@underpostnet/cyberia 3.2.80 → 3.3.0

package/scripts/k3s-node-setup.sh

@@ -49,22 +49,25 @@ if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# NVM and Node.js — required for `node bin ...` entrypoints
+# System-wide Node.js is required by service units under SELinux.
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.15.0..."
-
-curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-
-export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-# shellcheck disable=SC1090
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+if command -v dnf >/dev/null 2>&1; then
+    sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+fi
 
-nvm install 24.15.0
-nvm use 24.15.0
-nvm alias default 24.15.0
-ln -sf "$(command -v node)" /usr/local/bin/node
-ln -sf "$(command -v npm)" /usr/local/bin/npm
-ln -sf "$(command -v npx)" /usr/local/bin/npx
+if ! command -v node >/dev/null 2>&1 || ! node --version 2>/dev/null | grep -q '^v24'; then
+    echo "Installing system-wide Node.js 24..."
+    if command -v dnf >/dev/null 2>&1; then
+        curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+        sudo dnf install -y nodejs
+    elif command -v apt-get >/dev/null 2>&1; then
+        curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
+        sudo apt-get install -y nodejs
+    else
+        echo "ERROR: a supported system package manager is required for Node.js 24" >&2
+        exit 1
+    fi
+fi
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -116,7 +119,7 @@ if [ "$ROLE" = "control" ]; then
     curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
-    sh -s - agent
+    sh -s - agent $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi)
     
     echo ""
     echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."

package/scripts/kubeadm-node-setup.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 # Underpost Kubeadm Node Setup (bare-metal physical node)
 #
 # Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
-# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
-# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs
+# system-wide Node.js, ensures the engine source is present, and drives the cluster bring-up
 # through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
 # reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
 #
@@ -146,33 +146,22 @@ if [ "$JOIN_ONLY" = "1" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
-#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# 0. Base prerequisites.
 # ---------------------------------------------------------------------------
-log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+log "Installing base prerequisites..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
-# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
-#    a retried run does not reinstall Node from scratch.
+# 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
+#    systemd services under SELinux.
 # ---------------------------------------------------------------------------
 if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed; skipping NVM setup"
+    log "Node.js $(node --version) already installed"
 else
-    log "Installing NVM and Node.js v24.15.0..."
-    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-    
-    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-    # shellcheck disable=SC1090
-    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-    
-    nvm install 24.15.0
-    nvm use 24.15.0
-    nvm alias default 24.15.0
-    ln -sf "$(command -v node)" /usr/local/bin/node
-    ln -sf "$(command -v npm)" /usr/local/bin/npm
-    ln -sf "$(command -v npx)" /usr/local/bin/npx
+    log "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "

package/scripts/nat-iptables.sh

@@ -32,16 +32,24 @@ sudo firewall-cmd --permanent --zone=public --add-service=ssh
 sudo firewall-cmd --permanent --zone=public --add-service=http
 sudo firewall-cmd --permanent --zone=public --add-service=https
 
+# QUIC / HTTP3. The `https` service above covers TCP 443 only, so without this
+# an HTTP/3 gateway advertises `Alt-Svc: h3=":443"` and every client that acts
+# on it silently fails over UDP while HTTP/2 keeps working.
+sudo firewall-cmd --permanent --zone=public --add-port=443/udp
+sudo firewall-cmd --permanent --zone=public --add-port=80/udp
+
 echo "[INFO] Opening Kubernetes control plane ports..."
 
 # Kubernetes API Server
 sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=6443/udp
 
 # etcd
 sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
 
 # kubelet API
 sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=10250/udp
 
 # kube-scheduler
 sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp
@@ -98,10 +106,10 @@ sudo firewall-cmd --reload
 echo
 echo "[INFO] Sysctl status:"
 sudo sysctl \
-  net.ipv4.ip_forward \
-  net.ipv6.conf.all.forwarding \
-  net.bridge.bridge-nf-call-iptables \
-  net.bridge.bridge-nf-call-ip6tables
+net.ipv4.ip_forward \
+net.ipv6.conf.all.forwarding \
+net.bridge.bridge-nf-call-iptables \
+net.bridge.bridge-nf-call-ip6tables
 
