list: De[l]ete → [E]rase; K[e]ep / Mov[e] to Inbox →
  [K]ept: no/yes; the Kept folder [K]ept → [V]iew Kept;
  Delete [r]ead → [P]urge read; [U] Read → [U]nread. Note
  that E, K and P now mean something different on this screen: E
  used to keep a letter and now erases it (after a yes/no question that
  defaults to No), K used to open the Kept folder and now keeps a letter,
  and P used to page back and now purges read mail (after a question that
  defaults to No).
• A letter: Reply [a]ll → [A]nswer all; [D]elete → [E]rase;
  K[e]ep / Mov[e] to Inbox → [K]ept: no/yes; [U]nread →
  [U]nread: no; Bloc[k] sender → [S]ender blocked: no/yes. Here
  too E used to keep and now erases (default No), and K used to block the
  sender and now keeps.
• A sent letter: Re[s]end → [S]end again (or [S]end another copy); [D]elete → [E]rase.
• Post reader: Remove pos[t] → [T]ake down; P[i]n →
  [O]n top: no/yes; Un[k]eep → [K]ept: no/yes.
• Board and file area: Un[f]ollow → [F]ollow: off/on; a file's
  P[i]n → [O]n top.
• Who's online: Bloc[k] → [S]ender blocked: no/yes.
• Sort prompts: A[L]phabetical → [N]ame.
• Writing a post or letter, the review screen: [B]ody →
  [E]dit body; [C]ancel → [B]ack, which now asks "Discard this
  draft?" (default No) once a body is written.
• Row numbers: on a board's posts, the mailbox and a file area, a row is
  01, 02 …: type two digits, or one digit and Enter. A single digit no
  longer opens a row by itself.
• Settings (Profile, Name & details, the SysOp console's settings and
  editors, a resource's own screen): fields are chosen by number,
  01–99, numbered straight through a screen's sections, instead of by
  letter. The console's per-user account screen keeps its letters.
• SysOp console: every key now sits on its label's first letter, many
  with a reworded label. Keys that moved include A[w]ay → [T]ime away,
  Bac[k]up → [F]ull backups, [O]utbox → [Q]ueue (outbox),
  Node lo[g] → [E]rror log, [F]ollow log → [W]atch log,
  Limit[s] & retention → [L]imits & retention, Net[w]ork & login limits → [O]perating limits, Pr[o]motion rules →
  [A]uto-promotion rules, Re[t]ired names → [H]eld names,
  Moderate [E]verything → [G]lobal moderation, and the trust state
  [B]locked → [D]enied (its quick action Bloc[k] → [D]eny). Settings no longer has its hidden l o r d f k shortcuts into Operations screens; each of those screens keeps its key
  under Operations. Granting a moderator every board, area or channel now
  takes [A]ll of one kind, then the kind. The SysOp Handbook has the full
  set.
• New: the Managed DNS screen gains [W]eb page; Profile gains the
  Stylized MRC names setting (see below).

Keys that work everywhere (#1158)

The decisions are in design doc §3.5 "Keys that work everywhere" and §16
"Issue #1158" (Decisions 1–8), each with the alternative it rejected. The
User Handbook has a table of the keys in "Find your way around".

What callers and SysOps gain

• The same keys on every hotkey screen, on Telnet, SSH and the browser
  terminal alike (PRs #1160, #1161):
  • B or Esc is Back. Esc first drops a highlighted row, then goes
    back. On a form it takes the [B]ack path, with its "Discard unsaved
    changes?" question. Before, Esc did nothing on most screens, and on lists
    and forms it only dropped a highlight or rang the bell.
  • < and > page; so do PgUp/PgDn, and ←→ on lists and long text. On a
    form, ←→ still step the highlighted value, and < > switch sections.
  • / finds.
  • Enter chooses.
  • B is the only reserved letter. Line prompts (typing a name, a
    subject) and doors are outside the rule.
• Help on every hotkey screen (PR #1162). ?, F1 and Ctrl-H open help.
  Before, ? worked only on the main menu, and most console menus, the file
  area list, detail panels and a dozen caller screens rang the bell. Help is
  built from the screen's own menu: each key with its one-line description, a
  sentence on what the screen is for, and the keys that work everywhere. A
  ? typed into a post or letter is still a ?. The browser terminal now
  decodes F1, and a click on [<] or [>] is sent instead of dropped.
• Every menu key is its label's first letter (PR #1164): no key in the
  middle of a word, on a later word, or set apart from its label. Toggles show
  their state ([F]ollow: on), so the key never changes with the state. The
  mail list's [M]ark and [U]nread are the one exception: the row already
  shows * and new.
• Two-digit row numbers (PR #1170). A board's posts, the mailbox and a
  file area took one digit, 1–9, so rows past the ninth (the mailbox
  shows up to 30) had no number. They now work like the pickers: 05, or
  5 and Enter. A number beyond the page, 00, or a second key that is not
  a digit rings the bell and clears what was echoed.
• Numbered settings (PR #1175). Profile runs 01–24, for example.
  Typing a number from another section turns to that section and opens the
  field. The action bar shows [01-NN] change instead of a row of field
  letters, so forms are shorter; with menu descriptions on, the highlighted
  field's description appears under the list. ↑↓ with Enter still work. The
  handbooks now name settings by label ("Profile → Character set").
• A one-time notice (PR #1161, extended by #1164, #1170, #1175). Every
  account that exists at the upgrade sees "Keys that work everywhere" once,
  at its next caller login (Telnet, SSH or browser; not the local SysOp
  console), after the Recent callers screen. It lists the shared keys, the
  Topics/Operators and mail renames, two-digit rows and numbered settings.
  Accounts made after the upgrade never see it, and guests never do.
• Menu art that draws old keys (PR #1164; main-menu art only). A SysOp's main-menu art that
  still draws C[o]mmunities or S[t]aff list would send a caller to the
  wrong screen, since O and T swapped. Such a drawn item is now blanked
  and the real one listed in {menu} until you redraw it. Art drawing
  P[r]evious callers and Moder[a]tion keeps working (same letters) but
  reads better redrawn. Check and Preview on the art screen show what
  is blanked and moved.
• For contributors: tests/test_reserved_keys_enforced.py and
  tests/test_first_letter_keys.py read the source and fail on a screen that
  breaks the rules (doors excluded). FieldSpec no longer takes a letter,
  and DetailAction refuses a reserved key or a digit when built. The
  Developer Handbook's "Terminal and interaction contracts" explains the
  rules.

