What has changed since ARC6

Login, concurrent-session and reconnect protections default to Enforce; other protections default to Observe.

Observe records decisions while allowing operations; Enforce applies the selected rejection, suppression or penalty. On first normal startup, upgrade promotes those three saved Observe modes once; explicit Off, custom thresholds and later sysop choices are preserved. Other modes remain unchanged. Review normal and contest traffic before enabling the other protections.

Ordinary local and peer spots pass shared controls before storage and forwarding.

Spotter/public-IP limits and spotted-station, frequency and comment repetition controls use bounded rolling-window state. Remote origin IP reports retain their provenance; a relay socket is not substituted as the offender IP. RBN and every -# spot remain local-only.

Sender verification uses an origin-specific advertised user list.

An incomplete or unavailable configuration remains Unknown. Missing advertised membership is an observation, not proof of abuse. Configuration timestamps, advertised user counts and route evidence aid review. Sender Observe is retained for mixed-network acceptance.

Caller/public-IP login limits can impose temporary, capped cooldowns.

Optional additive or geometric retry escalation has an absolute recovery deadline from the first penalty. Command-rate and concurrent-session controls are separate. Private or hairpin addresses are excluded from aggregate public-IP limits. Unexpired learned protections survive restart with original deadlines; per-run diagnostic totals reset.

A short spot probation can protect new local Telnet sessions while keeping read access available.

Registered and Trusted callsigns can post without probation. They do not bypass rate, IP, login, command or session limits and do not authenticate the caller. Permission lists remain empty/Off; warm-up and station/sender defaults remain Observe. Fresh .200 spot/command defaults enforce; upgrades retain saved choices.

Sysops can apply explicit address or subnet rules independently of automatic limits.

The Security Lists editor explains host-bit normalization, coverage and duplicates. Manual spot/user rules and imported incoming peer/user rules remain separate. Registered and Trusted lists are separate tabs. All four lists validate before applying; Cancel preserves them and Setup Exit persists configuration.

The local modeless monitor shows totals, recent identities and cooldown evidence.

Counts distinguish observed and enforced decisions and include events omitted by warning throttling. They are decisions rather than unique spots or confirmed attackers. Cooldown displays distinguish actual and modeled reconnect times; Copy report supports sysop review.

Isolated enforcement tests and busy-node field observation support the implemented controls.

The protection controls are available through coordinated Trial upgrades. Complete DXSpider algorithm parity, authenticated accounts, persistent cooldowns and exhaustive adversarial coverage are not claimed. Review normal and contest workloads before changing the Observe defaults.

ARC6.6 adds mutual PC9X capability negotiation between supported ARC6.6 peers.

The existing ARC transport is retained while negotiated PC9X topology and spot messages exchange user/IP evidence. Legacy ARC6 and ARC4 paths remain compatible. Successful local and limited live chain checks establish their tested scope; they do not certify every mixed-network topology.

The receiving node advertises its capabilities when a PCxx peer connects.

This preserves the established receiver-led handshake. A live DXSpider connection saw the PC18 advertisement, exchanged PC92 A/K traffic and stayed connected. The result confirms that session; it does not certify every DXSpider configuration.

A peer allowlist controls where modern topology is offered.

Incoming and outgoing ARC6.6 peers prove negotiated capability for the current session. A bounded deadline and transport-generation checks prevent reuse of the prior mode. Legacy peers retain their compatible paths; mutual capable ARC6.6 negotiation failure is reported rather than silently downgraded.

A live CC-Cluster connection completed the modern handshake with ARC6.

The observed exchange included PC18, reciprocal PC20, PC92 K records, PC51 and PC22 before normal traffic. ARC6 also accepts the peer's legacy frames on that connection. This confirms the tested CC-Cluster negotiation path; wider CC-Cluster mesh routing remains part of field acceptance.

The server does not assume its own completed handshake proves the peer retained PC9X.

An explicit oldstyle notice retires that session's PC92 graph and moves publication to the legacy path. Repeated notices are idempotent and diagnostics retain the fallback reason.

Configuration, keepalive, add, delete and related frames update an origin-owned topology graph.

The graph tracks transport generations and protects local identities against remote replacement. Legacy SHOW node and user views receive a projection of this graph rather than becoming its owners.

The same origin can remain reachable through another accepted path.

When one transport disconnects, route selection can use a retained alternate ingress. A duplicate frame is still meaningful if it establishes a new path, even when its payload is not new.

Sequence checks, tombstones and leases constrain old or deleted PC92 state.

Malformed frames and stale transport work are rejected before mutation. Expired origins and accepted deletes remove their routes, while an unknown delete cannot remove a node that was never learned.

Origin, edge, queue, message and metadata bounds limit work admitted from peers.

The limits protect local resources during large or malformed network updates. They are part of the new PC9X path, not a claim that every possible worldwide mesh has been load-tested.

Legacy imports and exports retain hop limits and suppress reflected projected identities.

Input validation is atomic for a topology command. A rejected malformed update does not leave a partially changed graph, and modern-origin identities are not blindly echoed back through the legacy path.

Modern peer spots pass through the same validation, cache, filter and duplicate pipeline.

Every RBN/skimmer spot and every spotter ending in -# remains local-user-only, including through ARx output. Ordinary PC11 remains valid for legacy peers; missing source IP data is not invented.

Directed TALK, announcements, weather and group chat have a PC9X path.

Legacy PC10/12 conversion retains hop controls and duplicate protection. Configured sysop recipients are local recipients only; the setting grants no administrative privilege.

A no-output handler result does not become an unnecessary PCxx frame.

The suppression applies to modern and legacy topology publication. The separate intentional idle keepalive remains available, preserving that transport behavior while reducing protocol noise.

A sysop can inspect peer mode, origin counts, duplicates and queue timing.

The diagnostics distinguish pending work, oldest queued age, active-work duration and last or peak wait. This helped identify topology-processing CPU work after the peer network filled in; it is an observation tool, not a substitute for a stack trace.

A queue-based reachability walk reduces work on a populated peer graph.

An isolated 200-origin, 30-peer fixture returned the same routes and ran about six to seven times faster on this path. It measures topology traversal, not the whole server or live network throughput.

Duplicates on an already known ingress path reuse the current projection.

A duplicate that establishes another usable ingress still updates the view. Changed identity, topology, local users, sessions and expiry continue to trigger projection when needed.

The periodic tick avoids a full view rebuild when graph and direct connections are unchanged.

Actual graph or direct-connection changes still project. This targets work observed in a settled CPU trace without changing PC92 wire messages or route rules.

An unchanged one-second expiry pass no longer scans the full reachable graph.

Accepted deletion or expiry still prunes; disconnect also prunes immediately. In an isolated 200-origin, 30-peer fixture, 1,000 unchanged passes fell from 238 ms to 14 ms with the same routes and origin count.

Lease refresh no longer clones an unchanged origin's entire edge dictionary.

A 1,000-edge isolated origin processed 1,000 keepalives in 3 ms rather than 60 ms with an identical route count. Replay, identity and path checks remain; these timings do not predict live CPU percentage.

Sampling identified projection and temporary reachability work as major allocation paths on a heavily connected field node.

Trial .205 combines bounded reachability reuse, direct warm route unions, exact component comparison and incremental ordinary remote-user reconciliation. A mature NC7J comparison with a closely matched graph, more users and higher filtering work measured 30.5% lower CPU, 25.3% lower allocations and 21.4% fewer garbage-collection starts than the retained .200 sample. Workloads differ, so this is evidence for the active node rather than a universal guarantee.

A bound ProgramData layout separates writable state from installed program files.

Configuration, SQLite databases, security checkpoints, login and setup data, callbook outputs, logs and upgrade history resolve through the selected instance. Static application resources remain installation-owned. New installations use owned ProgramData; Trial .205 also exposes the guarded move for an upgraded or repaired stopped instance.

Windows Installed Apps → Modify stages verified copies and publishes the binding last.

It revalidates registration, installed version, cached Setup digest, stable instance GUID, ownership and pending state; then hashes mapped files and validates copied operational databases. Configuration, lists, logs, learned-security state and recovery sidecars are preserved. The original remains, the node stays stopped and a mismatched binding fails instead of silently choosing another instance.

