ci(rust): pin frozen-manifest to website#209 while coreApi is ^1.11.0

The job cloned a MODULE_API 1.10.0 main and the loader refused the module
("needs core API ^1.11.0, this core is 1.10.0"), so it added no routes and
failed by construction. Pinned to #209's head (cc1f49a), where the job's own
steps pass: core alone 280 routes up to date, with this module 49 routes all
documented. Re-pin to #209's main merge sha once it lands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/pr-checks.yml

@@ -130,6 +130,9 @@ jobs:
       - name: Check the OpenAPI fragment is current (MODULE_API.md §2.8)
         run: npm run check:swagger --prefix server
 
+      - name: Check the engagement freeze is current (PLAN.md §25)
+        run: npm run check:engagement --prefix server
+
   client-build:
     runs-on: ubuntu-latest
     timeout-minutes: 20

.gitea/workflows/release.yml

@@ -336,10 +336,13 @@ jobs:
             cp -r "server/$d" "$OUT/server/"
           done
 
-          # The client half is the BUILT chunk only. `client/src` is source an
-          # operator has no use for and core will never read.
+          # The client half is the BUILT chunks only. `client/src` is source an
+          # operator has no use for and core will never read. Every `.js`, not
+          # `entry.js` by name: since D120 the Map tab imports Leaflet's split
+          # chunk from beside it, and a release that shipped the entry alone
+          # would load everywhere and spin for ever on that tab.
           mkdir -p "$OUT/client/dist"
-          cp client/dist/entry.js "$OUT/client/dist/"
+          cp client/dist/*.js "$OUT/client/dist/"
 
           # Prove the bundle is loadable before it is published: these are the
           # paths core's loader resolves out of module.json, and a release whose

README.md

@@ -38,14 +38,29 @@ rows here; the website core never learns there is more than one.
 | Public | `GET /api/v1/public/rust/servers` — every server and what it last reported |
 | Public | `GET …/servers/:id` — one server, or a `404`; the only route under `:id` that can say a server does not exist |
 | Public | `GET …/servers/:id/events` — the feed, served from a default-deny allowlist (`server/catalogue.js`) |
-| Public | `GET …/servers/:id/leaderboard` — per wipe, or all-time as those rows summed |
+| Public | `GET …/servers/:id/leaderboard` — per wipe, or all-time as those rows summed; each row carries the player's chat titles |
 | Public | `GET …/servers/:id/wipes` and `…/online` |
+| Public | `GET …/servers/:id/clans` — the server's clans, best score first (public: names nobody) |
+| Public | `GET /api/v1/public/rust/clans/:externalId` — one clan, and its roster inside the roster audience |
 | Player | `GET /api/v1/player/rust/servers` — the server list, on the authenticated tier |
-| Admin | `GET/PUT/DELETE /api/v1/admin/rust/servers` and `POST …/:id/test` |
+| Admin | `GET/PUT/DELETE /api/v1/admin/rust/servers` and `POST …/:id/test` — the `PUT` carries the wipe schedule |
+| Admin | `GET/PUT /api/v1/admin/rust/visibility` — who may see who is online, fleet-wide and per server |
+| Admin | `PUT …/servers/:id/titles`, `GET …/servers/:id/integrations`, `GET/PUT /api/v1/admin/rust/voice` — chat titles, the optional mods a server has, and the announcement voice |
 | Pages | `/rust` — the server list, and the module's landing page |
-| Pages | `/rust/servers/:id` — one server: feed, leaderboard, who is on, wipes |
+| Pages | `/rust/servers/:id` — one server: feed, leaderboard, who is on, wipes, clans |
+| Pages | `/rust/clans/:externalId` — one clan, with core's Team notify, activity and forum in three module slots |
+| Pages | `/admin/rust/servers` — add, edit, test and remove servers, set each one's wipe schedule and chat titles, and choose the announcement voice |
+| Discord | `/status`, `/wipe`, `/top`, `/online`, `/clan` — read-only, answered from this module's tables |
+| Teams | The deployment's Team provider: a first-party Rust clan is a Team |
 | Slot | `site.footer.status` — a live server/player count in core's footer |
 
+**Nothing names who is online by default.** The Online list, every feed item that says a named
+player was on the server (connects, respawns, deaths, chat, gather tallies) and the leaderboard's
+"last seen" reach **staff** unless an operator widens them in Admin → Rust visibility — fleet-wide,
+with an optional override per server. How many players are online is public at every setting. The
+viewer's standing is re-read from the database on each request, so a demotion or a ban applies at
+once rather than when a token expires.
+
 Every page reads this module's own tables and never calls a game server, which is what lets the
 whole surface render while every server in the fleet is off. Tab, feed filter, wipe and leaderboard
 sort all live in the URL, so any view of it is a link.
@@ -54,11 +69,67 @@ Seven tables: `rust_servers` (configuration), `rust_server_state` and `rust_pres
 state), `rust_wipes`, `rust_players`, `rust_player_wipe_stats` and `rust_gather_totals` (the record a
 wipe does not erase), plus the bounded `rust_events` window and the `rust_ingest_cursor`.
 
-The rest of the module — identity, site-owned permissions, Teams from Rust's clans, notifications,
-events, the live map, Discord commands — arrives phase by phase. **Nothing is registered before it
+**Teams come from Rust's own clans**, not from the uMod Clans plugin, which is optional and whose
+clans never become Teams. A clan's roster reaches its own members and staff unless an operator
+widens it in Admin → Rust visibility; its name, colour, score and count are public. The game lists
+at most 100 clans per server, and a server at that ceiling answers core partially, so core never
+removes a Team on its word. Core holds one Team provider per site, which is one reason **a site runs
+one module**: core's installer refuses a second.
+
+**The next wipe is the operator's to state** (Admin → Rust servers): a rule — the monthly forced
+wipe only, weekly or every other week, each in the server's own time zone and always including the
+forced wipe (first Thursday, 19:00 UK time) — plus an optional one-off date that replaces the next
+computed wipe. It is computed on every read and never stored, so it cannot go stale after a wipe.
+The server list, the server page, the Android app and `/wipe` all show it.
+
+**Two uMod plugins are optional, and the module works without either** (`docs/modules/rust/PLAN.md`
+§33). The bridge plugin's hard requirements are **Kits** and **ZoneManager**.
+
+- **BetterChat** (LaserHydra, 5.2.15). With it: **chat titles** an operator sets per server — "top 3
+  playtime", "#1 kills" on the current wipe — shown in game chat and beside the name on the web and
+  app leaderboards; and a **chat style** on any permission group this site authors, all twelve of
+  BetterChat's group fields, mirrored like the group's permissions (a field changed in game is
+  reported, never overwritten). Without it the titles still show on the web and the app, and the
+  styles wait until it is installed.
+- **PopupNotifications** (k1lly0u, 0.2.1). With it: `rust.announce` and a server's news posts can be
+  a popup instead of a chat line. Without it a popup is refused with a sentence saying so, and chat
+  works as before.
+
+News and event lines said in chat can wear one styled group's title and colours — the
+**announcement voice**, chosen in Admin → Rust servers. The line is said by the bridge plugin with no
+player as its sender, so it looks the same with or without BetterChat.
+
+**The Discord commands answer from the tables, never from a game server**, inside core's three-second
+budget. Every refusal is private. **An answer narrower than public goes to the caller alone:** a
+moderator's `/online` in a public channel shows the names to the moderator, never to the channel, and
+the same for a clan roster. Everything else is posted where it was asked.
+
+The rest of the module arrives phase by phase. **Nothing is registered before it
 has something behind it:** a declared trigger nothing emits and a declared slot nothing fills are
 both surfaces an operator can configure and then wait on, which is worse than an absent one.
 
+### What a client feature-detects on
+
+`module.json` declares six capability strings, and `GET /api/v1/public/modules` hands them to any
+client that asks — the website's own nav, and the Android app (`docs/modules/rust/PLAN.md` R10).
+Five of them name a surface: `servers`, `killfeed`, `leaderboard`, `presence`, `wipes`.
+
+The sixth is `rust`, and it names **the module itself**. It looks redundant beside `id`, and it is
+not, for two reasons worth writing down before somebody tidies it away:
+
+- **A client that asks "is this module installed" has nowhere else to ask.** Core flattens every
+  started module's capabilities into one list, so `servers` alone is a word another module could
+  declare tomorrow and silently reveal this one's screens. `rust` is the string that can only mean
+  this module, and it is the single gate a whole navigation group hangs on — exactly the job `shard`
+  does for `module-uo`.
+- **`id` answers a different question.** It is a *mount prefix* (§2.1 requires it to equal the
+  directory core loads the module from), and `MODULE_API.md` §2.9 is explicit that a client must
+  never infer a route from a capability. Gating on `id` would quietly make the two the same thing,
+  and the day a client builds `/<id>/servers` from it, the contract that lets this module move its
+  own pages is gone.
+
+An unknown capability is absent, and no route is ever derived from one.
+
 ## Build and check
 
 ```bash
@@ -140,8 +211,8 @@ directory; a symlink answers no and the module is skipped in complete silence.
 
 Either way, the module appears when the process restarts: the volume is read at require time.
 
-Then, in Admin → Rust, add a server: its name, the sidecar's base URL, and the token the sidecar
-printed on first start (`rust-link-sidecar --print-config`). **The token is write-only** — it is
+Then, in Admin → Rust servers, add a server: its name, the sidecar's base URL, and the token the
+sidecar printed on first start (`rust-link-sidecar --print-config`). **The token is write-only** — it is
 stored encrypted through core's own secret box and never returned to any client; the panel reports
 only whether one is set.
 

ci/bundle.json

@@ -29,16 +29,27 @@
   "server": [
     "boot.js",
     "catalogue.js",
+    "commands",
+    "configEdit.js",
     "core.js",
     "db",
+    "engagement",
+    "eventLeases.js",
+    "eventRewards.js",
+    "eventWorld.js",
     "index.js",
     "ingest.js",
+    "mapImages.js",
+    "mapLive.js",
     "model",
     "package.json",
+    "permSync.js",
     "router",
-    "sidecarClient.js"
+    "sidecarClient.js",
+    "titleSync.js"
   ],
   "root": [
+    "engagement-triggers.json",
     "swagger-fragment.json",
     "LICENSE.md",
     "README.md"

ci/core-ref.json

@@ -1,6 +1,6 @@
 {
-  "$comment": "The core this module is proved against. MODULE_API.md §5.3: the frozen-manifest job clones RunicGateway/website at this exact ref, drops this module in as modules/rust and runs CORE's own routeManifest.js — nothing else can answer whether the URLs the module claims are the URLs it actually serves, because a mount prefix is a string in server/index.js and a documented path is a string in a JSON file, and whether those name the same URL is a fact about a running core. It also answers the blind spot phase 1 had to check by hand: core mounts several routes at the TIER ROOT (/status, /version), which the loader's collision probe cannot see, so /rust being free is asserted here by a core rather than by a reading. Pinned rather than tracking a branch on purpose: core moves for reasons that have nothing to do with this module, and a bump is then a deliberate commit saying which core the module was last proved against, instead of an unexplained red X on someone else's PR. Bump it, regenerate routes.manifest.json, and commit both together. This module needs MODULE_API 1.10.0 (module.json's coreApi is ^1.10.0), which the Event System cutover put on `main` — so unlike Module-uo, which spent the Event System window pinned to `edge`, this repo starts pinned to `main` and should stay there unless it comes to depend on a contract member that has not shipped yet.",
+  "$comment": "The core this module is proved against. MODULE_API.md §5.3: the frozen-manifest job clones RunicGateway/website at this exact ref, drops this module in as modules/rust and runs CORE's own routeManifest.js — nothing else can answer whether the URLs the module claims are the URLs it actually serves, because a mount prefix is a string in server/index.js and a documented path is a string in a JSON file, and whether those name the same URL is a fact about a running core. It also answers the blind spot phase 1 had to check by hand: core mounts several routes at the TIER ROOT (/status, /version), which the loader's collision probe cannot see, so /rust being free is asserted here by a core rather than by a reading. Pinned rather than tracking a branch on purpose: core moves for reasons that have nothing to do with this module, and a bump is then a deliberate commit saying which core the module was last proved against, instead of an unexplained red X on someone else's PR. Bump it, regenerate routes.manifest.json, and commit both together. This module needs MODULE_API 1.10.0 (module.json's coreApi is ^1.10.0), which the Event System cutover put on `main` — so unlike Module-uo, which spent the Event System window pinned to `edge`, this repo starts pinned to `main` and should stay there unless it comes to depend on a contract member that has not shipped yet. **2026-09-27, protocol 13 step 2: pinned OFF main, to website#209's head** — the case the sentence above allows. This module now calls ctx.events.expired (MODULE_API 1.11.0, PLAN_FIXES D183), so coreApi is ^1.11.0 and the 1.10.0 main pin refuses to load it (\"needs core API ^1.11.0, this core is 1.10.0\") — red by construction, proving nothing. Move this back to the main sha #209 merges as.",
   "repo": "https://gitea.whitlocktech.com/RunicGateway/website.git",
-  "ref": "efa9db73304552dd8bb7a84030b258c6320f79f7",
-  "refName": "main @ MODULE_API 1.10.0, the Asset Bridge cutover 2 of 5 (website#202)"
+  "ref": "cc1f49af29f0c33a6562045806528b2a614d25de",
+  "refName": "feat/events-expired-status @ MODULE_API 1.11.0 (website#209, unmerged) — re-pin to its main merge sha"
 }

client/package-lock.json

@@ -10,6 +10,7 @@
       "license": "GPL-3.0-or-later",
       "devDependencies": {
         "@vitejs/plugin-react": "^4.3.2",
+        "leaflet": "1.9.4",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
         "react-router-dom": "^6.26.2",
@@ -1448,6 +1449,13 @@
         "node": ">=6"
       }
     },
+    "node_modules/leaflet": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/leaflet/-/leaflet-1.9.4.tgz",
+      "integrity": "sha512-nxS1ynzJOmOlHp+iL3FyWqK89GtNL8U8rvlMOsQdTTssxZwCXh8N2NB3GDQOL+YR3XnWyZAxwQixURb+FA74PA==",
+      "dev": true,
+      "license": "BSD-2-Clause"
+    },
     "node_modules/loose-envify": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",

client/package.json

@@ -16,6 +16,7 @@
   "//dependencies": "Deliberately none that ship. react, react-dom/client, react/jsx-runtime and react-router-dom are aliased to the shims in src/shim/ and arrive at runtime on window.__rg - there is exactly one React in the page and core owns it (MODULE_API.md 3.2, 3.6). They are devDependencies so that Vite and the JSX transform can resolve them during the build, and for no other reason.",
   "devDependencies": {
     "@vitejs/plugin-react": "^4.3.2",
+    "leaflet": "1.9.4",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^6.26.2",

client/scripts/checkExternals.js

@@ -82,9 +82,10 @@ export function stringMask(src) {
   return inString
 }
 
-// Static and dynamic imports that survived into the output. A relative or
-// absolute specifier is a chunk that was split, which this build does not do —
-// `lib` mode with one entry emits one file — so anything here is a bare name.
+// Static and dynamic imports that survived into the output. A relative
+// specifier is a chunk that was split — since D120 there is one, Leaflet's,
+// which the Map tab imports with `import()` — and is `relativeImports`'s
+// concern below; a bare name is this check's.
 //
 // **This pattern used to require whitespace after `import`, and so could not see
 // the one shape the build actually emits.** Minified Rollup output is
@@ -116,6 +117,28 @@ export function bareImports(chunk) {
   return [...bare]
 }
 
+/**
+ * Every relative specifier the chunk imports — its split chunks (D120).
+ *
+ * Each one is a file the browser will ask for beside `entry.js`, and core
+ * serves that directory, so it works in development. Whether it SHIPS is
+ * `release.yml`'s business, which is why the script below also asserts every
+ * one of them exists in `dist/`, and `test/build.test.js` asserts the release
+ * copies every `.js` in `dist/` rather than naming `entry.js`. A split chunk the
+ * release forgot is a Map tab that spins for ever on an operator's site while
+ * every check here passes.
+ */
+export function relativeImports(chunk) {
+  const masked = stringMask(chunk)
+  const found = new Set()
+  for (const match of chunk.matchAll(IMPORTS)) {
+    const keywordAt = match.index + (match[0].startsWith('import') ? 0 : 1)
+    if (masked[keywordAt]) continue
+    if (match[1].startsWith('./')) found.add(match[1].slice(2))
+  }
+  return [...found]
+}
+
 // Fingerprints from the shared libraries' own source. Each is a string those
 // packages ship and this module has no other reason to contain.
 //
@@ -161,12 +184,30 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     console.error(`No chunk at ${CHUNK} — run \`npm run build\` first.`)
     process.exit(1)
   }
-  const problems = problemsWith(fs.readFileSync(CHUNK, 'utf8'))
+  const dist = path.dirname(CHUNK)
+  const entry = fs.readFileSync(CHUNK, 'utf8')
+  const problems = []
+
+  // Every chunk, not only the entry: a split chunk that bundled a second React
+  // would load on the tab that imports it and fail there, and nowhere else.
+  for (const file of fs.readdirSync(dist).filter((f) => f.endsWith('.js'))) {
+    for (const p of problemsWith(fs.readFileSync(path.join(dist, file), 'utf8'))) problems.push(`${file}: ${p}`)
+  }
+  for (const name of relativeImports(entry)) {
+    if (!fs.existsSync(path.join(dist, name))) {
+      problems.push(`entry.js imports ./${name}, which is not in dist/ — the chunk would load and that import would fail`)
+    }
+  }
+
   if (problems.length) {
     console.error('\nThe built chunk breaks the shared-dependency rule:\n')
     for (const p of problems) console.error(`  - ${p}\n`)
     process.exit(1)
   }
   const kb = (fs.statSync(CHUNK).size / 1024).toFixed(1)
-  console.log(`OK — dist/entry.js (${kb} kB) has no bare imports and bundles no shared dependency.`)
+  const split = relativeImports(entry)
+  console.log(
+    `OK — dist/entry.js (${kb} kB) has no bare imports and bundles no shared dependency` +
+      (split.length ? `; its ${split.length} split chunk(s) (${split.join(', ')}) are present and clean.` : '.'),
+  )
 }

client/src/api.js

@@ -47,6 +47,26 @@ export const servers = {
   wipes: (id) => req(`/public/rust/servers/${encodeURIComponent(id)}/wipes`),
 
   online: (id) => req(`/public/rust/servers/${encodeURIComponent(id)}/online`),
+
+  // Phase 9. The clan list is public (D58): name, colour, score and member count
+  // name nobody. `board` says whether the list can be trusted right now.
+  clans: (id) => req(`/public/rust/servers/${encodeURIComponent(id)}/clans`),
+
+  // Phase 14. The map's picture address, geometry and which layers this viewer
+  // gets; then what moves on it, already cut down to this viewer on the server.
+  map: (id) => req(`/public/rust/servers/${encodeURIComponent(id)}/map`),
+  mapLive: (id) => req(`/public/rust/servers/${encodeURIComponent(id)}/map/live`),
+}
+
+// One clan. Its roster comes back only for a viewer inside the operator's roster
+// audience (D48) — clan members and staff by default — and `roster.visible`
+// says which answer this was, so a page can explain an empty roster rather than
+// imply an empty clan.
+//
+// The id carries colons (`<server>:<clan>:<created>`). They are legal in a path
+// segment, and encoded anyway so that a server slug is never read as structure.
+export const clans = {
+  get: (externalId) => req(`/public/rust/clans/${encodeURIComponent(externalId)}`),
 }
 
 /**
@@ -74,6 +94,27 @@ export const playerServers = {
   list: () => req('/player/rust/servers'),
 }
 
+// R1's identity link, from the signed-in player's side.
+//
+// **The code is the whole of what goes up.** The site has no idea which server
+// minted it — nothing in six characters says — so the server half asks each
+// configured server in turn (D24). A page that asked the player to pick would be
+// asking them a question the site can answer itself, and a wrong pick would come
+// back indistinguishable from a wrong code.
+export const playerLinks = {
+  list: () => req('/player/rust/links'),
+  confirm: (code) => req('/player/rust/link', { method: 'POST', body: { code } }),
+  remove: (steamId) =>
+    req(`/player/rust/links/${encodeURIComponent(steamId)}`, { method: 'DELETE' }),
+}
+
+// What the site has given the caller in game (phase 8). Read-only, and beside
+// `playerLinks` rather than under it: an entitlement exists whether or not an
+// account is linked yet, which is exactly the state worth showing.
+export const playerPermissions = {
+  list: () => req('/player/rust/permissions'),
+}
+
 // ── admin ─────────────────────────────────────────────────────────────────
 // **`sidecarToken` goes up and never comes back.** The list answers `hasToken`,
 // and a save that omits the field leaves the stored credential alone — so an
@@ -87,10 +128,153 @@ export const admin = {
     req(`/admin/rust/servers/${encodeURIComponent(id)}`, { method: 'DELETE' }),
   testServer: (id) =>
     req(`/admin/rust/servers/${encodeURIComponent(id)}/test`, { method: 'POST' }),
+  // Phase 14: fetch a server's map picture again, or ask a server with no
+  // picture to draw one — which stalls that game for seconds (D109).
+  fetchMap: (id) => req(`/admin/rust/servers/${encodeURIComponent(id)}/map/fetch`, { method: 'POST' }),
+  renderMap: (id) => req(`/admin/rust/servers/${encodeURIComponent(id)}/map/render`, { method: 'POST' }),
+  // Phase 17: a server's chat titles, what optional mods it has, and the voice.
+  saveTitles: (id, body) => req(`/admin/rust/servers/${encodeURIComponent(id)}/titles`, { method: 'PUT', body }),
+  integrations: (id) => req(`/admin/rust/servers/${encodeURIComponent(id)}/integrations`),
+  voice: () => req('/admin/rust/voice'),
+  saveVoice: (group) => req('/admin/rust/voice', { method: 'PUT', body: { group } }),
+}
+
+// ── admin · permissions (R2) ──────────────────────────────────────────────
+//
+// The authoring surface. Every call here writes to the SITE, and none of them
+// reaches a game server — the mirror's own loop does that on its own cadence.
+// `sync` is the exception and says so in its name: it runs the pass now and
+// answers with what each server reported, which is the only call on this screen
+// that can be slow or fail because a game host is down.
+//
+// A write is followed by a re-read rather than a local edit of the model: what
+// the screen is showing is partly the game's answer, and the honest way to learn
+// the new one is to ask.
+export const adminPermissions = {
+  overview: () => req('/admin/rust/permissions'),
+  catalogue: () => req('/admin/rust/permissions/catalogue'),
+
+  saveGroup: (name, body) =>
+    req(`/admin/rust/permissions/groups/${encodeURIComponent(name)}`, { method: 'PUT', body }),
+  deleteGroup: (name) =>
+    req(`/admin/rust/permissions/groups/${encodeURIComponent(name)}`, { method: 'DELETE' }),
+
+  addMember: (name, username) =>
+    req(`/admin/rust/permissions/groups/${encodeURIComponent(name)}/members`, {
+      method: 'POST',
+      body: { username },
+    }),
+  removeMember: (name, userId) =>
+    req(
+      `/admin/rust/permissions/groups/${encodeURIComponent(name)}/members/${encodeURIComponent(userId)}`,
+      { method: 'DELETE' },
+    ),
+
+  grant: (body) => req('/admin/rust/permissions/grants', { method: 'POST', body }),
+  revoke: (id) =>
+    req(`/admin/rust/permissions/grants/${encodeURIComponent(id)}`, { method: 'DELETE' }),
+
+  adoptDrift: (id) =>
+    req(`/admin/rust/permissions/drift/${encodeURIComponent(id)}/adopt`, { method: 'POST' }),
+  revokeDrift: (id) =>
+    req(`/admin/rust/permissions/drift/${encodeURIComponent(id)}/revoke`, { method: 'POST' }),
+
+  sync: (serverId = null) =>
+    req('/admin/rust/permissions/sync', { method: 'POST', body: serverId ? { serverId } : {} }),
+}
+
+// ── admin · visibility ────────────────────────────────────────────────────
+//
+// Who may see who is online. The org lead's rule is that nothing names who is
+// online by default; this is where an operator deliberately widens it. A save
+// answers the whole new state, so the screen re-renders from the server's word
+// rather than from what it sent.
+export const adminVisibility = {
+  read: () => req('/admin/rust/visibility'),
+  save: (body) => req('/admin/rust/visibility', { method: 'PUT', body }),
+}
+
+// ── admin · mod configuration (R18) ───────────────────────────────────────
+//
+// Every call here is a LIVE round trip to a game host, which makes this the only
+// section of this file where a call can be slow, or fail because a server is
+// off. Nothing is cached anywhere between the browser and the host's disk: a
+// cached config is an edit an operator made over SSH that this website then
+// silently overwrote.
+//
+// `save` carries a `version` the host issued with the file. Send a stale one and
+// the answer is a 409 with the current file attached, rather than an overwrite
+// of whatever somebody else changed in the meantime.
+export const adminConfig = {
+  files: (serverId) => req(`/admin/rust/config/${encodeURIComponent(serverId)}/files`),
+
+  file: (serverId, path) =>
+    req(`/admin/rust/config/${encodeURIComponent(serverId)}/file${query({ path })}`),
+
+  // Two tiers, one route. `edits` is the generated form — pointers and literals,
+  // type-preserving — and `text` is the raw document. A number travels as TEXT
+  // in both: `1.0` parsed into a JavaScript number and sent back as `1` is the
+  // whole failure this feature was designed around.
+  save: (serverId, body) =>
+    req(`/admin/rust/config/${encodeURIComponent(serverId)}/file`, { method: 'POST', body }),
+
+  writes: (serverId, limit = null) =>
+    req(`/admin/rust/config/${encodeURIComponent(serverId)}/writes${query({ limit })}`),
+
+  // One write, polled while its reload settles (protocol 13). A save that
+  // reloads a plugin answers before the reload has finished — behind a cold
+  // compile that can be many seconds — and this is where the outcome lands.
+  write: (serverId, id) =>
+    req(`/admin/rust/config/${encodeURIComponent(serverId)}/writes/${encodeURIComponent(id)}`),
+}
+
+// ── the admin.users.detail extension slot ─────────────────────────────────
+//
+// The client half of R13's first slot. Core hands the component a `userId` and
+// NOTHING else — not a client — so an extension builds its own bindings for the
+// routes it registered at the other end (§3.5). These two are the only calls in
+// this file whose path is core's rather than this module's: the resource is
+// core's user, and the module's own segment is the part after it.
+export const adminUserLinks = {
+  list: (userId) => req(`/admin/users/${encodeURIComponent(userId)}/rust/links`),
+  remove: (userId, steamId) =>
+    req(`/admin/users/${encodeURIComponent(userId)}/rust/links/${encodeURIComponent(steamId)}`, {
+      method: 'DELETE',
+    }),
+}
+
+// The same panel's phase 7 half: what this person may do in game. The id in the
+// path is the one the slot handed the component, so these send `userId` rather
+// than a name — the screen already knows who it is looking at.
+export const adminUserPermissions = {
+  list: (userId) => req(`/admin/users/${encodeURIComponent(userId)}/rust/permissions`),
+  grant: (userId, body) =>
+    req(`/admin/users/${encodeURIComponent(userId)}/rust/permissions/grants`, {
+      method: 'POST',
+      body,
+    }),
+  revoke: (userId, grantId) =>
+    req(
+      `/admin/users/${encodeURIComponent(userId)}/rust/permissions/grants/${encodeURIComponent(grantId)}`,
+      { method: 'DELETE' },
+    ),
 }
 
 // Exported for the rare caller that needs the base itself — an `<img src>`, a
 // download link, an EventSource. Reach for `request` first.
 export { BASE, query }
 
-export default { servers, playerServers, admin, BASE }
+export default {
+  servers,
+  clans,
+  playerServers,
+  playerLinks,
+  playerPermissions,
+  admin,
+  adminPermissions,
+  adminConfig,
+  adminVisibility,
+  adminUserLinks,
+  adminUserPermissions,
+  BASE,
+}

client/src/components/Clans.jsx

@@ -0,0 +1,118 @@
+// ── The clans on one server ───────────────────────────────────────────────
+//
+// Rust's OWN clans (R5), best score first. Public at every setting (D58): a
+// clan's name, colour, score and member count name nobody. Who is IN a clan is
+// the roster, and that lives on the clan's own page behind the operator's
+// roster audience (D48).
+//
+// **The list is only as good as the board it came from**, and the answer says
+// how good that is. Three cases would all look like an empty list if rendered
+// bare, and they are three different sentences:
+//
+//   • the bridge cannot read this server's clans at all (an older plugin, or a
+//     Nexus server whose clans live elsewhere) — "unavailable";
+//   • the game's clan system is switched off — "this server has no clans";
+//   • it can, and there are none — "nobody has founded one yet".
+//
+// And a board at the game's 100-clan ceiling (D55) says there may be more.
+
+import { Link } from 'react-router-dom'
+import { ErrorState, Loading, useAsync } from '../core.js'
+import Empty from './Empty.jsx'
+import { count } from '../lib/format.js'
+import api from '../api.js'
+
+export default function Clans({ serverId }) {
+  const { data, loading, error } = useAsync(() => api.servers.clans(serverId), [serverId])
+
+  if (loading) return <Loading />
+  if (error) return <ErrorState error={error} />
+
+  const clans = (data && data.clans) || []
+  const board = (data && data.board) || {}
+
+  if (clans.length === 0) {
+    if (!board.supported) {
+      return (
+        <Empty
+          title="Clans are unavailable for this server"
+          message={board.reason ? `${capitalise(board.reason)}.` : 'The bridge has not reported this server’s clans yet.'}
+        />
+      )
+    }
+    if (board.enabled === false) {
+      return <Empty title="This server has no clans" message="Its operator has switched the game’s clan system off." />
+    }
+    return <Empty title="No clans yet" message="Nobody on this server has founded a clan." />
+  }
+
+  return (
+    <>
+      {board.truncated && (
+        <p className="sans" style={{ color: 'var(--dim)', fontSize: '0.8rem', marginTop: 0 }}>
+          The game lists at most 100 clans, by score, so there may be more on this server than are shown here.
+        </p>
+      )}
+      <ul style={{ listStyle: 'none', margin: 0, padding: 0 }}>
+        {clans.map((clan, index) => (
+          <li
+            key={clan.externalId}
+            style={{
+              display: 'flex',
+              alignItems: 'baseline',
+              gap: 12,
+              padding: '10px 0',
+              borderBottom: '1px solid var(--line-soft, var(--line))',
+            }}
+          >
+            <span className="sans" style={{ color: 'var(--dim)', fontSize: '0.78rem', minWidth: 22, textAlign: 'right' }}>
+              {index + 1}
+            </span>
+            <Swatch color={clan.color} />
+            <Link to={clanPath(clan.externalId)} style={{ fontWeight: 600, flex: 1, minWidth: 0 }}>
+              {clan.name}
+            </Link>
+            <span className="sans" style={{ color: 'var(--dim)', fontSize: '0.8rem', whiteSpace: 'nowrap' }}>
+              {count(clan.memberCount)} {clan.memberCount === 1 ? 'member' : 'members'}
+            </span>
+            <span className="sans" style={{ fontSize: '0.8rem', whiteSpace: 'nowrap', minWidth: 70, textAlign: 'right' }}>
+              {count(clan.score)} pts
+            </span>
+          </li>
+        ))}
+      </ul>
+    </>
+  )
+}
+
+/** Where a clan's page is: the same template the Team provider hands core. */
+export function clanPath(externalId) {
+  return `/rust/clans/${encodeURIComponent(externalId)}`
+}
+
+/**
+ * A clan's colour, as a small square. The server has already checked it is a
+ * `#rrggbb` — it ends up in a style — and a clan with no colour gets an outline
+ * rather than a guess.
+ */
+export function Swatch({ color, size = 12 }) {
+  return (
+    <span
+      aria-hidden="true"
+      style={{
+        display: 'inline-block',
+        flex: 'none',
+        width: size,
+        height: size,
+        borderRadius: 3,
+        background: color || 'transparent',
+        border: color ? 'none' : '1px solid var(--line)',
+        alignSelf: 'center',
+      }}
+    />
+  )
+}
+
+function capitalise(text) {
+  return text ? text.charAt(0).toUpperCase() + text.slice(1) : text
+}

client/src/components/Empty.jsx

@@ -0,0 +1,26 @@
+// ── An empty state with a heading and a sentence ──────────────────────────
+//
+// Core's `EmptyState` renders its CHILDREN and nothing else. This module passed
+// it `title` and `message` from phase 4 onwards — the shape the Integration Kit's
+// template teaches — and React drops an unknown prop without a word, so every
+// empty panel in the module rendered as a blank box: "Nobody is on", "No scores
+// yet", "No servers yet", all of them. Found by the presence fix's browser walk,
+// when the "12 players online" it depended on came out as nothing.