Styled MRC names (#1156, PR #1157)

Since v7.17.1 an MRC sender's decorated handle is peeled off the message text
(#1152). A new Profile setting, Stylized MRC names (Communication
section), chooses how it is shown:

Setting	Shown
combined (de...

NetBBS v7.17.1

NetBBS v7.17.1

A patch release for v7.17.0, with two fixes for problems the maintainer met on
a live node. Entering a birthdate on Profile overflowed an 80-column screen,
and some MRC senders' names appeared twice. Nothing migrates: the node
database stays at schema 120, and every protocol, door API, save and world
version is unchanged. Upgrading is a wheel swap and a restart; rolling back to
v7.17.0 is the reverse.

Name & details: values are edited in a line of their own (PR #1151)

On Your profile › Name & details, the birthdate prompt put
Birthdate [(not set)] -- new value as YYYY-MM-DD (blank to keep, - to clear):
in front of the cursor. That is 78 columns, so on an 80-column screen the date
wrapped after two characters and scrolled the screen. Display name and location
had the same shape, with 14 columns left, and fewer once a value was shown in
the brackets.

All three now open with the current value already in the line, on a line of
its own, the way the SysOp edits the same values:

• Enter saves what is in the line;
• an empty line clears the value;
• Esc leaves it as it was.

A date that isn't one reads "Not a valid date (expected YYYY-MM-DD) --
unchanged."

Callers who learned - to clear a value: typing - no longer clears it.
Empty the line instead. A - typed as a display name or location is now saved
as the text -, and as a birthdate it is refused as not a date. The User
Handbook says so.

MRC: a decorated sender handle is no longer shown twice (#1152, PR #1153)

Some MRC lines showed the sender's name twice:

<Michael Nln@Castle_of_the_Gods_V> +Michael_Nln+[CASTLE BBS] hello all
<johnny5@The_Delta_Quadrant> ^Johnny5<grAvY> hey

The MRC spec makes the first word of a message the sender's handle, and some
clients or users decorate it. NetBBS only recognised the reference clients'
plain shapes (<nick>, a bare nick, * nick), so a decorated handle stayed
in the message.

When no plain shape matches, NetBBS now also removes a decorated first word
that names the sender:

• The name: either spelling (underscore or space), any case, with only
  punctuation touching it. Alicehello is not Alice's handle.
• Where the word ends: at the first space outside brackets, since a tag
  like [CASTLE BBS] holds one.
• Kept whole: a message that is nothing but the handle, one with an
  unbalanced bracket, and one whose first word names someone else.
• Colour: the sender's name colour is read from the decorated handle too.

This applies to room lines, broadcasts and private messages from MRC. Lines
already in scrollback keep the text they were stored with.

Website

www.netbbs.org announces the FTN gateway: "NetBBS can bark now." (PR #1150).
It is not part of the package.

Upgrade and rollback

Stop NetBBS, install the wheel and start it. No migration runs. Nothing about
the upgrade is MANUAL, but tell callers who clear profile values with -
that they now empty the line instead.

To roll back, install the v7.17.0 wheel and restart. No restore is needed.

Verification boundaries

• The MRC fix was tested against the two handles seen live and against
  constructed variants. It has not yet run against a live MRC room.
• The Name & details screen was tested with scripted sessions and drawn at
  80x23 through the website's terminal emulator. It has not been checked in a
  real terminal client.
• The release gate: the full suite on Windows, 14,385 passed and 139
  skipped with pytest -n auto, plus the 5 timing_sensitive tests run
  serially, all passing, on a tree identical to main after PRs #1151 and
  #1153. The release commit adds only the version bump and these notes.