The two active database connection strings must resolve to the selected named local files.

External, wrong-file and network paths are refused before configuration is saved in bound mode. Legacy unbound paths retain their established behavior. This protects multi-instance upgrades from accidental data sharing.

Writable log policy, setup downloads, security state and callbook output use the selected data root.

The bound log target is absolute. Manual .205 migrations have completed successfully on active multi-instance hosts, including the published-updater path. The original installation's static resources and retained installation-local behavior remain separate.

Solar reports can cross modern or legacy PCxx peers and capable ARC6 peers.

Accepted WCY reports are persisted separately from WWV and forwarded as PC73 over PCxx/PC9X, with source exclusion and one hop decrement. ARx forwarding requires the WCY capability tag, so older ARC6 peers are not sent an unknown message. Duplicate input paths share the same report-hour key.

A bounded cache avoids rebuilding unchanged node reachability for ordinary membership updates.

Structural, route, session, identity, expiry and ambiguous changes invalidate or bypass it. User membership remains immediate and current.

The final route snapshot is built directly from cached nodes and current users.

Cold traversal, insertion order and direct-peer route precedence retain their established behavior.

Five retained components are compared exactly before deciding whether the visible projection changed.

Sorting, equality, separator-collision behavior and rebuild decisions are preserved without the previous aggregate comparison string.

Bounded reusable indexes reconcile an eligible add or remove without rebuilding the entire visible topology.

The path is used only when topology, direct transports, local users and identity state are proven unchanged. Complex or ambiguous changes retain the full projection.

Later upgrades retain recent recovery points alongside the original legacy baseline.

Rollback must restore matching application and database state when schemas differ. Current-schema history validation avoids redundant full scans while preserving upgrade integrity checks; measured installation timings depend on the instance.

The viewer uses window width, faster includes/excludes filtering and saved font/window preferences.

Window restoration accounts for monitor availability. A bounded loaded portion is identified in the viewer; exact-level filtering applies to loaded records, not necessarily the complete file. Search full files searches older records in current or rotated files; standalone large-file viewers remain optional future tooling.

Connection tooltips expose the selected protocol and useful peer/session information.

ARC6.6 PC9X is identified separately from legacy ARx and PCxx. Diagnostics help distinguish local user sockets, peers and high-volume feeds without requiring all outgoing Telnet traffic to be logged.

Connection policies apply to local Telnet users; spot policies identify the originating spotter.

Numeric SSIDs share a base identity for the relevant protections. A connected relay node is not treated as the remote spotter, and RF/feed/peer handshakes are excluded from local-user login/session limits.

Setup nests protections by purpose rather than presenting one long flat list.

Login and reconnect settings share a group; posting permissions and warm-up share Registered/Trusted lists. Spot submission, repeated stations, sender verification, IPs, sessions and commands remain separate groups.

Observe reports that a local spotter is outside the Registered/Trusted lists while allowing the spot.

ARC6.6 provides an optional callsign-list permission policy, not account enrollment or password authentication. Empty lists in Observe do not prevent posting; Enforce with empty lists refuses unlisted local submissions.

Legacy IP-file rules migrate into a separate incoming-user/peer list and mode.

Nonempty imported rules start Enforce, empty imports Off. Manual spot/user IP settings remain unchanged. Successful adoption retires old IP-file downloads/watchers; malformed adoption preserves legacy enforcement and records the failure.

Sender diagnostics include own-configuration age, reported user count and keepalive age.

A newer total does not establish individual membership. Missing or incomplete topology stays inconclusive. Mixed-network sender enforcement should follow complete same-origin traffic review, not a sampled omission warning.

The default tab surfaces bounded callsign, origin, via-peer, IP provenance, reason and action evidence.

Decision totals include repetitive warnings suppressed in logs. Cooldowns/models distinguish actual admission deadlines from Observe simulations. A decision is not a unique attacker or necessarily a unique spot.

The main application can take focus over the monitor.

Window size/location is restored with monitor visibility checks. Columns can be resized and double-clicked at their divider for content width; the monitor refreshes local snapshots without granting remote administration.

The identity-capacity warning advances its throttle timestamp rather than repeating for every new key.

Monitor counts retain decisions. This correction preserves bounded state and admission semantics; retained field samples do not prove that the capacity boundary caused earlier memory pressure.

Direct connections can be sorted alphabetically or grouped by the loaded CTY country prefix.

The country is resolved locally, not by a live online account lookup. Unknown Prefix collects unresolved calls and does not imply abuse. Group counts describe direct connections, not recursively authenticated users.

The CW/RTTY and FT feed entries are grouped separately when Country Prefix is selected.

Alphabetical view retains the ordinary alphabetical list. Feed identifiers are not user callsigns; a missing feed group in alphabetical view is expected.

Peer-user children come from a bounded topology snapshot refreshed on a slower cadence.

Nested peer nodes are omitted to avoid recursively rebuilding a looping graph. Incomplete or stale remote membership remains labeled reported evidence, rather than a local socket session.

Lookup, log filtering, details and copy actions remain available for reported users.

Local disconnect/configuration actions are hidden because a child reported through a peer is not a directly owned user socket. The decision uses entry type, not merely tree depth.

Tools opens a graphical node/link view that refreshes approximately every ten seconds.

The display is this node's known network, not a complete worldwide map. Pause and manual Refresh control updates; expired reports disappear, and a failed refresh retains the prior view.

Graph snapshots retain shared links and cycles rather than forcing a parent-only tree.

Reported nodes without known links remain visible as unlinked. The map does not fabricate parents or edges while waiting for more advertisements.

Green represents ARC6.6, blue legacy ARC6, brown ARC4, purple DXSpider, teal CC-Cluster and gray unknown.

Remote reports may omit software or retain a generic protocol identifier. Transport alone is insufficient to confidently identify every distant node, so gray is a valid result.

Complete reported membership is preferred; a fresh keepalive total can supply display-only fallback.

Zero is distinct from unknown. Keepalive totals do not fabricate individual users or change sender-verification membership; selection details show the source and timestamps.

Known direct initiator direction is drawn with an arrow and a thicker line.

Traffic flows both ways after connection. Solid direct and dashed reported links distinguish local knowledge from relayed reports; unknown remote initiation does not receive a guessed arrow.

Wheel zoom, empty-space drag and double-click drag navigate the map; a single node drag repositions it.

Pan all moves the camera even over nodes. Connected lines reroute during movement. Fit frames the map; Re-layout / Fit arranges it again. Interaction holds avoid refresh replacing a graph mid-drag.

Measured text bounds, bold callsigns and subtle color gradients avoid large fixed rectangles.

An explicit renderer draws labels; viewport scrollbars and a subdued background support wide layouts. Unsupported generic toolbar controls and rotation buttons are removed.

The map window and details divider persist per user/installation with visibility checks.

Selection explains node/link evidence. Node search and neighborhood controls are available. Exporting a worldwide map and authenticated remote management remain future work.

The country file and MASTER.SCP defaults point to their maintained publishers.

One-time recognized-source migration preserves download opt-outs, explicit custom overrides and subsequent URL edits. A URL migration is not an immediate forced dataset download.

The maintained ARRL CSV is validated and converted to the existing callsign cache.

All listed callsigns count regardless of last-upload age; this is not a recent-activity or QSL guarantee. Legacy one-call-per-line custom input remains supported; malformed CSV/HTML does not replace working membership.

The dxcluster.info Telnet listing is parsed after download into callsign, host, port and software rows.

Malformed source rows are reported and skipped within bounded tolerances. Changed layout, challenge pages, truncation or conflicting endpoints reject the update. SHOW DXCLUSTERS uses the local cache, not live endpoint probing.

The Top100 source uses the public rank-to-ADIF API rather than authenticated HTML scraping.

The top 100 map through ADIF metadata in active CTY. Missing or ambiguous mappings refuse activation and retain the previous ranking; custom legacy prefix files remain usable.

The default source includes current member calls and exported associated calls.

The official roster remains an audit reference. Export/roster differences are recorded rather than claimed to be exact membership proof; FOC and FOCN remain distinct filters.