+//
+// Fixed here rather than in core: core's component is shared by every module,
+// and a module-side wrapper changes nothing anybody else renders. The client
+// suite (`test/uiKitProps.test.js`) refuses a titled EmptyState so the mistake
+// cannot come back.
+
+import { EmptyState } from '../core.js'
+
+export default function Empty({ title, message }) {
+  return (
+    <EmptyState>
+      {title && (
+        <strong style={{ display: 'block', color: 'var(--head)', marginBottom: message ? 6 : 0 }}>{title}</strong>
+      )}
+      {message && <span>{message}</span>}
+    </EmptyState>
+  )
+}

client/src/components/Feed.jsx

@@ -11,11 +11,13 @@
 // see the comment at the top of that file for why core's `useAsync` cannot do
 // this job.
 
-import { EmptyState, ErrorState, Loading } from '../core.js'
+import { ErrorState, Loading } from '../core.js'
+import Empty from './Empty.jsx'
 import { describe, FILTERS, kindsFor } from '../lib/feed.js'
 import { ago, clock } from '../lib/format.js'
 import usePolled from '../hooks/usePolled.js'
 import api from '../api.js'
+import { hiddenMessage } from './Online.jsx'
 
 const TONE = {
   kill: 'var(--accent-bright)',
@@ -79,10 +81,24 @@ export default function Feed({ serverId, wipeId, filter, onFilter }) {
           off" must not blank itself the first time a request does. */}
       {error && !data && <ErrorState error={error} />}
 
+      {/* Below the operator's presence audience the server withholds every item
+          that names a player who was on — the killfeed, chat, joins — and keeps
+          only the server's own story. Said once, above the rows, so a thin feed
+          reads as withheld rather than as a quiet server. */}
+      {data && data.presenceHidden && (
+        <p className="sans" style={{ color: 'var(--dim)', fontSize: '0.8rem', marginTop: 0 }}>
+          Joins, deaths and chat are not shown. {hiddenMessage(data.presenceAudience, 'what players did')}
+        </p>
+      )}
+
       {data && events.length === 0 && (
-        <EmptyState
+        <Empty
           title="Nothing here yet"
-          message="Nothing this server has reported matches. A server that has just been added has no history until it says something."
+          message={
+            data.presenceHidden
+              ? 'Nothing this server has reported about itself matches.'
+              : 'Nothing this server has reported matches. A server that has just been added has no history until it says something.'
+          }
         />
       )}
 

client/src/components/Leaderboard.jsx

@@ -10,8 +10,9 @@
 // than one that is four minutes old, and the page has a `Refresh` on the tab
 // strip for anybody who disagrees.
 
-import { EmptyState, ErrorState, Loading, useAsync } from '../core.js'
-import { ago, count, duration, shortId } from '../lib/format.js'
+import { ErrorState, Loading, useAsync } from '../core.js'
+import Empty from './Empty.jsx'
+import { ago, contrastInk, count, duration, shortId } from '../lib/format.js'
 import api from '../api.js'
 
 // `sort` is the API's own vocabulary (`kills`, `deaths`, `npcKills`, `playtime`),
@@ -32,13 +33,15 @@ export default function Leaderboard({ serverId, wipeId, sort, onSort }) {
   )
 
   const rows = data ? data.leaderboard : []
+  // Present on every row or on none — the server decides per request.
+  const showLastSeen = rows.some((row) => 'lastSeen' in row)
 
   if (loading) return <Loading />
   if (error) return <ErrorState error={error} />
 
   if (rows.length === 0) {
     return (
-      <EmptyState
+      <Empty
         title="No scores yet"
         message={
           wipeId
@@ -80,7 +83,13 @@ export default function Leaderboard({ serverId, wipeId, sort, onSort }) {
                 )}
               </th>
             ))}
-            <th style={{ ...cell, textAlign: 'right', textTransform: 'uppercase' }}>Last seen</th>
+            {/* The server withholds `lastSeen` below the operator's presence
+                audience — a gather tally refreshes it every minute somebody plays,
+                so it would name who is online. The column goes with it rather
+                than rendering a row of dashes that look like "never". */}
+            {showLastSeen && (
+              <th style={{ ...cell, textAlign: 'right', textTransform: 'uppercase' }}>Last seen</th>
+            )}
           </tr>
         </thead>
         <tbody>
@@ -92,13 +101,35 @@ export default function Leaderboard({ serverId, wipeId, sort, onSort }) {
                     of their id rather than as a blank: the row is real, and a
                     nameless one reads as a rendering fault. */}
                 <strong style={{ color: 'var(--ink)' }}>{row.name || shortId(row.steamId)}</strong>
+                {/* The chat titles this player holds now (phase 17, D137) — the
+                    same ones the game shows, ranked on the current wipe whichever
+                    wipe this table is showing. Absent on an older module. */}
+                {(row.titles || []).map((title, i) => (
+                  <span
+                    key={`${title.text}-${i}`}
+                    className="sans"
+                    style={{
+                      marginLeft: 6,
+                      padding: '1px 6px',
+                      borderRadius: 999,
+                      fontSize: '0.7rem',
+                      fontWeight: 600,
+                      background: title.color,
+                      color: contrastInk(title.color),
+                    }}
+                  >
+                    {title.text}
+                  </span>
+                ))}
               </td>
               {COLUMNS.map((column) => (
                 <td key={column.key} style={{ ...cell, textAlign: 'right' }}>
                   {column.value(row)}
                 </td>
               ))}
-              <td style={{ ...cell, textAlign: 'right', color: 'var(--dim)' }}>{ago(row.lastSeen)}</td>
+              {showLastSeen && (
+                <td style={{ ...cell, textAlign: 'right', color: 'var(--dim)' }}>{ago(row.lastSeen)}</td>
+              )}
             </tr>
           ))}
         </tbody>

client/src/components/MapView.jsx

@@ -0,0 +1,358 @@
+// ── The live map ──────────────────────────────────────────────────────────
+//
+// R9's page, as PLAN.md §30.2 drew it: the picture of the current map under
+// four layers, each with its own switch, polled every ten seconds while the tab
+// is visible (D14) and not at all while it is hidden.
+//
+// **Nothing here decides who may see what.** The server sends only the layers
+// this viewer may see — a hidden one is absent from the answer, not present and
+// hidden — so the checkboxes below are a reader's convenience and never a
+// boundary. A layer the viewer cannot see is still LISTED, disabled, with who
+// can: "staff only" explains an empty map where silence would imply an empty
+// server (§23.3's shape).
+//
+// Leaflet arrives in a chunk of its own when this tab first mounts (D120, see
+// `lib/leaflet.js`). The page draws with circle and div markers only, so
+// Leaflet's image assets are never needed.
+
+import { useEffect, useMemo, useRef, useState } from 'react'
+import { ErrorState, Loading, useAsync } from '../core.js'
+import Empty from './Empty.jsx'
+import usePolled from '../hooks/usePolled.js'
+import { ago } from '../lib/format.js'
+import { boundsOf, countdown, grid, gridLabel, toLatLng } from '../lib/mapGeometry.js'
+import api, { BASE } from '../api.js'
+
+const STYLE_ID = 'rust-leaflet-css'
+
+/** The narrowest a grid cell may be on screen, in pixels, and still carry its label. */
+const LABEL_MIN_CELL_PX = 30
+
+/** The layers, in the order the legend lists them, with their marker colours. */
+const LAYERS = [
+  { id: 'world', label: 'Monuments & world events' },
+  { id: 'events', label: 'Site events' },
+  { id: 'players', label: 'Players' },
+  { id: 'bases', label: 'Bases' },
+]
+
+const COLOURS = {
+  monument: '#e8d9a8',
+  cargo: '#4fc3f7',
+  heli: '#ef5350',
+  chinook: '#ffa726',
+  bradley: '#a1887f',
+  supply: '#66bb6a',
+  crate: '#ffee58',
+  event: '#ce93d8',
+  online: '#ffffff',
+  sleeping: '#9e9e9e',
+  tc: '#ff7043',
+  vending: '#26a69a',
+  self: '#00e5ff',
+  mate: '#7cffb2',
+}
+
+const WORLD_NAMES = {
+  cargo: 'Cargo ship',
+  heli: 'Patrol helicopter',
+  chinook: 'Chinook',
+  bradley: 'Bradley APC',
+  supply: 'Supply drop',
+  crate: 'Locked crate',
+}
+
+const AUDIENCE_WORDS = { public: 'everyone', signed_in: 'signed-in players', staff: 'staff only' }
+
+export default function MapView({ serverId, online }) {
+  const { data: meta, loading, error } = useAsync(() => api.servers.map(serverId), [serverId])
+  const geometry = meta ? meta.geometry : null
+
+  const [leaflet, setLeaflet] = useState(null)
+  const [leafletError, setLeafletError] = useState(null)
+  const [shown, setShown] = useState({ grid: true, world: true, events: true, players: true, bases: true, mates: true })
+
+  useEffect(() => {
+    let alive = true
+    import('../lib/leaflet.js')
+      .then((mod) => {
+        if (!alive) return
+        if (typeof document !== 'undefined' && !document.getElementById(STYLE_ID)) {
+          const style = document.createElement('style')
+          style.id = STYLE_ID
+          style.textContent = mod.css
+          document.head.appendChild(style)
+        }
+        setLeaflet(mod)
+      })
+      .catch((err) => alive && setLeafletError(err))
+    return () => {
+      alive = false
+    }
+  }, [])
+
+  const anyLive = Boolean(meta && (LAYERS.some((l) => meta.layers[l.id].visible) || meta.mates.visible))
+  const live = usePolled(() => api.servers.mapLive(serverId), {
+    key: serverId,
+    intervalMs: (meta && meta.pollMs) || 10_000,
+    enabled: Boolean(geometry) && anyLive,
+  })
+
+  const container = useRef(null)
+  const mapRef = useRef(null)
+  const groups = useRef(null)
+
+  // The map itself: made once per server and geometry, torn down with them.
+  useEffect(() => {
+    if (!leaflet || !geometry || !container.current) return undefined
+    const { L } = leaflet
+    const bounds = boundsOf(geometry)
+    const map = L.map(container.current, {
+      crs: L.CRS.Simple,
+      minZoom: -4,
+      maxZoom: 2,
+      zoomSnap: 0.25,
+      attributionControl: false,
+      // Some things sail off the edge: the rig's cargo ship spent the probe
+      // outside the picture entirely. The view may follow them a little way.
+      maxBounds: L.latLngBounds(bounds).pad(0.5),
+    })
+    if (meta.picture) L.imageOverlay(`${BASE}${meta.picture.path}`, bounds).addTo(map)
+    map.fitBounds(bounds)
+
+    const made = {}
+    for (const id of ['grid', 'monuments', 'world', 'events', 'players', 'bases', 'mates']) made[id] = L.layerGroup().addTo(map)
+    // The labels are a layer of their own inside the grid's, shown only when a cell
+    // is wide enough on screen to hold one: at the fitted zoom a 20-cell map's
+    // labels overlap into a wall of text (found on the phase 14 walk).
+    const labels = L.layerGroup()
+    const cellPx = () => geometry.gridCellSize * ((geometry.width - 2 * geometry.oceanMargin) / geometry.worldSize) * 2 ** map.getZoom()
+    const fitLabels = () => {
+      const want = cellPx() >= LABEL_MIN_CELL_PX
+      if (want && !made.grid.hasLayer(labels)) made.grid.addLayer(labels)
+      if (!want && made.grid.hasLayer(labels)) made.grid.removeLayer(labels)
+    }
+    map.on('zoomend', fitLabels)
+
+    const g = grid(geometry)
+    for (const [[x1, z1], [x2, z2]] of g.lines) {
+      L.polyline([toLatLng(geometry, x1, z1), toLatLng(geometry, x2, z2)], {
+        color: '#ffffff',
+        weight: 1,
+        opacity: 0.18,
+        interactive: false,
+      }).addTo(made.grid)
+    }
+    for (const label of g.labels) {
+      L.marker(toLatLng(geometry, label.x, label.z), {
+        interactive: false,
+        keyboard: false,
+        icon: L.divIcon({
+          className: '',
+          html: `<span style="font:600 10px/1 system-ui,sans-serif;color:rgba(255,255,255,.55);padding:2px 3px;display:block;white-space:nowrap">${label.text}</span>`,
+          iconSize: null,
+          iconAnchor: [0, 0],
+        }),
+      }).addTo(labels)
+    }
+    fitLabels()
+
+    for (const m of meta.monuments || []) {
+      L.circleMarker(toLatLng(geometry, m.x, m.z), {
+        radius: 4,
+        color: '#000',
+        weight: 1,
+        fillColor: COLOURS.monument,
+        fillOpacity: 0.9,
+      })
+        .bindTooltip(`${escape(m.label)} · ${escape(m.grid || gridLabel(geometry, m.x, m.z) || '')}`)
+        .addTo(made.monuments)
+    }
+
+    mapRef.current = map
+    groups.current = made
+    return () => {
+      map.remove()
+      mapRef.current = null
+      groups.current = null
+    }
+    // `meta` is replaced only when the server changes, with the geometry.
+  }, [leaflet, geometry]) // eslint-disable-line react-hooks/exhaustive-deps
+
+  // What moves: every group cleared and redrawn from the latest answer. The
+  // counts are small — a busy server is a few hundred markers — and a redraw is
+  // simpler to get right than a diff.
+  useEffect(() => {
+    const made = groups.current
+    if (!leaflet || !made || !geometry) return
+    const { L } = leaflet
+    const answer = live.data || {}
+    const at = (p) => toLatLng(geometry, p.x, p.z)
+    for (const id of ['world', 'events', 'players', 'bases', 'mates']) made[id].clearLayers()
+
+    for (const w of answer.world || []) {
+      let tip = WORLD_NAMES[w.kind] || w.kind
+      if (w.kind === 'crate' && w.hackLeftSec != null) tip += ` — ${countdown(w.hackLeftSec)} left on the hack`
+      if (w.kind === 'crate' && w.hacked) tip += ' — hacked'
+      dot(L, at(w), COLOURS[w.kind] || COLOURS.crate, w.kind === 'cargo' ? 7 : 5).bindTooltip(escape(tip)).addTo(made.world)
+    }
+
+    const px = (metres) => metres * ((geometry.width - 2 * geometry.oceanMargin) / geometry.worldSize)
+    for (const e of answer.events || []) {
+      if (e.kind === 'zone') {
+        L.circle(at(e), { radius: px(Number(e.radius) || 0), color: COLOURS.event, weight: 2, fillOpacity: 0.12 })
+          .bindTooltip(escape(e.name ? `Event zone · ${e.name}` : 'Event zone'))
+          .addTo(made.events)
+      } else {
+        dot(L, at(e), COLOURS.event, 5).bindTooltip(e.kind === 'npc' ? 'Event NPC' : 'Event crate').addTo(made.events)
+      }
+    }
+
+    for (const p of answer.players || []) {
+      dot(L, at(p), p.online ? COLOURS.online : COLOURS.sleeping, p.online ? 5 : 4)
+        .bindTooltip(escape(`${p.name || p.steamId}${p.online ? (p.sleeping ? ' · sleeping' : '') : ' · asleep, offline'}`))
+        .addTo(made.players)
+    }
+
+    for (const b of answer.bases || []) {
+      dot(L, at(b), COLOURS[b.kind] || COLOURS.tc, 4).bindTooltip(b.kind === 'tc' ? 'Tool cupboard' : 'Vending machine').addTo(made.bases)
+    }
+
+    for (const m of answer.mates || []) {
+      dot(L, at(m), m.self ? COLOURS.self : COLOURS.mate, m.self ? 8 : 6, 2)
+        .bindTooltip(escape(m.self ? `You${m.online ? '' : ' (asleep, offline)'}` : m.name || 'Clan mate'))
+        .addTo(made.mates)
+    }
+  }, [leaflet, geometry, live.data])
+
+  // The legend's checkboxes: a group is on the map or off it.
+  useEffect(() => {
+    const map = mapRef.current
+    const made = groups.current
+    if (!map || !made) return
+    const want = { grid: shown.grid, monuments: shown.world, world: shown.world, events: shown.events, players: shown.players, bases: shown.bases, mates: shown.mates }
+    for (const [id, on] of Object.entries(want)) {
+      if (on && !map.hasLayer(made[id])) made[id].addTo(map)
+      if (!on && map.hasLayer(made[id])) map.removeLayer(made[id])
+    }
+  }, [shown, leaflet, geometry])
+
+  const status = useMemo(() => liveStatus(live, anyLive, online), [live, anyLive, online])
+
+  if (loading) return <Loading />
+  if (error) return <ErrorState error={error} />
+  if (!geometry) {
+    return (
+      <Empty
+        title="No map yet"
+        message="This server has not described its map to the site yet. It will appear once the server is up and has said which map it is on."
+      />
+    )
+  }
+  if (leafletError) return <ErrorState error={leafletError} />
+
+  return (
+    <div className="sans">
+      {!meta.picture && (
+        <p style={{ color: 'var(--dim)', fontSize: '0.8rem', marginTop: 0 }}>
+          This server has no picture of its map, so the layers are drawn on a plain background.
+        </p>
+      )}
+      <div style={{ position: 'relative', zIndex: 0 }}>
+        <div
+          ref={container}
+          role="application"
+          aria-label="Map of the server"
+          style={{
+            height: 'min(70vh, 760px)',
+            minHeight: 320,
+            borderRadius: 8,
+            border: '1px solid var(--line)',
+            background: geometry.background || '#0b3b4a',
+          }}
+        />
+        {!leaflet && (
+          <div style={{ position: 'absolute', inset: 0, display: 'grid', placeItems: 'center' }}>
+            <Loading />
+          </div>
+        )}
+      </div>
+
+      <p style={{ color: 'var(--dim)', fontSize: '0.78rem', margin: '8px 0 16px' }}>{status}</p>
+
+      <Legend meta={meta} live={live.data} shown={shown} onToggle={(id) => setShown((s) => ({ ...s, [id]: !s[id] }))} />
+    </div>
+  )
+}
+
+function Legend({ meta, live, shown, onToggle }) {
+  const row = (id, label, swatches, visible, note) => (
+    <li key={id} style={{ display: 'flex', alignItems: 'baseline', gap: 10, padding: '6px 0', borderBottom: '1px solid var(--line-soft, var(--line))' }}>
+      <label style={{ display: 'flex', alignItems: 'center', gap: 8, cursor: visible ? 'pointer' : 'default', color: visible ? 'var(--ink)' : 'var(--dim)' }}>
+        <input type="checkbox" checked={visible && shown[id]} disabled={!visible} onChange={() => onToggle(id)} />
+        {label}
+      </label>
+      <span style={{ display: 'inline-flex', gap: 4 }}>
+        {swatches.map((c) => (
+          <span key={c} aria-hidden="true" style={{ width: 10, height: 10, borderRadius: '50%', background: c, display: 'inline-block', border: '1px solid rgba(0,0,0,.4)' }} />
+        ))}
+      </span>
+      {note && <span style={{ color: 'var(--dim)', fontSize: '0.76rem', marginLeft: 'auto', textAlign: 'right' }}>{note}</span>}
+    </li>
+  )
+
+  const hiddenNote = (layer) => {
+    const words = AUDIENCE_WORDS[layer.audience] || AUDIENCE_WORDS.staff
+    if (layer.audience === 'signed_in') return 'Sign in to see this layer.'
+    return `Shown to ${words}.`
+  }
+
+  const swatches = {
+    world: [COLOURS.monument, COLOURS.cargo, COLOURS.heli, COLOURS.crate],
+    events: [COLOURS.event],
+    players: [COLOURS.online, COLOURS.sleeping],
+    bases: [COLOURS.tc, COLOURS.vending],
+  }
+
+  return (
+    <ul style={{ listStyle: 'none', margin: 0, padding: 0, fontSize: '0.86rem' }}>
+      {row('grid', 'Grid', [], true, null)}
+      {LAYERS.map((l) => {
+        const layer = meta.layers[l.id]
+        let note = layer.visible ? null : hiddenNote(layer)
+        if (l.id === 'players' && layer.cappedByPresence && !layer.visible) {
+          note = `${note} Limited by who may see who is online.`
+        }
+        if (layer.visible && l.id === 'players' && live && live.playersTruncated) note = 'Not every sleeper is shown.'
+        if (layer.visible && l.id === 'bases' && live && live.basesTruncated) note = 'Not every base is shown.'
+        return row(l.id, l.label, swatches[l.id], layer.visible, note)
+      })}
+      {meta.mates.visible &&
+        row('mates', 'You and your clan', [COLOURS.self, COLOURS.mate], true, 'Your own position, and clan mates who are online.')}
+      {!meta.mates.visible && meta.mates.on && meta.mates.signedIn && !meta.mates.linked &&
+        row('mates', 'You and your clan', [COLOURS.self, COLOURS.mate], false, 'Link your Steam account to see yourself and your clan here.')}
+    </ul>
+  )
+}
+
+function dot(L, latlng, colour, radius, weight = 1) {
+  return L.circleMarker(latlng, { radius, color: '#000', weight, fillColor: colour, fillOpacity: 0.95 })
+}
+
+/** Tooltips are HTML in Leaflet, and a player's name is text they typed. */
+function escape(text) {
+  return String(text).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+}
+
+function liveStatus(live, anyLive, online) {
+  if (!anyLive) return 'No moving layers are shown to you on this server.'
+  if (live.loading) return 'Asking the server where things are…'
+  const data = live.data
+  if (data && data.live === false) {
+    return online
+      ? 'The server did not say where things are just now; it is asked again every ten seconds.'
+      : 'The server is offline, so nothing is moving on its map.'
+  }
+  if (live.error && !data) return 'Positions could not be loaded.'
+  return live.at ? `Positions as of ${ago(new Date(live.at).toISOString())}, refreshed every ten seconds while this tab is open.` : ''
+}

client/src/components/Online.jsx

@@ -9,7 +9,8 @@
 // It polls with the feed, because "who is on" is the one thing on this page that
 // is a live question.
 
-import { EmptyState, ErrorState, Loading } from '../core.js'
+import { ErrorState, Loading } from '../core.js'
+import Empty from './Empty.jsx'
 import { duration, shortId } from '../lib/format.js'
 import usePolled from '../hooks/usePolled.js'
 import api from '../api.js'
@@ -25,9 +26,23 @@ export default function Online({ serverId, online }) {
   if (loading) return <Loading />
   if (error && !data) return <ErrorState error={error} />
 
+  // Nothing names who is online by default (the org lead's rule). Below the
+  // operator's audience the server answers a count and no names, and the page
+  // says so — an empty list here would read as "nobody is on", which is a
+  // different claim and a false one.
+  if (data && data.hidden) {
+    const count = Number(data.count) || 0
+    return (
+      <Empty
+        title={online ? `${count.toLocaleString()} ${count === 1 ? 'player' : 'players'} online` : 'The server is offline'}
+        message={hiddenMessage(data.audience)}
+      />
+    )
+  }
+
   if (players.length === 0) {
     return (
-      <EmptyState
+      <Empty
         title={online ? 'Nobody is on' : 'The server is offline'}
         message={
           online
@@ -92,3 +107,16 @@ function sessionSoFar(connectedAt) {
   if (Number.isNaN(since)) return ''
   return duration((Date.now() - since) / 1000)
 }
+
+/**
+ * Why something was withheld, in words a visitor can act on.
+ *
+ * `what` completes the sentence — "who they are", "what players did". The
+ * audience is the operator's (`staff` unless widened), and only `signed_in` is
+ * something a visitor can do anything about.
+ */
+export function hiddenMessage(audience, what = 'who they are') {
+  if (audience === 'signed_in') return `Sign in to see ${what}.`
+  if (audience === 'public') return `This site is not showing ${what} right now.`
+  return `Only this site’s staff can see ${what}.`
+}

client/src/components/Wipes.jsx

@@ -11,7 +11,8 @@
 // id the events and the leaderboard filter by. There is no second derivation
 // anywhere that could disagree.
 
-import { EmptyState, ErrorState, Loading, useAsync } from '../core.js'
+import { ErrorState, Loading, useAsync } from '../core.js'
+import Empty from './Empty.jsx'
 import { ago, day } from '../lib/format.js'
 import api from '../api.js'
 
@@ -24,7 +25,7 @@ export default function Wipes({ serverId, currentWipeId, selected, onSelect }) {
 
   if (wipes.length === 0) {
     return (
-      <EmptyState
+      <Empty
         title="No wipes recorded"
         message="A wipe appears here once this server has reported something during it."
       />

client/src/entry.jsx

@@ -20,7 +20,15 @@ import { registry, coreApiVersion } from './core.js'
 
 import Servers from './routes/public/Servers.jsx'
 import ServerDetail from './routes/public/ServerDetail.jsx'
+import Clan from './routes/public/Clan.jsx'
+import Account from './routes/player/Account.jsx'
+import Permissions from './routes/admin/Permissions.jsx'
+import ModConfig from './routes/admin/ModConfig.jsx'
+import Visibility from './routes/admin/Visibility.jsx'
+import ServerSettings from './routes/admin/ServerSettings.jsx'
+import UserRustSections from './routes/admin/UserRustSections.jsx'
 import FooterStatus from './components/FooterStatus.jsx'
+import { IconEye, IconKey, IconLink, IconServer, IconSliders } from './icons.jsx'
 
 // The module id, exactly as `module.json` spells it. Core keys the registry by it
 // and prefixes every route path with it.
@@ -54,10 +62,53 @@ const ID = 'rust'
 //
 // React Router ranks a static segment above a dynamic one, so `/rust` wins
 // against core's `/:slug` CMS route without depending on registration order.
+//
+// The player route is registered with an empty path for the same reason the
+// public list is: `/player/rust` is the whole of what this module asks a player
+// to do, and a landing page above one page is a page nobody wants. Core applies
+// its own portal chrome and its own auth gate to the tier, so the component
+// renders no layout and re-implements no check.
+//
+// **The admin route arrives in phase 7 and is this module's first.** Everything
+// before it was configured through the API — the server rows still are — because
+// nothing until now had to be AUTHORED. A permission model is different in kind:
+// it is a thing an operator composes and keeps looking at, and there is no
+// version of "grant somebody VIP" that belongs in a terminal.
+//
+// It is registered with an empty path, so it lands at `/admin/rust`, and core
+// applies the admin tier's own gate. The routes underneath it are stricter than
+// that gate (`requireRole('admin')` on every one), which is a server-side answer
+// rather than a client one: a moderator who reached this page would see it fail
+// honestly rather than be quietly shown a page that cannot save.
 registry.registerRoutes(ID, {
   public: [
     { path: '', element: <Servers /> },
     { path: 'servers/:id', element: <ServerDetail /> },
+    // Phase 9 (D56). Not nested under its server: core links here from Team
+    // notification email through `pageUrlTemplate`, which substitutes
+    // `{externalId}` and nothing else — and the server is inside that id.
+    { path: 'clans/:externalId', element: <Clan /> },
+  ],
+  player: [{ path: '', element: <Account /> }],
+  admin: [
+    { path: '', element: <Permissions /> },
+    // Phase 7b (R18). A second admin page rather than a tab on the first: the
+    // permission mirror decides who may do what inside the game, and this edits
+    // the game host's own files. They are neighbours, not halves of one screen,
+    // and the nav says so with two rows.
+    //
+    // A static segment under the module's namespace, so it lands at
+    // `/admin/rust/config` and core's admin gate applies to it exactly as it
+    // does to the page above.
+    { path: 'config', element: <ModConfig /> },
+    // Who may see who is online — a third neighbour. The org lead's rule is that
+    // nothing names who is online by default; this is where an operator widens
+    // it on purpose, fleet-wide or per server.
+    { path: 'visibility', element: <Visibility /> },
+    // The servers themselves (phase 16, D133): the page that was missing. Until
+    // it, a server row was written only through the API, and D130's wipe
+    // schedule needed somewhere to be typed.
+    { path: 'servers', element: <ServerSettings /> },
   ],
 })
 
@@ -83,6 +134,34 @@ registry.registerNav(ID, {
   items: [{ label: 'Servers', to: '/rust' }],
 })
 
+// The player portal's row. It carries an `icon` because core draws one on every
+// portal row — a row without one is the only text in a column of glyphs, and
+// core used to render `<n.icon />` unguarded, which blanked the whole portal.
+//
+// No `order`: an unordered row appends after core's own rather than claiming a
+// position it was not given. Account, appeals and notifications are what a player
+// came to the portal for; linking a game account is what they do once.
+registry.registerNav(ID, {
+  area: 'player',
+  items: [{ label: 'Rust', to: '/player/rust', icon: IconLink }],
+})
+
+// The admin sidebar's row. `group` names an existing core group — an unknown name
+// appends a new group at the end rather than dropping the row, which is the
+// failure mode to avoid here: a row nobody can find is a feature nobody has.
+//
+// It carries an icon for the same reason the player row does: core draws one on
+// every sidebar row, and the one without is the only text in a column of glyphs.
+registry.registerNav(ID, {
+  area: 'admin',
+  items: [
+    { label: 'Rust permissions', to: '/admin/rust', icon: IconKey },
+    { label: 'Rust mod config', to: '/admin/rust/config', icon: IconSliders },
+    { label: 'Rust visibility', to: '/admin/rust/visibility', icon: IconEye },
+    { label: 'Rust servers', to: '/admin/rust/servers', icon: IconServer },
+  ],
+})
+
 // ── Extension slots ───────────────────────────────────────────────────────
 //
 // Core declares a slot, only core may declare one, and at most one module may
@@ -97,6 +176,32 @@ registry.registerNav(ID, {
 // purpose.
 registry.registerExtension(ID, 'site.footer.status', FooterStatus)
 
+// R13's other slot, and the one that IS named in `module.json` — because it has
+// a server half too (`server/router/admin/usersRust.router.js`). The two halves
+// carry one name on purpose: a module that adds routes under
+// `/api/v1/admin/users/:id` is the module with something to show on that page.
+//
+// Core passes `userId` and nothing else, so the component builds its own client
+// for the routes the server half registered. It renders NOTHING for a user with
+// no linked Steam account, which is most of them.
+registry.registerExtension(ID, 'admin.users.detail', UserRustSections)
+
+// ── Inverted slots: core's Team contributions on OUR clan page ─────────────
+//
+// §3.7a. A clan is a Team (R5), and core renders no Team page because it does
+// not own the word "clan". So the page is `routes/public/Clan.jsx` and core
+// contributes the three things only it can render — into places this module
+// names, in this module's vocabulary. Core offers a CONTRIBUTION; it never names
+// a slot, which is what lets a second game use the same contract as module-uo.
+//
+// One slot per PLACE (D56): a slot holds one component, and a collapsed slot
+// would hand core the decision about where each part sits on a page it does not
+// own. Asking for a contribution core does not offer throws here, at
+// registration — a typo fails loudly rather than rendering nothing for ever.
+registry.declareModuleSlot(ID, 'rust.clan.header', { core: 'team.notify' })
+registry.declareModuleSlot(ID, 'rust.clan.detail', { core: 'team.activity' })
+registry.declareModuleSlot(ID, 'rust.clan.forum', { core: 'team.forum' })
+
 // `module.json`'s `coreApi` range was checked by the loader before this file was
 // ever served, so there is nothing to re-check here. Log it anyway: a mismatch
 // between the core that validated the manifest and the core that published this

client/src/icons.jsx

@@ -0,0 +1,113 @@
+// ── The nav glyph for this module's player-portal row ─────────────────────
+//
+// `icon` is part of the nav-item contract (MODULE_API.md §3.3, 1.3.0): core
+// renders whatever component a row carries, exactly as it renders its own rows'
+// icons — and core's player portal draws a glyph on every row, so a row without
+// one reads as breakage rather than as a design. The client suite asserts it.
+//
+// The public header is text buttons and carries no icons, which is why this file
+// arrives with the player row and not before it.
+//
+// **The frame is copied from core's `PlayerPortalLayout`, deliberately and by
+// copy rather than by import** — 16px, `currentColor`, stroke 2. Four attributes
+// of presentation are not a component: putting them in the shared kit would
+// freeze core's icon sizing into the contract, where changing it later would be a
+// major bump. A module that wants to look like the nav it is in matches that nav.