 echo
 echo "[INFO] Firewall status:"

package/scripts/rocky-kickstart.sh

@@ -168,7 +168,7 @@ PermitEmptyPasswords no
 PasswordAuthentication ${SSHD_PASSWORD_AUTH}
 ChallengeResponseAuthentication ${SSHD_KBD_INTERACTIVE}
 KbdInteractiveAuthentication ${SSHD_KBD_INTERACTIVE}
-UsePAM no
+UsePAM yes
 X11Forwarding no
 PrintMotd no
 TCPKeepAlive yes
@@ -585,7 +585,7 @@ fi
 post_status "installing" "\"detail\":\"installing packages\",\"disk\":\"\$REAL_DISK\""
 
 ilog "Installing base packages with dnf --installroot ..."
-PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release"
+PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release policycoreutils policycoreutils-python-utils selinux-policy-targeted audit sudo"
 if [ "\$FW" = "uefi" ]; then
     PKGS="\$PKGS grub2-efi-x64 shim-x64 efibootmgr"
 else
@@ -622,15 +622,10 @@ ilog "Configuring installed system (hostname, network, ssh, users) ..."
 echo "\${TARGET_HOSTNAME:-rocky9}" > "\$TARGET_MNT/etc/hostname"
 
 chroot "\$TARGET_MNT" /bin/bash -s << CHROOTEOF >> "\$KS_LOG" 2>&1
-set +e
+set -e
 systemctl enable sshd NetworkManager chronyd 2>/dev/null
 
-# SELinux -> permissive in the DEPLOYED OS. Critical: with SELinux enforcing on
-# first boot, files written from this installer chroot (authorized_keys, home
-# dirs) carry the wrong security context, so sshd drops sessions ("Connection
-# reset by peer") and PAM can block console logins. Permissive ignores contexts
-# (no relabel reboot needed) and matches what kubeadm/cluster.js expect.
-sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config 2>/dev/null || true
+sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
 
 # Ensure sshd host keys exist so sshd actually starts on first boot.
 ssh-keygen -A 2>/dev/null || true
@@ -708,11 +703,19 @@ fi
 # Key-only SSH on the installed system.
 mkdir -p /etc/ssh/sshd_config.d
 cat > /etc/ssh/sshd_config.d/00-underpost.conf <<SSHDEOF
+Port ${SSH_PORT}
 PermitRootLogin prohibit-password
 PubkeyAuthentication yes
 PasswordAuthentication no
+KbdInteractiveAuthentication no
+UsePAM yes
 SSHDEOF
 
+if [ "${SSH_PORT}" != "22" ]; then
+    semanage port -a -t ssh_port_t -p tcp "${SSH_PORT}" 2>/dev/null || \
+        semanage port -m -t ssh_port_t -p tcp "${SSH_PORT}"
+fi
+
 # Create the admin login accounts. create_user <name> writes the authorized key,
 # wheel membership and passwordless sudo. Passwords are applied after the chroot.
 create_user() {
@@ -738,11 +741,24 @@ chmod 600 /root/.ssh/authorized_keys
 create_user "\${ADMIN_USER}"
 create_user "\${DEPLOY_USER}"
 
+restorecon -RF /etc/ssh /etc/sudoers.d /root/.ssh /home 2>/dev/null
+touch /.autorelabel
+
 # Build initramfs for the installed kernel.
 KVER=\\\$(ls /lib/modules | head -1)
 [ -n "\\\$KVER" ] && dracut -f /boot/initramfs-\\\$KVER.img "\\\$KVER"
 CHROOTEOF
 
+CHROOT_RC=\$?
+if [ "\$CHROOT_RC" -ne 0 ]; then
+    ilog "FATAL: installed-system configuration failed (rc=\$CHROOT_RC)"
+    post_status "failed" "\"detail\":\"installed-system configuration rc=\$CHROOT_RC\""
+    for d in dev proc sys run; do umount -l "\$TARGET_MNT/\$d" 2>/dev/null; done
+    umount -R "\$TARGET_MNT" 2>/dev/null || true
+    rm -f "\$INSTALL_LOCK"
+    exit 1
+fi
+
 # Set console passwords AFTER the chroot heredoc, from decoded installer vars.
 # Primary path: pipe 'user:password' into 'chroot chpasswd' (keeps password
 # characters out of any heredoc). Fallback: hash with openssl and apply via