ARC-hosted band/mode and block/content lists have source/freshness comments and an integrity manifest.

A reviewed bad-word rule feed uses boundary/phrase/substring matching. An unreviewed external corpus is not automatically published, and a same-origin hash is not a digital release signature.

Timeouts, payload caps, structure checks and HTTPS downgrade refusal precede activation.

Conditional ETags/hashes and elapsed-week eligibility reduce repeated downloads. Failures retain active last-good bytes; retry eligibility is deferred and no network or disk parsing is added to the spot hot path.

Top100 download state includes the active CTY mapping hash.

A new mapping can require reprocessing even when remote JSON has not changed. Rank conversion cannot reuse a cached result tied to a different country generation.

Readers retain complete working caches while a new candidate is validated.

Quiet-period dispatch handles edits, rename/delete and overflow. Retry and metadata reconciliation recover missed notifications; deliberate identical-size/timestamp edits remain a documented limitation.

Content / call lists provides edit, import, export and read-only base views.

Validation precedes atomic per-list save, with stale-editor checks and one previous copy. Removing local additions does not remove a base rule; modes and matching semantics depend on the relevant policy.

First normal startup can preserve dataset bytes, sources, flags and migration changes before adopting defaults.

Unknown old base files are not assumed to be pristine vendor data. Offline preparation defers runtime adoption. Original local additions and old IP evidence remain recoverable.

The compatibility export defaults to False for new configuration.

Enable it only when supporting a legacy ARC4 database consumer. Existing saved choices survive upgrades; native ARC6.6 callsign lookups do not need the export.

Fresh accounts default to blank callsign/password and use HTTPS.

Upgrade packages contain no test-node configuration or credentials. An upgrade preserves the destination node's own saved account; clean installs require the sysop to provide one if desired.

Downloaded lists and callsign services sit under Reference Data; history counts sit under History & Database Retention.

File Log Retention remains separate. US/Canadian auto-refresh is next to its URLs/export; HamQTH is a sibling lookup service without a duplicate wrapper.

Daily housekeeping uses a saved UTC time; ordinary reference fetches use elapsed-week eligibility.

US/Canadian refresh runs Monday UTC. Load supporting data on first use changes startup loading and requires restart. Fresh configuration uses 08 UTC with a saved randomized minute; upgrades preserve schedules. A selectable weekday remains future work.

Nested headings are bold while ordinary leaf settings retain regular text.

Root server callsign and read-only version labels are emphasized. Projection groups write the existing configuration owners rather than renaming serialized fields.

Size, placement and the configuration/help divider are remembered.

Monitor working-area checks recover off-screen placement. The taller default window leaves a smaller help pane; related settings remain visible together.

Outgoing Connections and Incoming Listeners include their applicable node/user transport roles.

RBN feeds remain distinct. These labels clarify direction without implying that every listener accepts only peer nodes.

Public/private chat options and unused ContestMode are hidden, while their XML fields survive.

Legacy IP-file settings disappear only after successful migration. No new contest processing or deletion of saved compatibility data is implied.

The grid initially reads the last 1 MiB per file and Exact level filters that retained set.

Search full files scans selected current/rotated files for older matches. A physical-line count can differ from multiline logical entries; a file that has not rolled can still contain older unloaded errors.

A short edit delay avoids rescanning after every keystroke while normal ingestion continues.

Enter/focus completion can apply promptly. The grid uses the window width; saved font/size/bounds and modeless focus improve long analysis sessions.

Feed-family capture settings independently control skimmer delivery logging.

Ordinary incoming/outgoing user Telnet capture is not permission to record all high-volume feed output. Explicit per-connection session capture ends at disconnect; opening a viewer alone enables no capture.

Local sysop export includes callsigns and useful profile/filter details.

Corrupt XML is skipped with identifying warning evidence. Do not reset a longstanding profile automatically; preserve it and repair or reset only the affected record deliberately.

The permanent original baseline and newest three checkpoints support successive upgrades and rollback.

Restore matching application/configuration/databases together. Logs remain subject to normal rotation/retention; rolling back does not merge later writes.

The final explicit-FT pass kept 1,002 total sessions including publishers and delivered all 20 private markers.

No marker was missing or duplicated. Human-only users received no FT output while opted-in users did. The plateau lasted one minute; it is not a maximum-user or long-soak guarantee.

The final one-minute pass delivered about 1.50 million subscriber lines with median 0.223 s and p95 0.553 s marker latency.

Lines include copies to many subscribers, not unique network spots. Live feed input varied and shared-host CPU included other applications. No synthetic spots or upstream RBN writes reached public peers.

Session/command refusals, spot suppression and reconnect recovery were checked without dropping intended marker recipients.

Rules, modes and operator configuration were restored after isolated testing. Public-IP rotation, IPv6 capacity and indefinite abusive load were not established by these LAN fixtures.

The owned send queue closes before socket disposal so stale writers cannot create new reservations.

Queued reservations release promptly; a native in-flight buffer remains owned until completion. Expected close warnings are distinguished from genuine send failures; later focused runtime checks exercised departure/refusal/recovery.

Owned staging uses a shorter maintenance sibling and preflights destination lengths.

This addresses deeply nested history under an in-application download cache. Existing containment, stopped-instance, reparse and preservation guards remain; the prior published package is not rewritten.

Database fallback can answer recent-history requests without the previous full-scan cost.

On an isolated copied database, a 20-result human query fell from 307 ms to 18 ms and an FT query from 2,538 ms to 23 ms with a date index. The subsequent candidate handler passed matching-result checks. Warm-cache queries were already fast; restrictive searches and real socket backpressure remain separate costs.

Retention maintenance limits the work performed in each batch.

Transactional batches protect count/delete consistency and handle timestamp ties and NULL dates. The candidate was checked with simultaneous reads and writes, schema preparation and rollback. Retained row count and allocated SQL CE file size are separate measures; deleting old rows does not itself guarantee a smaller database file.

Preservation checks no longer retain three complete DX DataTables.

Typed fingerprints and duplicate multiplicities protect required before/after comparisons. Current-schema upgrades avoid redundant full history scans; migrations retain the comparisons they require. Observed installation duration depends on database size, storage and snapshot work.

Disabling feed logging now stops its per-spot application INFO/WARN output as well as raw I/O capture.

One installation continued showing real-time RBN lines because its application log accepted INFO while other installations accepted WARN. The saved feed switches were correct. The correction applies the CW/RTTY and FT controls to both output paths. Operator testing confirmed the revised behavior; the cause was not a demonstrated Program Files write-permission failure.

Separate Application diagnostics, Protocol and I/O groups make the settings easier to interpret.

The WARN/INFO/DEBUG minimum reads and updates each installation’s log4net XML and applies the running file-appender filter immediately. CW/RTTY and FT feed capture have distinct controls. Focused configuration/live-filter checks passed, and the operator accepted the revised dialog and logging behavior.

The server has moved beyond the former x86/Framework 4.0 target.

Visual Studio 2026 builds the server against .NET Framework 4.8; runtime 4.8.1 is supported. The ARC4 export helper is a separate compatibility dependency. Native SQLite and isolated SQL CE conversion are delivered; modern .NET and service hosting remain future work; no whole-server speed multiplier is inferred.

A reproduced projection bottleneck delayed peer initialization behind topology work.

The earlier implementation rebuilt remote objects and repeatedly scanned origins for each identity. One identity index and a shared route snapshot now support each projection, while unchanged objects are retained. An isolated populated-topology fixture reproduced the original cost; this is a correction to the new PC9X layer.

An active worker and an empty capacity-error counter did not rule out long delays.

SHOW PC9X now includes pending count, oldest queued age, active-work duration and last/peak wait. Clock observation uses receipt time so time spent waiting locally is not mistaken for remote clock skew.

A connected socket can stop delivering bytes without triggering the disconnected-client retry.

The existing one-minute retry pass now checks receive inactivity. An established enabled feed silent for 60 seconds is disconnected and retried, yielding roughly one to two minutes detection time. New sessions receive a grace period, and incoming bytes reset the timer. Ordinary users and cluster peers retain their own behavior.