+
+const Icon = ({ children }) => (
+  <svg
+    width="16"
+    height="16"
+    viewBox="0 0 24 24"
+    fill="none"
+    stroke="currentColor"
+    strokeWidth="2"
+    strokeLinecap="round"
+    strokeLinejoin="round"
+    aria-hidden="true"
+    focusable="false"
+  >
+    {children}
+  </svg>
+)
+
+/**
+ * A chain link — what the row is for.
+ *
+ * Not a gem, a person or a server: the portal's rows say what a player does
+ * there, and what a player does at `/player/rust` is link an account. Core's own
+ * neighbours are a gear (account), a shield (appeals) and a bell (notifications),
+ * so the row has to read as a verb in that company.
+ */
+export const IconLink = () => (
+  <Icon>
+    <path d="M10 13a5 5 0 007.07 0l2.83-2.83a5 5 0 00-7.07-7.07L11.5 4.5" />
+    <path d="M14 11a5 5 0 00-7.07 0L4.1 13.83a5 5 0 007.07 7.07L12.5 19.5" />
+  </Icon>
+)
+
+/**
+ * A key — the admin sidebar's row for the permission mirror.
+ *
+ * Core's admin groups are labelled by subject and drawn with glyphs of the same
+ * weight, so this is the same 16px frame as the portal's. A key rather than a
+ * shield: a shield is protection from something, and this row is about handing
+ * somebody the right to do something.
+ */
+export const IconKey = () => (
+  <Icon>
+    <circle cx="7.5" cy="15.5" r="4.5" />
+    <path d="M10.7 12.3L20 3" />
+    <path d="M17 6l2.5 2.5" />
+  </Icon>
+)
+
+/**
+ * Sliders — the admin sidebar's row for the mod-configuration editor.
+ *
+ * Not a gear: core's account row is a gear, and two gears in one sidebar say
+ * "settings" twice without saying whose. Sliders read as values being tuned,
+ * which is exactly what that page does to somebody else's game host.
+ */
+export const IconSliders = () => (
+  <Icon>
+    <path d="M4 6h10" />
+    <path d="M18 6h2" />
+    <circle cx="16" cy="6" r="2" />
+    <path d="M4 12h4" />
+    <path d="M12 12h8" />
+    <circle cx="10" cy="12" r="2" />
+    <path d="M4 18h10" />
+    <path d="M18 18h2" />
+    <circle cx="16" cy="18" r="2" />
+  </Icon>
+)
+
+/**
+ * An eye — the admin sidebar's row for who may see who is online.
+ *
+ * The page decides what the public can SEE, so the glyph is the act of seeing.
+ */
+export const IconEye = () => (
+  <Icon>
+    <path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12z" />
+    <circle cx="12" cy="12" r="3" />
+  </Icon>
+)
+
+/**
+ * Two stacked units — the admin sidebar's row for the servers themselves.
+ *
+ * The one row that is about the machines rather than what happens on them: the
+ * sidecar each one answers through, and when each one wipes.
+ */
+export const IconServer = () => (
+  <Icon>
+    <rect x="3" y="4" width="18" height="7" rx="1.5" />
+    <rect x="3" y="13" width="18" height="7" rx="1.5" />
+    <path d="M7 7.5h.01" />
+    <path d="M7 16.5h.01" />
+  </Icon>
+)
+
+export default { IconLink, IconKey, IconSliders, IconEye, IconServer }

client/src/lib/feed.js

@@ -21,7 +21,7 @@
 // here is presentation, and the honest presentation of a kind we have no words
 // for is its own name.
 
-import { duration, prefab } from './format.js'
+import { attacker, duration, prefab } from './format.js'
 
 /**
  * Kinds this feed asks for.
@@ -161,7 +161,7 @@ function death(frame, name) {
     case 'npc':
       return {
         tone: 'death',
-        actor: prefab(frame.attackerName) || 'Something',
+        actor: attacker(frame.attackerName) || 'Something',
         verb: 'killed',
         subject: name,
         detail: where,

client/src/lib/format.js

@@ -119,12 +119,87 @@ export function prefab(name) {
   return String(name).replace(/[_.]+/g, ' ').trim()
 }
 
+/**
+ * The NPC families whose prefab reads badly as words, by the prefix the game's
+ * short names share. First match wins, so a longer prefix sits above a shorter
+ * one it starts with.
+ */
+const NPC_FAMILIES = [
+  ['scientistnpc_heavy', 'Heavy scientist'],
+  ['scientistnpc', 'Scientist'],
+  ['npc_bandit_guard', 'Bandit guard'],
+  ['bandit_guard', 'Bandit guard'],
+  ['npc_tunneldweller', 'Tunnel dweller'],
+  ['npc_underwaterdweller', 'Underwater dweller'],
+  ['bradleyapc', 'Bradley APC'],
+  ['patrolhelicopter', 'Patrol helicopter'],
+  ['ch47scientists', 'Chinook'],
+  ['sentry.scientist', 'Outpost sentry'],
+  ['sentry.bandit', 'Bandit Camp sentry'],
+  ['autoturret', 'Auto turret'],
+  ['flameturret', 'Flame turret'],
+  ['guntrap', 'Shotgun trap'],
+  ['sam_site', 'SAM site'],
+  ['sam_static', 'SAM site'],
+  ['polarbear', 'Polar bear'],
+  ['simpleshark', 'Shark'],
+]
+
+/**
+ * What killed somebody, when it was not a player (PLAN_FIXES F2, D185) — the
+ * killfeed's `npc` attacker, which the plugin sends as a prefab short name.
+ *
+ * The first walk read "killed by wolf2". `prefab` keeps its light touch for a
+ * weapon, where the short name is what a Rust player reads on their own console;
+ * an ATTACKER is a creature or a machine, and a number stuck to its name is the
+ * game's variant, not something a reader needs. So a known family is named
+ * (above), and anything else has its variant digits and deploy suffixes trimmed
+ * and reads as capitalised words — `wolf2` is "Wolf", `boar` is "Boar". Still no
+ * table of every prefab: a new animal reads fine without one.
+ */
+export function attacker(name) {
+  if (!name) return ''
+  const text = String(name).toLowerCase()
+  const family = NPC_FAMILIES.find(([prefix]) => text.startsWith(prefix))
+  if (family) return family[1]
+
+  const words = text
+    .replace(/(\.deployed|_deployed|\.entity|\.prefab)$/, '')
+    .replace(/\d+$/, '')
+    .replace(/[_.]+/g, ' ')
+    .trim()
+  return words ? words[0].toUpperCase() + words.slice(1) : ''
+}
+
 /** A steam id, shortened for a table cell, without pretending it is a name. */
 export function shortId(steamId) {
   const id = String(steamId || '')
   return id.length > 10 ? `…${id.slice(-6)}` : id
 }
 
+/**
+ * The next wipe (phase 16, D130), as `Thu, Oct 1, 7:00 PM (in 6 days)` in the
+ * VIEWER's locale and clock — or `null` when the server has no schedule.
+ *
+ * The server computes the instant from the operator's rule in the operator's
+ * zone; the page only says it the reader's way. A `once` source is an operator
+ * moving a wipe, and says so, because "the wipe is not when it usually is" is
+ * the thing a regular needs to notice.
+ */
+export function nextWipe(value, now = Date.now()) {
+  if (!value || !value.at) return null
+  const at = toMillis(value.at)
+  if (at === null) return null
+  const when = new Date(at).toLocaleString(undefined, {
+    weekday: 'short',
+    month: 'short',
+    day: 'numeric',
+    hour: 'numeric',
+    minute: '2-digit',
+  })
+  return `${when} (${ago(at, now)})${value.source === 'once' ? ' — rescheduled' : ''}`
+}
+
 function toMillis(value) {
   if (value === null || value === undefined || value === '') return null
   if (typeof value === 'number') return Number.isFinite(value) ? value : null
@@ -133,4 +208,24 @@ function toMillis(value) {
   return Number.isNaN(parsed) ? null : parsed
 }
 
-export default { ago, clock, day, duration, count, prefab, shortId }
+/**
+ * The ink that reads on a background of `hex` — black or white, whichever has
+ * the higher WCAG contrast. A chat title's colour is the operator's, chosen for
+ * a dark game chat, and this page is drawn in the reader's theme: yellow text on
+ * a white page is unreadable, so the colour becomes the chip and the text is
+ * picked for it (phase 17, D137). Anything that is not `#rrggbb` gets black on
+ * the caller's fallback.
+ */
+export function contrastInk(hex) {
+  const m = /^#([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})$/i.exec(String(hex || ''))
+  if (!m) return '#000000'
+  const linear = (c) => {
+    const v = parseInt(c, 16) / 255
+    return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4
+  }
+  const L = 0.2126 * linear(m[1]) + 0.7152 * linear(m[2]) + 0.0722 * linear(m[3])
+  // Contrast against white is 1.05 / (L + 0.05); against black (L + 0.05) / 0.05.
+  return (L + 0.05) / 0.05 >= 1.05 / (L + 0.05) ? '#000000' : '#ffffff'
+}
+
+export default { ago, clock, day, duration, count, prefab, shortId, nextWipe, contrastInk }

client/src/lib/leaflet.js

@@ -0,0 +1,28 @@
+// ── Leaflet, and only when the Map tab asks for it ────────────────────────
+//
+// D116 put Leaflet on the map; D120 put it HERE, in a chunk of its own that the
+// Map tab imports with `import()`. Two reasons, and both are about `entry.js`:
+//
+//   • `entry.js` is loaded on EVERY page of the site, because core injects every
+//     started module's chunk into its shell. Leaflet in it would be ~40 KB gz on
+//     the home page, the forum and the news, for a tab most visitors never open.
+//   • Leaflet touches `document` and `window` the moment it is evaluated. The
+//     chunk is evaluated in Node by `test/registration.test.js`, with a
+//     `window` and nothing else — so Leaflet in the entry chunk fails that test
+//     at import, before a single registration is checked.
+//
+// Vite emits this as `dist/map-<hash>.js` beside `entry.js`. Core serves the
+// directory `client.entry` sits in (MODULE_API.md §3.1), and `release.yml`
+// copies every `.js` in it — `test/build.test.js` holds both ends of that.
+//
+// The ESM build is imported by path: Leaflet 1.9.4's package.json names only its
+// UMD file, and the UMD one would go through CommonJS interop for nothing.
+//
+// The stylesheet comes in as a STRING and is injected once as a `<style>` by the
+// page (core's CSP allows `style-src 'unsafe-inline'`). The map uses circle and
+// div markers only, so the images Leaflet's CSS names are never shown.
+
+import * as L from 'leaflet/dist/leaflet-src.esm.js'
+import css from 'leaflet/dist/leaflet.css?inline'
+
+export { L, css }

client/src/lib/mapGeometry.js

@@ -0,0 +1,92 @@
+// ── How a world position reaches a pixel ──────────────────────────────────
+//
+// PLAN.md §30.3, in the one place the page computes it. Rust's world is centred
+// on the origin, x east and z north; the picture is the world at a scale, with
+// an ocean margin around it that is measured in PIXELS and is not scaled (the
+// rig's 3000 map is 3000 × 0.5 + 2 × 500 = 2500 pixels). So:
+//
+//     s  = (width − 2 × margin) / worldSize
+//     px = (x + worldSize / 2) × s + margin
+//     py = (z + worldSize / 2) × s + margin      measured UP from the bottom edge
+//
+// Up from the bottom because Leaflet's `CRS.Simple` has y growing north, which
+// is Rust's z — so the picture's bounds are `[[0, 0], [height, width]]` and a
+// position is `[py, px]` with no flip anywhere.
+//
+// The grid is the GAME's (D119): `gridCells` cells of `gridCellSize` metres per
+// side, lettered from the west and numbered from the north, `A0` at the
+// north-west corner. Both numbers come from the plugin, which asks the game's own
+// `MapHelper`; nothing here assumes a cell size.
+//
+// Pure, and free of Leaflet, so it is tested in Node.
+
+/** Pixels per metre, or 0 for a geometry that cannot place anything. */
+export function scaleOf(g) {
+  if (!g || !(g.worldSize > 0) || !(g.width > 0)) return 0
+  return (g.width - 2 * (g.oceanMargin || 0)) / g.worldSize
+}
+
+/** A world position as `[lat, lng]` in the map's pixel space. */
+export function toLatLng(g, x, z) {
+  const s = scaleOf(g)
+  const half = g.worldSize / 2
+  const m = g.oceanMargin || 0
+  return [(Number(z) + half) * s + m, (Number(x) + half) * s + m]
+}
+
+/** The picture's bounds in the same space. */
+export function boundsOf(g) {
+  return [[0, 0], [g.height, g.width]]
+}
+
+/** A column number as Rust spells it: 0 is A, 25 is Z, 26 is AA. */
+export function column(index) {
+  let name = ''
+  let n = index + 1
+  while (n > 0) {
+    const r = (n - 1) % 26
+    name = String.fromCharCode(65 + r) + name
+    n = Math.floor((n - 1) / 26)
+  }
+  return name
+}
+
+/** The grid label for a world position, the way the in-game map writes it. */
+export function gridLabel(g, x, z) {
+  if (!g || !(g.gridCells > 0) || !(g.gridCellSize > 0)) return null
+  const half = g.worldSize / 2
+  const clamp = (v) => Math.max(0, Math.min(g.gridCells - 1, v))
+  const col = clamp(Math.floor((Number(x) + half) / g.gridCellSize))
+  const row = clamp(Math.floor((half - Number(z)) / g.gridCellSize))
+  return `${column(col)}${row}`
+}
+
+/**
+ * The grid as lines and labels in world metres: `lines` are `[[x1, z1], [x2,
+ * z2]]` pairs, `labels` sit at each cell's north-west corner.
+ */
+export function grid(g) {
+  if (!g || !(g.gridCells > 0) || !(g.gridCellSize > 0)) return { lines: [], labels: [] }
+  const half = g.worldSize / 2
+  const n = g.gridCells
+  const c = g.gridCellSize
+  const lines = []
+  for (let i = 0; i <= n; i += 1) {
+    const at = -half + i * c
+    lines.push([[at, half], [at, half - n * c]])
+    lines.push([[-half, half - i * c], [-half + n * c, half - i * c]])
+  }
+  const labels = []
+  for (let col = 0; col < n; col += 1) {
+    for (let row = 0; row < n; row += 1) {
+      labels.push({ text: `${column(col)}${row}`, x: -half + col * c, z: half - row * c })
+    }
+  }
+  return { lines, labels }
+}
+
+/** Seconds as `m:ss`, for a locked crate's hack. */
+export function countdown(seconds) {
+  const s = Math.max(0, Math.round(Number(seconds) || 0))
+  return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}`
+}

client/src/routes/admin/ChatStyle.jsx

@@ -0,0 +1,163 @@
+// ── Admin · Rust · Permissions — a group's chat style (phase 17, D138) ─────
+//
+// All twelve of BetterChat's group fields, on a group this site authors. A style
+// is the whole of a BetterChat group or nothing, so the editor always shows all
+// twelve, starting from BetterChat's own defaults.
+//
+// Three things the section says out loud, because each looks like success from
+// here:
+//
+//   • a server where BetterChat is not loaded holds nothing yet — the style
+//     lands when BetterChat does, at the next sync;
+//   • a field somebody changed in game is NOT overwritten — it shows under
+//     "Changed in game", to adopt or put back;
+//   • a field BetterChat refused (`InvalidValue`) is named with its server.
+//
+// Removing a style removes the group from BetterChat on the next sync (D139),
+// which is BetterChat's own `chat group remove` — it has no quieter way.
+
+import { useState } from 'react'
+
+const LABELS = {
+  Priority: 'Priority (lower wins when a player is in several groups)',
+  Title: 'Title',
+  TitleColor: 'Title colour',
+  TitleSize: 'Title size',
+  TitleHidden: 'Hide the title',
+  TitleHiddenIfNotPrimary: 'Hide the title unless this is the player’s main group',
+  UsernameColor: 'Name colour',
+  UsernameSize: 'Name size',
+  MessageColor: 'Message colour',
+  MessageSize: 'Message size',
+  ChatFormat: 'Chat format',
+  ConsoleFormat: 'Console format',
+}
+
+/** BetterChat's defaults for this group, from the field list the server sent. */
+function defaultsFor(group, fields) {
+  const out = {}
+  for (const f of fields) out[f.name] = f.default === null ? '' : f.default
+  out.Title = group === 'default' ? '[Player]' : `[${group}]`
+  return out
+}
+
+/** What each server's last sync said about this group's style. */
+function styleNotes(group, servers) {
+  const notes = []
+  for (const s of servers) {
+    const chat = s.report && s.report.chat
+    if (!chat) continue
+    if (chat.loaded === false) {
+      notes.push(`${s.serverId}: BetterChat is not loaded, so nothing is styled there yet.`)
+      continue
+    }
+    for (const f of chat.failed || []) {
+      if (f.group !== group) continue
+      notes.push(`${s.serverId}: BetterChat refused ${f.field || 'the group'} (${f.reason}).`)
+    }
+  }
+  return notes
+}
+
+export default function ChatStyleSection({ group, fields, servers, busy, onSave }) {
+  const [editing, setEditing] = useState(null)
+
+  if (!fields || !fields.length) return null
+
+  const notes = group.chat ? styleNotes(group.name, servers) : []
+
+  const set = (name, value) => setEditing((e) => ({ ...e, [name]: value }))
+
+  return (
+    <>
+      <div className="field-label" style={{ marginTop: 18 }}>
+        Chat style (BetterChat)
+      </div>
+      {!editing && !group.chat && (
+        <p className="sans dim" style={{ fontSize: '0.8rem', margin: '4px 0' }}>
+          No chat style. BetterChat, where it is installed, styles this group’s members as it does anybody else.
+        </p>
+      )}
+      {!editing && group.chat && (
+        <p className="sans" style={{ fontSize: '0.82rem', margin: '4px 0' }}>
+          <span style={{ color: /^#[0-9a-f]{6}$/i.test(group.chat.TitleColor) ? group.chat.TitleColor : undefined, fontWeight: 600 }}>
+            {group.chat.TitleHidden === 'true' ? '(title hidden)' : group.chat.Title}
+          </span>{' '}
+          <span className="dim" style={{ fontSize: '0.76rem' }}>
+            priority {group.chat.Priority} · <code>{group.chat.ChatFormat}</code>
+          </span>
+        </p>
+      )}
+      {notes.map((n) => (
+        <p key={n} className="sans" style={{ color: '#d08a2a', fontSize: '0.76rem', margin: '2px 0' }}>{n}</p>
+      ))}
+
+      {!editing && (
+        <div style={{ display: 'flex', gap: 8, marginTop: 6 }}>
+          <button
+            type="button"
+            className="btn"
+            disabled={busy}
+            onClick={() => setEditing({ ...defaultsFor(group.name, fields), ...(group.chat || {}) })}
+          >
+            {group.chat ? 'Edit the style' : 'Give it a chat style'}
+          </button>
+          {group.chat && (
+            <button type="button" className="btn btn-ghost" disabled={busy} onClick={() => onSave(null)}>
+              Remove the style
+            </button>
+          )}
+        </div>
+      )}
+
+      {editing && (
+        <form
+          onSubmit={async (event) => {
+            event.preventDefault()
+            if (await onSave(editing)) setEditing(null)
+          }}
+          className="sans"
+          style={{ display: 'grid', gap: 8, marginTop: 8, fontSize: '0.82rem' }}
+        >
+          {fields.map((f) => (
+            <label key={f.name} style={{ display: 'grid', gridTemplateColumns: 'minmax(160px, 1fr) 2fr', gap: 8, alignItems: 'center' }}>
+              <span>{LABELS[f.name] || f.name}</span>
+              {f.type === 'bool' ? (
+                <select className="input" value={editing[f.name]} onChange={(e) => set(f.name, e.target.value)}>
+                  <option value="false">No</option>
+                  <option value="true">Yes</option>
+                </select>
+              ) : f.type === 'color' ? (
+                <span style={{ display: 'flex', gap: 6 }}>
+                  <input
+                    type="color"
+                    value={/^#[0-9a-f]{6}$/i.test(editing[f.name]) ? editing[f.name] : '#ffffff'}
+                    onChange={(e) => set(f.name, e.target.value)}
+                    aria-label={LABELS[f.name]}
+                    style={{ width: 36, height: 28, padding: 0, border: 'none', background: 'none' }}
+                  />
+                  <input className="input" value={editing[f.name]} onChange={(e) => set(f.name, e.target.value)} style={{ flex: 1 }} />
+                </span>
+              ) : (
+                <input
+                  className="input"
+                  type={f.type === 'int' || f.type === 'size' ? 'number' : 'text'}
+                  value={editing[f.name]}
+                  onChange={(e) => set(f.name, e.target.value)}
+                />
+              )}
+            </label>
+          ))}
+          <p className="dim" style={{ fontSize: '0.74rem', margin: 0 }}>
+            A format must hold <code>{'{Message}'}</code> exactly once; <code>{'{Title}'}</code> and <code>{'{Username}'}</code>{' '}
+            are where the title and name go. A hand edit in game is reported rather than overwritten.
+          </p>
+          <div style={{ display: 'flex', gap: 8 }}>
+            <button type="submit" className="btn" disabled={busy}>Save the style</button>
+            <button type="button" className="btn btn-ghost" disabled={busy} onClick={() => setEditing(null)}>Cancel</button>
+          </div>
+        </form>
+      )}
+    </>
+  )
+}

client/src/routes/admin/ChatTitles.jsx

@@ -0,0 +1,224 @@
+// ── Admin · Rust · Servers — chat titles and the voice (phase 17) ─────────
+//
+// Two things the servers page gained with BetterChat and PopupNotifications
+// becoming optional (PLAN.md §33):
+//
+//  • **A server's chat titles** (D135, D136): rules that rank the current wipe,
+//    in the operator's order, and how many a player shows. Saved with their own
+//    PUT, because they are not part of the server row — an operator retitling
+//    "Top Killer" must not have to re-type a sidecar address.
+//  • **The voice** (D140): the one styled permission group news and event lines
+//    are said in. A fleet setting, so it sits once at the foot of the page.
+//
+// Neither needs BetterChat to save. Titles are held by the plugin until BetterChat
+// arrives, and the voice is said by our own plugin whether BetterChat is there or
+// not; the "What this server has" line says which is which.
+
+import { useState } from 'react'
+
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import api from '../../api.js'
+import { contrastInk } from '../../lib/format.js'
+
+const STATS = [
+  { id: 'kills', label: 'Kills' },
+  { id: 'npckills', label: 'NPC kills' },
+  { id: 'playtime', label: 'Playtime' },
+]
+
+const MODES = [
+  { id: 'first', label: 'The first title they earn', hint: 'The rule highest in the list wins.' },
+  { id: 'all', label: 'Every title they earn' },
+  { id: 'upto', label: 'Up to a number of titles', hint: 'In list order.' },
+]
+
+const statLabel = (id) => (STATS.find((s) => s.id === id) || { label: id }).label
+
+/** One line summarising a server's titles, for its row on the list. */
+export function titlesSummary(titles, push) {
+  const rules = (titles && titles.rules) || []
+  if (!rules.length) return 'No chat titles.'
+  const list = rules.map((r) => `${r.text} (top ${r.topN} ${statLabel(r.stat).toLowerCase()})`).join(', ')
+  const shown = push ? ` Last pushed: ${push.count} player${push.count === 1 ? '' : 's'} hold one${push.betterChat ? '' : ' — BetterChat is not loaded, so they are not showing in game yet'}.` : ''
+  return `Chat titles: ${list}.${shown}`
+}
+
+/** A title as the leaderboard will show it. */
+function Chip({ text, color }) {
+  return (
+    <span
+      className="sans"
+      style={{ padding: '1px 6px', borderRadius: 999, fontSize: '0.72rem', fontWeight: 600, background: color, color: contrastInk(color) }}
+    >
+      {text || '…'}
+    </span>
+  )
+}
+
+export function TitlesForm({ server, onSaved, onCancel }) {
+  const start = server.titles || { mode: 'first', max: 2, rules: [] }
+  const [mode, setMode] = useState(start.mode)
+  const [max, setMax] = useState(start.max)
+  const [rules, setRules] = useState(start.rules.map((r) => ({ ...r })))
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+
+  const setRule = (i, key) => (e) => {
+    const value = e.target.value
+    setRules((list) => list.map((r, n) => (n === i ? { ...r, [key]: key === 'topN' ? Number(value) : value } : r)))
+  }
+  const move = (i, by) => setRules((list) => {
+    const next = [...list]
+    const [r] = next.splice(i, 1)
+    next.splice(i + by, 0, r)
+    return next
+  })
+
+  const save = async (e) => {
+    e.preventDefault()
+    setBusy(true)
+    setError('')
+    try {
+      await api.admin.saveTitles(server.id, { mode, max: Number(max), rules })
+      onSaved()
+    } catch (err) {
+      setError(err.message || 'That did not save.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <form onSubmit={save} className="panel" style={{ padding: '16px 18px', display: 'grid', gap: 12, marginBottom: 18 }}>
+      <h2 className="display" style={{ fontSize: '1.05rem', margin: 0, color: 'var(--head)' }}>Chat titles on {server.name}</h2>
+      <p className="sans dim" style={{ fontSize: '0.78rem', margin: 0 }}>
+        Each rule gives a title to the top players on this wipe for one stat. A stat of zero earns nothing, so a fresh wipe
+        has no titles until somebody plays. Titles show in game chat when BetterChat is installed, and beside the name on
+        the leaderboard here and in the app. Up to ten rules; a title is at most 24 characters and cannot carry markup.
+      </p>
+
+      {rules.map((r, i) => (
+        <div key={i} className="sans" style={{ display: 'flex', flexWrap: 'wrap', gap: 8, alignItems: 'center', fontSize: '0.84rem' }}>
+          <span className="dim" style={{ width: 18 }}>{i + 1}</span>
+          <span>Top</span>
+          <input type="number" min={1} max={10} value={r.topN} onChange={setRule(i, 'topN')} style={{ ...inputStyle, width: 60 }} aria-label="How many players" />
+          <select value={r.stat} onChange={setRule(i, 'stat')} style={inputStyle} aria-label="Stat">
+            {STATS.map((s) => <option key={s.id} value={s.id}>{s.label}</option>)}
+          </select>
+          <span>earn</span>
+          <input value={r.text} onChange={setRule(i, 'text')} maxLength={24} required style={{ ...inputStyle, width: 160 }} aria-label="Title" />
+          <input type="color" value={r.color} onChange={setRule(i, 'color')} aria-label="Colour" style={{ width: 36, height: 28, padding: 0, border: 'none', background: 'none' }} />
+          <Chip text={r.text} color={r.color} />
+          <span style={{ marginLeft: 'auto', display: 'flex', gap: 4 }}>
+            <button type="button" className="btn" disabled={i === 0} onClick={() => move(i, -1)} aria-label="Move up">↑</button>
+            <button type="button" className="btn" disabled={i === rules.length - 1} onClick={() => move(i, 1)} aria-label="Move down">↓</button>
+            <button type="button" className="btn" onClick={() => setRules((list) => list.filter((_, n) => n !== i))}>Remove</button>
+          </span>
+        </div>
+      ))}
+      {rules.length < 10 && (
+        <div>
+          <button type="button" className="btn" onClick={() => setRules((list) => [...list, { stat: 'kills', topN: 1, text: '', color: '#ffaa55' }])}>
+            Add a rule
+          </button>
+        </div>
+      )}
+
+      <div className="sans" style={{ display: 'flex', flexWrap: 'wrap', gap: 12, alignItems: 'center', fontSize: '0.84rem' }}>
+        <label style={{ display: 'flex', gap: 8, alignItems: 'center' }}>
+          A player shows
+          <select value={mode} onChange={(e) => setMode(e.target.value)} style={inputStyle}>
+            {MODES.map((m) => <option key={m.id} value={m.id}>{m.label}</option>)}
+          </select>
+        </label>
+        {mode === 'upto' && (
+          <label style={{ display: 'flex', gap: 8, alignItems: 'center' }}>
+            at most
+            <input type="number" min={1} max={5} value={max} onChange={(e) => setMax(e.target.value)} style={{ ...inputStyle, width: 60 }} />
+          </label>
+        )}
+        <span className="dim" style={{ fontSize: '0.74rem' }}>{(MODES.find((m) => m.id === mode) || {}).hint || ''}</span>
+      </div>
+
+      <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
+        <button type="submit" className="btn" disabled={busy}>{busy ? 'Saving…' : 'Save titles'}</button>
+        <button type="button" className="btn" onClick={onCancel} disabled={busy}>Cancel</button>
+        {error && <span style={{ color: '#d08a2a', fontSize: '0.8rem' }}>{error}</span>}
+      </div>
+    </form>
+  )
+}
+
+/** What a server says it has loaded, as one sentence (§33.2 `integrations`). */
+export function integrationsLine(r) {
+  if (!r || !r.integrations) {
+    return r && r.ok === false
+      ? `The game could not be asked (${r.status}).`
+      : 'This server’s plugin is older than protocol 12, so it cannot say which optional mods it has.'
+  }
+  const one = (name, x, without) => (x && x.loaded ? `${name} ${x.version || ''} is loaded`.trim() : `${name} is not loaded — ${without}`)
+  return `${one('BetterChat', r.integrations.betterChat, 'titles and group styles wait for it')}. ${one('PopupNotifications', r.integrations.popupNotifications, 'a popup is refused, and chat still works')}.`
+}
+
+export function VoiceCard() {
+  const [reloads, setReloads] = useState(0)
+  const { data, error: loadError } = useAsync(() => api.admin.voice(), [reloads])
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+
+  if (loadError) return <ErrorState error={loadError} />
+  if (!data) return <Loading />
+
+  const choose = async (group) => {
+    setBusy(true)
+    setError('')
+    try {
+      await api.admin.saveVoice(group)
+      setReloads((n) => n + 1)
+    } catch (err) {
+      setError(err.message || 'That did not save.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const current = data.options.find((o) => o.group === data.voice)
+
+  return (
+    <section className="panel sans" style={{ padding: '16px 18px', marginBottom: 18, fontSize: '0.84rem' }}>
+      <h2 className="display" style={{ fontSize: '1.05rem', margin: '0 0 6px', color: 'var(--head)' }}>Announcement voice</h2>
+      <p className="dim" style={{ fontSize: '0.78rem', margin: '0 0 10px' }}>
+        News posts and event announcements said in game chat can wear the title and colours of one permission group that
+        has a chat style. The line has no sender, so no player’s name appears. It works whether or not BetterChat is
+        installed. Popups are plain text.
+      </p>
+      <label style={{ display: 'flex', gap: 8, alignItems: 'center' }}>
+        Say them as
+        <select value={data.voice} onChange={(e) => choose(e.target.value)} disabled={busy} style={inputStyle}>
+          <option value="">Plain chat</option>
+          {data.options.map((o) => <option key={o.group} value={o.group}>{o.group} — {o.title}</option>)}
+        </select>
+      </label>
+      {data.voice && !current && (
+        <p style={{ color: '#d08a2a', fontSize: '0.78rem', margin: '8px 0 0' }}>
+          The group “{data.voice}” no longer has a chat style, so lines are said in plain chat until it has one again or
+          another voice is chosen.
+        </p>
+      )}
+      {current && <p className="dim" style={{ fontSize: '0.74rem', margin: '8px 0 0' }}>The line: <code>{current.format}</code></p>}
+      {!data.options.length && (
+        <p className="dim" style={{ fontSize: '0.76rem', margin: '8px 0 0' }}>No group has a chat style yet. Give one a style under Permissions.</p>
+      )}
+      {error && <p style={{ color: '#d08a2a', fontSize: '0.8rem', margin: '8px 0 0' }}>{error}</p>}
+    </section>
+  )
+}
+
+const inputStyle = {
+  background: 'var(--panel-flat, transparent)',
+  color: 'var(--text)',
+  border: '1px solid var(--line)',
+  borderRadius: 'var(--radius-input, 6px)',
+  padding: '5px 8px',
+  fontSize: '0.84rem',
+}

client/src/routes/admin/ModConfig.jsx

@@ -0,0 +1,641 @@
+// ── Admin · Rust · Mod configuration ──────────────────────────────────────
+//
+// R18. An admin picks a server, a plugin and a file, changes something, and the
+// plugin reloads. This module's second admin page, and the first that writes to
+// somebody's filesystem.
+//
+// **What is on the screen is decided by what is dangerous about the action.**
+// Four things are true here that are not true anywhere else in this module, and
+// each of them is a piece of the page rather than a line in a doc:
+//
+//   • a save can take a required plugin DOWN. So the reload target is a
+//     deliberate choice with the folder name as a guess, the result is reported
+//     as its own panel, and a rollback shows the server's own log line.
