World scripts run in the server's interpreter, from the world's WebAssembly module, the same on every platform: a server on Linux ARM64 needs no folder of its own, and no check of a world's code can refuse it any more.
Worlds are no longer signed: at start, the server checks a world's manifest format (4) and every file's size and SHA-256 against it; a world that fails is refused as damaged (problem damaged, which replaces badSignature and codeRefused).
Worlds published with an SDK older than 0.3.0 (manifest format 3) are refused as too old: their creators must publish them again.
Protocol 5: players need NodeWorld 0.3.0.
A world's scripts on the server are stopped only when their own code runs longer than FluxWatchdogSeconds in one call: the server's own work during the call no longer counts. A call of a script to the server that takes a second or more is named in the log.
The server tells NodeWorld which of its worlds it refuses and why, so its owner and co-owners get a notification and see them on their server's page.
A server on Linux ARM64 runs the scripts each world publishes for it, in the world's LinuxArm64 folder, instead of the Quest's.
A world's scripts on the server that run longer than 10 seconds in one call are stopped, and the instance goes on without them; FluxWatchdogSeconds in server-config.yaml sets another limit, 0 turns it off.
The server verifies the machine code of each world's FL# module at start and before running its scripts, the same check the SDK and players' devices run; a world whose code is refused is not served, the log names the function and the rule, and its owner and co-owners are told.
The scripts of the worlds that run on the server can make web requests and open WebSockets to any address; the hosting pages say how to keep them out of the machine and its local network with the firewall.
On its first start, the server asks for its ID and token in the console, finds its public address, opens its port on your router (UPnP), has NodeWorld test it from the internet and offers to install itself as a service; each step can be skipped or forced, also without a console.
The server can run as a service, systemd on Linux or a Windows service: it starts with the machine and again after each update.
The server updates itself: it looks for a new version every hour, checks its signature, and installs it as soon as no one is on it; AutoUpdate: false in server-config.yaml turns this off.
Players see each other's away status (AFK), VR or desktop, status sentence and Do not disturb.
Between two players with a block, in either direction, the server no longer relays their voice, avatar and moves to each other.
Instance owners can send players home; you and your co-owners can ban players from the game, and players banned on the website are sent home within 30 seconds.
The server itself refuses minors in 18+ instances, and every refused player is told why: banned, adults only or suspended account.
The server tells NodeWorld its version and protocol, so an outdated server shows as not up to date, and which of its worlds are 18+.
Players see on each other's nametag when a microphone is off, also those who arrive later.
Each world is checked at start, always: its creator's signature of manifest.json, its format and every file's size and SHA-256; a world that fails is not served and the log says why.
Objects spawned by world scripts get an id of their own in the room, are shown to every player and to those who arrive later, and stay with the master when their owner leaves.
World scripts on the server receive the network events players send them, and can open portals for them.
The server-config.yaml created at first start now has the values the server uses when a line is missing: 100 players and 40 logic ticks a second instead of 50 and 30, and a world without GraceSeconds uses DefaultRoomGraceSeconds; a server set up before keeps its own file (set TickRate: 40 there).