Log queries no longer damage values through broad text substitutions.

Persisted predicates retain their original literals, and shorthand apostrophes receive appropriate escaping. Explicit LIKE escaping keeps its established meaning.

Database-backed results now match the intended recent-history selection.

The query selects newest rows first, then presents the selected set in chronological display order. Previously an unordered TOP query could choose a different set.

The all-log wildcard must be the complete argument, and empty translated predicates are rejected.

For example, trailing garbage after the wildcard goes through validation rather than broadening the query. The explicit all-log request and default requester selection remain available.

Official US/Canadian input is indexed by byte position and decoded without stripping valid Unicode.

This fixes lookups that drifted after multibyte characters. It improves import/storage correctness, but does not turn the legacy Telnet transport into Unicode.

Successful dataset publication clears cached hits and cached misses.

A callsign that was absent before an update can resolve afterward, and an earlier successful lookup no longer keeps returning its obsolete cached object.

Paired geographic classification is captured under the same country-cache lock.

A concurrent reload cannot mix old country data for one station with new data for the other in that captured pair. Existing spots are not retroactively reclassified.

LoTW, FOC and MasterCall retain their last complete snapshot when input cannot be read.

A successful reload still replaces membership, including removals. The change protects availability; it does not redefine membership matching or silently repair input files.

Missing or malformed ranking data no longer partially clears the active list.

The parser validates records before publication. This verifies structural validity, not the ranking’s factual accuracy or completeness.

The active country snapshot changes only after full parsing succeeds.

Bad downloads, HTML and invalid supported overrides are rejected while prior lookup data remains usable. A syntactically valid but incorrect dataset is still outside structural validation.

A validated temporary file replaces the old file atomically where supported.

A failed validation or replacement leaves the active bytes unchanged. This is a local filesystem safety improvement, not a guarantee against every power-loss or storage failure.

Required fields are validated while supported appended fields remain intact.

The importer no longer relies on character stripping and old field-width truncation as a compatibility workaround. Unsupported or malformed records are rejected explicitly.

Byte-aware reading supports CRLF, LF, CR, a UTF-8 BOM and a final line without a terminator.

Record-size limits bound processing, and unsupported UTF-16 input is rejected. Both native lookup and ARC4 export use the corrected reader.

Preparation is serialized and validated before the active directory changes.

A journal and retained prior generation support recovery from process interruption. This is not a transaction across separate server processes or proof of power-loss durability.

Export copies a stable callbook snapshot, then releases the shared gate before building the MDB.

Snapshot preparation still briefly coordinates with readers. Legacy MDB field-width limits remain, so oversized records can be rejected by export while native ARC6 retains them.

The candidate defaults to official HTTPS archives and records the migration revision.

Later operator URL overrides survive normal reloads. Downgrading and resaving configuration with an older build can remove the marker, so matching backups remain important.

Initial prompt spaces or tabs are discarded even when split into another TCP fragment.

Later payload whitespace is preserved. This fixes recognition of the next PC18 without broadly trimming protocol content.

PC11 and AR17 generation no longer depends on a comma-decimal Windows locale.

The existing one-decimal precision and field layout remain. Malformed output generated by an unchanged remote peer is a separate limitation.

Generated protocol dates retain English month names and the established UTC time fields.

Regional settings no longer change outgoing PC11/AR17/PC23 date text. Incoming legacy parser limitations are not claimed to be universally repaired.

The worker waits for new work instead of draining once and exiting.

PC16/17/19/21 commands arriving after startup idle or a later pause can still run. A failed individual command does not terminate the persistent worker.

The queue no longer repeats a publication already performed by the command handler.

This removes the reproduced double-send path without changing packet fields or forwarding recipients.

Queue admission occurs before unrelated background scheduling can reorder commands.

Other handlers keep their existing scheduling. This establishes order at this boundary, not a total order across unrelated concurrent network callers.

Commands carry the connection session version captured at construction.

Old queued work, delayed admission and commands created while disconnected cannot become valid merely because the same connection object reconnects.

An admitted local mutation finishes before the session transition clears its state.

Stale handlers cannot start a mutation after the transition. Network publication stays outside the mutation lock so a paused send does not hold that lock.

PC connection transitions clear the reported subtree while retaining the configured peer object.

This keeps old nodes/users from remaining visible after a session ends. Non-PC subtree policy is unchanged.

Initial node and user announcements can apply locally even when global duplicate memory matches.

Forwarding-loop suppression remains in force. The per-session record is bounded; it is not a new network-wide causality or sequencing protocol.

PC17 and PC21 can remove recreated users/nodes after reconnect.

The first relevant deletion in a new session is permitted to mutate local state while global duplicate forwarding remains suppressed.

Shutdown stops admission, wakes the worker and waits for already accepted commands.

Repeated shutdown is safe and self-wait is rejected. Because I/O may already be closing, queue draining is not a guarantee that every final publication reaches a peer.

The new PC9X layer tracks origin-owned routes and transport generations.

PC92 configuration, keepalive, add/delete and related updates are bounded by graph, queue and message limits. Replay, expiry and alternate-ingress handling protect topology, while local identities cannot be replaced by remote claims. Broader mesh acceptance continues.

Modern peer spots share cache, filter and duplicate decisions with ordinary spots.

PC61 ingestion reuses established spot processing. Skimmer metadata and every spotter ending -# remain local-user-only, including through ARX publication. Missing IP information is not fabricated for legacy PC11 reports.

Directed messages, announcements, weather and group chat have an integrated PC9X path.

The implementation bridges legacy PC10/PC12 where applicable, preserves hop controls and rejects replay/content duplicates. Configured sysop recipients are local recipients only and receive no administrative privileges from that setting.

Local completion of a handshake does not prove that the peer retained PC9X mode.

The observed DXSpider oldstyle notice now transitions that transport generation to legacy, retires its owned PC92 graph and sends one legacy snapshot. Repeated notices are idempotent; later publication uses legacy topology. Diagnostics retain the fallback reason.

Topology activity could produce empty output that was still framed and sent.

Empty or whitespace-only publication results are suppressed for modern and legacy PCxx peers. The separate intentional idle keepalive mechanism remains available.

Receive and connect completions check ownership of their originating socket.

A stale EOF, reset or failure after reconnect acts on the old connection rather than the new one. Each receive chain owns its byte buffer.

Connect completion calls EndConnect and cancellation closes the owned attempt.

Disconnect is a no-op when there is no owned socket. Connection notification precedes receive scheduling so the consumer initializes its state first.

Sends advance by the actual byte count and keep message chunks together.

A write error or zero completion closes the failed stream. The synchronous policy does not guarantee delivery to a slow receiver or introduce unbounded retries.

Each socket has an owned queue with one active native send.

Short completions resume the current message before the next starts. Admission order is determined under the queue lock, not by wall-clock ordering of concurrent callers.

Pending messages own copied byte buffers.

A caller modifying its input after admission cannot corrupt the queued wire payload. This protects data ownership at the cost of a bounded copy.

Per-socket byte and message limits reject overflow and close the requesting connection.

The safeguards bound queued payloads rather than promising arbitrary slow-client delivery. They do not evict an unrelated socket to make room.

Aggregate byte and message reservations prevent each socket from independently consuming the full allowance.

The budget is shared across TCP server instances in one AppDomain. It does not cap inbound buffers, caches, kernel allocations or total process memory.

An active buffer remains reserved until its matching completion finishes.

Waiting messages release their reservations immediately. This prevents disconnect churn from admitting new work against memory still retained by native sends.

Immediate completions iterate through remaining output.

Begin/completion failures and zero-byte completions close the stream and discard pending work. Late completions cannot restart a closed queue.

Each owned receive retains its originating socket for EndReceive.

Completed data is ignored after shutdown or socket replacement. This closes the reproduced null-reference race caused by rereading a cleared client.Socket field.

Tracked socket removal no longer waits for a periodic timer.

An earlier recovery corrected the old sweep loop. Subsequent ownership review and loopback tests showed normal disconnect handling removes entries immediately, so the now-redundant timer was retired. Its measured cost did not explain the observed CPU burst.

