feat(rust): the world verbs, their budgets and the reconcile watch (phase 13a, protocol 9)

- registerEventActions: rust.zone.open and rust.prefab.place, both
  reversible 'ledger' with revert() and reconcile(), budgetMs 15000 above the
  client's 12 s. A location is a monument (kind + instance, carrying its
  server) or raw coordinates, exactly one (D87, D93); bounds mirrored from the
  plugin so a bad step is refused on the form (D95); zone minutes required and
  held by the game (D96).
- registerEventBudgets: rust.prefabs, rust.npcs and rust.zone.minutes, each
  beside the verb that spends it (D79, D89).
- Option sources rust.options.monuments (live, searchable) and
  rust.options.prefabs (mirrored, answers with every server off), registered in
  the one batch core accepts alongside the lease sources.
- Refs are <serverId>:<id>, since revert and reconcile get no params. The undo
  sends no idempotency key; a lost answer is reverted by key on every server.
  reconcile asks the plugin, and a server that cannot be asked keeps its rows.
- The refresh's bootId/wipeId watch calls ctx.events.reconcile() on a restart
  or a wipe, never on a first sighting or a reconnect (§11.1).
- The permission mirror keeps the plugin's new notLanded grants out of what it
  records as pushed, and the admin page says so (D85).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -57,6 +57,7 @@ module.exports = function register(ctx, api) {
   const { AUDIENCES } = require('./engagement/audiences')
   const seeds = require('./engagement/seeds')
   const eventLeases = require('./eventLeases')
+  const eventWorld = require('./eventWorld')
   const boot = require('./boot')
   /* eslint-enable global-require */
 
@@ -153,14 +154,21 @@ module.exports = function register(ctx, api) {
   // target names the server (D73), which is how one value on one server gets
   // exactly one holder without core learning what a server is.
   //
-  // The option sources are the three targets' own (D78). **No budgets** (D79): a
-  // lease spends none, and a dimension with nothing to spend it is a dial on the
-  // operator's cap screen that does nothing. They arrive with the actions.
+  // The option sources are the three targets' own (D78).
   api.registerEventLeases(eventLeases.LEASES)
-  api.registerEventOptionSources(eventLeases.OPTION_SOURCES)
 
-  // Everything else this module will register — the event actions and budgets,
-  // the announce leg and the slash commands — is deliberately absent. Each arrives
+  // The world verbs (PLAN.md §28, protocol 9): what an event MAKES and gives
+  // back — a zone, crates, NPCs — and the budgets that price them, each declared
+  // beside the verb that spends it (D79, D89). A lease spends none of them.
+  api.registerEventBudgets(eventWorld.BUDGETS)
+  api.registerEventActions(eventWorld.ACTIONS)
+
+  // ONE call for every option source: core takes a batch once, as this module's
+  // complete statement, and refuses a second.
+  api.registerEventOptionSources([...eventLeases.OPTION_SOURCES, ...eventWorld.OPTION_SOURCES])
+
+  // Everything else this module will register — the rewards and the announce
+  // leg (13b), the slash commands — is deliberately absent. Each arrives
   // with the phase that has something real to put in it. A registration
   // with nothing behind it is worse than a missing one: a declared trigger
   // nothing emits and a declared slot nothing fills are both surfaces an operator
@@ -175,6 +183,8 @@ module.exports = function register(ctx, api) {
     streams: STREAMS.length,
     audiences: AUDIENCES.length,
     leases: eventLeases.LEASES.length,
-    optionSources: eventLeases.OPTION_SOURCES.length,
+    actions: eventWorld.ACTIONS.length,
+    budgets: eventWorld.BUDGETS.length,
+    optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length,
   })
 }