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.2.80                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.3.0                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace
@@ -202,7 +202,8 @@ run_runtime_mode() {
     setup_tls_secrets $(hosts_from "$SERVER_CONF")
     expose_flags="--tls"
   fi
-  [ "$DO_EXPOSE" = true ] && node bin deploy --expose --local-proxy "$DEPLOY_ID" "$ENV" $expose_flags
+  [ "$DO_EXPOSE" = true ] && node bin run expose "${DEPLOY_ID}-${ENV}-traffic-service" --namespace "$NAMESPACE" \
+    --local-proxy $DEV_FLAG $CLUSTER_FLAG $expose_flags
 }
 
 # ─────────────────────────── instance mode ───────────────────────────
@@ -234,7 +235,7 @@ run_instance_mode() {
     # Plain HTTP: port-forward each instance service port directly.
     for id in "${ids[@]}"; do
       [ -n "$id" ] || continue
-      node bin deploy --expose "${DEPLOY_ID}-${id}" "$ENV" --namespace "$NAMESPACE" || true
+      node bin run expose "${DEPLOY_ID}-${id}-${ENV}-traffic-service" --namespace "$NAMESPACE" $CLUSTER_FLAG || true
     done
   fi
 }

package/src/api/cyberia-action/cyberia-action.model.js

@@ -60,6 +60,7 @@ const CyberiaActionSchema = new Schema(
             qty: { type: Number, default: 1, min: 1 },
           },
         ],
+        craftTimeMs: { type: Number, default: 0, min: 0 },
       },
     ],
 

package/src/api/cyberia-instance/cyberia-fallback-default-items.js

@@ -0,0 +1,63 @@
+/**
+ * Fallback-world default items — process-local override store.
+ *
+ * The procedural fallback world is never persisted, so its default item set
+ * has no collection to live in. This module holds the set the FallbackWorldEngine
+ * view composed, in memory, for the lifetime of the engine process:
+ *
+ *   - written by  POST /api/cyberia-instance/fallback-world/hot-reload
+ *   - read by     fetchFullInstance()'s fallback branch (instance-data.js) and
+ *                 GET /api/cyberia-instance/fallback-world[/default-items]
+ *
+ * Deliberately NOT persisted: an engine restart drops back to the code defaults,
+ * so a stale editor session can never become the permanent shape of the world.
+ * This keeps the fallback path's "code defaults are authoritative" invariant —
+ * the only thing an operator can layer on top is this explicit, volatile list.
+ *
+ * @module src/api/cyberia-instance/cyberia-fallback-default-items.js
+ */
+
+/** @typedef {{ id: string, defaultPlayerInventory: boolean }} FallbackDefaultItem */
+
+/** @type {FallbackDefaultItem[]} */
+let defaultItems = [];
+
+/**
+ * Coerce a caller-supplied list into the canonical `{ id, defaultPlayerInventory }`
+ * shape. Accepts the legacy `string[]` form and drops blank/duplicate ids so the
+ * world generator never sees a malformed entry.
+ *
+ * @param {Array<string|FallbackDefaultItem>} entries
+ * @returns {FallbackDefaultItem[]}
+ */
+function normalizeFallbackDefaultItems(entries) {
+  if (!Array.isArray(entries)) return [];
+  const seen = new Set();
+  const normalized = [];
+  for (const entry of entries) {
+    const raw = typeof entry === 'string' ? { id: entry } : entry;
+    const id = typeof raw?.id === 'string' ? raw.id.trim() : '';
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    normalized.push({ id, defaultPlayerInventory: !!raw.defaultPlayerInventory });
+  }
+  return normalized;
+}
+
+/**
+ * Current override set. Returns a copy so callers cannot mutate the store.
+ * @returns {FallbackDefaultItem[]}
+ */
+const getFallbackDefaultItems = () => defaultItems.map((entry) => ({ ...entry }));
+
+/**
+ * Replace the override set. An empty list clears it, restoring pure code defaults.
+ * @param {Array<string|FallbackDefaultItem>} entries
+ * @returns {FallbackDefaultItem[]} The stored set.
+ */
+function setFallbackDefaultItems(entries) {
+  defaultItems = normalizeFallbackDefaultItems(entries);
+  return getFallbackDefaultItems();
+}
+
+export { getFallbackDefaultItems, setFallbackDefaultItems, normalizeFallbackDefaultItems };