+//   • the form cannot express everything a config holds. A `null`, an empty
+//     array and anything past the depth limit are marked and sent to the raw
+//     tier rather than half-drawn.
+//   • three keys in the bridge's own config would cut the link carrying the
+//     edit, or split the server's history. They render read-only, with the
+//     reason (D38).
+//   • configs hold API keys and Discord webhooks. Those fields render masked
+//     with a reveal, which is about the shoulder rather than the wire: an admin
+//     can already read the file over SSH (D37), and the audit trail never
+//     records the values either way.
+
+import { useCallback, useEffect, useState } from 'react'
+
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import { ago } from '../../lib/format.js'
+import api from '../../api.js'
+
+function Card({ title, subtitle, children, actions }) {
+  return (
+    <section className="panel" style={{ padding: '16px 18px', marginBottom: 18 }}>
+      <header style={{ display: 'flex', alignItems: 'baseline', gap: 12, marginBottom: 12 }}>
+        <h2 className="display" style={{ fontSize: '1.05rem', margin: 0, color: 'var(--head)' }}>
+          {title}
+        </h2>
+        {subtitle && (
+          <span className="sans dim" style={{ fontSize: '0.76rem' }}>
+            {subtitle}
+          </span>
+        )}
+        <span style={{ flex: 1 }} />
+        {actions}
+      </header>
+      {children}
+    </section>
+  )
+}
+
+function Warn({ children, tone = '#d08a2a' }) {
+  return (
+    <p className="sans" style={{ color: tone, fontSize: '0.78rem', margin: '6px 0 0' }}>
+      {children}
+    </p>
+  )
+}
+
+/** A value the form can edit: one row, typed by what the file already holds. */
+function Field({ field, value, onChange, revealed, onReveal }) {
+  const indent = 12 * Math.max(0, field.depth - 1)
+  const label = (
+    <label
+      className="sans"
+      style={{
+        flex: '0 0 300px',
+        paddingLeft: indent,
+        color: field.locked ? 'var(--ink)' : 'var(--head)',
+        fontSize: '0.84rem',
+        wordBreak: 'break-word',
+      }}
+      title={field.path}
+    >
+      {field.key}
+      {field.locked && (
+        <span className="dim" style={{ fontSize: '0.72rem' }}>
+          {' '}
+          · read-only
+        </span>
+      )}
+    </label>
+  )
+
+  if (field.type === 'object' || field.type === 'array') {
+    return (
+      <div style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '10px 0 2px' }}>
+        <span
+          className="sans"
+          style={{ paddingLeft: indent, color: 'var(--head)', fontSize: '0.86rem', fontWeight: 500 }}
+        >
+          {field.key || '(the file)'}
+        </span>
+        <span className="sans dim" style={{ fontSize: '0.72rem' }}>
+          {field.type === 'array' ? `${field.count} entries` : `${field.count} settings`}
+          {field.advanced && field.reason ? ` · ${field.reason}` : ''}
+        </span>
+      </div>
+    )
+  }
+
+  if (field.advanced) {
+    return (
+      <div style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '6px 0' }}>
+        {label}
+        <span className="sans dim" style={{ fontSize: '0.78rem' }}>
+          {field.reason} — edit it in Raw JSON
+        </span>
+      </div>
+    )
+  }
+
+  return (
+    <div style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '6px 0' }}>
+      {label}
+      {field.type === 'boolean' ? (
+        <input
+          type="checkbox"
+          checked={Boolean(value)}
+          disabled={field.locked}
+          onChange={(event) => onChange(field, event.target.checked)}
+        />
+      ) : (
+        <input
+          className="input"
+          style={{ flex: 1, minWidth: 0 }}
+          type={field.secret && !revealed ? 'password' : 'text'}
+          value={value === undefined || value === null ? '' : String(value)}
+          disabled={field.locked}
+          onChange={(event) => onChange(field, event.target.value)}
+        />
+      )}
+      {field.secret && !field.locked && (
+        <button type="button" className="btn btn-ghost" onClick={() => onReveal(field.path)}>
+          {revealed ? 'Hide' : 'Show'}
+        </button>
+      )}
+    </div>
+  )
+}
+
+/** How often a save that is still reloading asks how it went. */
+const POLL_MS = 2000
+
+/**
+ * A settled write row as the report panel reads it.
+ *
+ * The row is this module's audit record, not the plugin's frame, so it carries
+ * no per-file `rewritten` — the file is re-read after either way, which is what
+ * the panel's note about rewriting was for.
+ */
+function reportFromWrite(write) {
+  return {
+    pending: write.outcome === 'reloading',
+    lost: write.outcome === 'lost',
+    reload: write.reloadTarget,
+    reloaded: Boolean(write.reloaded),
+    rolledBack: write.outcome === 'rolled-back',
+    restored: write.restored,
+    reason: write.detail,
+    log: write.log,
+    files: [],
+  }
+}
+
+/** The sentence at the top of the panel. */
+function headline(report) {
+  if (report.pending) {
+    return `Saved. Reloading ${report.reload || 'the plugin'}… a first compile after a quiet spell can take a while.`
+  }
+
+  if (report.lost) {
+    return 'The server never said how the reload went — the bridge may have been reloaded, or the link dropped. Re-read the file to see what is on disk.'
+  }
+
+  if (report.rolledBack) {
+    return report.restored === false
+      ? 'The plugin did not come back, so the old file was put back — and it did not come back on the old file either. It is down: check the server console.'
+      : 'The plugin did not come back, so the old file was put back automatically.'
+  }
+
+  return report.reloaded ? 'Saved, and the plugin reloaded.' : `Saved. ${report.reason || 'Nothing was reloaded.'}`
+}
+
+/** What the game said happened. The rollback case is the one worth reading. */
+function Report({ report }) {
+  if (!report) return null
+
+  const tone = report.rolledBack || report.lost ? '#e05a5a' : 'var(--ink)'
+
+  return (
+    <div style={{ borderTop: '1px solid var(--line-soft)', paddingTop: 10, marginTop: 10 }}>
+      <p className="sans" style={{ color: tone, fontSize: '0.84rem', margin: 0 }}>
+        {headline(report)}
+      </p>
+      {report.rolledBack && report.reason && (
+        <p className="sans dim" style={{ fontSize: '0.78rem', margin: '4px 0 0' }}>
+          {report.reason}
+        </p>
+      )}
+      {report.log && (
+        <pre
+          className="sans"
+          style={{
+            background: 'var(--line-soft)',
+            padding: 10,
+            marginTop: 8,
+            fontSize: '0.74rem',
+            maxHeight: 200,
+            overflow: 'auto',
+            whiteSpace: 'pre-wrap',
+          }}
+        >
+          {report.log}
+        </pre>
+      )}
+      {report.files.some((f) => f.rewritten) && (
+        <Warn>
+          The plugin rewrote the file as it loaded — both frameworks add any settings a config is
+          missing and save it back, so what is on disk now is not byte-for-byte what was sent.
+        </Warn>
+      )}
+    </div>
+  )
+}
+
+export default function ModConfig() {
+  const [serverId, setServerId] = useState('')
+  const [path, setPath] = useState('')
+  const [tier, setTier] = useState('form')
+  const [edits, setEdits] = useState({})
+  const [raw, setRaw] = useState('')
+  const [reload, setReload] = useState('')
+  const [revealed, setRevealed] = useState({})
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [report, setReport] = useState(null)
+  const [fileNonce, setFileNonce] = useState(0)
+  // The write a save left reloading, polled until it settles (protocol 13, D179).
+  const [watching, setWatching] = useState(null)
+
+  const { data: servers, error: serverError } = useAsync(() => api.admin.listServers(), [])
+
+  // The tree is asked for per server and never cached across one: what is on a
+  // host's disk has no stale answer worth showing, and a plugin loaded a minute
+  // ago has to be able to appear.
+  const { data: tree, error: treeError } = useAsync(
+    () => (serverId ? api.adminConfig.files(serverId) : Promise.resolve(null)),
+    [serverId],
+  )
+
+  const { data: file, error: fileError } = useAsync(
+    () => (serverId && path ? api.adminConfig.file(serverId, path) : Promise.resolve(null)),
+    [serverId, path, fileNonce],
+  )
+
+  const reset = useCallback(() => {
+    setEdits({})
+    setRevealed({})
+    setError('')
+  }, [])
+
+  // A freshly opened file starts from what the host holds: the raw editor's text
+  // and the reload target's guess both come from the answer rather than from
+  // whatever the previous file left behind.
+  //
+  // **The guess is only taken when the dropdown actually offers it.** A `<select>`
+  // whose value matches no `<option>` displays the first one, so a guess of
+  // `RunicGateway` — which is deliberately not offered, because the bridge cannot
+  // reload itself — put "nothing — just write the file" on the screen while the
+  // request carried `reload: RunicGateway`, and every save of our own config was
+  // refused for a reason the page had just said did not apply.
+  useEffect(() => {
+    if (!file) return
+    setRaw(file.text)
+
+    const offered = (tree ? tree.loaded : []).some(
+      (p) => p.name === file.plugin && p.name !== (tree && tree.self),
+    )
+
+    setReload(offered ? file.plugin : '')
+    reset()
+  }, [file, tree, reset])
+
+  useEffect(() => {
+    setPath('')
+    setReport(null)
+    setWatching(null)
+  }, [serverId])
+
+  // A save that reloads a plugin comes back before the reload has finished.
+  // Ask how it went every couple of seconds until the row leaves `reloading` —
+  // the server calls it `lost` once twice the plugin's ceiling has passed, so
+  // this always ends — then re-read the file, because a reload rewrites it and a
+  // rollback puts the old one back.
+  useEffect(() => {
+    if (!watching) return undefined
+
+    let stopped = false
+    let handle = null
+
+    const poll = async () => {
+      try {
+        const { write } = await api.adminConfig.write(watching.serverId, watching.id)
+        if (stopped) return
+
+        setReport(reportFromWrite(write))
+
+        if (write.outcome !== 'reloading') {
+          setWatching(null)
+          setFileNonce((n) => n + 1)
+          return
+        }
+      } catch {
+        // One failed poll is a blip, not an answer; the next one asks again.
+        if (stopped) return
+      }
+
+      handle = setTimeout(poll, POLL_MS)
+    }
+
+    handle = setTimeout(poll, POLL_MS)
+
+    return () => {
+      stopped = true
+      clearTimeout(handle)
+    }
+  }, [watching])
+
+  if (serverError) return <ErrorState error={serverError} />
+  if (!servers) return <Loading />
+
+  const rows = servers.servers || servers || []
+  const change = (field, value) => setEdits((current) => ({ ...current, [field.path]: { field, value } }))
+
+  const save = async () => {
+    setBusy(true)
+    setError('')
+    setReport(null)
+
+    try {
+      const body =
+        tier === 'form'
+          ? {
+              path,
+              version: file.version,
+              ...(reload ? { reload } : {}),
+              // A number goes up as the TEXT that was typed. `2.50` stays
+              // `2.50` and `1.0` stays `1.0`; turning either into a JavaScript
+              // number here is precisely the bug the server half exists to
+              // avoid, and it would be reintroduced in the browser.
+              edits: Object.values(edits).map(({ field, value }) =>
+                field.type === 'number'
+                  ? { pointer: field.pointer, raw: String(value) }
+                  : { pointer: field.pointer, value },
+              ),
+            }
+          : { path, version: file.version, ...(reload ? { reload } : {}), text: raw }
+
+      const answer = await api.adminConfig.save(serverId, body)
+
+      if (answer.pending && answer.write && answer.write.id) {
+        setReport({ ...(answer.report || {}), pending: true, reload: reload || null, files: [] })
+        setWatching({ serverId, id: answer.write.id })
+      } else {
+        setReport(answer.report || null)
+      }
+
+      if (!answer.changed) setError('Nothing changed, so nothing was written.')
+
+      // Re-read either way: a successful reload usually rewrites the file with
+      // the defaults it was missing, and a rollback means what is on disk is no
+      // longer what is on the screen.
+      setFileNonce((n) => n + 1)
+    } catch (err) {
+      setError(err.message || 'That save did not work.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const pending = Object.keys(edits).length
+
+  return (
+    <div style={{ maxWidth: 980 }}>
+      <p className="sans dim" style={{ fontSize: '0.82rem', marginTop: 0 }}>
+        These are the configuration files on the game host itself, read live through the bridge. A
+        save backs the file up, writes it, reloads the plugin you name, and <strong>puts the old
+        file back automatically</strong> if the plugin does not come back. The game’s data
+        directory — kit cooldowns, zone definitions, the permission store — is not settings and is
+        never listed here.
+      </p>
+
+      <Card title="Server" subtitle={`${rows.length} configured`}>
+        <select className="input" value={serverId} onChange={(event) => setServerId(event.target.value)}>
+          <option value="">Choose a server…</option>
+          {rows.map((row) => (
+            <option key={row.id} value={row.id}>
+              {row.name || row.id}
+            </option>
+          ))}
+        </select>
+        {tree && tree.root && (
+          <p className="sans dim" style={{ fontSize: '0.74rem', margin: '10px 0 0' }}>
+            {tree.root}
+            {tree.truncated ? ' · the walk stopped at its limit, so this is not the whole tree' : ''}
+          </p>
+        )}
+      </Card>
+
+      {serverId && treeError && <ErrorState error={treeError} />}
+
+      {serverId && !treeError && !tree && <Loading />}
+
+      {tree && (
+        <Card title="Files" subtitle="grouped by the plugin each one probably belongs to">
+          {tree.plugins.length === 0 && (
+            <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>
+              This server reports no configuration files.
+            </p>
+          )}
+          {tree.plugins.map((group) => (
+            <div key={group.plugin} style={{ padding: '8px 0', borderTop: '1px solid var(--line-soft)' }}>
+              <div style={{ display: 'flex', alignItems: 'baseline', gap: 8 }}>
+                <strong className="sans" style={{ fontSize: '0.88rem', fontWeight: 500 }}>
+                  {group.title || group.plugin}
+                </strong>
+                <span className="sans dim" style={{ fontSize: '0.74rem' }}>
+                  {group.loaded ? `loaded · ${group.version}` : 'not loaded'}
+                  {group.isBridge ? ' · this bridge' : ''}
+                </span>
+              </div>
+              {group.files.map((entry) => (
+                <div
+                  key={entry.path}
+                  style={{ display: 'flex', alignItems: 'center', gap: 10, padding: '4px 0 4px 12px' }}
+                >
+                  <button
+                    type="button"
+                    className={entry.path === path ? 'btn btn-primary' : 'btn btn-ghost'}
+                    disabled={!entry.editable}
+                    onClick={() => {
+                      setPath(entry.path)
+                      setReport(null)
+                      setTier('form')
+                    }}
+                  >
+                    {entry.path}
+                  </button>
+                  <span className="sans dim" style={{ fontSize: '0.72rem' }}>
+                    {Math.round(entry.bytes / 102.4) / 10} KB
+                    {entry.modified ? ` · changed ${ago(entry.modified)}` : ''}
+                    {entry.reason ? ` · ${entry.reason}` : ''}
+                  </span>
+                </div>
+              ))}
+              {!group.loaded && (
+                <Warn>
+                  Nothing on this server is loaded under that name, so a save here is written and
+                  not reloaded. It applies the next time the plugin loads.
+                </Warn>
+              )}
+            </div>
+          ))}
+        </Card>
+      )}
+
+      {path && fileError && <ErrorState error={fileError} />}
+      {path && !fileError && !file && <Loading />}
+
+      {file && (
+        <Card
+          title={file.path}
+          subtitle={tier === 'form' ? `${pending} unsaved` : 'raw JSON'}
+          actions={
+            <>
+              <button
+                type="button"
+                className={tier === 'form' ? 'btn btn-primary' : 'btn btn-ghost'}
+                onClick={() => setTier('form')}
+              >
+                Settings
+              </button>
+              <button
+                type="button"
+                className={tier === 'raw' ? 'btn btn-primary' : 'btn btn-ghost'}
+                onClick={() => setTier('raw')}
+              >
+                Raw JSON
+              </button>
+            </>
+          }
+        >
+          {file.parseError && (
+            <Warn tone="#e05a5a">
+              This file is not valid JSON on the server ({file.parseError}), so there is nothing to
+              draw a form from. Raw JSON is the tier that can fix it.
+            </Warn>
+          )}
+
+          {file.isBridge && (
+            <Warn>
+              This is the bridge’s own configuration. Its address, port and server id are read-only
+              here — changing any of them from the website would cut the link carrying the change,
+              or strand every row this site holds for this server. They are editable on the host
+              itself. This plugin also cannot be reloaded from here.
+            </Warn>
+          )}
+
+          {tier === 'form' && file.fields && (
+            <div style={{ marginTop: 6 }}>
+              {file.fields
+                .filter((field) => field.path !== '')
+                .map((field) => (
+                  <Field
+                    key={field.path}
+                    field={field}
+                    value={
+                      edits[field.path]
+                        ? edits[field.path].value
+                        : field.type === 'number'
+                          ? field.raw
+                          : field.value
+                    }
+                    onChange={change}
+                    revealed={Boolean(revealed[field.path])}
+                    onReveal={(p) => setRevealed((current) => ({ ...current, [p]: !current[p] }))}
+                  />
+                ))}
+            </div>
+          )}
+
+          {tier === 'raw' && (
+            <textarea
+              className="input"
+              spellCheck={false}
+              value={raw}
+              onChange={(event) => setRaw(event.target.value)}
+              style={{ width: '100%', minHeight: 360, fontFamily: 'monospace', fontSize: '0.8rem' }}
+            />
+          )}
+
+          <div
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: 10,
+              marginTop: 12,
+              borderTop: '1px solid var(--line-soft)',
+              paddingTop: 12,
+            }}
+          >
+            <label className="sans dim" style={{ fontSize: '0.78rem' }}>
+              Reload
+            </label>
+            {/* A guess, and it says so. The folder a config sits in is convention
+                rather than contract, so reloading it silently is how the wrong
+                plugin gets reloaded, reports success, and the edited one never
+                re-reads anything. */}
+            <select className="input" value={reload} onChange={(event) => setReload(event.target.value)}>
+              <option value="">nothing — just write the file</option>
+              {(tree ? tree.loaded : [])
+                .filter((p) => p.name !== tree.self)
+                .map((p) => (
+                  <option key={p.name} value={p.name}>
+                    {p.name}
+                  </option>
+                ))}
+            </select>
+            <span style={{ flex: 1 }} />
+            <button
+              type="button"
+              className="btn btn-primary"
+              disabled={busy || Boolean(watching) || (tier === 'form' && pending === 0) || (tier === 'raw' && raw === file.text)}
+              onClick={save}
+            >
+              {busy ? 'Saving…' : watching ? 'Reloading…' : 'Save and reload'}
+            </button>
+          </div>
+
+          {/* Beside the button, not at the top of the page. A save is made at the
+              bottom of a long form, and a refusal rendered above the fold is a
+              click that visibly did nothing. */}
+          {error && (
+            <p className="sans" style={{ color: '#e05a5a', fontSize: '0.82rem', margin: '8px 0 0' }}>
+              {error}
+            </p>
+          )}
+
+          <Report report={report} />
+        </Card>
+      )}
+
+      {serverId && <History serverId={serverId} nonce={fileNonce} />}
+    </div>
+  )
+}
+
+/** Who changed what, including the saves that were refused or undone. */
+function History({ serverId, nonce }) {
+  const { data } = useAsync(() => api.adminConfig.writes(serverId), [serverId, nonce])
+
+  if (!data || !data.writes || data.writes.length === 0) return null
+
+  return (
+    <Card title="Recent changes" subtitle="every save, including the ones that did not land">
+      {data.writes.map((row) => (
+        <div
+          key={row.id}
+          className="sans"
+          style={{ padding: '8px 0', borderTop: '1px solid var(--line-soft)', fontSize: '0.82rem' }}
+        >
+          <div style={{ display: 'flex', gap: 8, alignItems: 'baseline' }}>
+            <strong style={{ fontWeight: 500 }}>{row.path}</strong>
+            <span
+              className="sans"
+              style={{ fontSize: '0.74rem', color: row.outcome === 'applied' ? 'var(--ink)' : '#d08a2a' }}
+            >
+              {row.outcome}
+              {row.reloaded ? ' · reloaded' : ''}
+            </span>
+            <span className="sans dim" style={{ fontSize: '0.72rem' }}>
+              {ago(row.createdAt)}
+              {row.tier === 'raw' ? ' · raw' : ''}
+            </span>
+          </div>
+          {(row.changes || []).map((change, index) => (
+            <div key={`${row.id}-${index}`} className="dim" style={{ fontSize: '0.74rem' }}>
+              {change.path}
+              {change.from !== null && change.to !== null ? `: ${change.from} → ${change.to}` : ''}
+            </div>
+          ))}
+          {row.detail && (
+            <div className="dim" style={{ fontSize: '0.74rem' }}>
+              {row.detail}
+            </div>
+          )}
+        </div>
+      ))}
+    </Card>
+  )
+}

client/src/routes/admin/Permissions.jsx

@@ -0,0 +1,677 @@
+// ── Admin · Rust · Permissions ────────────────────────────────────────────
+//
+// R2's authoring surface, and this module's first admin page.
+//
+// **What is on it is decided by what an operator can get wrong**, rather than by
+// what the tables contain. Four states are invisible from the game and from a
+// list of grants, and every one of them looks exactly like success:
+//
+//   • a grant against somebody who has linked no Steam account — authored,
+//     stored, pushed nowhere;
+//   • a permission no loaded plugin has registered — the grant lands silently
+//     nowhere, because `GrantUserPermission` no-ops for an unregistered name;
+//   • a group member who has never connected — the store has no user record to
+//     put in a group yet, and the membership waits for their first connection;
+//   • a server whose last sync failed — the site is authoritative and the game
+//     has not heard it.
+//
+// So each of those is a sentence on this page rather than a number in a report.
+//
+// The screen never writes to a game. Every button here writes to the site and
+// the mirror's loop reconciles within seconds — except *Sync now*, which runs
+// that pass immediately because an operator who has just changed something
+// should not have to trust a timer to find out that a host is unreachable.
+
+import { useCallback, useState } from 'react'
+
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import { ago } from '../../lib/format.js'
+import api from '../../api.js'
+import ChatStyleSection from './ChatStyle.jsx'
+
+const FLEET = '*'
+
+/** Shared furniture. The kit is nine exports and none of them is a table. */
+function Card({ title, subtitle, children, actions }) {
+  return (
+    <section className="panel" style={{ padding: '16px 18px', marginBottom: 18 }}>
+      <header style={{ display: 'flex', alignItems: 'baseline', gap: 12, marginBottom: 12 }}>
+        <h2 className="display" style={{ fontSize: '1.05rem', margin: 0, color: 'var(--head)' }}>
+          {title}
+        </h2>
+        {subtitle && (
+          <span className="sans dim" style={{ fontSize: '0.76rem' }}>
+            {subtitle}
+          </span>
+        )}
+        <span style={{ flex: 1 }} />
+        {actions}
+      </header>
+      {children}
+    </section>
+  )
+}
+
+function Row({ children, muted = false }) {
+  return (
+    <div
+      className="sans"
+      style={{
+        display: 'flex',
+        alignItems: 'center',
+        gap: 10,
+        padding: '8px 0',
+        borderTop: '1px solid var(--line-soft)',
+        fontSize: '0.86rem',
+        color: muted ? 'var(--ink)' : 'var(--head)',
+      }}
+    >
+      {children}
+    </div>
+  )
+}
+
+function Warn({ children }) {
+  return (
+    <p className="sans" style={{ color: '#d08a2a', fontSize: '0.78rem', margin: '6px 0 0' }}>
+      {children}
+    </p>
+  )
+}
+
+function Scope({ value }) {
+  return (
+    <span className="sans dim" style={{ fontSize: '0.74rem' }}>
+      {value === FLEET ? 'every server' : value}
+    </span>
+  )
+}
+
+/**
+ * One server's mirror state.
+ *
+ * `unresolved` and `pending` are rendered as sentences rather than counts
+ * because each is a different problem with a different fix, and both are
+ * invisible everywhere else on this page.
+ */
+function ServerState({ row, onSync, busy }) {
+  const report = row.report || {}
+  const unresolved = report.unresolved || []
+  const pending = report.pending || []
+  const notLanded = report.notLanded || []
+
+  return (
+    <div style={{ padding: '10px 0', borderTop: '1px solid var(--line-soft)' }}>
+      <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
+        <span className="sans" style={{ color: 'var(--head)', fontSize: '0.9rem' }}>
+          {row.serverId}
+        </span>
+        <span
+          className="sans"
+          style={{ fontSize: '0.76rem', color: row.inSync ? 'var(--ink)' : '#d08a2a' }}
+        >
+          {row.inSync ? 'in sync' : row.state === 'failed' ? 'out of sync' : 'pending'}
+        </span>
+        <span className="sans dim" style={{ fontSize: '0.74rem' }}>
+          {row.lastOkAt ? `last pushed ${ago(row.lastOkAt)}` : 'never pushed'}
+        </span>
+        <span style={{ flex: 1 }} />
+        <button type="button" className="btn btn-ghost" onClick={() => onSync(row.serverId)} disabled={busy}>
+          {busy ? 'Syncing…' : 'Sync now'}
+        </button>
+      </div>
+
+      {row.error && (
+        <p className="sans" style={{ color: '#e05a5a', fontSize: '0.78rem', margin: '4px 0 0' }}>
+          {row.error}
+        </p>
+      )}
+
+      {unresolved.length > 0 && (
+        <Warn>
+          {unresolved.join(', ')} — no plugin loaded on this server has registered{' '}
+          {unresolved.length === 1 ? 'that name' : 'those names'}, so a grant naming{' '}
+          {unresolved.length === 1 ? 'it' : 'them'} reaches nobody here. It will land by itself when
+          the plugin is back.
+        </Warn>
+      )}
+
+      {pending.length > 0 && (
+        <Warn>
+          {pending.length} {pending.length === 1 ? 'membership is' : 'memberships are'} waiting on a
+          first connection — this server has never seen those players, so it has no account to put
+          in a group yet.
+        </Warn>
+      )}
+
+      {notLanded.length > 0 && (
+        <Warn>
+          {notLanded.length} {notLanded.length === 1 ? 'grant was' : 'grants were'} sent and not found
+          in the game's permission store afterwards ({notLanded.slice(0, 5).join(', ')}
+          {notLanded.length > 5 ? ', …' : ''}). They are not counted as pushed, and the next sync
+          tries again.
+        </Warn>
+      )}
+    </div>
+  )
+}
+
+/** A hand edit, with the two answers to it. */
+function DriftRow({ row, onAdopt, onRevoke, busy }) {
+  const subject = row.username ? `${row.username} (${row.subject})` : row.subject
+
+  // Phase 17: a field of a group's chat style somebody changed in game. Adopt
+  // takes the game's value into the style; Revoke puts the site's value back.
+  if (row.kind === 'chat-field') {
+    return (
+      <Row>
+        <span style={{ minWidth: 0, flex: 1 }}>
+          <strong style={{ fontWeight: 500 }}>{row.object}</strong>{' '}
+          <span className="dim" style={{ fontSize: '0.78rem' }}>
+            of group {row.subject}’s chat style is <code>{row.detail === null ? '(empty)' : row.detail}</code> in game ·{' '}
+            {row.serverId} · seen {ago(row.firstSeen)}
+          </span>
+        </span>
+        <button type="button" className="btn btn-ghost" onClick={() => onAdopt(row)} disabled={busy}>
+          Adopt
+        </button>
+        <button type="button" className="btn btn-ghost" onClick={() => onRevoke(row)} disabled={busy}>
+          Put ours back
+        </button>
+      </Row>
+    )
+  }
+
+  return (
+    <Row>
+      <span style={{ minWidth: 0, flex: 1 }}>
+        <strong style={{ fontWeight: 500 }}>{row.object}</strong>{' '}
+        <span className="dim" style={{ fontSize: '0.78rem' }}>
+          {row.kind === 'group-permission' ? `on group ${row.subject}` : `held by ${subject}`} ·{' '}
+          {row.serverId} · seen {ago(row.firstSeen)}
+        </span>
+      </span>
+      <button type="button" className="btn btn-ghost" onClick={() => onAdopt(row)} disabled={busy}>
+        Adopt
+      </button>
+      <button type="button" className="btn btn-ghost" onClick={() => onRevoke(row)} disabled={busy}>
+        Revoke
+      </button>
+    </Row>
+  )
+}
+
+/**
+ * The memberships the game could not place yet, as `steamId:group`.
+ *
+ * Read out of each server's own report, because it is the only thing that knows:
+ * a member who has never connected to a server has no user record there to put
+ * in a group (§12.2 rule 4), and from every other angle they look like a member.
+ * The server strip says how many; this is what puts it next to the person.
+ */
+function pendingSet(servers) {
+  const pending = new Map()
+
+  for (const server of servers) {
+    for (const entry of (server.report && server.report.pending) || []) {
+      if (!pending.has(entry)) pending.set(entry, [])
+      pending.get(entry).push(server.serverId)
+    }
+  }
+
+  return pending
+}
+
+function GroupCard({ group, catalogue, servers, pending, chatFields, onChanged, setError }) {
+  const [busy, setBusy] = useState(false)
+  const [member, setMember] = useState('')
+  const [permission, setPermission] = useState('')
+
+  const act = async (fn) => {
+    setBusy(true)
+    setError('')
+    try {
+      await fn()
+      await onChanged()
+    } catch (err) {
+      setError(err.message || 'That did not work.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const save = (permissions) =>
+    act(() =>
+      api.adminPermissions.saveGroup(group.name, {
+        title: group.title,
+        rank: group.rank,
+        scope: group.scope,
+        permissions,
+      }),
+    )
+
+  // The style is saved with the group, like its permissions (D138). Answers
+  // whether it saved, so the editor stays open on a refusal and shows why.
+  const saveStyle = async (chat) => {
+    setBusy(true)
+    setError('')
+    try {
+      await api.adminPermissions.saveGroup(group.name, {
+        title: group.title,
+        rank: group.rank,
+        scope: group.scope,
+        permissions: group.permissions,
+        chat,
+      })
+      await onChanged()
+      return true
+    } catch (err) {
+      setError(err.message || 'That style did not save.')
+      return false
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Card
+      title={group.title || group.name}
+      subtitle={<>{group.name} · <Scope value={group.scope} /></>}
+      actions={
+        <button
+          type="button"
+          className="btn btn-ghost"
+          disabled={busy}
+          onClick={() => act(() => api.adminPermissions.deleteGroup(group.name))}
+        >
+          Delete
+        </button>
+      }
+    >
+      <div className="field-label">Permissions</div>
+      {group.permissions.length === 0 && (
+        <p className="sans dim" style={{ fontSize: '0.8rem', margin: '4px 0' }}>
+          This group carries nothing, so being in it does nothing.
+        </p>
+      )}
+      {group.permissions.map((perm) => (
+        <Row key={perm}>
+          <span style={{ flex: 1 }}>{perm}</span>
+          {!catalogue.some((entry) => entry.permission === perm) && (
+            <span className="sans" style={{ color: '#d08a2a', fontSize: '0.74rem' }}>
+              no server has registered this
+            </span>
+          )}
+          <button
+            type="button"
+            className="btn btn-ghost"
+            disabled={busy}
+            onClick={() => save(group.permissions.filter((p) => p !== perm))}
+          >
+            Remove
+          </button>
+        </Row>
+      ))}
+
+      <form
+        style={{ display: 'flex', gap: 8, marginTop: 10 }}
+        onSubmit={(event) => {
+          event.preventDefault()
+          if (!permission.trim()) return
+          save([...group.permissions, permission.trim().toLowerCase()])
+          setPermission('')
+        }}
+      >
+        <input
+          list="rust-permission-names"
+          className="input"
+          placeholder="kits.vip"
+          value={permission}
+          onChange={(event) => setPermission(event.target.value)}
+          style={{ flex: 1 }}
+        />
+        <button type="submit" className="btn" disabled={busy}>
+          Add permission
+        </button>
+      </form>
+
+      <div className="field-label" style={{ marginTop: 18 }}>
+        Members
+      </div>
+      {group.members.length === 0 && (
+        <p className="sans dim" style={{ fontSize: '0.8rem', margin: '4px 0' }}>
+          Nobody is in this group.