Permanent disposal stops and releases the parser timer and clears framing state.

This fixes a specific retained-client leak, including derived RBN clients. Ordinary disconnect remains reusable for reconnect; disposal is terminal.

Callback, parsing, connection setup and disposal share lifecycle coordination.

Reentrant disposal suppresses remaining extracted lines without waiting on itself. Connect cannot restart a permanently disposed object.

Telnet UI failures are logged without preventing later peer/log/local cleanup.

Parent/event detachment uses a finally path. This cannot guarantee delivery to a failed peer or recover a callback that never returns.

The owning server disposes both monitor resources during shutdown.

Pending paths and subscribers are cleared; callbacks cannot reactivate a disposed monitor. This fixes specific retained-resource paths, not all possible memory growth.

One failing notification is logged and contained instead of abandoning future monitoring.

Callbacks are serialized per monitor. External disposal waits for an active subscriber, while reentrant disposal suppresses remaining callbacks without self-deadlock.

Both sides of a rename and deleted paths enter the existing notification path.

This keeps login text and supported optional overlays from staying stale after removal or renaming. AutoReload settings still apply.

Overlapping callbacks are skipped, with exceptions contained.

Dependencies initialize before the timer starts. This avoids accumulating blocked timer callbacks without promising replay of missed periods.

Full maintenance, DX purge and manual callbook work share an owned serial queue.

Each operation can have one pending or active request. Duplicates are coalesced, and exceptions release registration so later requests can run.

The scheduler rejects new work, suppresses queued bodies and waits for active work.

Watchers, configuration and caches are closed afterward. A slow download can still delay shutdown; this is not forced cancellation with a timeout.

Watcher re-enablement runs in a finally path.

An exception after temporarily suspending setup monitoring no longer leaves reload notifications permanently disabled.

Complete UTC minute identities replace minute-of-hour comparisons.

A callback one hour later at the same minute is no longer silently skipped. Missed periods are not replayed, and arbitrary clock changes do not gain an exactly-once guarantee.

Dispatch and maintenance-hour selection share the callback’s UTC timestamp.

A delayed path or clock change cannot make those stages independently choose different periods. The established weekly weekday policy remains separate.

Cache cutoff expressions no longer depend on culture-formatted dates.

The correction prevents the reproduced removal of unexpired rows or retention of expired rows under affected locales. Normal retention policy remains.

Seven active purge paths bind DateTime parameters instead of embedding localized strings.

DX, announcements, logs, talk, users, WWV and weather keep their existing units and database destinations. The inactive mail purge is outside this correction.

Expected per-file deletion failures are reported and the pass continues.

Locked/read-only files remain for a later retry. Enumeration failures and the existing nonrecursive local-time cutoff retain their separate limits.

Serialization finishes in a unique temporary file before replacement.

Serialization failure, blocked replacement or interruption before publication no longer truncates the active destination. Local filesystem replacement permissions are still required.

A request for 25 cached results no longer imports every matching row into its result table.

In the 10,000-row fixture, one case fell from 5,000 imports to 25. Selection still evaluates the expression and allocates its match array.

A local numeric-equality case dropped from 14.094 ms to 0.231 ms; nested negation from 19.990 ms to 6.170 ms.

These are warm, isolated 10,000-row microbenchmarks, not total command latency or a full-server speed multiplier. Result identities and order were checked.

Already-trimmed expressions reuse their translated result.

The nested-TRIM fixture reduced generated SQL from 7,338 to 1,482 characters and median query time from 736.968 to 214.749 ms. This is a local 10,000-row result; ordinary queries did not all improve.

AND/OR and IIF conditions stay structured instead of repeatedly expanding into scalar CASE expressions.

A reproduced request that exceeded the 65,536-character guard translated to roughly 1,800 characters after correction. Existing input/depth/output limits remain.

The server omits the splash thread/dwell when disabled and removes the inherited one-second MainForm sleep.

Engine initialization still takes its actual required time. This is a specific startup-path improvement, not a promised total startup duration.

Selected PCxx and ARX traffic writes to ProtocolTraffic.log through a separate logger.

Existing application logging configuration is retained. Capture is opt-in and does not silently raise the overall application log level.

Records distinguish RX, TX and rejected sends with UTC timestamps and connection identifiers.

TX means admission by the transport, not confirmed remote processing. Escaped line/control characters prevent a single message from forging extra capture records.

The writer retains an active size-limited file and a limited backup set.

The current policy is a 10 MB active file and up to five backups. It bounds this capture family, not every application log or total disk use.

Authentication-root frames are omitted and recognized sensitive XML fields are redacted.

Malformed, oversized and unsafe XML receives an omission marker. Wire data is unchanged; this does not claim to remove arbitrary private text from every other logger.

Writer failures are reported and capture is disabled for that process.

A status/location display helps operators distinguish capture state from quiet traffic. Restart is currently needed to retry a failed capture sink.

Diagnostic menu labels now name the primary output file for each category.

Tooltips explain secondary INFO output and threshold requirements. Enabling an INFO diagnostic does not override a WARN-only application appender; switches remain session-only.

The menu uses the absolute quoted ProtocolTraffic.log path with the existing viewer.

This avoids ambiguity about the selected installation’s log. The viewer must be available in that installation.

Application and protocol logs can be read within the server.

The managed viewer replaces native process launching and window reparenting. Application and traffic files remain separate, while Combined merges retained records by UTC and Legacy permits older I/O files to be read. Opening a viewer does not enable capture.

High-volume traffic is read in bounded batches.

Each source uses 256 KiB read batches, a bounded initial tail and limits on retained rows, text and line length. Evictions and clipping are visible; hidden viewers do no polling. These limits bound viewer work rather than claim unlimited throughput.

A renamed, replaced or truncated log file need not break the viewer.

The reader tracks file identity, drains rotated handles, preserves split UTF-8 decoder state and recognizes truncation/regrowth. Unrecognized records remain visible as raw text rather than silently disappearing.

A busy writer cannot extend an operator search indefinitely.

Multi-file searches use bounded results and context, cancellation and export. Context lines may intentionally fail the selected filters and are identified as context.

Operators can narrow traffic without changing the underlying capture.

Source, severity, direction, peer, connection and component filters combine with literal terms, exclusions and time-bounded regular expressions. Named presets retain common investigations.

A paused view can be examined while the bounded tail keeps receiving records.

Pause freezes the displayed/exported snapshot. Follow, newest, find, copy and UTF-8 export operate on the viewer’s selected or retained content, with limits made visible.

Verbose protocol capture does not need the same retention policy as application events.

Application and traffic backup age and budget settings are separate. Cleanup targets recognized ARC6 backup names and excludes active logs and unrelated files. Custom log4net paths and settings are preserved by compatible-default migration.

Startup and Setup provide a persistent show-splash preference.

Suppressed startup creates no splash thread or four-second splash dwell. The separate Windows client splash is unchanged.

The server no longer releases splash ownership before the old window has actually finished closing.

The corrected lifecycle prevents the reproduced overlapping-window race. This is distinct from unrelated docking-library or screenshot-fixture issues.

Failed saves restore the previous checkbox state and report an inline error.

Malformed or unsupported preference files are not overwritten. The setting belongs to the installation and uses staged replacement rather than a shared registry preference.

Unused docked-log and obsolete external-link entries are removed from the server menu.

Ordinary log-opening commands remain. This is in the newer local menu build, not a claim about the deployed protocol candidate.

Each active connection has its own series, including incoming peer connections.

The replacement graph uses the existing received-activity counters. Those counters are taken before duplicate and later validation checks, so they are not accepted-spot totals.

The graph refreshes every two seconds while retaining the operator’s selections.

Duplicate callsigns have distinct connection IDs and copied counter arrays. Snapshots are approximate concurrent observations, not atomic accounting.

Incoming user connections are classified separately and hidden by default.

Operators can include them when useful without mixing them into the default peer/feed view. Live incoming-peer display acceptance remains separate from the focused offline fixture.

Incoming feed labels describe received data; host/IP and port identify the connection.

Outgoing entries preserve configured hostnames, and incoming entries use their remote endpoint. Hover text retains full labels when space requires ellipsis.