package/src/api/cyberia-instance/cyberia-fallback-world.js

@@ -19,6 +19,7 @@
  */
 
 import { connectPortals } from './cyberia-portal-connector.js';
+import { withSeededRandom } from './cyberia-random-source.js';
 
 import {
   generateObstacles,
@@ -38,6 +39,7 @@ import {
   DEFAULT_PLAYER_SPAWN,
   ENTITY_TYPE_DEFAULTS,
   RESOURCE_ENTITY_TYPE_DEFAULTS,
+  DefaultCyberiaActions,
   DefaultSkillConfig,
 } from '../cyberia-server-defaults/cyberia-server-defaults.js';
 import {
@@ -92,6 +94,19 @@ function collectReferencedItemIds() {
       }
     }
   }
+  // Provider catalogs: the interact modal draws an icon for every item a
+  // vendor sells and every ingredient/output an assembler recipe names, so all
+  // of them must resolve to an ObjectLayer.
+  for (const action of DefaultCyberiaActions) {
+    for (const shopItem of action.shopItems || []) {
+      push(shopItem.itemId);
+      push(shopItem.priceItemId);
+    }
+    for (const recipe of action.craftRecipes || []) {
+      (recipe.ingredients || []).forEach((i) => push(i.itemId));
+      (recipe.outputItems || []).forEach((o) => push(o.itemId));
+    }
+  }
   return ids;
 }
 
@@ -164,7 +179,7 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
   const portalEntities = generatePortalEntities(mapDims, colors, { grid });
 
   // 6. Bots — placed on walkable cells (avoids obstacles, portals, NPCs)
-  const bots = generateBots(mapDims, colors, { count: opts.botCount, grid });
+  const bots = mapCode === 'fallback-map-0' ? [] : generateBots(mapDims, colors, { count: opts.botCount, grid });
 
   // 7. Resources — static exploitable entities placed on walkable cells
   const resources = generateResources(mapDims, colors, { count: opts.resourceCount, grid });
@@ -217,6 +232,11 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
  * @param {number} [opts.resourceCount]        Resources per map (random if omitted).
  * @param {number} [opts.staticCount]          Static decorators per map (random if omitted).
  * @param {Array}  [opts.colors]              Override palette.
+ * @param {Array<{id: string, defaultPlayerInventory: boolean}>} [opts.itemIds=[]]
+ *   Instance-level default items, mirroring `CyberiaInstance.itemIds`. Entries
+ *   flagged `defaultPlayerInventory` are merged into the player entity default
+ *   by `applyInstanceDefaultPlayerInventory`; every id is also resolved to an
+ *   atlas at boot. Layout is unaffected, so this stays outside the world seed.
  * @returns {{
  *   instance: object,
  *   maps: object[],
@@ -241,6 +261,7 @@ function generateFallbackWorld(opts = {}) {
     // fallback before atlases load. The C client resolves real colours
     // through domain/presentation_runtime — it does not read this value.
     colors = PALETTE,
+    itemIds = [],
   } = opts;
 
   // Surface item-id drift loudly on the very first build, so a missing
@@ -262,20 +283,32 @@ function generateFallbackWorld(opts = {}) {
     mapCodes.push(`fallback-map-${i}`);
   }
 