+        </p>
+      )}
+      {group.members.map((m) => {
+        const waiting = m.accounts
+          .map((account) => pending.get(`${account.steamId}:${group.name}`))
+          .filter(Boolean)
+          .flat()
+
+        return (
+        <Row key={m.userId}>
+          <span style={{ flex: 1 }}>
+            {m.username}
+            {m.accounts.length > 0 ? (
+              <span className="dim" style={{ fontSize: '0.76rem' }}>
+                {' '}
+                · {m.accounts.map((a) => a.name || a.steamId).join(', ')}
+              </span>
+            ) : (
+              <span style={{ color: '#d08a2a', fontSize: '0.76rem' }}>
+                {' '}
+                · has linked no Steam account, so this reaches nobody
+              </span>
+            )}
+            {waiting.length > 0 && (
+              <span style={{ color: '#d08a2a', fontSize: '0.76rem' }}>
+                {' '}
+                · waiting on their first connection to {[...new Set(waiting)].join(', ')}
+              </span>
+            )}
+          </span>
+          <button
+            type="button"
+            className="btn btn-ghost"
+            disabled={busy}
+            onClick={() => act(() => api.adminPermissions.removeMember(group.name, m.userId))}
+          >
+            Remove
+          </button>
+        </Row>
+        )
+      })}
+
+      <form
+        style={{ display: 'flex', gap: 8, marginTop: 10 }}
+        onSubmit={(event) => {
+          event.preventDefault()
+          if (!member.trim()) return
+          act(() => api.adminPermissions.addMember(group.name, member.trim()))
+          setMember('')
+        }}
+      >
+        <input
+          className="input"
+          placeholder="website username"
+          value={member}
+          onChange={(event) => setMember(event.target.value)}
+          style={{ flex: 1 }}
+        />
+        <button type="submit" className="btn" disabled={busy}>
+          Add member
+        </button>
+      </form>
+
+      <ChatStyleSection group={group} fields={chatFields} servers={servers} busy={busy} onSave={saveStyle} />
+
+      {servers.length > 1 && group.scope !== FLEET && (
+        <p className="sans dim" style={{ fontSize: '0.74rem', margin: '10px 0 0' }}>
+          This group exists on {group.scope} only. The other servers never receive it.
+        </p>
+      )}
+    </Card>
+  )
+}
+
+export default function Permissions() {
+  const [reloads, setReloads] = useState(0)
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [form, setForm] = useState({ name: '', title: '', scope: FLEET })
+  const [grant, setGrant] = useState({ username: '', permission: '', scope: FLEET })
+
+  const { data, error: loadError } = useAsync(() => api.adminPermissions.overview(), [reloads])
+  const reload = useCallback(() => setReloads((n) => n + 1), [])
+
+  const act = async (fn) => {
+    setBusy(true)
+    setError('')
+    try {
+      await fn()
+      reload()
+    } catch (err) {
+      setError(err.message || 'That did not work.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  if (loadError) return <ErrorState error={loadError} />
+  if (!data) return <Loading />
+
+  const servers = data.servers || []
+
+  return (
+    <div style={{ maxWidth: 900 }}>
+      {/* No heading of our own: core's admin chrome already draws the route's
+          title above the page, and a second one is the same words twice. */}
+      <p className="sans dim" style={{ fontSize: '0.82rem', marginTop: 0 }}>
+        This site is the author of record. Groups and grants written here are pushed into each
+        server’s own permission store, so every plugin that checks a permission honours them — and a
+        wipe does not lose them, because they are re-pushed when the server comes back.
+      </p>
+
+      {/* The option source, shared by both forms. A datalist rather than a select:
+          a name that no server has registered is still authorable — the plugin
+          may simply not be loaded right now — and the warning beside it is the
+          honest treatment, where a closed list would be a refusal. */}
+      <datalist id="rust-permission-names">
+        {(data.catalogue || []).map((entry) => (
+          <option key={entry.permission} value={entry.permission} />
+        ))}
+      </datalist>
+
+      {error && (
+        <p className="sans" style={{ color: '#e05a5a', fontSize: '0.84rem' }}>
+          {error}
+        </p>
+      )}
+
+      <Card
+        title="Servers"
+        subtitle={`${servers.length} configured`}
+        actions={
+          <button type="button" className="btn btn-ghost" disabled={busy} onClick={() => act(() => api.adminPermissions.sync())}>
+            Sync all
+          </button>
+        }
+      >
+        {servers.length === 0 && (
+          <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>
+            No servers are configured yet, so nothing written here reaches a game.
+          </p>
+        )}
+        {servers.map((row) => (
+          <ServerState
+            key={row.serverId}
+            row={row}
+            busy={busy}
+            onSync={(id) => act(() => api.adminPermissions.sync(id))}
+          />
+        ))}
+      </Card>
+
+      {(data.drift || []).length > 0 && (
+        <Card
+          title="Changed in game"
+          subtitle="granted at a console, not by this site"
+        >
+          <p className="sans dim" style={{ fontSize: '0.8rem', marginTop: 0 }}>
+            Nothing here is undone automatically. <strong>Adopt</strong> records it as the site’s
+            own, so it survives the next wipe; <strong>Revoke</strong> removes it from the game on
+            the next sync. A chat style field changed in game is adopted into the style — which then
+            reaches every server the group does — or put back to the site’s value.
+          </p>
+          {data.drift.map((row) => (
+            <DriftRow
+              key={row.id}
+              row={row}
+              busy={busy}
+              onAdopt={(d) => act(() => api.adminPermissions.adoptDrift(d.id))}
+              onRevoke={(d) => act(() => api.adminPermissions.revokeDrift(d.id))}
+            />
+          ))}
+        </Card>
+      )}
+
+      <Card title="Direct grants" subtitle="one person, one permission">
+        {(data.grants || []).length === 0 && (
+          <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>
+            Nobody holds a permission of their own yet.
+          </p>
+        )}
+        {(data.grants || []).map((row) => (
+          <Row key={row.id}>
+            <span style={{ flex: 1 }}>
+              {row.username} · <strong style={{ fontWeight: 500 }}>{row.permission}</strong>{' '}
+              <Scope value={row.scope} />
+              {row.accounts.length === 0 && (
+                <span style={{ color: '#d08a2a', fontSize: '0.76rem' }}>
+                  {' '}
+                  · has linked no Steam account, so this reaches nobody
+                </span>
+              )}
+              {/* The same warning the group's permission list carries, and it
+                  matters more here: a grant naming a permission nothing has
+                  registered is the failure the plugin's pre-check exists for,
+                  and it is invisible on this row without it. */}
+              {!(data.catalogue || []).some((entry) => entry.permission === row.permission) && (
+                <span style={{ color: '#d08a2a', fontSize: '0.76rem' }}>
+                  {' '}
+                  · no server has registered this permission
+                </span>
+              )}
+              {row.source !== 'admin' && (
+                <span className="dim" style={{ fontSize: '0.74rem' }}> · {row.source}</span>
+              )}
+            </span>
+            <button
+              type="button"
+              className="btn btn-ghost"
+              disabled={busy}
+              onClick={() => act(() => api.adminPermissions.revoke(row.id))}
+            >
+              Remove
+            </button>
+          </Row>
+        ))}
+
+        <form
+          style={{ display: 'flex', gap: 8, marginTop: 12, flexWrap: 'wrap' }}
+          onSubmit={(event) => {
+            event.preventDefault()
+            if (!grant.username.trim() || !grant.permission.trim()) return
+            act(() =>
+              api.adminPermissions.grant({
+                username: grant.username.trim(),
+                permission: grant.permission.trim().toLowerCase(),
+                scope: grant.scope,
+              }),
+            )
+            setGrant({ username: '', permission: '', scope: FLEET })
+          }}
+        >
+          <input
+            className="input"
+            placeholder="website username"
+            value={grant.username}
+            onChange={(event) => setGrant({ ...grant, username: event.target.value })}
+            style={{ flex: '1 1 160px' }}
+          />
+          <input
+            list="rust-permission-names"
+            className="input"
+            placeholder="kits.vip"
+            value={grant.permission}
+            onChange={(event) => setGrant({ ...grant, permission: event.target.value })}
+            style={{ flex: '1 1 160px' }}
+          />
+          <select
+            className="input"
+            value={grant.scope}
+            onChange={(event) => setGrant({ ...grant, scope: event.target.value })}
+          >
+            <option value={FLEET}>every server</option>
+            {servers.map((row) => (
+              <option key={row.serverId} value={row.serverId}>
+                {row.serverId}
+              </option>
+            ))}
+          </select>
+          <button type="submit" className="btn" disabled={busy}>
+            Grant
+          </button>
+        </form>
+      </Card>
+
+      {(data.groups || []).map((group) => (
+        <GroupCard
+          key={group.name}
+          group={group}
+          catalogue={data.catalogue || []}
+          servers={servers}
+          pending={pendingSet(servers)}
+          chatFields={data.chatFields || []}
+          onChanged={reload}
+          setError={setError}
+        />
+      ))}
+
+      <Card title="New group">
+        <form
+          style={{ display: 'flex', gap: 8, flexWrap: 'wrap' }}
+          onSubmit={(event) => {
+            event.preventDefault()
+            if (!form.name.trim()) return
+            act(() =>
+              api.adminPermissions.saveGroup(form.name.trim().toLowerCase(), {
+                title: form.title.trim() || form.name.trim(),
+                scope: form.scope,
+                permissions: [],
+              }),
+            )
+            setForm({ name: '', title: '', scope: FLEET })
+          }}
+        >
+          <input
+            className="input"
+            placeholder="vip"
+            value={form.name}
+            onChange={(event) => setForm({ ...form, name: event.target.value })}
+            style={{ flex: '1 1 140px' }}
+          />
+          <input
+            className="input"
+            placeholder="VIP"
+            value={form.title}
+            onChange={(event) => setForm({ ...form, title: event.target.value })}
+            style={{ flex: '1 1 140px' }}
+          />
+          <select
+            className="input"
+            value={form.scope}
+            onChange={(event) => setForm({ ...form, scope: event.target.value })}
+          >
+            <option value={FLEET}>every server</option>
+            {servers.map((row) => (
+              <option key={row.serverId} value={row.serverId}>
+                {row.serverId}
+              </option>
+            ))}
+          </select>
+          <button type="submit" className="btn" disabled={busy}>
+            Create
+          </button>
+        </form>
+        <p className="sans dim" style={{ fontSize: '0.74rem', margin: '10px 0 0' }}>
+          A group is created in each in-scope game as a real group, so plugins that read group
+          membership see it. A member who has never connected to a server joins it there on their
+          first connection — a direct grant reaches them straight away, which is the difference
+          worth knowing when somebody is waiting.
+        </p>
+      </Card>
+    </div>
+  )
+}

client/src/routes/admin/ServerSettings.jsx

@@ -0,0 +1,414 @@
+// ── Admin · Rust · Servers (phase 16, D133) ───────────────────────────────
+//
+// The page the module did not have. Until phase 16 a server row was written only
+// through `PUT /admin/rust/servers/:id` — D106 recorded it, and the README said
+// "in Admin → Rust, add a server" about a page that did not exist. D130's wipe
+// schedule needed somewhere to be typed, and the org lead chose to build the
+// missing page rather than hang the schedule on the visibility page (D133).
+//
+// One form for adding and editing, because they are one `PUT`. Three rules it
+// keeps from the API:
+//
+//  1. **The token is write-only.** The field is blank on every edit, a blank
+//     save leaves the stored one alone, and the row says whether one is stored.
+//  2. **The protocol a row was configured against is kept.** The `PUT` defaults
+//     an omitted protocol to this build's, so an edit sends the stored value back
+//     rather than silently re-stamping the row.
+//  3. **The wipe schedule is the operator's words, not the forecast.** The form
+//     shows what was stored; the row shows what it computes to, from the same
+//     answer the public pages read.
+//
+// Test and Delete act at once rather than on Save — they are questions put to a
+// sidecar and a removal, not settings.
+//
+// Phase 17 added a server's chat titles and the announcement voice, in
+// `ChatTitles.jsx`, each saved on its own.
+
+import { useState } from 'react'
+
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import api from '../../api.js'
+import { ago, nextWipe } from '../../lib/format.js'
+import { TitlesForm, VoiceCard, integrationsLine, titlesSummary } from './ChatTitles.jsx'
+
+const RULES = [
+  { id: 'none', label: 'No schedule', hint: 'Nothing is forecast, not even the monthly forced wipe.' },
+  { id: 'forced', label: 'Forced wipe only', hint: 'The first Thursday of each month, 19:00 UK time — Facepunch forces it on every server.' },
+  { id: 'weekly', label: 'Weekly', hint: 'Every week on the day and time below, and the forced wipe.' },
+  { id: 'biweekly', label: 'Every other week', hint: 'Every second week, on the weeks the date below falls in, and the forced wipe.' },
+]
+
+const DAYS = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
+
+const SOURCE = { forced: 'the forced wipe', rule: 'its own schedule', once: 'the one-off date' }
+
+/** The browser's own zone — the likeliest answer for an operator typing a time. */
+const localZone = () => {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'
+  } catch {
+    return 'UTC'
+  }
+}
+
+/** Every zone the browser knows, for the datalist; an older browser gets none and a free field. */
+const ZONES = (() => {
+  try {
+    return typeof Intl.supportedValuesOf === 'function' ? Intl.supportedValuesOf('timeZone') : []
+  } catch {
+    return []
+  }
+})()
+
+/** An ISO instant as the value a `datetime-local` input takes, in the browser's clock. */
+/**
+ * What the missing ZoneManager helper costs this server (PLAN_FIXES F12, D182), or
+ * null when there is nothing to say — the helper patched, or a plugin that
+ * reported no ZoneManager state at all. Scoring is never what is lost: the bridge
+ * falls back to the zone's shape. ZoneManager's own flags are.
+ */
+export function zoneHelperNote(helper) {
+  if (!helper || helper.state === 'patched' || helper.state === 'no-zonemanager') return null
+  const cost =
+    'Event zones still score everybody inside, but ZoneManager’s own flags and messages miss a player who was already standing in a zone when it opened or came back after a restart.'
+  if (helper.state === 'missing') {
+    return `The ZoneManager helper (RunicGatewayZones.cs) is not installed. ${cost} Reinstall or update the plugin to put it back.`
+  }
+  return `The ZoneManager helper could not patch this ZoneManager${helper.reason ? ` (${helper.reason})` : ''}. ${cost}`
+}
+
+function toLocalInput(iso) {
+  if (!iso) return ''
+  const d = new Date(iso)
+  if (Number.isNaN(d.getTime())) return ''
+  const pad = (n) => String(n).padStart(2, '0')
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`
+}
+
+function blankForm() {
+  return {
+    isNew: true,
+    id: '',
+    name: '',
+    sidecarBaseUrl: '',
+    sidecarToken: '',
+    enabled: true,
+    sortOrder: 0,
+    protocol: undefined,
+    wipeRule: 'none',
+    wipeDay: 4,
+    wipeTime: '19:00',
+    wipeTz: localZone(),
+    wipeAnchor: '',
+    wipeOnce: '',
+  }
+}
+
+function formFrom(server) {
+  const s = server.schedule || { rule: 'none' }
+  return {
+    isNew: false,
+    id: server.id,
+    name: server.name,
+    sidecarBaseUrl: server.sidecarBaseUrl,
+    sidecarToken: '',
+    enabled: server.enabled,
+    sortOrder: server.sortOrder,
+    protocol: server.protocol,
+    wipeRule: s.rule || 'none',
+    wipeDay: s.day == null ? 4 : s.day,
+    wipeTime: s.time || '19:00',
+    wipeTz: s.tz || localZone(),
+    wipeAnchor: s.anchor || '',
+    wipeOnce: toLocalInput(s.onceAt),
+    storedOnceAt: s.onceAt || null,
+  }
+}
+
+/** The PUT body. The token only when one was typed; the schedule always. */
+function bodyFrom(form) {
+  const weekly = form.wipeRule === 'weekly' || form.wipeRule === 'biweekly'
+  const onceUnchanged = form.storedOnceAt && form.wipeOnce === toLocalInput(form.storedOnceAt)
+  const body = {
+    name: form.name.trim(),
+    sidecarBaseUrl: form.sidecarBaseUrl.trim(),
+    enabled: form.enabled,
+    sortOrder: Number(form.sortOrder) || 0,
+    wipeRule: form.wipeRule,
+    wipeDay: weekly ? Number(form.wipeDay) : null,
+    wipeTime: weekly ? form.wipeTime : null,
+    wipeTz: weekly ? form.wipeTz.trim() : null,
+    wipeAnchor: form.wipeRule === 'biweekly' ? form.wipeAnchor : null,
+    // A past one-off date that was not touched is dropped rather than sent back:
+    // the server refuses a past date on save (it says nothing about the next
+    // wipe), and an operator editing the name must not be stopped by it.
+    wipeOnceAt: !form.wipeOnce || (onceUnchanged && Date.parse(form.storedOnceAt) <= Date.now())
+      ? null
+      : new Date(form.wipeOnce).toISOString(),
+  }
+  if (form.sidecarToken) body.sidecarToken = form.sidecarToken
+  if (form.protocol !== undefined) body.protocol = form.protocol
+  return body
+}
+
+export default function ServerSettings() {
+  const [reloads, setReloads] = useState(0)
+  const { data, error: loadError } = useAsync(() => api.admin.listServers(), [reloads])
+  const [form, setForm] = useState(null)
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [notes, setNotes] = useState({})
+  const [confirming, setConfirming] = useState(null)
+  const [titling, setTitling] = useState(null)
+
+  if (loadError) return <ErrorState error={loadError} />
+  if (!data) return <Loading />
+  const servers = data.servers || []
+
+  const set = (key) => (e) => {
+    const value = e && e.target ? (e.target.type === 'checkbox' ? e.target.checked : e.target.value) : e
+    setForm((f) => ({ ...f, [key]: value }))
+  }
+
+  const save = async (e) => {
+    e.preventDefault()
+    setBusy(true)
+    setError('')
+    try {
+      await api.admin.saveServer(form.id.trim(), bodyFrom(form))
+      setForm(null)
+      setReloads((n) => n + 1)
+    } catch (err) {
+      setError(err.message || 'That did not save.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const test = async (server) => {
+    setNotes((n) => ({ ...n, [server.id]: 'Asking the sidecar…' }))
+    try {
+      const r = await api.admin.testServer(server.id)
+      const sidecar = r.sidecar || {}
+      const text = r.ok
+        ? `The sidecar answered${sidecar.protocol ? ` (protocol ${sidecar.protocol})` : ''}${sidecar.plugin_connected === false ? ', but the game’s plugin is not connected to it' : ''}.`
+        : `The sidecar did not answer: ${r.status}.`
+      setNotes((n) => ({ ...n, [server.id]: text }))
+    } catch (err) {
+      setNotes((n) => ({ ...n, [server.id]: err.message || 'The test did not run.' }))
+    }
+  }
+
+  const mods = async (server) => {
+    setNotes((n) => ({ ...n, [server.id]: 'Asking the game…' }))
+    try {
+      const line = integrationsLine(await api.admin.integrations(server.id))
+      setNotes((n) => ({ ...n, [server.id]: line }))
+    } catch (err) {
+      setNotes((n) => ({ ...n, [server.id]: err.message || 'The game could not be asked.' }))
+    }
+  }
+
+  const remove = async (server) => {
+    setConfirming(null)
+    try {
+      await api.admin.deleteServer(server.id)
+      setReloads((n) => n + 1)
+    } catch (err) {
+      setNotes((n) => ({ ...n, [server.id]: err.message || 'That did not delete.' }))
+    }
+  }
+
+  return (
+    <div style={{ maxWidth: 900 }}>
+      <p className="sans dim" style={{ fontSize: '0.82rem', marginTop: 0 }}>
+        Each Rust server this site follows, the sidecar it answers through, and when it wipes. A server’s sidecar is
+        installed on its own game host; this page tells the site where to find it.
+      </p>
+
+      <section className="panel" style={{ padding: '16px 18px', marginBottom: 18 }}>
+        {servers.length === 0 && (
+          <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>No servers are configured yet.</p>
+        )}
+        {servers.map((s) => (
+          <div key={s.id} className="sans" style={{ borderTop: '1px solid var(--line-soft)', padding: '10px 0', fontSize: '0.84rem' }}>
+            <div style={{ display: 'flex', flexWrap: 'wrap', alignItems: 'baseline', gap: 10 }}>
+              <strong style={{ color: 'var(--head)' }}>{s.name}</strong>
+              <code className="dim" style={{ fontSize: '0.74rem' }}>{s.id}</code>
+              {!s.enabled && <span className="dim" style={{ fontSize: '0.74rem' }}>disabled</span>}
+              <span style={{ marginLeft: 'auto', color: s.online ? 'var(--mode-live, #5fb98a)' : 'var(--dim)' }}>
+                {s.online ? `online · ${s.players}${s.maxPlayers ? `/${s.maxPlayers}` : ''}` : s.reachable ? 'sidecar up, game offline' : 'unreachable'}
+              </span>
+            </div>
+            <div className="dim" style={{ fontSize: '0.76rem', marginTop: 4 }}>
+              {s.sidecarBaseUrl} · {s.hasToken ? 'token stored' : 'no token'} · protocol {s.protocol}
+              {s.sidecarProtocol != null && s.sidecarProtocol !== s.protocol ? ` (sidecar speaks ${s.sidecarProtocol})` : ''}
+              {s.lastSeenAt ? ` · last seen ${ago(s.lastSeenAt)}` : ''}
+            </div>
+            <div className="dim" style={{ fontSize: '0.76rem', marginTop: 2 }}>
+              {s.nextWipe
+                ? `Next wipe ${nextWipe(s.nextWipe)}, from ${SOURCE[s.nextWipe.source] || s.nextWipe.source}.`
+                : 'No wipe schedule set.'}
+            </div>
+            <div className="dim" style={{ fontSize: '0.76rem', marginTop: 2 }}>{titlesSummary(s.titles, s.titlePush)}</div>
+            {zoneHelperNote(s.zoneHelper) && (
+              <div style={{ fontSize: '0.76rem', marginTop: 2, color: 'var(--warn, #d9c184)' }}>{zoneHelperNote(s.zoneHelper)}</div>
+            )}
+            <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8, marginTop: 8 }}>
+              <button type="button" className="btn" onClick={() => { setError(''); setTitling(null); setForm(formFrom(s)) }}>Edit</button>
+              <button type="button" className="btn" onClick={() => test(s)}>Test the sidecar</button>
+              <button type="button" className="btn" onClick={() => { setForm(null); setTitling(s) }}>Chat titles</button>
+              <button type="button" className="btn" onClick={() => mods(s)}>Optional mods</button>
+              {confirming === s.id ? (
+                <>
+                  <button type="button" className="btn" onClick={() => remove(s)}>Delete {s.name} and everything recorded about it</button>
+                  <button type="button" className="btn" onClick={() => setConfirming(null)}>Keep it</button>
+                </>
+              ) : (
+                <button type="button" className="btn" onClick={() => setConfirming(s.id)}>Delete</button>
+              )}
+            </div>
+            {notes[s.id] && <p className="dim" style={{ fontSize: '0.76rem', margin: '6px 0 0' }}>{notes[s.id]}</p>}
+          </div>
+        ))}
+        {!form && (
+          <div style={{ marginTop: 12 }}>
+            <button type="button" className="btn" onClick={() => { setError(''); setForm(blankForm()) }}>Add a server</button>
+          </div>
+        )}
+      </section>
+
+      {form && (
+        <ServerForm form={form} set={set} busy={busy} error={error} onSave={save} onCancel={() => setForm(null)} />
+      )}
+
+      {titling && (
+        <TitlesForm
+          key={titling.id}
+          server={titling}
+          onSaved={() => { setTitling(null); setReloads((n) => n + 1) }}
+          onCancel={() => setTitling(null)}
+        />
+      )}
+
+      <VoiceCard />
+    </div>
+  )
+}
+
+function Field({ label, hint, children }) {
+  return (
+    <label className="sans" style={{ display: 'grid', gap: 4, fontSize: '0.84rem' }}>
+      <span style={{ color: 'var(--head)' }}>{label}</span>
+      {children}
+      {hint && <span className="dim" style={{ fontSize: '0.74rem' }}>{hint}</span>}
+    </label>
+  )
+}
+
+function ServerForm({ form, set, busy, error, onSave, onCancel }) {
+  const weekly = form.wipeRule === 'weekly' || form.wipeRule === 'biweekly'
+  const rule = RULES.find((r) => r.id === form.wipeRule) || RULES[0]
+  const oncePast = form.storedOnceAt && form.wipeOnce === toLocalInput(form.storedOnceAt) && Date.parse(form.storedOnceAt) <= Date.now()
+
+  return (
+    <form onSubmit={onSave} className="panel" style={{ padding: '16px 18px', display: 'grid', gap: 14 }}>
+      <h2 className="display" style={{ fontSize: '1.05rem', margin: 0, color: 'var(--head)' }}>
+        {form.isNew ? 'Add a server' : `Edit ${form.name}`}
+      </h2>
+
+      {form.isNew && (
+        <Field label="Id" hint="Lowercase letters, digits and hyphens. It is in every link to this server and cannot be changed later.">
+          <input value={form.id} onChange={set('id')} required pattern="[a-z0-9][a-z0-9-]{0,63}" style={inputStyle} />
+        </Field>
+      )}
+      <Field label="Name">
+        <input value={form.name} onChange={set('name')} required maxLength={120} style={inputStyle} />
+      </Field>
+      <Field label="Sidecar address" hint="The base URL of the sidecar on the game host, e.g. http://10.0.0.5:8090.">
+        <input value={form.sidecarBaseUrl} onChange={set('sidecarBaseUrl')} required style={inputStyle} />
+      </Field>
+      <Field
+        label="Sidecar token"
+        hint={form.isNew ? 'From the sidecar’s own config. Needed to add a server.' : 'Leave blank to keep the stored token. It is never shown again once saved.'}
+      >
+        <input
+          type="password"
+          autoComplete="new-password"
+          value={form.sidecarToken}
+          onChange={set('sidecarToken')}
+          required={form.isNew}
+          maxLength={512}
+          style={inputStyle}
+        />
+      </Field>
+      <div style={{ display: 'flex', gap: 18, flexWrap: 'wrap' }}>
+        <label className="sans" style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: '0.84rem' }}>
+          <input type="checkbox" checked={form.enabled} onChange={set('enabled')} /> Enabled
+        </label>
+        <Field label="Order">
+          <input type="number" value={form.sortOrder} onChange={set('sortOrder')} min={-1000} max={1000} style={{ ...inputStyle, width: 90 }} />
+        </Field>
+      </div>
+
+      <fieldset style={{ border: '1px solid var(--line-soft)', borderRadius: 8, padding: '12px 14px', display: 'grid', gap: 12 }}>
+        <legend className="sans" style={{ color: 'var(--head)', fontSize: '0.86rem', padding: '0 6px' }}>Wipe schedule</legend>
+        <Field label="Rule" hint={rule.hint}>
+          <select value={form.wipeRule} onChange={set('wipeRule')} style={inputStyle}>
+            {RULES.map((r) => <option key={r.id} value={r.id}>{r.label}</option>)}
+          </select>
+        </Field>
+        {weekly && (
+          <div style={{ display: 'flex', gap: 12, flexWrap: 'wrap' }}>
+            <Field label="Day">
+              <select value={form.wipeDay} onChange={set('wipeDay')} style={inputStyle}>
+                {DAYS.map((d, i) => <option key={d} value={i}>{d}</option>)}
+              </select>
+            </Field>
+            <Field label="Time">
+              <input type="time" value={form.wipeTime} onChange={set('wipeTime')} required style={inputStyle} />
+            </Field>
+            <Field label="Time zone" hint="The zone the time is in. It follows that zone’s summer time.">
+              <input value={form.wipeTz} onChange={set('wipeTz')} list="rust-zones" required style={inputStyle} />
+            </Field>
+          </div>
+        )}
+        {form.wipeRule === 'biweekly' && (
+          <Field label="One wipe on this schedule" hint={`A ${DAYS[form.wipeDay]} the server wiped or will wipe on. It says which weeks are wipe weeks.`}>
+            <input type="date" value={form.wipeAnchor} onChange={set('wipeAnchor')} required style={inputStyle} />
+          </Field>
+        )}
+        <Field
+          label="One-off wipe (optional)"
+          hint="A delayed or extra wipe, in your own clock. While it is in the future it is the next wipe, and anything scheduled before it is skipped."
+        >
+          <span style={{ display: 'flex', gap: 8, alignItems: 'center' }}>
+            <input type="datetime-local" value={form.wipeOnce} onChange={set('wipeOnce')} style={inputStyle} />
+            {form.wipeOnce && <button type="button" className="btn" onClick={() => set('wipeOnce')('')}>Clear</button>}
+          </span>
+        </Field>
+        {oncePast && (
+          <p className="sans dim" style={{ fontSize: '0.76rem', margin: 0 }}>
+            That date has passed, so it no longer changes anything. Saving will clear it.
+          </p>
+        )}
+      </fieldset>
+      <datalist id="rust-zones">{ZONES.map((z) => <option key={z} value={z} />)}</datalist>
+
+      <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
+        <button type="submit" className="btn" disabled={busy}>{busy ? 'Saving…' : 'Save'}</button>
+        <button type="button" className="btn" onClick={onCancel} disabled={busy}>Cancel</button>
+        {error && <span style={{ color: '#d08a2a', fontSize: '0.8rem' }}>{error}</span>}
+      </div>
+    </form>
+  )
+}
+
+const inputStyle = {
+  background: 'var(--panel-flat, transparent)',
+  color: 'var(--text)',
+  border: '1px solid var(--line)',
+  borderRadius: 'var(--radius-input, 6px)',
+  padding: '5px 8px',
+  fontSize: '0.84rem',
+}

client/src/routes/admin/UserRustSections.jsx

@@ -0,0 +1,284 @@
+// ── This module's fill for `admin.users.detail` ───────────────────────────
+//
+// R13's first slot, and the phase criterion as an operator meets it: the Steam
+// id inside core's own user page, under core's own security panel.
+//
+// **The slot hands over `userId` and nothing else** — not a client. So this file
+// builds its own bindings for the routes the server half registered
+// (`api.adminUserLinks`), which is §3.5's rule applied to a slot: the two ends of
+// a call belong to the same module even when the URL between them is core's.
+//
+// **Most users have no Rust account, so most of the time this renders nothing.**
+// A panel that announced "no linked Steam accounts" on every user page in a
+// community that also runs a UO shard would be noise on the overwhelming
+// majority of them. Silence is the honest answer to "what does the Rust module
+// know about this person" when it is nothing.
+
+import { useCallback, useState } from 'react'
+import { ago, count, duration } from '../../lib/format.js'
+import { useAsync } from '../../core.js'
+import api from '../../api.js'
+
+/** Six lines of furniture the §3.4 kit does not carry, so it is vendored. */
+function SectionTitle({ children }) {
+  return (
+    <div className="field-label" style={{ marginBottom: 12, marginTop: 4 }}>
+      {children}
+    </div>
+  )
+}
+
+/** One server's all-time totals for this player. */
+function ServerRow({ server }) {
+  return (
+    <li
+      className="sans"
+      style={{ display: 'flex', justifyContent: 'space-between', gap: 12, fontSize: '0.86rem', color: 'var(--ink)' }}
+    >
+      <span style={{ minWidth: 0, color: 'var(--head)' }}>{server.serverName}</span>
+      <span className="dim" style={{ flex: 'none', fontSize: '0.8rem' }}>
+        {count(server.kills)} kills · {count(server.deaths)} deaths · {duration(server.playtimeSec)}
+        {server.wipes > 1 ? ` · ${server.wipes} wipes` : ''}
+      </span>
+    </li>
+  )
+}
+
+/** One linked Steam account: who it is, when it was linked, and the way out. */
+function LinkPanel({ userId, link, onRemoved }) {
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+
+  async function unlink() {
+    setBusy(true)
+    setError('')
+    try {
+      await api.adminUserLinks.remove(userId, link.steamId)
+      await onRemoved()
+    } catch (err) {
+      setError(err.message || 'Could not unlink that account.')
+      setBusy(false)
+    }
+  }
+
+  return (
+    <div className="panel" style={{ padding: '14px 16px' }}>
+      <div style={{ display: 'flex', alignItems: 'flex-start', gap: 14 }}>
+        <div style={{ minWidth: 0, flex: 1 }}>
+          <div className="display" style={{ fontSize: '1rem', color: 'var(--head)' }}>
+            {link.name || link.steamId}
+          </div>
+          <div className="sans dim" style={{ fontSize: '0.76rem', marginTop: 2 }}>
+            {link.steamId} · linked {ago(link.linkedAt)}
+            {link.serverId ? ` on ${link.serverId}` : ''}
+            {link.lastSeen ? ` · last played ${ago(link.lastSeen)}` : ' · never played'}
+          </div>
+          {/* Worth showing only when they differ: the name on the link is what
+              they were called when they linked, the other is what the game last
+              saw. A rename is the ordinary reason, and an operator reading a
+              support ticket wants both names. */}
+          {link.linkedName && link.name && link.linkedName !== link.name && (
+            <div className="sans dim" style={{ fontSize: '0.72rem', marginTop: 2 }}>
+              Linked as “{link.linkedName}”.