Operators can inspect a point and distinguish the current incomplete minute.

The graph is now under Tools. Client graphs retain their existing graph library and are outside this server replacement.

The splash, About presentation and application icon have been refreshed.

This is a presentation update alongside the functional changes. Terry Gerdes, AB5K (SK), remains credited as the original author.

Generic node/version templates are used for new or missing default greeting files.

Existing operator greeting files, including intentionally empty ones, remain unchanged. Clean-install introductions include the operator-requested access warning.

Rate charts use native WinForms drawing.

The older chart dependency is removed from the current trial and obsolete DLLs are removed by exact name in the isolated upgrade stage. This is a dependency reduction, not a claimed throughput gain.

Legacy helper controls are replaced in the server UI.

The current trial replaces Visual Basic Power Packs with native controls and upgrades DockPanel Suite to 3.1.1. Manual acceptance remains appropriate for individual dialogs and docking behavior.

A stopped installation or consistent stopped copy is backed up and verified before import.

There is no skip-backup choice in the public-facing preparation window. Fresh empty-folder installs are a separate case.

Rollback creates a separate restored installation from the trial’s verified pre-upgrade backup.

The changed trial is retained for investigation. Trial-period data is not merged into the restored legacy state, and that consequence is explicit in the restore workflow.

The operator can inspect a new trial before enabling its incoming and outgoing endpoints.

Addresses, identity and filters remain present. Download preferences are separate; disabling connections is not a claim that every background network activity is disabled.

The review dialog reserves its action row and scrolls longer content.

Text wrapping no longer pushes the bottom buttons out of reach in the tested layouts. Enlarged-text checks do not certify every native DPI setting.

The server takes an installation identity lease before the main window and logging initialize.

Pending activation and layout markers also prevent startup from unsafe intermediate roles. This coordinates cooperating tools; it does not control unrelated external programs.

Configuration, logs, databases and license data are retained by the tested ownership policy.

The evaluated installer removes its program/shortcut payload while preserving state. Public distribution and clean-machine prerequisites remain separate acceptance work.

A supported empty XML identity can be preserved when its database key identifies the profile.

Conflicting populated identities, whitespace-only values and other validation failures still require review. This improves upgrade auditing and does not alter peer authentication.

Windows download marks could block an otherwise valid trial assembly.

The installer clears the download mark only on manifest-verified candidate binaries in its isolated runtime and checks their hashes again. Assembly-load failures receive a distinct diagnostic; licensing behavior is unchanged.

Windows could reject renaming the active Program Files directory.

Upgrade now preserves the root, copies verified contents to rollback storage and publishes the validated stage inside the existing root. Recovery uses the same root-preserving process.

An older recovery flow could mistake a completed relocation for an incomplete operation.

Recover, Rollback and Upgrade are routed to the active native Program Files installation after relocation has completed. The operation still requires preservation and ownership checks.

Previously: Characters outside the ARC4 alphabet could trigger encoding errors. Earlier candidate handling could also retain a decoded prefix from an invalid packet.

Changed: Unsupported outbound characters become ? in the ARC4 wire representation only; stored comments and other protocols are not rewritten. Invalid packets are rejected completely, envelope lengths are validated, and framing can recover on a subsequent valid packet.

Evidence & limits: Preserved-assembly comparisons and isolated alphabet/wire/framing checks. Raw encrypted ARC4 envelopes were not captured in focused live acceptance.

Previously: Compressed text was encoded as UTF-8 but decoded as ASCII, losing non-ASCII characters. Frame selection could process compressed content ahead of earlier plain content.

Changed: Strict stateful UTF-8 decoding preserves multibyte characters across buffer boundaries. Shared framing consumes wire order, holds incomplete packets and continues after rejected complete frames. Valid compression output remains compatible.

Evidence & limits: Original/cleaned comparisons and isolated loopback/split-frame checks. Natural Unicode ARX payloads remain a live-coverage gap; older remote peers can still lose accents in their own decoding.

Previously: Before login completed, a PCxx connection could still carry a default ARX state. Diagnostics then treated its login prompt as XML and omitted the payload.

Changed: Capture selects the configured server protocol without changing admission, connection state or routing. Credential redaction remains in place, and omitted payloads remain unknown rather than being counted as verified traffic.

Evidence & limits: Actual isolated PCxx login/capture regression. Natural pre-login prompts were absent from focused live acceptance, and previously omitted text cannot be reconstructed.

Previously: A request containing OR could admit an alternative outside the saved filter. For example, with Band=20 saved, SHOW/DX Call=W1AW OR Call=G4FOC could include a G4FOC spot on another band.

Changed: The complete request is now grouped before combining it with the saved filter. Both restrictions must match. The explicit leading bypass option remains available for a single request and does not rewrite the saved filter.

Evidence & limits: Isolated command tests cover cached results, database fallback, grouping, bypass and saved-filter preservation.

Previously: Some repeated skimmer reports are deliberately retained only in memory. When too few cached matches were available, switching entirely to database history could make those reports disappear—even producing an empty result for a receiver with recent reports.

Changed: SHOW/DX combines matching memory-only skimmer reports with persisted matches before applying the newest-record limit. Already-persisted cache rows are not added a second time. Saved/request filters and the existing persistence policy remain intact.

Evidence & limits: Isolated regression coverage and operator-confirmed live history retrieval. This does not persist every repeated skimmer report.

Previously: History translation could rewrite words such as band inside quoted comments. Additional development translation could also alter Boolean-looking words inside literal text.

Changed: Translation distinguishes expressions from quoted values and bracketed field names, preserving literal case, spaces and escaped apostrophes. Existing bracketed identifiers are not bracketed a second time.

Evidence & limits: Compared against preserved assemblies and verified through actual cache/persistence/query paths. General multiword command-input syntax is a separate limitation.

Previously: Text-based conversion of Boolean filters could change the meaning of grouped conditions, explicit comparisons or missing values when a query reached the database.

Changed: Structured translation preserves the tested AND, OR, NOT, comparison, IN and NULL behavior of the existing live filter engine, including its nonstandard ordered NULL rules. Live filtering and stored filter text are not replaced.

Evidence & limits: Isolated cache/database comparisons include true, false and unknown values. This is compatibility with the tested filter engine, not a claim that its rules are standard SQL.

Previously: Supported expressions could give different results—or fail—after database fallback. Examples included trailing spaces in LEN, conditional/null functions and whitespace handling in TRIM.

Changed: History translation preserves the tested length, conditional, null-fallback and trimming behavior. TRIM retains internal text and whitespace; temporary query expressions do not normalize stored comments.

Evidence & limits: Compared with preserved behavior and tested against persisted values, including NULL and selected Unicode whitespace. Arbitrary conversions, all function combinations and large-history query performance are not certified.

Previously: During trial use, a valid compound saved filter combined with a history request could expand into an excessively large generated query and hit the safety limit.

Changed: AND/OR conditions remain compact when used to select matching rows; full nullable-value translation is retained where it is required. The correction does not raise the safety limits or change the saved expression.

Evidence & limits: A pre-fix regression reproduced the failure. Isolated checks and subsequent live database-fallback queries verified the correction.

Previously: Some filter fields existed in memory but were absent from persisted history. The expanded history translator exposed missing-column failures, including SkimValid.

Changed: Transactional history preparation adds the required nullable fields and retains actual values for newly persisted reports. Older records remain unknown where no original value exists; no quality flags are guessed from comments.

Evidence & limits: Isolated migration/regression checks and focused live history acceptance. Unknown historical values and client-only placeholders are not converted into positive quality classifications.

Previously: An ungrouped OR could escape the saved announcement/weather filter. Removing a leading count could also remove matching digits elsewhere in the request; weather history used the announcement count preference.

Changed: The complete predicate is grouped, only the leading count is removed, and weather history uses its own configured count. Saved filters remain unchanged.

Evidence & limits: Latest-source comparison and actual candidate command tests using cached and database-backed records; not an original-binary command parity claim.

Previously: Removing a leading count with a global replacement could also damage the requested value: SHOW WWV 1 Sfi=111 is one example.

Changed: Only the leading count token is removed. Digits in solar-flux values, callsign suffixes and forecast text remain intact.