-  // Generate each map (all randomized independently).
-  const maps = mapCodes.map((code) =>
-    generateFallbackMap(code, colors, {
-      gridSize,
-      obstacleCount,
-      foregroundCount,
-      botCount,
-      resourceCount,
-      staticCount,
-    }),
-  );
-
-  // Connect maps with portal topology using the portal connector module.
-  const { portals, topology } = connectPortals(mapCodes, maps);
+  // Deterministic layout: seed the shared random source so every call
+  // reproduces the SAME world. The instance-map `/static` POIs and the
+  // `/preview` node image are built by independent requests (and survive
+  // restarts) — they must agree on where every entity sits, so a resource POI
+  // lands exactly where the preview draws that resource. The seed folds in the
+  // layout-affecting options so a custom count set stays internally consistent.
+  const seed = `cyberia-fallback-world-v1:${mapCount}:${gridSize ?? ''}:${obstacleCount ?? ''}:${
+    foregroundCount ?? ''
+  }:${botCount ?? ''}:${resourceCount ?? ''}:${staticCount ?? ''}`;
+
+  const { maps, portals, topology } = withSeededRandom(seed, () => {
+    // Generate each map (deterministic under the seeded source).
+    const genMaps = mapCodes.map((code) =>
+      generateFallbackMap(code, colors, {
+        gridSize,
+        obstacleCount,
+        foregroundCount,
+        botCount,
+        resourceCount,
+        staticCount,
+      }),
+    );
+    // Connect maps with portal topology using the portal connector module.
+    const { portals: p, topology: t } = connectPortals(mapCodes, genMaps);
+    return { maps: genMaps, portals: p, topology: t };
+  });
 
   // Build the instance shell (never persisted — no mongoId).
   const instance = {
@@ -287,6 +320,7 @@ function generateFallbackWorld(opts = {}) {
     portals,
     topologyMode: 'procedural',
     playerSpawn: { ...DEFAULT_PLAYER_SPAWN },
+    itemIds: itemIds.map((entry) => ({ ...entry })),
   };
 
   return {

package/src/api/cyberia-instance/cyberia-instance-map.service.js

@@ -31,8 +31,8 @@ import {
   DefaultCyberiaActions,
   DefaultCyberiaQuests,
   ENTITY_TYPE_DEFAULTS,
-  RESOURCE_ENTITY_TYPE_DEFAULTS,
 } from '../cyberia-server-defaults/cyberia-server-defaults.js';
+import { DefaultCyberiaItems } from '../../client/components/cyberia/SharedDefaultsCyberia.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -430,22 +430,18 @@ const resolveInstanceWorld = async (instanceCode, options) => {
   const instance = await CyberiaInstance.findOne({ code: instanceCode }).lean();
 
   if (!instance) {
-    // Fallback world: topology is regenerated (portal cells may drift from
-    // the live simulation's world), but map codes and provider POIs come
-    // from the deterministic canonical defaults.
     const world = generateFallbackWorld();
     const mapCodes = new Set(world.instance.cyberiaMapCodes);
 
-    // Build synthetic object-layer metadata for the fallback world's resource
-    // items so resource entities carry a stats-sum readout.  The canonical
-    // resource defaults (wood-1, wood-2) are not persisted to MongoDB in the
-    // fallback path, so we compute a reasonable stats sum from the item type's
-    // default stat block (each stat 0-10, 6 stats → ~30 average).
-    const resourceItemIds = [
-      ...new Set(RESOURCE_ENTITY_TYPE_DEFAULTS.flatMap((r) => [...(r.liveItemIds || []), ...(r.dropItemIds || [])])),
+    const fallbackItemIds = [
+      ...new Set(world.maps.flatMap((m) => (m.entities || []).flatMap((e) => e.objectLayerItemIds || []))),
     ];
+    const itemTypeById = Object.fromEntries(DefaultCyberiaItems.map((entry) => [entry.item.id, entry.item.type]));
+    const resolved = await resolveObjectLayerMetadata(fallbackItemIds, options);
     const objectLayerMetadata = Object.fromEntries(
-      resourceItemIds.map((itemId) => [itemId, { statsSum: 30, type: 'resource' }]),
+      Object.entries(resolved).map(([itemId, meta]) => {
+        return [itemId, { statsSum: meta.statsSum, type: meta.type }];
+      }),
     );
 