+            </div>
+          )}
+        </div>
+        <button type="button" className="btn btn-ghost" onClick={unlink} disabled={busy} style={{ flex: 'none' }}>
+          {busy ? 'Unlinking…' : 'Unlink'}
+        </button>
+      </div>
+
+      {error && (
+        <p className="sans" style={{ color: '#e05a5a', fontSize: '0.8rem', margin: '8px 0 0' }}>{error}</p>
+      )}
+
+      {link.servers.length > 0 && (
+        <ul
+          style={{
+            listStyle: 'none',
+            margin: '12px 0 0',
+            padding: '12px 0 0',
+            borderTop: '1px solid var(--line-soft)',
+            display: 'flex',
+            flexDirection: 'column',
+            gap: 6,
+          }}
+        >
+          {link.servers.map((server) => (
+            <ServerRow key={server.serverId} server={server} />
+          ))}
+        </ul>
+      )}
+    </div>
+  )
+}
+
+/**
+ * Phase 7's half of the panel: what this person may do in game.
+ *
+ * It renders whenever they hold anything, INCLUDING when they have linked no
+ * Steam account — which is the one case worth going out of the way for. A grant
+ * against an unlinked person is authored, stored, pushed nowhere, and identical
+ * to a working one everywhere except here.
+ */
+function PermissionsPanel({ userId, data, onChanged }) {
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [permission, setPermission] = useState('')
+
+  const act = async (fn) => {
+    setBusy(true)
+    setError('')
+    try {
+      await fn()
+      await onChanged()
+    } catch (err) {
+      setError(err.message || 'That did not work.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  if (!data) return null
+
+  const nothing = data.groups.length === 0 && data.grants.length === 0
+
+  return (
+    <div className="panel" style={{ padding: '14px 16px' }}>
+      <div className="field-label" style={{ marginBottom: 8 }}>
+        Permissions
+      </div>
+
+      {nothing && (
+        <p className="sans dim" style={{ fontSize: '0.8rem', margin: '0 0 8px' }}>
+          Nothing granted.
+        </p>
+      )}
+
+      {data.groups.map((group) => (
+        <div key={group.name} className="sans" style={{ fontSize: '0.84rem', padding: '4px 0' }}>
+          <span style={{ color: 'var(--head)' }}>{group.title || group.name}</span>{' '}
+          <span className="dim" style={{ fontSize: '0.76rem' }}>
+            group · {group.scope === '*' ? 'every server' : group.scope}
+            {group.permissions.length ? ` · ${group.permissions.join(', ')}` : ' · carries nothing'}
+          </span>
+        </div>
+      ))}
+
+      {data.grants.map((row) => (
+        <div
+          key={row.id}
+          className="sans"
+          style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: '0.84rem', padding: '4px 0' }}
+        >
+          <span style={{ flex: 1, color: 'var(--head)' }}>
+            {row.permission}{' '}
+            <span className="dim" style={{ fontSize: '0.76rem' }}>
+              {row.scope === '*' ? 'every server' : row.scope}
+              {row.source !== 'admin' ? ` · ${row.source}` : ''}
+            </span>
+          </span>
+          <button
+            type="button"
+            className="btn btn-ghost"
+            disabled={busy}
+            onClick={() => act(() => api.adminUserPermissions.revoke(userId, row.id))}
+            style={{ flex: 'none' }}
+          >
+            Remove
+          </button>
+        </div>
+      ))}
+
+      {!nothing && data.reaches.length === 0 && (
+        <p className="sans" style={{ color: '#d08a2a', fontSize: '0.78rem', margin: '8px 0 0' }}>
+          This account has linked no Steam id, so none of it reaches a game yet. It will apply by
+          itself when they link.
+        </p>
+      )}
+
+      <form
+        style={{ display: 'flex', gap: 8, marginTop: 10 }}
+        onSubmit={(event) => {
+          event.preventDefault()
+          if (!permission.trim()) return
+          act(() =>
+            api.adminUserPermissions.grant(userId, { permission: permission.trim().toLowerCase() }),
+          )
+          setPermission('')
+        }}
+      >
+        <input
+          className="input"
+          placeholder="kits.vip"
+          value={permission}
+          onChange={(event) => setPermission(event.target.value)}
+          style={{ flex: 1 }}
+        />
+        <button type="submit" className="btn" disabled={busy}>
+          Grant
+        </button>
+      </form>
+
+      {error && (
+        <p className="sans" style={{ color: '#e05a5a', fontSize: '0.8rem', margin: '8px 0 0' }}>
+          {error}
+        </p>
+      )}
+    </div>
+  )
+}
+
+export default function UserRustSections({ userId }) {
+  // Core's `useAsync` has no refresh, so a counter in the deps is how this
+  // re-reads after its own write (the same shape the player page uses).
+  const [reloads, setReloads] = useState(0)
+  const { data } = useAsync(() => api.adminUserLinks.list(userId), [userId, reloads])
+  const { data: permissions } = useAsync(
+    () => api.adminUserPermissions.list(userId),
+    [userId, reloads],
+  )
+  const reload = useCallback(() => setReloads((n) => n + 1), [])
+
+  // No `Loading` and no `ErrorState`, deliberately. This is a section inside
+  // somebody else's page: a spinner on every user page for a module most users
+  // have nothing to do with is worse than a section that appears when it has
+  // something, and a failure here must not replace core's own user detail with an
+  // error card.
+  // **Both reads decide whether this section exists**, and the second one is the
+  // reason. A browser walk found it: a person can hold permissions and have
+  // linked no Steam account — which is exactly the state an operator most needs
+  // to see, because it is the one that reaches nobody — and a section gated on
+  // links alone hides it completely.
+  const holdsSomething =
+    permissions && (permissions.groups.length > 0 || permissions.grants.length > 0)
+
+  if (!data || (data.links.length === 0 && !holdsSomething)) return null
+
+  return (
+    <section style={{ borderTop: '1px solid var(--line-soft)', marginTop: 30, paddingTop: 22 }}>
+      <SectionTitle>Rust</SectionTitle>
+
+      <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
+        {data.links.map((link) => (
+          <LinkPanel key={link.steamId} userId={userId} link={link} onRemoved={reload} />
+        ))}
+
+        {data.links.length > 0 && (
+          <p className="sans dim" style={{ fontSize: '0.74rem', margin: 0 }}>
+            A link is fleet-wide and totals are all-time, summed across every wipe. Unlinking here is
+            recorded in the activity log — it is the way back for a player who linked the wrong
+            account and cannot reach it in game.
+          </p>
+        )}
+
+        {/* Inside the same section rather than beside it: "who is this in game"
+            and "what may they do there" are one question asked twice, and an
+            operator reading a support ticket has both in front of them. The note
+            above belongs to the links, so it sits with them rather than under
+            the panel it would otherwise appear to describe. */}
+        <PermissionsPanel userId={userId} data={permissions} onChanged={reload} />
+      </div>
+    </section>
+  )
+}

client/src/routes/admin/Visibility.jsx

@@ -0,0 +1,570 @@
+// ── Admin · Rust · Visibility ─────────────────────────────────────────────
+//
+// Who may see who is online. The org lead's rule (2026-09-22): nothing names who
+// is online by default — the narrowest audience, staff, unless an operator
+// deliberately widens it here. A count of players is public at every setting.
+//
+// One fleet default and an optional override per server, because a creative or
+// PvE server may reasonably publish a roll call a PvP server must not — and a
+// server that has not chosen follows the fleet, so narrowing the fleet narrows
+// every server that never said otherwise.
+//
+// The page says what "who is online" covers, because it is wider than the tab
+// of the same name: the killfeed, chat and joins in the feed, and the
+// leaderboard's "last seen" all name a player who was on at a given moment.
+//
+// Phase 9 adds a second setting beside it: who may see a CLAN ROSTER (D48). It
+// defaults to the clan's own members and staff, and widening it widens online
+// status too, because a roster row carries it — the page says so. The same card
+// lists each server's clan board: a server whose clans cannot be read, one at
+// the game's 100-clan ceiling (D55), and one running the uMod Clans plugin,
+// whose clans are a separate system and never Teams (D47).
+//
+// Phase 13b adds a third (D104, D106): whether a published news post is also
+// said in each server's in-game chat. Off by default, because core sends every
+// post to every registered leg — without a switch, the day this module updated,
+// every post would start appearing in every server's chat. It lives here because
+// this is the one page that lists every server with a setting of its own.
+//
+// Phase 14 adds the live map's switches (D114): four layers, each with a fleet
+// audience and an optional per-server override, and the own-and-mates switch
+// (D118). Beside each server is what its map picture is, and the two buttons
+// that act at once rather than on Save: Fetch again, and Render now — shown only
+// where there is no picture, with how long it will stall that server (D109).
+
+import { useCallback, useEffect, useState } from 'react'
+
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import api from '../../api.js'
+
+const INHERIT = ''
+
+const LABEL = {
+  staff: 'Staff only',
+  signed_in: 'Signed-in members',
+  public: 'Everyone',
+}
+
+const CLAN_LABEL = {
+  members: 'The clan’s members and staff',
+  signed_in: 'Signed-in members',
+  public: 'Everyone',
+}
+
+const CLAN_DESCRIBE = {
+  members: 'Players whose linked Rust account is in the clan, plus admins and moderators. The default.',
+  signed_in: 'Anybody with an account on this site.',
+  public: 'Anybody at all, signed in or not.',
+}
+
+const DESCRIBE = {
+  staff: 'Admins and moderators. The default.',
+  signed_in: 'Anybody with an account on this site.',
+  public: 'Anybody at all, signed in or not.',
+}
+
+function Card({ title, subtitle, children }) {
+  return (
+    <section className="panel" style={{ padding: '16px 18px', marginBottom: 18 }}>
+      <header style={{ display: 'flex', alignItems: 'baseline', gap: 12, marginBottom: 12 }}>
+        <h2 className="display" style={{ fontSize: '1.05rem', margin: 0, color: 'var(--head)' }}>
+          {title}
+        </h2>
+        {subtitle && (
+          <span className="sans dim" style={{ fontSize: '0.76rem' }}>
+            {subtitle}
+          </span>
+        )}
+      </header>
+      {children}
+    </section>
+  )
+}
+
+function AudienceSelect({ value, onChange, audiences, inherit = null, label }) {
+  return (
+    <select value={value} onChange={(e) => onChange(e.target.value)} style={selectStyle} aria-label={label}>
+      {inherit && <option value={INHERIT}>{inherit}</option>}
+      {audiences.map((a) => (
+        <option key={a} value={a}>{LABEL[a] || a}</option>
+      ))}
+    </select>
+  )
+}
+
+export default function Visibility() {
+  const [reloads, setReloads] = useState(0)
+  const { data, error: loadError } = useAsync(() => api.adminVisibility.read(), [reloads])
+
+  const [fleet, setFleet] = useState('staff')
+  const [clanRoster, setClanRoster] = useState('members')
+  const [servers, setServers] = useState({})
+  const [news, setNews] = useState({})
+  const [delivery, setDelivery] = useState({})
+  const [mapFleet, setMapFleet] = useState({})
+  const [mapServers, setMapServers] = useState({})
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [saved, setSaved] = useState(false)
+
+  // The form starts from what the server said and is reset from it after every
+  // save — the answer to a PUT is the new state, so what is on screen is always
+  // the site's word rather than what this page sent.
+  const load = useCallback((state) => {
+    setFleet(state.presence.fleet)
+    setClanRoster((state.clans && state.clans.roster) || 'members')
+    setServers(Object.fromEntries(state.presence.servers.map((s) => [s.id, s.override || INHERIT])))
+    setNews(Object.fromEntries(((state.news && state.news.servers) || []).map((s) => [s.id, Boolean(s.on)])))
+    setDelivery(Object.fromEntries(((state.news && state.news.servers) || []).map((s) => [s.id, s.delivery || 'chat'])))
+    if (state.map) {
+      setMapFleet({ ...state.map.fleet })
+      setMapServers(Object.fromEntries(state.map.servers.map((s) => [s.id, mapOverridesToForm(s.overrides)])))
+    }
+  }, [])
+
+  useEffect(() => {
+    if (data) load(data)
+  }, [data, load])
+
+  if (loadError) return <ErrorState error={loadError} />
+  if (!data) return <Loading />
+
+  const audiences = data.audiences
+  const rows = data.presence.servers
+
+  const dirtyFleet = fleet !== data.presence.fleet
+  const dirtyServers = rows.filter((s) => (servers[s.id] ?? INHERIT) !== (s.override || INHERIT))
+  const clans = data.clans || { audiences: [], roster: 'members', servers: [] }
+  const dirtyClans = clanRoster !== clans.roster
+  const newsRows = (data.news && data.news.servers) || []
+  const dirtyNews = newsRows.filter((s) => Boolean(news[s.id]) !== Boolean(s.on))
+  const dirtyDelivery = newsRows.filter((s) => (delivery[s.id] || 'chat') !== (s.delivery || 'chat'))
+  const mapCard = data.map || null
+  const mapChanges = mapCard ? mapDiff(mapCard, mapFleet, mapServers) : null
+  const dirtyMap = Boolean(mapChanges)
+  const dirty = dirtyFleet || dirtyServers.length > 0 || dirtyClans || dirtyNews.length > 0 || dirtyDelivery.length > 0 || dirtyMap
+
+  const effective = (id) => servers[id] || fleet
+  const widened = fleet !== 'staff' || rows.some((s) => effective(s.id) !== 'staff')
+
+  const save = async (e) => {
+    e.preventDefault()
+    setBusy(true)
+    setError('')
+    setSaved(false)
+    try {
+      const body = {}
+      if (dirtyFleet) body.fleet = fleet
+      if (dirtyClans) body.clanRoster = clanRoster
+      if (dirtyServers.length) {
+        body.servers = Object.fromEntries(dirtyServers.map((s) => [s.id, servers[s.id] || null]))
+      }
+      if (dirtyNews.length) body.news = Object.fromEntries(dirtyNews.map((s) => [s.id, Boolean(news[s.id])]))
+      if (dirtyDelivery.length) body.newsDelivery = Object.fromEntries(dirtyDelivery.map((s) => [s.id, delivery[s.id] || 'chat']))
+      if (dirtyMap) body.map = mapChanges
+      load(await api.adminVisibility.save(body))
+      setSaved(true)
+      setReloads((n) => n + 1)
+    } catch (err) {
+      setError(err.message || 'That did not save.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <form onSubmit={save} style={{ maxWidth: 900 }}>
+      <p className="sans dim" style={{ fontSize: '0.82rem', marginTop: 0 }}>
+        Nothing on this site names who is online unless you choose to show it. That covers more than
+        the Online tab: the joins, deaths and chat in each server’s feed, and the leaderboard’s “last
+        seen”, all say that a named player was on at a given moment. How many players are online is
+        always shown.
+      </p>
+
+      <Card title="Who is online" subtitle="the default for every server">
+        <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 12, fontSize: '0.86rem' }}>
+          <AudienceSelect value={fleet} onChange={setFleet} audiences={audiences} label="Fleet default" />
+          <span className="dim" style={{ fontSize: '0.78rem' }}>{DESCRIBE[fleet]}</span>
+        </div>
+      </Card>
+
+      <Card title="Per server" subtitle="an override, or the default above">
+        {rows.length === 0 && (
+          <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>No servers are configured yet.</p>
+        )}
+        {rows.map((s) => (
+          <div
+            key={s.id}
+            className="sans"
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: 12,
+              padding: '8px 0',
+              borderTop: '1px solid var(--line-soft)',
+              fontSize: '0.86rem',
+            }}
+          >
+            <span style={{ minWidth: 180, color: 'var(--head)' }}>
+              {s.name}
+              {!s.enabled && <span className="dim" style={{ fontSize: '0.74rem' }}> · disabled</span>}
+            </span>
+            <AudienceSelect
+              value={servers[s.id] ?? INHERIT}
+              onChange={(v) => setServers((prev) => ({ ...prev, [s.id]: v }))}
+              audiences={audiences}
+              inherit={`Default (${LABEL[fleet] || fleet})`}
+              label={`Who is online on ${s.name}`}
+            />
+            <span className="dim" style={{ fontSize: '0.78rem' }}>
+              {servers[s.id] ? 'its own setting' : 'follows the default'}
+            </span>
+          </div>
+        ))}
+      </Card>
+
+      {widened && (
+        <p className="sans" style={{ color: '#d08a2a', fontSize: '0.8rem' }}>
+          Wider than staff: on a PvP server, knowing who is on tells a raiding party whose base is
+          undefended.
+        </p>
+      )}
+
+      <Card title="Clan rosters" subtitle="who is in each clan, on every server">
+        <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 12, fontSize: '0.86rem' }}>
+          <select
+            value={clanRoster}
+            onChange={(e) => setClanRoster(e.target.value)}
+            style={selectStyle}
+            aria-label="Who may see a clan roster"
+          >
+            {clans.audiences.map((a) => (
+              <option key={a} value={a}>{CLAN_LABEL[a] || a}</option>
+            ))}
+          </select>
+          <span className="dim" style={{ fontSize: '0.78rem' }}>{CLAN_DESCRIBE[clanRoster]}</span>
+        </div>
+        <p className="sans dim" style={{ fontSize: '0.78rem', margin: '10px 0 0' }}>
+          Each clan’s name, colour, score and member count are always public.
+        </p>
+        {clanRoster !== 'members' && (
+          <p className="sans" style={{ color: '#d08a2a', fontSize: '0.8rem', margin: '8px 0 0' }}>
+            A roster also shows which members are online right now, so this shows who is on to{' '}
+            {clanRoster === 'public' ? 'everyone' : 'every signed-in member'} as well.
+          </p>
+        )}
+        <ClanBoards servers={clans.servers || []} />
+      </Card>
+
+      <Card title="News in game chat" subtitle="a published news post, said in each server’s chat">
+        <p className="sans dim" style={{ fontSize: '0.8rem', margin: '0 0 8px' }}>
+          When a news post is published, its title is said in the chat of every server switched on
+          here. A server that is down when a post is published is skipped rather than told late. A popup
+          needs PopupNotifications on that server; one without it refuses the post and says why.
+        </p>
+        {newsRows.length === 0 && (
+          <p className="sans dim" style={{ fontSize: '0.82rem', margin: 0 }}>No servers are configured yet.</p>
+        )}
+        {newsRows.map((s) => (
+          <label
+            key={s.id}
+            className="sans"
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: 12,
+              padding: '8px 0',
+              borderTop: '1px solid var(--line-soft)',
+              fontSize: '0.86rem',
+              cursor: 'pointer',
+            }}
+          >
+            <input
+              type="checkbox"
+              checked={Boolean(news[s.id])}
+              onChange={(e) => setNews((prev) => ({ ...prev, [s.id]: e.target.checked }))}
+              aria-label={`Say news in ${s.name}’s chat`}
+            />
+            <span style={{ minWidth: 180, color: 'var(--head)' }}>
+              {s.name}
+              {!s.enabled && <span className="dim" style={{ fontSize: '0.74rem' }}> · disabled</span>}
+            </span>
+            <span className="dim" style={{ fontSize: '0.78rem' }}>{news[s.id] ? 'says news' : 'off'}</span>
+            {/* D142: where the post goes on this server when it is switched on. */}
+            <select
+              value={delivery[s.id] || 'chat'}
+              onChange={(e) => setDelivery((prev) => ({ ...prev, [s.id]: e.target.value }))}
+              disabled={!news[s.id]}
+              aria-label={`Where news goes on ${s.name}`}
+              style={{ marginLeft: 'auto', background: 'var(--panel-flat, transparent)', color: 'var(--text)', border: '1px solid var(--line)', borderRadius: 'var(--radius-input, 6px)', padding: '3px 6px', fontSize: '0.8rem' }}
+            >
+              <option value="chat">in chat</option>
+              <option value="popup">as a popup</option>
+            </select>
+          </label>
+        ))}
+      </Card>
+
+      {mapCard && (
+        <MapCard
+          card={mapCard}
+          audiences={audiences}
+          presenceOf={(id) => effective(id)}
+          fleet={mapFleet}
+          setFleet={setMapFleet}
+          servers={mapServers}
+          setServers={setMapServers}
+          onActed={() => setReloads((n) => n + 1)}
+        />
+      )}
+
+      <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
+        <button type="submit" className="btn" disabled={busy || !dirty}>
+          {busy ? 'Saving…' : 'Save'}
+        </button>
+        {saved && !dirty && <span className="dim" style={{ fontSize: '0.8rem' }}>Saved.</span>}
+        {error && <span style={{ color: '#d08a2a', fontSize: '0.8rem' }}>{error}</span>}
+      </div>
+    </form>
+  )
+}
+
+/**
+ * What each server's clan board says about itself. Only the servers with
+ * something to report are listed: a board that is current, complete and read
+ * normally is the case that needs no sentence.
+ */
+function ClanBoards({ servers }) {
+  const notes = []
+  for (const s of servers) {
+    if (s.umodClans) {
+      notes.push([s, 'is running the uMod Clans plugin. Its clans are a separate system from the game’s own, and only the game’s clans appear on this site.'])
+    }
+    if (!s.supported) {
+      notes.push([s, s.reason ? `cannot report its clans: ${s.reason}.` : 'has not reported its clans yet.'])
+    } else if (s.truncated) {
+      notes.push([s, 'is at the game’s limit of 100 listed clans, so clans beyond the top 100 by score are not shown, and a disbanded clan is not removed until it drops below.'])
+    } else if (!s.fresh) {
+      notes.push([s, 'has not reported its clans recently, so they are shown as last reported.'])
+    }
+  }
+  if (!notes.length) return null
+  return (
+    <ul className="sans" style={{ margin: '12px 0 0', paddingLeft: 18, fontSize: '0.8rem' }}>
+      {notes.map(([s, text], i) => (
+        // eslint-disable-next-line react/no-array-index-key
+        <li key={`${s.id}-${i}`} style={{ margin: '4px 0' }}>
+          <strong style={{ color: 'var(--head)' }}>{s.name}</strong> {text}
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+const selectStyle = {
+  background: 'var(--panel-flat, transparent)',
+  color: 'var(--text)',
+  border: '1px solid var(--line)',
+  borderRadius: 'var(--radius-input, 6px)',
+  padding: '4px 8px',
+  fontSize: '0.84rem',
+}
+
+// ── The live map (phase 14) ───────────────────────────────────────────────
+
+const MAP_LAYERS = [
+  { id: 'world', label: 'Monuments & world events', hint: 'Cargo, helicopters, Bradley, supply drops, locked crates.' },
+  { id: 'events', label: 'Site events', hint: 'The zones, crates and NPCs this site’s events placed, while they run.' },
+  { id: 'players', label: 'Players', hint: 'Where everybody is, with names, and the sleepers.' },
+  { id: 'bases', label: 'Bases', hint: 'Tool cupboards and vending machines, as positions only.' },
+]
+
+const RANK = { public: 0, signed_in: 1, staff: 2 }
+
+/** A server's overrides as form values: '' follows the fleet, mates is 'on' / 'off'. */
+function mapOverridesToForm(overrides) {
+  const form = {}
+  for (const l of MAP_LAYERS) form[l.id] = overrides[l.id] || INHERIT
+  form.mates = overrides.mates === null || overrides.mates === undefined ? INHERIT : overrides.mates ? 'on' : 'off'
+  return form
+}
+
+/** What the form changed, in the shape the PUT takes, or null when nothing did. */
+function mapDiff(card, fleet, servers) {
+  const out = {}
+  const fleetChanges = {}
+  for (const key of [...MAP_LAYERS.map((l) => l.id), 'mates']) {
+    if (key in fleet && fleet[key] !== card.fleet[key]) fleetChanges[key] = fleet[key]
+  }
+  if (Object.keys(fleetChanges).length) out.fleet = fleetChanges
+
+  const serverChanges = {}
+  for (const s of card.servers) {
+    const before = mapOverridesToForm(s.overrides)
+    const now = servers[s.id] || before
+    const changed = {}
+    for (const key of Object.keys(before)) {
+      if (now[key] === before[key]) continue
+      if (key === 'mates') changed.mates = now.mates === INHERIT ? null : now.mates === 'on'
+      else changed[key] = now[key] === INHERIT ? null : now[key]
+    }
+    if (Object.keys(changed).length) serverChanges[s.id] = changed
+  }
+  if (Object.keys(serverChanges).length) out.servers = serverChanges
+  return Object.keys(out).length ? out : null
+}
+
+function MapCard({ card, audiences, presenceOf, fleet, setFleet, servers, setServers, onActed }) {
+  const [acting, setActing] = useState(null)
+  const [notes, setNotes] = useState({})
+
+  // Fetch again and Render now act at once rather than on Save: they are
+  // questions put to a game server, not settings.
+  const act = async (server, kind) => {
+    setActing(`${server.id}:${kind}`)
+    setNotes((n) => ({ ...n, [server.id]: '' }))
+    try {
+      if (kind === 'fetch') {
+        const r = await api.admin.fetchMap(server.id)
+        setNotes((n) => ({ ...n, [server.id]: r.message || `Fetched: ${r.outcome}.` }))
+      } else {
+        const r = await api.admin.renderMap(server.id)
+        setNotes((n) => ({
+          ...n,
+          [server.id]: `The server is drawing its map now — about ${r.stallSeconds} seconds of stall. The picture appears here when it is done.`,
+        }))
+      }
+      onActed()
+    } catch (err) {
+      setNotes((n) => ({ ...n, [server.id]: err.message || 'That did not work.' }))
+    } finally {
+      setActing(null)
+    }
+  }
+
+  return (
+    <Card title="The live map" subtitle="what each server’s map shows, and to whom">
+      <p className="sans dim" style={{ fontSize: '0.8rem', margin: '0 0 10px' }}>
+        The picture of the map is always public: it is drawn from the map seed and says nothing about who plays.
+        Everything that moves on it is a layer, and each layer has its own audience. The players layer can never
+        show more than who is online does, whatever it is set to here.
+      </p>
+
+      <div
+        className="sans"
+        style={{ display: 'grid', gridTemplateColumns: 'minmax(180px, 1fr) auto', gap: '6px 12px', alignItems: 'center', fontSize: '0.86rem' }}
+      >
+        {MAP_LAYERS.map((l) => (
+          <FleetRow key={l.id} label={l.label} hint={l.hint}>
+            <AudienceSelect
+              value={fleet[l.id] || 'staff'}
+              onChange={(v) => setFleet((f) => ({ ...f, [l.id]: v }))}
+              audiences={audiences}
+              label={`${l.label}: fleet default`}
+            />
+          </FleetRow>
+        ))}
+        <FleetRow label="You and your clan" hint="A linked player sees themselves and their online clan mates, whatever the players layer says.">
+          <select
+            value={fleet.mates ? 'on' : 'off'}
+            onChange={(e) => setFleet((f) => ({ ...f, mates: e.target.value === 'on' }))}
+            style={selectStyle}
+            aria-label="You and your clan: fleet default"
+          >
+            <option value="on">On</option>
+            <option value="off">Off</option>
+          </select>
+        </FleetRow>
+      </div>
+
+      {card.servers.length === 0 && (
+        <p className="sans dim" style={{ fontSize: '0.82rem', margin: '12px 0 0' }}>No servers are configured yet.</p>
+      )}
+
+      {card.servers.map((s) => {
+        const form = servers[s.id] || mapOverridesToForm(s.overrides)
+        const set = (key, value) => setServers((prev) => ({ ...prev, [s.id]: { ...form, [key]: value } }))
+        const players = form.players || fleet.players
+        const presence = presenceOf(s.id)
+        const capped = RANK[players] < RANK[presence]
+        const noPicture = !s.picture || !s.picture.hasPicture
+
+        return (
+          <div key={s.id} className="sans" style={{ borderTop: '1px solid var(--line-soft)', padding: '10px 0', fontSize: '0.84rem' }}>
+            <div style={{ color: 'var(--head)', marginBottom: 6 }}>
+              {s.name}
+              {!s.enabled && <span className="dim" style={{ fontSize: '0.74rem' }}> · disabled</span>}
+            </div>
+            <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8, alignItems: 'center' }}>
+              {MAP_LAYERS.map((l) => (
+                <label key={l.id} className="dim" style={{ display: 'inline-flex', flexDirection: 'column', gap: 2, fontSize: '0.74rem' }}>
+                  {l.label}
+                  <AudienceSelect
+                    value={form[l.id]}
+                    onChange={(v) => set(l.id, v)}
+                    audiences={audiences}
+                    inherit={`Default (${LABEL[fleet[l.id]] || fleet[l.id]})`}
+                    label={`${l.label} on ${s.name}`}
+                  />
+                </label>
+              ))}
+              <label className="dim" style={{ display: 'inline-flex', flexDirection: 'column', gap: 2, fontSize: '0.74rem' }}>
+                You and your clan
+                <select value={form.mates} onChange={(e) => set('mates', e.target.value)} style={selectStyle} aria-label={`You and your clan on ${s.name}`}>
+                  <option value={INHERIT}>{`Default (${fleet.mates ? 'On' : 'Off'})`}</option>
+                  <option value="on">On</option>
+                  <option value="off">Off</option>
+                </select>
+              </label>
+            </div>
+            {capped && (
+              <p className="dim" style={{ fontSize: '0.76rem', margin: '6px 0 0' }}>
+                Players will be shown to {(LABEL[presence] || presence).toLowerCase()} on this server, because that is who may see who is online.
+              </p>
+            )}
+            <div style={{ display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 10, marginTop: 8, fontSize: '0.78rem' }}>
+              <span className="dim">{describePicture(s.picture)}</span>
+              <button type="button" className="btn" disabled={Boolean(acting) || s.fetching} onClick={() => act(s, 'fetch')}>
+                {acting === `${s.id}:fetch` || s.fetching ? 'Fetching…' : 'Fetch again'}
+              </button>
+              {noPicture && (
+                <button type="button" className="btn" disabled={Boolean(acting) || s.rendering} onClick={() => act(s, 'render')}>
+                  {s.rendering ? 'Drawing…' : 'Render now'}
+                </button>
+              )}
+            </div>
+            {noPicture && (
+              <p style={{ color: '#d08a2a', fontSize: '0.76rem', margin: '6px 0 0' }}>
+                Render now makes the game draw its own map, which stops that server for about {s.renderStallSeconds} seconds —
+                nobody on it can move while it draws. A server with Rust+ switched on (<code>app.port</code>) never needs it.
+              </p>
+            )}
+            {(notes[s.id] || s.lastError) && (
+              <p className="dim" style={{ fontSize: '0.76rem', margin: '6px 0 0' }}>{notes[s.id] || s.lastError}</p>
+            )}
+          </div>
+        )
+      })}
+    </Card>
+  )
+}
+
+function FleetRow({ label, hint, children }) {
+  return (
+    <>
+      <span>
+        <span style={{ color: 'var(--head)' }}>{label}</span>
+        <span className="dim" style={{ display: 'block', fontSize: '0.74rem' }}>{hint}</span>
+      </span>
+      {children}
+    </>
+  )
+}
+
+function describePicture(pic) {
+  if (!pic) return 'The server has not described its map yet.'
+  if (!pic.hasPicture) return `Map ${pic.mapKey}: the game has no picture of it.`
+  const from = pic.source === 'companion' ? 'from Rust+' : 'drawn on request'
+  const kb = Math.round((pic.bytes || 0) / 1024)
+  return `Map ${pic.mapKey}: picture ${from}, ${pic.width} × ${pic.height}, ${kb} KB${pic.fetchedAt ? `, fetched ${new Date(pic.fetchedAt).toLocaleString()}` : ''}.`
+}

client/src/routes/player/Account.jsx

@@ -0,0 +1,331 @@
+// ── The player's own Rust identity ────────────────────────────────────────
+//
+// `/player/rust` — where a signed-in player links the Steam account they play
+// on. It is the one page in this module a player is asked to *do* something on,
+// and the thing they are doing matters more than it looks: from phase 7 the link
+// is what in-game permissions are granted against, and from phase 13 it is what
+// rewards are handed to.
+//
+// **A player route renders no layout of its own.** Core wraps `/player/*` in its
+// own portal chrome, so this page starts at a heading — unlike the public pages
+// in this module, which render `PublicLayout` themselves.
+//
+// The three-step instruction at the top is not decoration. Nothing else on the
+// site tells a player that the code comes from the game, and a code field with no
+// explanation is a code field nobody can use.