Evidence & limits: Latest-source comparison and isolated command tests with actual stored WWV records. Broader command-marker parsing remains separate.

Previously: The runtime selection path could return false positives for combinations such as not skimmer and not lotw. Explicitly parenthesized Boolean comparisons also exposed the problem.

Changed: The complete user predicate is evaluated as one expression while retaining the spot-ID restriction. This protects already-stored expressions in the tested delivery path without rewriting them.

Evidence & limits: Truth-table and actual isolated Telnet delivery tests. The reports do not establish that every released legacy command path exhibited the same failure.

Previously: A compound contest macro expanded without an outer group. NOT could therefore negate only its first condition rather than the whole macro.

Changed: The CQWW and ARRL CW/SSB macros expand as grouped clauses. Their existing frequency ranges and ordinary meaning are retained; previously saved expanded expressions are not silently rewritten.

Evidence & limits: Source comparison plus macro, compound-filter and local delivery fixtures. This change does not redefine contest eligibility.

Previously: Malformed Boolean expressions could be accepted with an empty cache but rejected when a particular cached row existed. Invalid branches could also hide behind a short-circuiting condition.

Changed: Validation checks expression structure and compatible Boolean/scalar types against an independent schema. It examines both sides of Boolean expressions without selecting live cached rows. Rejected interactive changes preserve the previous filter.

Evidence & limits: Preserved-assembly comparison across multiple cache states and isolated command tests. Data-dependent conversions can still fail for particular values.

Previously: Extra spaces or tabs could change a shorthand list into a different comparison. Unclosed lists or missing fields could stall expansion; malformed entries could introduce unintended Boolean clauses.

Changed: Spacing is normalized and list values are checked before expansion. Empty entries, nested brackets and embedded expressions are rejected. Input, expansion and expression limits bound processing. Valid wildcards, skimmer suffixes and ordinary lists retain their meaning.

Evidence & limits: Original/cleaned comparison, bounded malformed-input fixtures and actual local delivery checks. This does not add a new quoted or multiword filter language.

Previously: A comment such as O'BRIEN could be escaped twice before storage, fail to match itself, or lose apostrophes when a filter was displayed and reapplied. Escaping could also push a comment beyond its stored length.

Changed: New comments retain their original text through parameterized persistence. Filter display and SHOW/DX value handling preserve apostrophes with the appropriate expression escaping.

Evidence & limits: Preserved-assembly comparisons and actual command/cache/database tests. Existing historical rows are not rewritten because repeated apostrophes may be intentional.

Previously: The latest preserved export path invoked profile validation with side effects before collecting filters, and an interrupted replacement could endanger the prior export.

Changed: Export takes a locked snapshot, skips unreadable profiles with a log entry, and does not save or delete them. A staged replacement preserves the last complete export if replacement fails.

Evidence & limits: Latest-source comparison and candidate command/file-failure fixtures. The recovered command itself is not presented as a new feature in the original product.

Previously: The preserved skimmer parser recognized CW/RTTY, without the new direct FT-mode support.

Changed: The candidate recognizes explicit FT4/FT8 modes, signed SNR, optional validated grids and CQ/DE markers. Missing SNR is not treated as zero, and duplicate keys distinguish FT4 from FT8 even where their dial frequencies overlap.

Evidence & limits: Isolated parsing/persistence/delivery tests and focused natural-traffic acceptance. FT quality certification is not inferred from the existing CW/RTTY quality processing.

Previously: Adding a new feed should not silently add FT traffic to every existing skimmer user.

Changed: FT eligibility requires a satisfied positive FT branch in the user policy. Live delivery and SHOW/DX apply the opt-in rules; saved expressions are not automatically rewritten. Signed FT data requires an updated graphical client where that client path is used.

Evidence & limits: Isolated compound-filter tests and focused opt-in/non-opt-in live observations. RBN and all -# spotters remain local-user-only; they must never be forwarded to cluster peers.

Previously: The first FT implementation retained upstream padding that the CW processing path normally removed, shifting the mode text and creating excessive spacing.

Changed: Whitespace is normalized only for successfully parsed FT comments before the storage limit. Received signed SNR spelling, optional grid and CQ/DE marker are preserved; unrelated human comments are not rewritten.

Evidence & limits: Isolated formatting fixtures and focused natural FT4/FT8 observations, including negative, zero and positive SNR and grids present/absent.

Previously: Integer band boundaries lost fractional-kHz detail; preserved LF coverage was incomplete and MF coverage was missing.

Changed: Fractional boundaries are retained, with corrected 2200 m and added 630 m recognition. Existing custom band/mode rows retain precedence. Explicit decoded FT mode takes priority over frequency-based mode inference.

Evidence & limits: Boundary and combined-feed fixtures. Recognition is a spot-processing feature, not a statement of local transmit privileges.

Previously: The keepalive dispatcher could send an empty application line to a receive-only feed. A refused write could remove the feed from its owner's connection tracking even while reception continued.

Changed: Receive-only connections are excluded from application keepalive sending. Login and incoming traffic handling remain intact; ordinary user and peer keepalives retain their behavior.

Evidence & limits: Original/cleaned comparison and sustained isolated feed tests. The observed defect was a blank-line heartbeat, not a demonstrated skimmer-spot leak.

SET DX FILTER and SHOW DX keep portable callsign components intact.

A slash within the argument is preserved while the established command separators remain available. This avoids interpreting part of a portable callsign as another command component.

General callsign validation supports up to 12 characters, including portable forms.

A portable suffix remains part of the identity instead of being truncated or rejected merely for exceeding the older candidate's shorter limit. This restores the latest deployment’s allowance and directly affects login, saved preferences and correct user identification; it is not a newly invented callsign format.

Telnet user suffixes must be decimal 1–99, without leading zeros.

Malformed suffixes are rejected before character scrubbing can turn an invalid identity into a different valid one. Plain calls retain their existing rules. Stored accounts are not renamed or deleted; peer and RF admission policy is separate.

Incoming bytes wait until connection initialization and receive-handler attachment finish.

The server previously could consume early lines before the application was ready. The corrected order delivers buffered input after successful admission and removes rejected connections explicitly.

Unsigned Telnet sessions use full elapsed age for the one-minute timeout.

The old minute-component calculation wrapped each hour and could leave an old pending connection open. Signed-in users retain their timeout exemption.

Login completion and connection closure share an explicit decision point.

A delayed profile lookup cannot complete a login after timeout or disconnect has already closed it. A committed successful login remains usable even if its welcome output takes longer.

User-add and user-remove publication now follow a coordinated order.

If disconnect wins before addition, addition is skipped. If addition is already underway, its completion performs pending cleanup. This prevents a late add from following the removal of the same Telnet session.

A callsign prompt or unfinished profile load is not advertised as a signed-in user.

PC16 snapshots now test committed Telnet login state. This is specific to Telnet users and does not introduce new peer authentication requirements.

A 75-character announcement no longer triggers an out-of-range exception.

The boundary is handled directly while retaining the established continuation indentation and ordinary word wrapping.

Continuation processing must consume message content on each pass.

Long tokens are kept intact even when wider than the preferred line length, preventing the old indentation-only non-progress loop.

Lowercase callsigns normalize independently of the server’s regional settings.

Invariant casing avoids Turkish dotted-I changes before exact-call, prefix and portable-call lookup. This does not claim exhaustive worldwide callsign normalization.

An alias override returns its continent value rather than unrelated prefix text.

The correction was reproduced against preserved assemblies. It improves the country information that feeds spot display and geographic filtering.

Alias coordinates now follow the same internal convention as entity defaults.

The change corrects an inherited sign mismatch without replacing the country dataset or changing unrelated zone assignments.

Deleted exact-call entries no longer linger in the active country cache.

Both exact-call and prefix state are rebuilt for a successful reload, so an old exception does not override newer data indefinitely.

Empty or null postal values follow the normal no-enrichment path.

Valid one-to-five-digit ZIP behavior is retained, including leading zeros. Missing data is not invented, and ZIP+4 support is not added.

Geographic enrichment parses coordinate values with invariant culture.