     return {

package/src/api/cyberia-instance/cyberia-instance.controller.js

@@ -30,6 +30,9 @@ const CyberiaInstanceController = buildCrudController(CyberiaInstanceService, {
   portalConnect: serviceHandler(CyberiaInstanceService.portalConnect),
   // Moderator/admin-triggered world reload on a running cyberia-server.
   hotReload: serviceHandler(CyberiaInstanceService.hotReload, { errorStatus: 502 }),
+  // Fallback-world default items (volatile) + its own reload trigger.
+  fallbackDefaultItems: serviceHandler(CyberiaInstanceService.fallbackDefaultItems),
+  fallbackHotReload: serviceHandler(CyberiaInstanceService.fallbackHotReload, { errorStatus: 502 }),
   // Boot transport (REST fallback of the gRPC CyberiaDataService).
   bootPing: serviceHandler(CyberiaInstanceBootService.ping),
   bootObjectLayerBatch: serviceHandler(CyberiaInstanceBootService.objectLayerBatch, { errorStatus: 500 }),

package/src/api/cyberia-instance/cyberia-instance.router.js

@@ -38,6 +38,19 @@ class CyberiaInstanceRouter {
       async (req, res) => await CyberiaInstanceController.bootFullInstance(req, res, options),
     );
     router.get(`/fallback-world`, async (req, res) => await CyberiaInstanceController.fallbackWorld(req, res, options));
+    // Fallback-world default items — volatile, process-local (never persisted).
+    // The read is open (same as /fallback-world); staging them and triggering a
+    // rebuild is elevated privilege, like every other hot-reload path.
+    router.get(
+      `/fallback-world/default-items`,
+      async (req, res) => await CyberiaInstanceController.fallbackDefaultItems(req, res, options),
+    );
+    router.post(
+      `/fallback-world/hot-reload`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceController.fallbackHotReload(req, res, options),
+    );
     // Instance Map — static topology/presence plus dynamic player capability activity.
     router.get(
       `/instance-map/:instanceCode/static`,

package/src/api/cyberia-instance/cyberia-instance.service.js

@@ -7,6 +7,8 @@ import {
   fallbackListInstance,
   DEFAULT_FALLBACK_INSTANCE_CODE,
 } from './cyberia-fallback-world.js';
+import { getFallbackDefaultItems, setFallbackDefaultItems } from './cyberia-fallback-default-items.js';
+import { CYBERIA_INSTANCE_CONF_DEFAULTS } from '../cyberia-server-defaults/cyberia-server-defaults.js';
 import { triggerHotReload } from '../../projects/cyberia/hot-reload-trigger.js';
 
 const logger = loggerFactory(import.meta);
@@ -183,8 +185,49 @@ class CyberiaInstanceService {
       botCount: q.botCount ? parseInt(q.botCount, 10) : undefined,
       obstacleCount: q.obstacleCount ? parseInt(q.obstacleCount, 10) : undefined,
       foregroundCount: q.foregroundCount ? parseInt(q.foregroundCount, 10) : undefined,
+      itemIds: getFallbackDefaultItems(),
     });
   };
+
+  /**
+   * Current fallback-world default items — the volatile set the
+   * FallbackWorldEngine view last pushed, or `[]` when the engine is running on
+   * pure code defaults. Lets the view reopen showing what this process serves.
+   *
+   * `entityDefaultItemIds` are the ids the code defaults already ship in an
+   * entity's `defaultObjectLayers`. Selecting one of them and leaving
+   * `defaultPlayerInventory` unchecked REMOVES it (see
+   * applyInstanceDefaultPlayerInventory), so the editor needs to be able to warn
+   * before an operator silently strips the player's starting skin or weapon.
+   */
+  static fallbackDefaultItems = async () => {
+    const entityDefaultItemIds = new Set();
+    for (const entityDefault of CYBERIA_INSTANCE_CONF_DEFAULTS.entityDefaults || []) {
+      for (const layer of entityDefault.defaultObjectLayers || []) {
+        if (layer.itemId) entityDefaultItemIds.add(layer.itemId);
+      }
+    }
+    return { itemIds: getFallbackDefaultItems(), entityDefaultItemIds: [...entityDefaultItemIds].sort() };
+  };
+
+  /**
+   * Stage the fallback world's default items, then ask a running cyberia-server
+   * to rebuild. The items are not persisted (see cyberia-fallback-default-items):
+   * they are staged here first so the rebuild's `getFullInstance` re-fetch picks
+   * them up, which is what makes them reach the server at all.
+   *
+   * `instanceCode` is intentionally left empty — the target world is addressed by
+   * `serverUrl` (origin, or origin + variant sub-path), and naming the synthetic
+   * `fallback` code would be rejected by any server serving a real instance code.
+   */
+  static fallbackHotReload = async (req) => {
+    const { serverUrl, mode, itemIds } = req.body || {};
+    if (!serverUrl) throw new Error('serverUrl is required');
+
+    const staged = setFallbackDefaultItems(itemIds || []);
+    const { transport, result, grpcError } = await triggerHotReload({ serverUrl, instanceCode: '', mode });
+    return { transport, itemIds: staged, grpcError, ...result };
+  };
 }
 