+
+import { useCallback, useState } from 'react'
+import { ErrorState, Loading, useAsync } from '../../core.js'
+import { ago, shortId } from '../../lib/format.js'
+import api from '../../api.js'
+
+/** The code field, and the four answers it can produce. */
+function LinkForm({ onLinked }) {
+  const [code, setCode] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState('')
+  const [error, setError] = useState('')
+
+  async function submit(event) {
+    event.preventDefault()
+    if (!code.trim() || busy) return
+
+    setBusy(true)
+    setMessage('')
+    setError('')
+
+    try {
+      const result = await api.playerLinks.confirm(code.trim())
+      setMessage(
+        result.already
+          ? 'That account was already linked to you.'
+          : `Linked ${result.link.name || shortId(result.link.steamId)}.`,
+      )
+      setCode('')
+      await onLinked()
+    } catch (err) {
+      // Every refusal the server sends is already a sentence aimed at a player —
+      // "run /link again", "run /unlink in game", "try again in a minute" — so
+      // this renders it rather than replacing it with one of its own. The three
+      // are not interchangeable, and a page that flattened them into "could not
+      // link that code" would send a player back to the server that is down.
+      setError(err.message || 'Could not link that code.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <form onSubmit={submit} style={{ marginTop: 18 }}>
+      <div style={{ display: 'flex', gap: 10, alignItems: 'flex-end', flexWrap: 'wrap' }}>
+        <label style={{ display: 'block' }}>
+          <span className="field-label" style={{ display: 'block', marginBottom: 6 }}>Link code</span>
+          <input
+            value={code}
+            onChange={(e) => setCode(e.target.value.toUpperCase())}
+            placeholder="K7M2PQ"
+            // The plugin's alphabet has no O, 0, I or 1, so a player reading a
+            // code off their screen cannot produce one — but they can type a
+            // lowercase one, and the code is matched case-insensitively at the
+            // other end. Upper-casing here makes what they typed look like what
+            // they were shown.
+            maxLength={12}
+            autoComplete="off"
+            spellCheck={false}
+            className="input"
+            style={{ textTransform: 'uppercase', letterSpacing: '0.18em', width: 160 }}
+          />
+        </label>
+        <button type="submit" className="btn" disabled={busy || !code.trim()}>
+          {busy ? 'Checking…' : 'Link account'}
+        </button>
+      </div>
+
+      {message && (
+        <p className="sans" style={{ color: '#7fd0a4', fontSize: '0.86rem', margin: '10px 0 0' }}>{message}</p>
+      )}
+      {error && (
+        <p className="sans" style={{ color: '#e05a5a', fontSize: '0.86rem', margin: '10px 0 0' }}>{error}</p>
+      )}
+    </form>
+  )
+}
+
+/** One linked account, and the control that releases it. */
+function LinkRow({ link, onRemoved }) {
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+
+  async function remove() {
+    setBusy(true)
+    setError('')
+    try {
+      await api.playerLinks.remove(link.steamId)
+      await onRemoved()
+    } catch (err) {
+      setError(err.message || 'Could not unlink that account.')
+      setBusy(false)
+    }
+  }
+
+  return (
+    <li className="panel" style={{ padding: '14px 16px', display: 'flex', alignItems: 'center', gap: 14 }}>
+      <div style={{ minWidth: 0, flex: 1 }}>
+        <div className="display" style={{ fontSize: '1rem', color: 'var(--head)' }}>
+          {link.name || shortId(link.steamId)}
+        </div>
+        <div className="sans dim" style={{ fontSize: '0.76rem', marginTop: 2 }}>
+          {link.steamId} · linked {ago(link.linkedAt)}
+          {link.serverId ? ` on ${link.serverId}` : ''}
+        </div>
+        {error && (
+          <p className="sans" style={{ color: '#e05a5a', fontSize: '0.8rem', margin: '6px 0 0' }}>{error}</p>
+        )}
+      </div>
+      <button type="button" className="btn btn-ghost" onClick={remove} disabled={busy} style={{ flex: 'none' }}>
+        {busy ? 'Unlinking…' : 'Unlink'}
+      </button>
+    </li>
+  )
+}
+
+/**
+ * Where an entitlement has actually landed.
+ *
+ * The server resolves the scope and marks each server, so this renders an answer
+ * rather than working one out — `*` means nothing to a player, and a second
+ * implementation of the scope arithmetic on the client is a second thing to keep
+ * true (see `forPlayer` in the permission model).
+ */
+function Reach({ reach }) {
+  if (!reach.length) {
+    return (
+      <span className="sans dim" style={{ fontSize: '0.76rem' }}>
+        No servers are configured yet
+      </span>
+    )
+  }
+
+  return (
+    <div className="sans" style={{ display: 'flex', flexWrap: 'wrap', gap: 8, fontSize: '0.76rem' }}>
+      {reach.map((server) => (
+        <span
+          key={server.id}
+          style={{
+            border: '1px solid var(--line, rgba(255,255,255,0.14))',
+            borderRadius: 999,
+            padding: '2px 10px',
+            color: server.live ? 'var(--head)' : undefined,
+            opacity: server.live ? 1 : 0.65,
+          }}
+        >
+          {/* The word, not only the dot. A filled circle beside a hollow one is
+              the whole difference between "you have this in game" and "you do
+              not yet", which is more than a shape should have to carry — and a
+              reader who cannot tell the two apart gets no answer at all. */}
+          {server.live ? '● ' : '○ '}
+          {server.name} · {server.live ? 'has it' : 'waiting'}
+        </span>
+      ))}
+    </div>
+  )
+}
+
+/** One group or one direct grant, drawn the same way because they read the same. */
+function HeldRow({ title, subtitle, permissions, reach }) {
+  return (
+    <li className="panel" style={{ padding: '14px 16px' }}>
+      <div className="display" style={{ fontSize: '1rem', color: 'var(--head)' }}>{title}</div>
+
+      {subtitle && (
+        <div className="sans dim" style={{ fontSize: '0.76rem', marginTop: 2 }}>{subtitle}</div>
+      )}
+
+      {permissions && permissions.length > 0 && (
+        <div className="sans dim" style={{ fontSize: '0.78rem', marginTop: 8 }}>
+          {permissions.join(' · ')}
+        </div>
+      )}
+
+      <div style={{ marginTop: 10 }}>
+        <Reach reach={reach} />
+      </div>
+    </li>
+  )
+}
+
+/**
+ * What the site has given this player in game.
+ *
+ * Its own read, not part of the links read: an entitlement exists whether or not
+ * a Steam account is linked, and a player who has just been given something and
+ * has not linked yet is exactly the person who needs to see both halves at once.
+ */
+function Held({ accounts }) {
+  const { data, loading, error } = useAsync(() => api.playerPermissions.list(), [])
+
+  if (loading) return <Loading />
+  if (error) return <ErrorState error={error} />
+
+  const groups = data.groups || []
+  const grants = data.grants || []
+
+  if (!groups.length && !grants.length) {
+    return (
+      <p className="sans dim" style={{ fontSize: '0.8rem', margin: 0, maxWidth: '60ch' }}>
+        Nothing yet. Ranks and rewards this site hands out show up here, and reach you in game on
+        the servers they cover.
+      </p>
+    )
+  }
+
+  const waiting = [...groups, ...grants].some((entry) => entry.reach.some((server) => !server.live))
+
+  return (
+    <>
+      <ul style={{ listStyle: 'none', margin: 0, padding: 0, display: 'flex', flexDirection: 'column', gap: 10 }}>
+        {groups.map((group) => (
+          <HeldRow
+            key={`group:${group.name}`}
+            title={group.title}
+            subtitle={`Rank · joined ${ago(group.since)}`}
+            permissions={group.permissions}
+            reach={group.reach}
+          />
+        ))}
+
+        {grants.map((grant) => (
+          <HeldRow
+            key={`grant:${grant.permission}:${grant.scope}`}
+            title={grant.permission}
+            subtitle={grant.note || `Granted ${ago(grant.since)}`}
+            reach={grant.reach}
+          />
+        ))}
+      </ul>
+
+      {accounts === 0 && (
+        <p className="sans dim" style={{ fontSize: '0.76rem', marginTop: 12, maxWidth: '60ch' }}>
+          None of this reaches the game yet — link a Steam account above and the site pushes it
+          across on its next sync.
+        </p>
+      )}
+
+      {accounts > 0 && waiting && (
+        <p className="sans dim" style={{ fontSize: '0.76rem', marginTop: 12, maxWidth: '60ch' }}>
+          A server marked <em>waiting</em> has not confirmed it yet. One that is offline catches up
+          when it comes back.
+        </p>
+      )}
+    </>
+  )
+}
+
+export default function Account() {
+  // `useAsync` rather than this module's `usePolled`: nothing here changes unless
+  // the person looking at it changes it, and a page that re-asked every twenty
+  // seconds would be asking a question nobody is waiting on.
+  //
+  // **Core's `useAsync` has no `refresh`** — it re-runs when its deps change and
+  // that is the whole of its interface — so a counter in the deps is how a page
+  // re-reads after its own write. It blanks while it re-reads, which is right
+  // here and is exactly what made it wrong for a poll (see `hooks/usePolled.js`).
+  const [reloads, setReloads] = useState(0)
+  const { data, loading, error } = useAsync(() => api.playerLinks.list(), [reloads])
+  const links = data ? data.links : []
+
+  const reload = useCallback(() => setReloads((n) => n + 1), [])
+
+  return (
+    <div>
+      <div className="field-label" style={{ marginBottom: 12 }}>Steam accounts</div>
+
+      <p className="sans dim" style={{ margin: 0, fontSize: '0.86rem', maxWidth: '60ch' }}>
+        Linking tells this site which Steam account is yours, so your play on our servers appears
+        under your name here — and so rewards and permissions the site hands out can reach you in
+        game.
+      </p>
+
+      <ol className="sans dim" style={{ fontSize: '0.86rem', marginTop: 14, paddingLeft: 20, maxWidth: '60ch' }}>
+        <li>Join any of our Rust servers and type <code>/link</code> in chat.</li>
+        <li>The server replies with a six-character code, only you can see it, and it lasts five minutes.</li>
+        <li>Type it below. It works once.</li>
+      </ol>
+
+      <LinkForm onLinked={reload} />
+
+      {loading && <Loading />}
+      {error && <ErrorState error={error} />}
+
+      {data && links.length > 0 && (
+        <ul style={{ listStyle: 'none', margin: '22px 0 0', padding: 0, display: 'flex', flexDirection: 'column', gap: 10 }}>
+          {links.map((link) => (
+            <LinkRow key={link.steamId} link={link} onRemoved={reload} />
+          ))}
+        </ul>
+      )}
+
+      {data && links.length > 0 && (
+        <p className="sans dim" style={{ fontSize: '0.76rem', marginTop: 14, maxWidth: '60ch' }}>
+          A link covers every server this community runs — a Steam account is one person wherever
+          they play, while stats are kept per server and per wipe. You can also type
+          {' '}<code>/unlink</code> in game to release one.
+        </p>
+      )}
+
+      {data && links.length === 0 && (
+        <p className="sans dim" style={{ fontSize: '0.8rem', marginTop: 18 }}>
+          No Steam account is linked to this profile yet.
+        </p>
+      )}
+
+      {/* Phase 8. Rendered whether or not anything is linked: an entitlement is
+          authored against the website account, so it exists before a Steam id
+          does — and hiding it until one appears is the mistake the admin user
+          page shipped in phase 7 (PLAN.md §20.5). */}
+      <div className="field-label" style={{ margin: '30px 0 12px' }}>What you can do in game</div>
+
+      {data && <Held accounts={links.length} />}
+    </div>
+  )
+}

client/src/routes/public/Clan.jsx

@@ -0,0 +1,161 @@
+// ── One clan ──────────────────────────────────────────────────────────────
+//
+// A first-party Rust clan is a Team (R5), and this is its page. Core owns the
+// Team — the reconciler, the access rules, the activity feed, the forum — but
+// not the word "clan", so it publishes no Team page of its own (MODULE_API.md
+// §3.7a). The page is this module's, and the three parts only core can render
+// are contributed into places this page names:
+//
+//   rust.clan.header   ← core's `team.notify`    (above the roster: an action ON the page)
+//   rust.clan.detail   ← core's `team.activity`  (the members-only feed, D49)
+//   rust.clan.forum    ← core's `team.forum`
+//
+// One slot per PLACE, as module-uo does, so core never decides the layout of a
+// page it does not own. **Every slot may be empty** — a core without Teams, a
+// deployment with the forum switched off, a clan whose Team core has not created
+// yet — and the page has to read correctly anyway. That is the phase criterion,
+// and it is why nothing here says "see below" about something core may not put
+// below.
+//
+// The roster comes from this module's own board, through the same function core
+// asks when it projects a roster (D48), so the two cannot disagree about who may
+// look. Below the audience the clan is still described — its name, score and
+// count are public (D58) — and the roster says who may see it instead.
+
+import { useParams, Link } from 'react-router-dom'
+import { ErrorState, Loading, PageHeader, PublicLayout, Slot, useAsync } from '../../core.js'
+import Empty from '../../components/Empty.jsx'
+import { Swatch } from '../../components/Clans.jsx'
+import { count, day } from '../../lib/format.js'
+import api from '../../api.js'
+
+const ID = 'rust'
+
+export default function Clan() {
+  const { externalId } = useParams()
+  const { data, loading, error } = useAsync(() => api.clans.get(externalId), [externalId])
+
+  if (loading) {
+    return (
+      <PublicLayout shell="mid">
+        <Loading />
+      </PublicLayout>
+    )
+  }
+
+  // A mistyped or out-of-date address is not an outage, and must not read as
+  // one — the same rule the server page learned in phase 4.
+  if (error || !data || !data.clan) {
+    const missing = !error || error.status === 404
+    return (
+      <PublicLayout shell="mid">
+        <PageHeader
+          title={missing ? 'No such clan' : 'That clan could not be loaded'}
+          lead={
+            missing
+              ? 'This address does not name a clan this site knows about.'
+              : 'The site could not read this clan just now. It is worth trying again.'
+          }
+        />
+        {!missing && <ErrorState error={error} />}
+        <p className="sans" style={{ marginTop: 20 }}>
+          <Link to="/rust">Back to the server list</Link>
+        </p>
+      </PublicLayout>
+    )
+  }
+
+  const { clan, roster } = data
+  const serverLink = `/rust/servers/${encodeURIComponent(clan.serverId)}?tab=clans`
+
+  return (
+    <PublicLayout shell="mid">
+      <p className="sans" style={{ margin: '0 0 12px' }}>
+        <Link to={serverLink}>← Clans on {clan.serverName || clan.serverId}</Link>
+      </p>
+
+      <PageHeader eyebrow="Rust clan" title={clan.name} lead={describe(clan)} />
+
+      {clan.gone && (
+        <p className="sans" style={{ color: 'var(--dim)', marginTop: 0 }}>
+          This clan has been disbanded, or has left its server’s clan list. What is shown is the last the site heard.
+        </p>
+      )}
+
+      <Slot name="rust.clan.header" externalId={clan.externalId} moduleId={ID} />
+
+      <h2 className="sans" style={{ fontSize: '1rem', margin: '24px 0 8px' }}>Members</h2>
+      <Roster roster={roster} memberCount={clan.memberCount} gone={clan.gone} />
+
+      <Slot name="rust.clan.detail" externalId={clan.externalId} moduleId={ID} />
+
+      <Slot name="rust.clan.forum" externalId={clan.externalId} moduleId={ID} />
+    </PublicLayout>
+  )
+}
+
+function describe(clan) {
+  const parts = [
+    <Swatch key="c" color={clan.color} />,
+    ` ${count(clan.memberCount)} ${clan.memberCount === 1 ? 'member' : 'members'}`,
+    clan.maxMembers ? ` of ${count(clan.maxMembers)}` : '',
+    ` · ${count(clan.score)} points`,
+    clan.founded ? ` · founded ${day(clan.founded)}` : '',
+  ]
+  return <span>{parts}</span>
+}
+
+function Roster({ roster, memberCount, gone }) {
+  if (!roster || !roster.visible) {
+    return <Empty title={`${count(memberCount)} ${memberCount === 1 ? 'member' : 'members'}`} message={withheld(roster && roster.audience)} />
+  }
+
+  if (roster.members.length === 0) {
+    return gone
+      ? <Empty title="No roster" message="A clan that has left its server’s list has no members to show." />
+      : <Empty title="No roster yet" message="The server has not sent this clan’s members yet." />
+  }
+
+  return (
+    <ul style={{ listStyle: 'none', margin: 0, padding: 0 }}>
+      {roster.members.map((m, i) => (
+        <li
+          // The roster carries no identifier on purpose (a Steam id and a site
+          // account are withheld from every public roster), so the row's place is
+          // its key. The list is re-rendered whole, never reordered in place.
+          // eslint-disable-next-line react/no-array-index-key
+          key={i}
+          style={{
+            display: 'flex',
+            alignItems: 'baseline',
+            gap: 12,
+            padding: '8px 0',
+            borderBottom: '1px solid var(--line-soft, var(--line))',
+          }}
+        >
+          <strong style={{ color: 'var(--ink)', flex: 1, minWidth: 0 }}>
+            {m.name || 'Unknown player'}
+            {m.leader && (
+              <span className="sans" style={{ color: 'var(--accent)', marginLeft: 8, fontSize: '0.72rem' }}>Leader</span>
+            )}
+          </strong>
+          {m.role && !m.leader && (
+            <span className="sans" style={{ color: 'var(--dim)', fontSize: '0.8rem' }}>{m.role}</span>
+          )}
+          {/* Inside the roster audience by construction (D48): a viewer who may
+              not see the roster sees no row to hang this on. */}
+          <span className="sans" style={{ color: m.online ? 'var(--mode-live, #5fb98a)' : 'var(--dim)', fontSize: '0.78rem', whiteSpace: 'nowrap' }}>
+            {m.online ? 'online' : ''}
+          </span>
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+/** Why the roster was withheld, in words a visitor can act on. */
+function withheld(audience) {
+  if (audience === 'signed_in') return 'Sign in to see who is in this clan.'
+  if (audience === 'public') return 'This site is not showing clan rosters right now.'
+  return 'Only this clan’s own members, with a linked Rust account, and this site’s staff can see who is in it.'
+}

client/src/routes/public/ServerDetail.jsx

@@ -23,20 +23,26 @@
 
 import { useSearchParams, useParams, Link } from 'react-router-dom'
 import { ErrorState, Loading, PageHeader, PublicLayout, useAsync } from '../../core.js'
+import Clans from '../../components/Clans.jsx'
 import Feed from '../../components/Feed.jsx'
 import Leaderboard from '../../components/Leaderboard.jsx'
+import MapView from '../../components/MapView.jsx'
 import Online from '../../components/Online.jsx'
 import Tabs from '../../components/Tabs.jsx'
 import WipeSelect, { ALL_TIME } from '../../components/WipeSelect.jsx'
 import Wipes from '../../components/Wipes.jsx'
-import { ago, count, day } from '../../lib/format.js'
+import { ago, count, day, nextWipe } from '../../lib/format.js'
 import api from '../../api.js'
 
 const TABS = [
   { id: 'feed', label: 'Feed' },
   { id: 'leaderboard', label: 'Leaderboard' },
   { id: 'online', label: 'Online' },
+  // Phase 14. The picture is public; what moves on it has an audience per layer.
+  { id: 'map', label: 'Map' },
   { id: 'wipes', label: 'Wipes' },
+  // Phase 9. The list is public (D58); each clan's roster is on its own page.
+  { id: 'clans', label: 'Clans' },
 ]
 
 export default function ServerDetail() {
@@ -152,6 +158,10 @@ export default function ServerDetail() {
 
       {tab === 'online' && <Online serverId={server.id} online={server.online} />}
 
+      {tab === 'map' && <MapView serverId={server.id} online={server.online} />}
+
+      {tab === 'clans' && <Clans serverId={server.id} />}
+
       {tab === 'wipes' && (
         <Wipes
           serverId={server.id}
@@ -178,6 +188,7 @@ function describeWorld(server) {
     server.worldSize ? `size ${count(server.worldSize)}` : null,
     server.seed ? `seed ${server.seed}` : null,
     server.wipedAt ? `wiped ${day(server.wipedAt)}` : null,
+    nextWipe(server.nextWipe) ? `next wipe ${nextWipe(server.nextWipe)}` : null,
   ].filter(Boolean)
 
   return parts.length > 0 ? parts.join(' · ') : 'This server has not described itself yet.'

client/src/routes/public/Servers.jsx

@@ -22,8 +22,9 @@
 // is down. The site's availability does not depend on the game's.
 
 import { Link } from 'react-router-dom'
-import { EmptyState, ErrorState, Loading, PageHeader, PublicLayout, useAsync } from '../../core.js'
-import { ago, count, day } from '../../lib/format.js'
+import { ErrorState, Loading, PageHeader, PublicLayout, useAsync } from '../../core.js'
+import Empty from '../../components/Empty.jsx'
+import { ago, count, day, nextWipe } from '../../lib/format.js'
 import api from '../../api.js'
 
 /** The "last reported" line, which has three cases and not one. */
@@ -61,7 +62,7 @@ export default function Servers() {
           empty game — it is an install that is not finished. Saying so beats a
           blank page that looks like a failure. */}
       {data && servers.length === 0 && (
-        <EmptyState
+        <Empty
           title="No servers yet"
           message="An administrator adds a Rust server, and its sidecar, from the admin panel."
         />
@@ -92,6 +93,9 @@ export default function Servers() {
                     server.level || null,
                     server.worldSize ? `size ${count(server.worldSize)}` : null,
                     server.wipedAt ? `wiped ${day(server.wipedAt)}` : null,
+                    // Phase 16 (D131): absent from an older module, and null for a
+                    // server with no schedule — either way the part is left out.
+                    nextWipe(server.nextWipe) ? `next wipe ${nextWipe(server.nextWipe)}` : null,
                   ]
                     .filter(Boolean)
                     .join(' · ')}

client/test/build.test.js

@@ -19,7 +19,7 @@ import { fileURLToPath } from 'node:url'
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const CLIENT = path.resolve(HERE, '..')
 
-const { bareImports, problemsWith } = await import('../scripts/checkExternals.js')
+const { bareImports, problemsWith, relativeImports } = await import('../scripts/checkExternals.js')
 const configModule = await import('../vite.config.js')
 const config = configModule.default
 const { SHARED, SHARED_PACKAGES: guardedPackages } = configModule
@@ -152,3 +152,38 @@ test('an import inside a string is not an import — the check reads code, not t
   // string must not end it early and leave the tail looking like code.
   assert.deepStrictEqual(bareImports('const s="he said \\"import\\" loudly";'), [])
 })
+
+// ── D120: Leaflet's split chunk ───────────────────────────────────────────
+
+test('a split chunk is found by what entry.js imports, and a string is still not an import', () => {
+  assert.deepStrictEqual(relativeImports('const m=await import("./leaflet-Ab12.js")'), ['leaflet-Ab12.js'])
+  assert.deepStrictEqual(relativeImports('import"./other.js";import"react"'), ['other.js'])
+  assert.deepStrictEqual(relativeImports('const s="import(\\"./fake.js\\")"'), [])
+})
+
+test('every chunk entry.js imports is in dist/, and none of them bundles a shared dependency', () => {
+  const dist = path.join(CLIENT, 'dist')
+  const entry = path.join(dist, 'entry.js')
+  if (!fs.existsSync(entry)) return
+  const split = relativeImports(fs.readFileSync(entry, 'utf8'))
+  assert.ok(split.length >= 1, 'the Map tab imports Leaflet from a chunk of its own (D120)')
+  for (const name of split) {
+    assert.ok(fs.existsSync(path.join(dist, name)), `entry.js imports ./${name}, which the build did not emit`)
+    assert.deepStrictEqual(problemsWith(fs.readFileSync(path.join(dist, name), 'utf8')), [], name)
+  }
+})
+
+test('Leaflet is not in the entry chunk — every page of the site loads that one', () => {
+  const entry = path.join(CLIENT, 'dist', 'entry.js')
+  if (!fs.existsSync(entry)) return
+  assert.doesNotMatch(fs.readFileSync(entry, 'utf8'), /Leaflet 1\.9/, 'Leaflet was bundled into entry.js')
+})
+
+test('the release ships every chunk, not entry.js by name', () => {
+  // The other half of D120. A release that copied `entry.js` alone would load on
+  // every page and spin for ever on the Map tab, with every check above green.
+  const release = fs.readFileSync(path.join(CLIENT, '..', '.gitea', 'workflows', 'release.yml'), 'utf8')
+  assert.match(release, /cp client\/dist\/\*\.js "\$OUT\/client\/dist\/"/)
+  assert.doesNotMatch(release, /cp client\/dist\/entry\.js /)
+})
+

client/test/feed.test.js

@@ -43,7 +43,8 @@ test('the four attacker types are four different sentences', () => {
   const victim = { name: 'Bob' }
 
   const npc = describe(row('player.death', { ...victim, attackerType: 'npc', attackerName: 'scientistnpc_full_any' }))
-  assert.equal(npc.actor, 'scientistnpc full any')
+  // A family is named, not spelled out as a prefab (PLAN_FIXES F2, D185).
+  assert.equal(npc.actor, 'Scientist')
   assert.equal(npc.subject, 'Bob')
 
   const self = describe(row('player.death', { ...victim, attackerType: 'self' }))

client/test/format.test.js

@@ -11,7 +11,7 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
 
-import { ago, clock, count, day, duration, prefab, shortId } from '../src/lib/format.js'
+import { ago, attacker, clock, contrastInk, count, day, duration, nextWipe, prefab, shortId } from '../src/lib/format.js'
 
 const NOW = Date.parse('2026-09-16T12:00:00Z')
 
@@ -94,3 +94,49 @@ test("a feed row from another day carries its date, not just a time", () => {
   const earlyToday = Date.parse('2026-09-16T00:20:00')
   assert.ok(clock(lateLastNight, earlyToday).length > time(lateLastNight).length)
 })
+
+test('the next wipe: the reader’s own clock, how far away, and whether it moved', () => {
+  const now = Date.parse('2026-09-25T12:00:00Z')
+  const forced = nextWipe({ at: '2026-10-01T18:00:00.000Z', source: 'forced' }, now)
+  assert.match(forced, /\(in 6 days\)$/)
+  assert.ok(!forced.includes('rescheduled'))
+
+  assert.match(nextWipe({ at: '2026-09-27T17:00:00.000Z', source: 'once' }, now), /\(in 2 days\) — rescheduled$/)
+
+  // No schedule is no line, not "unknown": the page leaves the part out.
+  assert.equal(nextWipe(null, now), null)
+  assert.equal(nextWipe({ at: 'soon', source: 'rule' }, now), null)
+})
+
+test('a title chip’s ink is whichever of black and white reads on its colour', () => {
+  assert.equal(contrastInk('#ffff00'), '#000000')
+  assert.equal(contrastInk('#FFAA55'), '#000000')
+  assert.equal(contrastInk('#1a1a8c'), '#ffffff')
+  assert.equal(contrastInk('#ff0000'), '#000000')
+  assert.equal(contrastInk('red'), '#000000', 'not a hex colour: black, on the caller’s fallback')
+})
+
+test('an NPC attacker reads as a name: a family, or the prefab without its variant (F2, D185)', () => {
+  // The first walk's "killed by wolf2".
+  assert.equal(attacker('wolf2'), 'Wolf')
+  assert.equal(attacker('wolf'), 'Wolf')
+  assert.equal(attacker('boar'), 'Boar')
+  assert.equal(attacker('polarbear'), 'Polar bear')
+  assert.equal(attacker('scientistnpc_full_any'), 'Scientist')
+  assert.equal(attacker('scientistnpc_roam'), 'Scientist')
+  assert.equal(attacker('scientistnpc_heavy'), 'Heavy scientist')
+  assert.equal(attacker('npc_bandit_guard'), 'Bandit guard')
+  assert.equal(attacker('bradleyapc'), 'Bradley APC')
+  assert.equal(attacker('patrolhelicopter'), 'Patrol helicopter')
+  assert.equal(attacker('autoturret_deployed'), 'Auto turret')
+  assert.equal(attacker('sam_site_turret_deployed'), 'SAM site')
+  // Anything unknown still reads as words, capitalised, with no suffix or variant.
+  assert.equal(attacker('some_new_beast3'), 'Some new beast')
+  assert.equal(attacker('spikes.floor.deployed'), 'Spikes floor')
+  assert.equal(attacker(null), '')
+  assert.equal(attacker(''), '')
+})
+
+test('a weapon keeps the light touch — attacker() is for what did the killing', () => {
+  assert.equal(prefab('rifle.ak'), 'rifle ak')
+})

client/test/mapGeometry.test.js

@@ -0,0 +1,92 @@
+// ── How a world position reaches a pixel (PLAN.md §30.3) ─────────────────
+//
+// The grid cases are the GAME's answers, not this file's: on 2026-09-25 a probe
+// on the Oxide rig (a 3000 map, seed 1234) asked `MapHelper.PositionToString`
+// for these positions and wrote down what it said. A label the page draws that
+// disagrees with the in-game map is a player walking to the wrong square — and
+// phase 3's plugin did exactly that for three weeks with a 146.3 m cell (D119).
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import { boundsOf, column, countdown, grid, gridLabel, scaleOf, toLatLng } from '../src/lib/mapGeometry.js'
+
+// The rig's map as `GET /map` describes it.
+const RIG = { worldSize: 3000, oceanMargin: 500, width: 2500, height: 2500, gridCells: 20, gridCellSize: 150 }
+
+test('the grid label is the game’s, at every probed position', () => {
+  const probed = [
+    ['ue_jungle_swamp_a', 764.7, 167.4, 'P8'],
+    ['ue_jungle_swamp_a', 733.7, -556.0, 'O13'],
+    ['harbor_2', 1122.7, 204.6, 'R8'],
+    ['harbor_1', 678.1, 1005.7, 'O3'],
+    ['ferry_terminal_1', 645.4, -1004.1, 'O16'],
+    ['fishing_village_a', -787.8, 224.1, 'E8'],
+    ['fishing_village_c', -203.0, -911.1, 'I16'],
+    ['fishing_village_b', 1142.1, -566.5, 'R13'],
+    ['desert_military_base_c', 94.0, -729.3, 'K14'],
+    ['arctic_research_base_a', -556.9, 840.0, 'G4'],
+    ['powerplant_1', -608.6, -346.4, 'F12'],
+    ['water_treatment_plant_1', 497.8, 84.9, 'N9'],
+    ['nw-corner', -1499, 1499, 'A0'],
+    ['se-corner', 1499, -1499, 'T19'],
+    ['origin', 0, 0, 'K10'],
+  ]
+  for (const [name, x, z, game] of probed) assert.equal(gridLabel(RIG, x, z), game, name)
+})
+
+test('a 146.3 m cell — phase 3’s constant — would have disagreed with the game', () => {
+  // Kept as a test so the constant cannot come back in a refactor that "fixes"
+  // the cell size to the number community tools quote.
+  assert.notEqual(gridLabel({ ...RIG, gridCells: 21, gridCellSize: 146.3 }, 645.4, -1004.1), 'O16')
+})
+
+test('columns past Z are spelled the way Rust spells them', () => {
+  assert.equal(column(0), 'A')
+  assert.equal(column(25), 'Z')
+  assert.equal(column(26), 'AA')
+  assert.equal(column(27), 'AB')
+})
+
+test('the ocean margin is in pixels and is not scaled', () => {
+  assert.equal(scaleOf(RIG), 0.5)
+  // The world's corners sit exactly one margin inside the picture's.
+  assert.deepEqual(toLatLng(RIG, -1500, -1500), [500, 500])
+  assert.deepEqual(toLatLng(RIG, 1500, 1500), [2000, 2000])
+  assert.deepEqual(toLatLng(RIG, 0, 0), [1250, 1250])
+})
+
+test('north is up: a larger z is a larger latitude, and x is longitude', () => {
+  const [lat1, lng1] = toLatLng(RIG, 100, 100)
+  const [lat2, lng2] = toLatLng(RIG, 100, 400)
+  assert.ok(lat2 > lat1)
+  assert.equal(lng1, lng2)
+  assert.deepEqual(boundsOf(RIG), [[0, 0], [2500, 2500]])
+})
+
+test('something off the edge of the world is still placed, outside the picture', () => {
+  // The rig's cargo ship, as the probe found it: past the world AND the margin.