This prevents regional settings from dropping enrichment or treating decimal points as thousands separators. It does not add a ZIP-to-CQ/ITU-zone calculation.

Calls such as W2BR/Q normalize to the base call for country lookup, as /QRP already did.

The suffix is removed before ordinary slash-call normalization, while full-call CTY overrides retain first priority. The displayed spot callsign is unchanged. This corrects observed country-resolution warnings for /Q calls; the correction preserves the displayed callsign.

UTC and offset-bearing timestamps are converted to the correct UTC instant.

DX, announcement/weather and WWV XML readers no longer treat local clock ticks as UTC. This prevents fresh DX reports from appearing hours old on a non-UTC server.

Reports from matching month/day/hour values in different years no longer share the same key.

The invariant year-inclusive key corrects the inherited annual collision while retaining the existing one-report-per-hour duplicate policy.

Recent persisted reporting hours repopulate the duplicate cache at startup.

Restored rows are marked unchanged so they are not saved again. A failed database load is reported; recovery during the same running process is not guaranteed.

Numeric fields use bounded invariant parsing.

This improves input robustness without exposing the unregistered user-submission helper as a new public command or changing every legacy peer date dialect.

Insertion is positioned relative to the generated UTC suffix and checks the actual available range.

The corrected boundary accommodates longer spotter fields while preserving human comment text and ordinary end-of-spot extensions.

Spotter delimiters and field tokens replace fragile fixed-column extraction.

Both Telnet feed variants share the parser, including variable frequency widths and optional wrappers. Later FT support extends this path; malformed times and invalid frequencies remain rejected.

New input accepts up to 12 characters, including portable components and the final -#.

New input preserves up to 12 characters, including portable components, SSIDs and -#. This removes dependence on the older nine-character feed-format/workaround assumption. Latest preserved source already used a 12-character scrub/storage boundary, so nine is not claimed as a universal legacy validation limit. Overlength new input is rejected rather than truncated; historical storage remains at least 15 characters. The parser also handles ordinary human spot lines, but no percentage increase in accepted traffic is claimed.

RTTY keeps its explicit mode and signal report with a zero WPM value.

CW reports retain their words-per-minute interpretation. This is a parsing correction, not a change to user mode preferences.

Spot IDs use an atomic increment when reports arrive on different worker threads.

This closes the shared-counter race without adding a new feed queue or promising arrival-order fairness across independent sources.

Quality and unique-count windows use elapsed age across hour and day boundaries.

The correction keeps the normal cutoffs while preventing the minute component from making old evidence appear fresh. CT1BOH processing remains for CW/RTTY, not FT quality certification.

New reports update the stored coverage timestamp, and older arrivals cannot move it backward.

Previously an update changed only a local variable. Conditional removal also prevents cleanup from deleting a coverage value refreshed after its expiration snapshot.

Busted-call override evidence now uses the same confirmation-age window.

Fresh confirmation and QSY behavior are retained; old reports no longer count simply because they reached the separate override loop.

Valid-call refresh publishes a replacement record and cleanup removes only the record it inspected.

A newer frequency/time pair survives concurrent cleanup, including when a writer resumes after the old record has already been removed.

SNR storage uses a nullable signed value instead of an unsigned byte.

The database preparation preserves prior values and NULLs while widening supported storage. Updated graphical clients are required for negative FT SNR; this is separate from ordinary Telnet output.

Reports on a shared dial frequency are not merged solely because their modes overlap.

Explicit decoded mode participates in FT duplicate identity and takes precedence over frequency-based mode inference.

Upgrade initialization adds absent canonical direct feeds without silently enabling them.

Existing connection settings, operator URLs and unrelated preferences are preserved. Enabling a feed does not automatically opt users into FT delivery.

Band/mode ranges retain fractional kHz and explicit file order.

Existing custom rows keep priority over supplemental defaults. This improves spot classification; it is not a statement of transmit privileges.

The snr alias supports signed comparisons together with explicit FT opt-in.

For example, SET DX FILTER ftskimmer and snr>=0 selects FT reports at zero dB or above; add mode=FT8 or mode=FT4 for one mode. Negative values remain signed, and an unknown report is not silently treated as zero. The same saved selection applies to live delivery and historical queries. snr maps to SkimDb; a threshold is a user choice, not a quality-certification score.

The parsed transmitting-station locator is available as Grid, rather than requiring comment-text matching.

For example, SET DX FILTER ftskimmer and grid=FN20 selects reports carrying that locator. Existing FT fixtures cover grid equality, nonempty grids and history translation. Missing or invalid locators stay blank; FT processing does not substitute a callbook grid and present it as decoded data.

Choose exact locators or prefixes before unwanted spots reach the logging application.

Use SET DX FILTER ftskimmer and grid=[FN20,FN31] for chosen squares, ftskimmer and grid=FN* for a prefix, or ftskimmer and grid=[FN*,EM*] for multiple prefixes. Existing list expansion and text wildcard handling supply these forms; Grid and FT opt-in already exist. The filter reduces the unwanted spots sent over the connection and leaves less incoming traffic for desktop logging software to process. Local software can still track worked/confirmed grids and apply finer rules. Reports without a matching valid supplied locator are excluded. This is manual selection, not automatic award tracking; traffic reduction depends on the filter and observed reports.

A literal # remains part of a spotter identity; an explicit * requests wildcard matching.

An exact receiver callsign comparison remains distinct from a wildcard comparison. Negative wildcard comparisons use NOT LIKE and survive display/re-entry, recovering the latest exclusion behavior. Existing stored wildcard expressions are not silently narrowed because their original intent cannot be inferred.

Decoder comments were being evaluated as ordinary human prose.

Skimmer comments are now exempt from the comment bad-word check. Ordinary human spot comments retain that check; other validation and local-user-only skimmer routing remain in force.

CW/RTTY on port 7000 and FT4/FT8 on port 7001 can feed the same ARC6 instance.

Users receive their selected modes through one cluster connection; separate server instances are not required just to obtain both feed families. A field user retained a saved filter after a data-path migration and saw CW/RTTY and FT reports in the same session. FT remains an explicit opt-in, skimmer traffic remains local-user-only, and both upstreams are receive-only.

Accepted hourly WCY reports reach users and can be recalled with SH/WCY.

WCY has its own history, count, output, default and help commands alongside WWV. A user can disable live WCY without disabling WWV, or choose a default history count. Reports are delivered when accepted from the network; the server does not invent a missing hourly report. Field testing confirmed visible delivery.

The supplemental LF range is 135.7–137.8 kHz, with band identifier 2200.

The fractional endpoints replace the inherited incomplete LF envelope. Existing filter syntax can use band=2200 or explicit kHz frequency comparisons. This is reception/spot classification, not authorization to transmit.

The 472–479 kHz interval uses band identifier 630.

Valid reports in this range no longer fail solely because the inherited band acceptance omitted it. Human and skimmer reports use the applicable shared acceptance path; user delivery filters still apply.

The latest deployment’s 5200–5500 kHz acceptance is restored alongside band identity 60.

This accommodates the reviewed global spotting envelope without restricting reception to the operator’s local transmit allocation. Custom mode rows keep precedence; it is not a claim that every frequency is licensed everywhere.

Fractional configuration values and incoming single-precision frequencies are compared deliberately.

The 137.8 kHz edge no longer becomes just outside the band merely because float-to-double promotion yields a slightly larger value. The double overload retains precise configured-boundary comparisons.

Updated band/mode defaults include FT4/FT8 activity segments while explicit decoded mode takes priority.

Frequency windows are inference guidance, not exclusive allocations. FT4/FT8 can overlap, including a shared 60 m dial, so a valid decoded mode must win. Existing custom URLs, disabled-download preferences and local rules retain their documented precedence.

The bundled band/mode file adds LF, MF, 60 m and FT windows without replacing a custom active file.

The updated 73-row definitions and fractional-kHz loader recognize 2200 m, 630 m and a wider 60 m spotting envelope. Existing custom rows keep their order and priority. Custom download URLs and disabled-download preferences retain the active local file; the bundled default is selected only under the documented default-source or missing-file conditions. Recognition is not a claim about local transmit privileges.