Accounts and sign-in 0.16.0, the patch notes.

Accounts and sign-in 0.16.0 25 October 2026

• POST /identity/native/repo/network/state: what the open network's switch shows for the caller's page (available, on, handle, did, and why it cannot join: no-page or no-handle), 120 a minute per account; while the network is switched off it answers only {"available": false} (ADR-0061, amendment of 2026-10-24).
• The console's boards for agents (`console-board`) read the time before as the console now does: at the finest step kept for it, a range only an hour inside each step's keeping, every breakdown at its window's step, and the time before's counts weighed to the time the window's own points hold. A 30-day board's time before is no longer refused, and a board no longer counts a whole last point, or a coarser time's whole points, against the window.
• A developer token with the new cloud:tasks scope may be exchanged for a cloud workspace token (POST /identity/native/access-token with Authorization: Bearer alyd_... and {"audience": "alelyon-workspace"}), so alelyon-cli runs the person's cloud tasks; refused from a browser, logged in the token's log, never offered to apps.
• Articles written with marks (ADR-0062). POST /identity/native/pages/post and draft-save take `format`: `marks` for an article written with headings, bold and italic, lists, quotes, code, links with words and dividers, or `plain` (the default). A post's and a draft's replies carry `format`. A draft carries it to the post it makes, and an edit keeps it. It applies to an article only: a post asking for marks is refused (`invalid-text`), and any other value is refused (`invalid-request`). Every article written before reads as plain, as it always did. MCP's `pages_post` takes `format` too.
• `hosted_post_marks` (one row per article written with marks) goes with an account's deletion, as `hosted_post_via` does.
• An article holds up to 10 photos (ADR-0062's amendment); a post still holds 4. `post` and `draft-save` refuse more with `invalid-text`, as before. A post's `media` says each photo's `position` (0 first), by which an article's text places it: `` alone on a line is position N - 1. A photo held back leaves its place empty.
• Pages takes a long article whole. The routes that carry an article (POST /identity/native/pages/post, edit and draft-save) take a request body of up to 256 KiB. Before, every route had a 16 KiB limit, so an article of more than about 16,000 characters was refused as "not understood", although the limit is 20,000. 256 KiB holds the longest article even when a program writes every character as an escaped surrogate pair (12 bytes). Every other route keeps 16 KiB. For the same reason the MCP server takes a message of up to 272 KiB (it was 64 KiB), so an agent's pages_post or pages_edit can carry the longest article too.
• Text of several lines (a post, an article, an about or a note) keeps its tabs. A Windows (CR LF) or old Mac (CR) line break is stored as a newline and counts as one character. Before, pasted code and text written on Windows were refused ("text may not carry control characters"), and a CR LF counted twice toward the limit. Every other control character is still refused, and a one-line field (a title, a name) still refuses a tab.
• A page on the open network now also carries its profile, posts and plain reposts in the collections Bluesky's app reads (app.bsky.actor.profile, app.bsky.feed.post, app.bsky.feed.repost), within that app's limits: 300 characters (a longer post goes as its opening and its address on Pages; an article, a poll or a job opening adds a link card), at most four photos of at most 1,000,000 bytes, and facets for links, mentions of people on the network and hashtags. A reply, quote or repost names only a post on the network. Follows, likes and votes are never records (ADR-0061, amendment). GET /xrpc/com.atproto.sync.getBlob redirects to the media domain for a photo a repository names, and listBlobs lists them. A photo a moderator holds is no longer named in any record, Alelyon's own included.
• The open network's event stream (ADR-0061, amendment of 2026-10-24): GET /xrpc/com.atproto.sync.subscribeRepos, a WebSocket relays follow, from ?cursor= when given (FutureCursor for one ahead of the stream; #info OutdatedCursor for one older than the 72 hours kept). Each new commit of a page on the network is a #commit (sync 1.1: ops with what each record was, since, prevData, and blocks with which a relay can undo the ops to the tree before), written in the transaction that keeps the commit; a change of more than 200 records goes as #sync. Joining says #identity, #account and #sync; leaving and a suspension say #account (deactivated, suspended); a new username sends the directory an update and says #identity. Deleting an account deletes its events, says #account deleted, and owes the directory a tombstone, which the upkeep sends (hosted_repo_departures until then). The upkeep (NetworkStore.tend) runs every 15 seconds. The front's certificate questions from loopback no longer count against the public limit. hosted_repo_events and hosted_repo_stream go with account deletion (ADR-0047 rows); hosted_repo_departures is kept until sent.
• Projects on the account: an Alelyon signed in to the account saves its projects there (name, description and a summary of the scan: languages, stack, license, how many files; never a path, a git remote, a command or code), and a project can be shared: the owner invites a friend, or makes it public and open to join so the owner's friends can join it. Only the owner changes, invites to, removes from or deletes a project; a member leaves. Deleting the account deletes its projects, everyone's places in them and its places in other people's.
• deploy the identity service at the version's commit (the boards' reads only; no migration).
• deploy the identity service at the version's commit, after a data-disk snapshot; no setting changes.
• The store makes `hosted_post_marks` on start (additive). No route changes for older clients, which send no `format` and get plain articles.
• On its first start the store rebuilds `hosted_post_media` and `hosted_draft_media` once, so that they take places 0-9 (they took 0-3): SQLite's documented table rebuild, in one transaction, with foreign keys checked after. It logs `pages: <table> rebuilt to hold an article's ten photos` for each. Older clients ignore `position`.
• No migration and no client change; deploy the identity service as usual.
• nothing beyond ADR-0061's switch, which stays off until the event stream and the switch's Privacy and Terms wording have landed. No migration.