 export { CyberiaInstanceService };

package/src/api/cyberia-instance/cyberia-portal-connector.js

@@ -20,6 +20,8 @@
  * @module src/api/cyberia-instance/cyberia-portal-connector
  */
 
+import { nextRandom } from './cyberia-random-source.js';
+
 // ── Portal mode constants ────────────────────────────────────────────────────
 
 /**
@@ -117,7 +119,7 @@ function buildTopologyFromSubtypes(orderedCodes, portalIndex) {
 
       // Target: pick any portal on the target map for landing coordinates
       const tgtAll = portalIndex[tgtCode] || [];
-      const tgtEnt = tgtAll.length > 0 ? tgtAll[Math.floor(Math.random() * tgtAll.length)] : null;
+      const tgtEnt = tgtAll.length > 0 ? tgtAll[Math.floor(nextRandom() * tgtAll.length)] : null;
 
       if (srcEnt) {
         usedInRing.add(srcEnt);
@@ -139,7 +141,7 @@ function buildTopologyFromSubtypes(orderedCodes, portalIndex) {
     if (n < 2) return srcCode;
     let code;
     do {
-      code = orderedCodes[Math.floor(Math.random() * n)];
+      code = orderedCodes[Math.floor(nextRandom() * n)];
     } while (code === srcCode && n > 1);
     return code;
   };
@@ -151,13 +153,13 @@ function buildTopologyFromSubtypes(orderedCodes, portalIndex) {
     for (const srcEnt of remaining) {
       // If the entity already has an explicit subtype, honour it;
       // otherwise assign a random mode (matching fallback-world behaviour).
-      const sub = srcEnt.portalSubtype || PORTAL_MODE_LIST[Math.floor(Math.random() * PORTAL_MODE_LIST.length)];
+      const sub = srcEnt.portalSubtype || PORTAL_MODE_LIST[Math.floor(nextRandom() * PORTAL_MODE_LIST.length)];
 
       switch (sub) {
         case PORTAL_MODES.INTER_PORTAL: {
           const tgtCode = otherMap(srcCode);
           const candidates = portalIndex[tgtCode] || [];
-          const tgtEnt = candidates.length > 0 ? candidates[Math.floor(Math.random() * candidates.length)] : null;
+          const tgtEnt = candidates.length > 0 ? candidates[Math.floor(nextRandom() * candidates.length)] : null;
           portals.push({
             sourceMapCode: srcCode,
             sourceCellX: srcEnt.initCellX ?? 0,
@@ -198,7 +200,7 @@ function buildTopologyFromSubtypes(orderedCodes, portalIndex) {
           const candidates = allOnMap.filter(
             (e) => e !== srcEnt && (e.initCellX !== srcEnt.initCellX || e.initCellY !== srcEnt.initCellY),
           );
-          const tgtEnt = candidates.length > 0 ? candidates[Math.floor(Math.random() * candidates.length)] : null;
+          const tgtEnt = candidates.length > 0 ? candidates[Math.floor(nextRandom() * candidates.length)] : null;
           portals.push({
             sourceMapCode: srcCode,
             sourceCellX: srcEnt.initCellX ?? 0,