+  const [lat, lng] = toLatLng(RIG, 2691.6, -1453.1)
+  assert.ok(lng > RIG.width)
+  assert.ok(lat > 0 && lat < RIG.height)
+})
+
+test('the grid has a line per edge and a label per cell, A0 at the north-west corner', () => {
+  const g = grid(RIG)
+  assert.equal(g.lines.length, 2 * (RIG.gridCells + 1))
+  assert.equal(g.labels.length, RIG.gridCells * RIG.gridCells)
+  const a0 = g.labels.find((l) => l.text === 'A0')
+  assert.deepEqual([a0.x, a0.z], [-1500, 1500])
+  assert.deepEqual(grid(null), { lines: [], labels: [] })
+})
+
+test('a geometry that cannot place anything places nothing rather than NaN everywhere', () => {
+  assert.equal(scaleOf({ worldSize: 0, width: 2500 }), 0)
+  assert.equal(gridLabel({ worldSize: 3000 }, 0, 0), null)
+})
+
+test('a hack timer reads as minutes and seconds', () => {
+  assert.equal(countdown(540), '9:00')
+  assert.equal(countdown(61.4), '1:01')
+  assert.equal(countdown(-3), '0:00')
+})

client/test/registration.test.js

@@ -257,6 +257,23 @@ it('every declared slot names a core contribution core actually offers', () => {
   }
 })
 
+it('the clan page gets all three of core’s Team contributions, one per place (phase 9, D56)', () => {
+  // Core contributes three things to a Team page it does not own. Each has its
+  // own place on the clan page, so no contribution is decided by another's
+  // position — and a slot missing here is a clan page with no feed, no forum or
+  // no notification switch, with nothing logged anywhere.
+  const byName = Object.fromEntries(registered.declaredSlots.map((s) => [s.name, s.wants]))
+  assert.deepEqual(byName, {
+    'rust.clan.header': 'team.notify',
+    'rust.clan.detail': 'team.activity',
+    'rust.clan.forum': 'team.forum',
+  })
+
+  // And the page is at the address the Team provider hands core.
+  const paths = registered.routes.public.map((r) => r.path)
+  assert.ok(paths.includes('rust/clans/:externalId'), paths.join(', '))
+})
+
 it('registers under exactly one module id, matching the manifest', () => {
   const owners = new Set([
     ...Object.values(registered.routes).flat().map((r) => r.moduleId),

client/test/uiKitProps.test.js

@@ -0,0 +1,49 @@
+// ── The UI kit's props, as core actually reads them ───────────────────────
+//
+// React drops an unknown prop without a word, so a UI-kit component called with
+// the wrong one renders — just not what was written. Two of these have shipped
+// from this org already: `PageHeader subtitle` (Teams phase 11, the kit's
+// template) and `EmptyState title/message` (this module, phases 4 to 8 — every
+// empty panel was a blank box until the presence fix's browser walk).
+//
+// A DOM-less runner cannot see a blank box, so this reads the source instead:
+// it names the props core's components do NOT take and fails on any use of them.
+// It is a claim about core that must be re-read when core's kit changes —
+// written down rather than imported, because no core is in this process.
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const SRC = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'src')
+
+/** Every .jsx/.js under src/. */
+function sources(dir = SRC) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) return sources(full)
+    return /\.(jsx?|mjs)$/.test(entry.name) ? [full] : []
+  })
+}
+
+// Core's `components/PageState.jsx` and `PageHeader.jsx`, read 2026-09-23 at the
+// pinned core (ci/core-ref.json).
+const REFUSED = {
+  // `EmptyState({ children })` — children only.
+  EmptyState: /<EmptyState\b[^>]*\b(title|message|description|text)\s*=/,
+  // `PageHeader({ eyebrow, title, lead, center })` — there is no `subtitle`.
+  PageHeader: /<PageHeader\b[^>]*\bsubtitle\s*=/,
+}
+
+test('no UI-kit component is handed a prop core does not read', () => {
+  const offences = []
+  for (const file of sources()) {
+    const text = fs.readFileSync(file, 'utf8')
+    for (const [component, pattern] of Object.entries(REFUSED)) {
+      if (pattern.test(text)) offences.push(`${path.relative(SRC, file)}: ${component}`)
+    }
+  }
+  assert.deepEqual(offences, [], 'use components/Empty.jsx for a titled empty state')
+})

module.json

@@ -2,7 +2,7 @@
   "id": "rust",
   "name": "Rust",
   "version": "0.1.0",
-  "coreApi": "^1.10.0",
+  "coreApi": "^1.11.0",
   "server": "server/index.js",
   "client": { "entry": "client/dist/entry.js" },
   "schema": "server/db/schema.sql",
@@ -12,5 +12,6 @@
     "admin": ["/rust"],
     "player": ["/rust"]
   },
-  "capabilities": ["servers", "killfeed", "leaderboard", "presence", "wipes"]
+  "extensions": ["admin.users.detail"],
+  "capabilities": ["rust", "servers", "killfeed", "leaderboard", "presence", "wipes", "identity", "map"]
 }

routes.manifest.json

@@ -1,21 +1,121 @@
 {
   "$comment": "Generated inventory of the URLs module-rust serves - the module half of the freeze core keeps in server/routes.manifest.json. DERIVED as the difference between a core without this module and the same core with it, both at the pinned ref in ci/core-ref.json. Regenerate with the frozen-manifest job in .gitea/workflows/pr-checks.yml; see server/scripts/frozenManifest.js.",
   "routes": [
+    {
+      "method": "DELETE",
+      "path": "/api/v1/admin/rust/permissions/grants/:id",
+      "tier": "public"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/admin/rust/permissions/groups/:name",
+      "tier": "public"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/admin/rust/permissions/groups/:name/members/:userId",
+      "tier": "public"
+    },
     {
       "method": "DELETE",
       "path": "/api/v1/admin/rust/servers/:id",
       "tier": "public"
     },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/admin/users/:id/rust/links/:steamId",
+      "tier": "public"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/admin/users/:id/rust/permissions/grants/:grantId",
+      "tier": "public"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/player/rust/links/:steamId",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/config/:serverId/file",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/config/:serverId/files",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/config/:serverId/writes",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/config/:serverId/writes/:writeId",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/permissions",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/permissions/catalogue",
+      "tier": "public"
+    },
     {
       "method": "GET",
       "path": "/api/v1/admin/rust/servers",
       "tier": "public"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/servers/:id/integrations",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/visibility",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/rust/voice",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/users/:id/rust/links",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/users/:id/rust/permissions",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/player/rust/links",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/player/rust/permissions",
+      "tier": "public"
+    },
     {
       "method": "GET",
       "path": "/api/v1/player/rust/servers",
       "tier": "public"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/public/rust/clans/:externalId",
+      "tier": "public"
+    },
     {
       "method": "GET",
       "path": "/api/v1/public/rust/servers",
@@ -26,6 +126,11 @@
       "path": "/api/v1/public/rust/servers/:id",
       "tier": "public"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/public/rust/servers/:id/clans",
+      "tier": "public"
+    },
     {
       "method": "GET",
       "path": "/api/v1/public/rust/servers/:id/events",
@@ -36,6 +141,21 @@
       "path": "/api/v1/public/rust/servers/:id/leaderboard",
       "tier": "public"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/public/rust/servers/:id/map",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/public/rust/servers/:id/map/image",
+      "tier": "public"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/public/rust/servers/:id/map/live",
+      "tier": "public"
+    },
     {
       "method": "GET",
       "path": "/api/v1/public/rust/servers/:id/online",
@@ -46,15 +166,85 @@
       "path": "/api/v1/public/rust/servers/:id/wipes",
       "tier": "public"
     },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/config/:serverId/file",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/permissions/drift/:id/adopt",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/permissions/drift/:id/revoke",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/permissions/grants",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/permissions/groups/:name/members",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/permissions/sync",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/servers/:id/map/fetch",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/rust/servers/:id/map/render",
+      "tier": "public"
+    },
     {
       "method": "POST",
       "path": "/api/v1/admin/rust/servers/:id/test",
       "tier": "public"
     },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/users/:id/rust/permissions/grants",
+      "tier": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/player/rust/link",
+      "tier": "public"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/v1/admin/rust/permissions/groups/:name",
+      "tier": "public"
+    },
     {
       "method": "PUT",
       "path": "/api/v1/admin/rust/servers/:id",
       "tier": "public"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/v1/admin/rust/servers/:id/titles",
+      "tier": "public"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/v1/admin/rust/visibility",
+      "tier": "public"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/v1/admin/rust/voice",
+      "tier": "public"
     }
   ]
 }

server/boot.js

@@ -21,10 +21,11 @@
 // letting that fail the boot would make installing the module before installing
 // the bridge impossible.
 //
-// ── Three timers, and they answer three different questions ───────────────
+// ── Four timers, and they answer four different questions ─────────────────
 //
 //   refresh   (30s)  what is each server, and who is on it — the BOARDS
 //   ingest     (5s)  what has happened since we last looked — the CURSOR
+//   sweep      (1m)  which login attempts were never let in (PLAN.md §25)
 //   prune       (1h)  forgetting the detail we promised not to keep for ever
 //
 // The boards poll and the ingest are deliberately separate rather than one loop
@@ -42,8 +43,13 @@
 const core = require('./core')
 
 const db = require('./model/servers/servers.db')
+const engagement = require('./engagement/emit')
 const eventsDb = require('./model/events/events.db')
+const eventWorld = require('./eventWorld')
 const ingest = require('./ingest')
+const mapImages = require('./mapImages')
+const permSync = require('./permSync')
+const titleSync = require('./titleSync')
 const servers = require('./model/servers/servers.model')
 const sidecar = require('./sidecarClient')
 
@@ -52,10 +58,12 @@ const log = core.logger('boot')
 let refreshTimer = null
 let ingestTimer = null
 let pruneTimer = null
+let sweepTimer = null
 
 const REFRESH_MS = 30 * 1000
 const INGEST_MS = 5 * 1000
 const PRUNE_MS = 60 * 60 * 1000
+const SWEEP_MS = 60 * 1000
 
 /**
  * How long this module keeps raw events.
@@ -93,7 +101,15 @@ async function refreshOne(server) {
     // One call for both boards. `/server` would answer the same question about
     // the server itself, but presence would then be a second round trip to the
     // same process for a fact it already had in hand.
-    const board = await sidecar.boards(server)
+    //
+    // **And one for `/health`, because the boards cannot say whether the game is
+    // there NOW** (D68, PLAN.md §25.1). The sidecar keeps its last `server.hello`
+    // after the plugin disconnects — that is what lets a page render a server
+    // that is off — so a game that hung, or whose bridge was unloaded, while the
+    // sidecar stayed up read as online here from phase 4 until phase 10. Only
+    // `/health`'s `plugin_connected` answers the question, and the two are asked
+    // together so they describe the same moment.
+    const [board, health] = await Promise.all([sidecar.boards(server), sidecar.health(server)])
 
     // Three outcomes, and collapsing any two of them loses something an operator
     // needs:
@@ -112,6 +128,7 @@ async function refreshOne(server) {
       // server said, which is exactly what the pages exist to render while it is
       // off.
       await db.markUnreachable(server.id, false)
+      engagement.serverObserved(server, false)
       return
     }
 
@@ -124,20 +141,34 @@ async function refreshOne(server) {
       // reach is worse than an empty one, because it looks current.
       await db.markUnreachable(server.id, true)
       await ingest.applyBoards(server.id, {})
+      engagement.serverObserved(server, false)
       return
     }
 
-    await ingest.applyBoards(server.id, boards)
+    // Unknown is not connected. A `/health` that did not answer while `/boards`
+    // did is odd enough to be worth a line, and reporting the server up on the
+    // strength of a board the game may have left behind hours ago is the defect
+    // this call exists to remove.
+    const connected = Boolean(health.ok && health.data && health.data.plugin_connected === true)
+    if (!health.ok) log.warn('the sidecar answered /boards but not /health', { server: server.id })
+
+    // The presence board is the plugin's last word too. While the game is not
+    // connected it names people as online who may have left hours ago, which is
+    // both wrong and — under §23's rule — a claim about named people nobody made.
+    await ingest.applyBoards(
+      server.id,
+      connected ? boards : { ...boards, 'players.online': { players: [] } },
+    )
 
     await db.putState({
       serverId: server.id,
       reachable: true,
-      // A stored `server.hello` means the game connected; whether it is connected
-      // NOW is a different question, and `/health` is what answers it. The board
-      // alone cannot say, which is why `online` is not simply `true` here — it is
-      // decided by freshness in the model, from `updated_at`.
-      online: true,
-      players: Number(frame.players) || 0,
+      // The plugin is connected NOW (D68). A stored `server.hello` only says it
+      // connected once; the model still applies its own freshness on top.
+      online: connected,
+      // A board the game left behind is a description, not a sighting.
+      seen: connected,
+      players: connected ? Number(frame.players) || 0 : 0,
       maxPlayers: Number(frame.maxPlayers) || 0,
       hostname: frame.hostname || null,
       level: frame.level || null,
@@ -149,6 +180,22 @@ async function refreshOne(server) {
       protocol: frame.protocol === undefined ? null : Number(frame.protocol),
       raw: frame,
     })
+
+    // After the write, so a transition announced is one a page already shows.
+    engagement.serverObserved(server, connected)
+
+    // A restart or a wipe under a running event is the moment core must be told
+    // to ask what the world still holds (§11.1). Only a CONNECTED plugin's hello
+    // counts: a board the game left behind says nothing about now.
+    if (connected) {
+      eventWorld.observeServer(server.id, { bootId: frame.bootId, wipeId: frame.wipeId, worldReady: frame.worldReady })
+
+      // A new boot, wipe or map is a reason to ask what the map is now (D110).
+      // Started, never awaited: a picture is a megabyte over the game link, and
+      // the board poll does not wait on one. `mapImages` keeps one fetch per
+      // server and backs off on its own.
+      mapImages.observe(server, frame)
+    }
   } catch (err) {
     // A failure here is one server's, and it must not reach `Promise.allSettled`
     // as a rejection that hides which one. Log with the id and carry on.
@@ -188,19 +235,47 @@ async function prune() {
   }
 }
 
+/**
+ * Login attempts that were never approved (D64, PLAN.md §25).
+ *
+ * On its own minute timer rather than the prune's hour: an attempt waits a
+ * minute for its approval, and a staff alert an hour late is not an alert. A
+ * query over stored rows, so it needs nothing kept in memory and a restart loses
+ * nothing; the dedupe key makes a second pass over the same attempt a no-op.
+ */
+async function sweep() {
+  let rows
+  try {
+    rows = await servers.listForPolling()
+  } catch (err) {
+    log.warn('could not read the server list', { error: err.message })
+    return
+  }
+  const sent = await engagement.sweepLoginDenied(rows)
+  if (sent > 0) log.info('unapproved logins reported', { attempts: sent })
+}
+
 async function onBoot() {
   await refresh()
+  // The permission mirror owns its own loop and its own cadence (see
+  // `permSync.js`). It is started rather than run here: a first pass would write
+  // to every configured game server before the website had finished booting, and
+  // nothing about R2 is urgent enough to delay a listener for.
+  permSync.start()
+  // The chat titles have a loop of their own for the same reason (phase 17).
+  titleSync.start()
   refreshTimer = setInterval(refresh, REFRESH_MS)
   ingestTimer = setInterval(ingestAll, INGEST_MS)
   pruneTimer = setInterval(prune, PRUNE_MS)
+  sweepTimer = setInterval(sweep, SWEEP_MS)
   // Node keeps the process alive for a pending timer. Core's own intervals are
   // unref'd for exactly this reason: a module that forgets turns `Ctrl-C` into a
   // thirty-second wait, and on a host it turns a `systemctl stop` into a SIGKILL.
-  for (const timer of [refreshTimer, ingestTimer, pruneTimer]) {
+  for (const timer of [refreshTimer, ingestTimer, pruneTimer, sweepTimer]) {
     if (timer && typeof timer.unref === 'function') timer.unref()
   }
 
-  log.info('booted', { refreshMs: REFRESH_MS, ingestMs: INGEST_MS })
+  log.info('booted', { refreshMs: REFRESH_MS, ingestMs: INGEST_MS, permSyncMs: permSync.TICK_MS })
 }
 
 /**
@@ -212,13 +287,17 @@ async function onBoot() {
  * rather than cancelled, since nothing can stop a promise that is still running.
  */
 async function onShutdown() {
-  for (const timer of [refreshTimer, ingestTimer, pruneTimer]) {
+  permSync.stop()
+  titleSync.stop()
+
+  for (const timer of [refreshTimer, ingestTimer, pruneTimer, sweepTimer]) {
     if (timer) clearInterval(timer)
   }
 
   refreshTimer = null
   ingestTimer = null
   pruneTimer = null
+  sweepTimer = null
 
   log.info('shut down')
 }

server/catalogue.js

@@ -69,13 +69,77 @@ const STAFF_KINDS = Object.freeze([
   'player.unbanned',
   'player.login.attempt',
   'player.approved',
+  // Protocol 3's two account frames. Neither carries a code — the code travels
+  // through the player, which is what makes typing it proof — but both name a
+  // Steam id ALONGSIDE a website account's activity, which is exactly the join a
+  // public page must not be able to make: "this player is that person" is a fact
+  // about somebody's identity, not about what happened on the server.
+  'account.link.requested',
+  'account.unlinked',
+  // Protocol 4. Who holds which privilege in game, and the fact that somebody
+  // changed it by hand — a question about a person's standing and about an
+  // operator's own console, neither of which is a public page's business.
+  'perm.drift',
+  // Protocol 13. How a configuration save's reload ended — and, when it failed,
+  // the tail of the game server's own log, which is an operator's console and
+  // can hold anything a plugin chose to print.
+  'config.outcome',
+  // Protocol 13 (F8, D184). Which plugins a server runs, and which permissions
+  // each one registers: an operator's inventory, and the map of what can be
+  // granted there — not a public page's business.
+  'plugin.loaded',
+  'plugin.unloaded',
+  // The world an event borrowed or made, ending on its own deadline:
+  // `lease.expired` since protocol 8 and `world.expired` since protocol 9 — the
+  // latter recognisable only from protocol 13 (F13). Neither was ever classified
+  // (default deny kept both off public pages); both are an event's machinery,
+  // and the public learns what an event did from core's own announcements.
+  'lease.expired',
+  'world.expired',
+  // Protocol 6. Clan membership, which the org lead made members-only (D49):
+  // who joined which clan, and who threw whom out, is the clan's business. It
+  // reaches a clan's own members through core's Team feed, where core resolves
+  // who is a member, and it reaches the server's public feed not at all.
+  'clan.created',
+  'clan.disbanded',
+  'clan.member.added',
+  'clan.member.left',
+  'clan.member.kicked',
 ])
 
-/** Every kind protocol 2 defines. */
+/**
+ * The public kinds that say a NAMED player was on the server at a given moment.
+ *
+ * A subset of `PUBLIC_KINDS`, not a third list: these are public-page material
+ * whose audience an operator chooses (`model/visibility`), where the rest of
+ * `PUBLIC_KINDS` is public by construction. The org lead's rule, settled
+ * 2026-09-22: **nothing tells who is online by default** — the narrowest
+ * audience (staff) unless an operator widens it, and a count is never a name.
+ *
+ * `player.death` and `player.chat` are here, and that was decided rather than
+ * overlooked. They are the killfeed and the chat — the content a feed exists
+ * for — and each one says "this person was on at 12:03" as plainly as a connect
+ * frame does. `player.tally` is a per-minute flush that is only ever sent for a
+ * player who is playing, which makes it a roll call with extra steps.
+ *
+ * What is left in the public set once these are removed is the server's own
+ * story — a wipe, a start, a shutdown — which names nobody.
+ */
+const PRESENCE_KINDS = Object.freeze([
+  'player.connected',
+  'player.disconnected',
+  'player.respawned',
+  'player.death',
+  'player.chat',
+  'player.tally',
+])
+
+/** Every event kind the protocol defines, through protocol 13. */
 const ALL_KINDS = Object.freeze([...PUBLIC_KINDS, ...STAFF_KINDS])
 
 const PUBLIC = new Set(PUBLIC_KINDS)
 const STAFF = new Set(STAFF_KINDS)
+const PRESENCE = new Set(PRESENCE_KINDS)
 
 /**
  * May a signed-out visitor see this kind?
@@ -92,15 +156,27 @@ function isKnown(kind) {
   return PUBLIC.has(kind) || STAFF.has(kind)
 }
 
+/** Does this kind name a player who was on the server at the time? */
+function isPresence(kind) {
+  return PRESENCE.has(kind)
+}
+
 /**
  * Narrows a list of requested kinds to the ones a viewer may have.
  *
  * Returning the allowlist itself when nothing was requested is what makes the
  * public route safe by construction rather than by remembering to filter: there
  * is no code path where "no filter" means "everything".
+ *
+ * `presence` defaults to `false` for the same reason `admin` does: a caller that
+ * forgets to say what the viewer may see gets the narrowest answer. The route
+ * resolves it from the operator's setting (`model/visibility`); nothing else
+ * should be passing `true`.
  */
-function kindsFor({ admin = false, requested = null } = {}) {
-  const permitted = admin ? ALL_KINDS : PUBLIC_KINDS
+function kindsFor({ admin = false, presence = false, requested = null } = {}) {
+  const permitted = admin
+    ? ALL_KINDS
+    : PUBLIC_KINDS.filter((k) => presence || !PRESENCE.has(k))
 
   if (!requested || requested.length === 0) return [...permitted]
 
@@ -111,8 +187,10 @@ function kindsFor({ admin = false, requested = null } = {}) {
 module.exports = {
   PUBLIC_KINDS,
   STAFF_KINDS,
+  PRESENCE_KINDS,
   ALL_KINDS,
   isPublic,
   isKnown,
+  isPresence,
   kindsFor,
 }

server/commands/clan.command.js

@@ -0,0 +1,111 @@
+// ── `/clan name [server]` — one clan, and its roster where the caller may see it
+//
+// D50 deferred it here. A clan's name, colour, score and member count are public
+// (D58); its ROSTER — who is in it and which of them is on — sits behind the
+// roster audience (D48), which defaults to the clan's own members plus staff.
+//
+// The roster decision is `clans.getForViewer`'s, the same function the web page
+// and core's `projectRoster` use, so the three cannot disagree about who may
+// look. What this file adds is D127: **a roster shown to anything short of a
+// `public` audience goes to the caller alone**, never to the channel.
+
+const c = require('./common')
+const clans = require('../model/clans/clans.model')
+
+/** The candidates an ambiguous name lists. */
+const CANDIDATES = 10
+
+/**
+ * Every clan on the servers searched, with the server each came from, and the
+ * servers whose clan board cannot be trusted right now.
+ */
+async function gather(servers) {
+  const boards = await Promise.all(servers.map(async (s) => ({ server: s, ...(await clans.listForServer(s.id)) })))
+  return {
+    rows: boards.flatMap((b) => b.clans.map((clan) => ({ clan, server: b.server }))),
+    unreadable: boards.filter((b) => !b.board.supported || !b.board.fresh).map((b) => b.server),
+  }
+}
+
+/** An exact name (case-insensitive), then a unique prefix. */
+function find(rows, wanted) {
+  const needle = wanted.trim().toLowerCase()
+  const exact = rows.filter((r) => r.clan.name.toLowerCase() === needle)
+  if (exact.length === 1) return { hit: exact[0] }
+  if (exact.length > 1) return { ambiguous: exact }
+  const prefix = rows.filter((r) => r.clan.name.toLowerCase().startsWith(needle))
+  if (prefix.length === 1) return { hit: prefix[0] }
+  if (prefix.length > 1) return { ambiguous: prefix }
+  return {}
+}
+
+function memberLine(m) {
+  const tags = [m.leader ? 'leader' : null, m.online ? 'online' : null].filter(Boolean)
+  return `${m.name || 'Unknown player'}${tags.length ? ` (${tags.join(', ')})` : ''}`
+}
+
+async function handler({ options, actor }) {
+  const wanted = options && typeof options.name === 'string' ? options.name.trim() : ''
+  if (!wanted) return c.refuse('Name a clan.')
+
+  const picked = c.pickServer(await c.listServers(), options.server)
+  const refusal = c.pickRefusal(picked)
+  if (refusal) return refusal
+  const searched = picked.server ? [picked.server] : picked.all
+
+  const { rows, unreadable } = await gather(searched)
+  const { hit, ambiguous } = find(rows, wanted)
+
+  if (ambiguous) {
+    const list = ambiguous.slice(0, CANDIDATES).map((r) => (searched.length > 1 ? `${r.clan.name} on ${r.server.name}` : r.clan.name))
+    return c.refuse(`Several clans match “${wanted}”: ${list.join(', ')}${ambiguous.length > CANDIDATES ? ', …' : ''}`)
+  }
+  if (!hit) {
+    // A board that is missing, stale or unsupported proves nothing about a clan
+    // it does not list. Saying "no such clan" from it would be a guess presented
+    // as a fact.
+    if (unreadable.length) {
+      return c.refuse(
+        `No clan called “${wanted}” is on the boards that can be read right now. ` +
+          `The clan list for ${unreadable.map((s) => s.name).join(', ')} is not available, so it may be there.`,
+      )
+    }
+    return c.refuse(`No clan called “${wanted}”.`)
+  }
+
+  const answer = await clans.getForViewer(hit.clan.externalId, c.viewerOf(actor))
+  if (!answer) return c.refuse(`No clan called “${wanted}”.`)
+  const { clan, roster } = answer
+
+  const fields = [
+    { name: 'Score', value: String(clan.score), inline: true },
+    { name: 'Members', value: clan.maxMembers ? `${clan.memberCount}/${clan.maxMembers}` : String(clan.memberCount), inline: true },
+    { name: 'Server', value: clan.serverName || hit.server.name, inline: true },
+  ]
+  if (clan.color) fields.push({ name: 'Colour', value: clan.color, inline: true })
+
+  const base = { title: clan.name, url: c.pageUrl(`/rust/clans/${encodeURIComponent(clan.externalId)}`), fields }
+  if (!roster.visible || !roster.members.length) return base
+
+  // Leaders first, then whoever is on, then everyone else — the order a person
+  // looking for "who can I talk to" wants.
+  const members = [...roster.members].sort(
+    (a, b) => Number(b.leader) - Number(a.leader) || Number(b.online) - Number(a.online) || String(a.name).localeCompare(String(b.name)),
+  )
+  fields.push({ name: 'Roster', value: c.fitLines(members.map(memberLine)), inline: false })
+
+  // D127 and D48 together: a roster the whole site may see may be posted; any
+  // narrower one is for the caller.
+  return { ...base, ephemeral: roster.audience !== 'public' }
+}
+
+module.exports = {
+  name: 'clan',
+  description: 'A clan on a Rust server — score and members, and its roster where you may see it',
+  options: [
+    { name: 'name', type: 'string', description: 'Clan name, or the start of it', required: true },
+    { name: 'server', type: 'string', description: 'Server name or id (every server when left out)', required: false },
+  ],
+  access: 'everyone',
+  handler,
+}

server/commands/common.js

@@ -0,0 +1,187 @@
+// ── What the five commands share (phase 16, R11) ───────────────────────────
+//
+// Registered with `api.registerSlashCommands` (MODULE_API 1.6.0). The handlers
+// run in the WEBSITE process: core pulls the definitions over its internal API to
+// the bot and dispatches each call back here. Nothing in these files knows what
+// Discord is — a handler is handed an `actor` and returns an envelope.
+//
+// ── The two privacy rules (D127) ──────────────────────────────────────────
+//
+//  1. **A refusal is private.** Core already delivers an `ephemeral` answer as a
+//     private follow-up; `refuse()` below is the one way these files say no, and
+//     it always sets the flag.
+//  2. **An answer narrower than `public` is private too.** Core has no reverse
+//     case: an answer WITHOUT the flag is posted to the channel the command was
+//     run in, where everybody reads it. So a moderator running `/online` in a
+//     public channel must get the names privately, or the names they may see are
+//     published to everyone who may not. That is the leak module-uo's `/guild`
+//     has (D132, Module-uo#46), and every answer here decides it explicitly.
+//
+// ── Three seconds (`HANDLER_TIMEOUT_MS`) ──────────────────────────────────
+//
+// Every answer reads this module's own tables. **No command asks a sidecar**: a
+// game that is slow to answer would cost the reply, and the tables already hold
+// the last thing each server said.
+
+const core = require('../core')
+const servers = require('../model/servers/servers.model')
+const visibility = require('../model/visibility/visibility.model')
+
+/**
+ * Where the caller sits on the presence ladder.
+ *
+ * An UNLINKED caller is `public`, answered directly. Handing `visibility.viewer`
+ * a synthetic request with no user would make it fall through to
+ * `getUserFromRequest`, which expects real cookies (module-uo's phase 3 bug). A
+ * linked caller is handed over as `{ user }`, which `viewer` reads first and then
+ * re-reads from the account row — so a banned or demoted account is judged by
+ * what it is now, not by what core resolved.
+ */
+async function levelFor(actor) {
+  if (!actor || actor.userId == null) return 'public'
+  return visibility.viewerLevel({ user: { id: actor.userId, role: actor.role } })
+}
+
+/** The viewer shape `model/clans` takes: `{ userId, role }` or null. */
+const viewerOf = (actor) => (actor && actor.userId != null ? { userId: actor.userId, role: actor.role || null } : null)
+
+/** Every answer that says no. Private, always (D127 rule 1). */
+const refuse = (text) => ({ text, ephemeral: true })
+
+/** An absolute link to a page on the site. */
+const pageUrl = (path) => `${core.baseUrl}${path}`
+
+const serverUrl = (server) => pageUrl(`/rust/servers/${encodeURIComponent(server.id)}`)
+
+/**
+ * Which server a `server` option names, among `list`.
+ *
+ * An exact id, then an exact name (case-insensitive), then a unique prefix of
+ * either. Servers are added at runtime and `choices` are fixed at load, so this
+ * is free text matched here. A wrong-server answer is worse than "say which one",
+ * so two prefix matches are ambiguous rather than a guess.
+ *
+ * Answers `{ server }`, `{ all }` (no option and more than one server),
+ * `{ none }` (no servers at all), `{ ambiguous }` or `{ missing }`.
+ */
+function pickServer(list, option) {
+  if (!list.length) return { none: true }
+  const wanted = typeof option === 'string' ? option.trim().toLowerCase() : ''
+  if (!wanted) return list.length === 1 ? { server: list[0] } : { all: list }
+
+  const byId = list.find((s) => s.id.toLowerCase() === wanted)
+  if (byId) return { server: byId }
+  const byName = list.filter((s) => s.name.toLowerCase() === wanted)
+  if (byName.length === 1) return { server: byName[0] }
+
+  const prefix = list.filter((s) => s.id.toLowerCase().startsWith(wanted) || s.name.toLowerCase().startsWith(wanted))
+  if (prefix.length === 1) return { server: prefix[0] }
+  if (prefix.length > 1) return { ambiguous: prefix }
+  return { missing: option.trim() }
+}
+
+/** The refusal for each way `pickServer` can fail to name exactly one server. */
+function pickRefusal(picked, { needOne = false } = {}) {
+  const names = (list) => list.map((s) => `${s.name} (\`${s.id}\`)`).join(', ')
+  if (picked.none) return refuse('No Rust servers are set up on this site yet.')
+  if (picked.missing) return refuse(`No server matches “${picked.missing}”.`)
+  if (picked.ambiguous) return refuse(`Several servers match: ${names(picked.ambiguous)}. Name one.`)
+  if (needOne && picked.all) return refuse(`Which server? This site follows ${names(picked.all)}.`)
+  return null
+}
+
+/** Every enabled server, as the public shape. */
+const listServers = (now = Date.now()) => servers.listPublic(now)
+
+// ── Time, in words ────────────────────────────────────────────────────────
+//
+// Plain text, not a platform's timestamp markup: the envelope is platform-
+// agnostic (§7.1), and a second platform would print `<t:…>` literally. So an
+// instant is written in UTC, with how far away it is beside it — the relative
+// part is the one every reader can use without converting.
+
+const UTC_FORMAT = new Intl.DateTimeFormat('en-GB', {
+  timeZone: 'UTC',
+  weekday: 'short',
+  day: 'numeric',
+  month: 'short',
+  hour: '2-digit',
+  minute: '2-digit',
+  hourCycle: 'h23',
+})
+
+function relative(ms, now = Date.now()) {
+  const diff = ms - now
+  const abs = Math.abs(diff)
+  const unit = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`
+  let span
+  if (abs < 60_000) span = 'less than a minute'
+  else if (abs < 3_600_000) span = unit(Math.round(abs / 60_000), 'minute')
+  else if (abs < 172_800_000) span = unit(Math.round(abs / 3_600_000), 'hour')
+  else span = unit(Math.round(abs / 86_400_000), 'day')
+  return diff >= 0 ? `in ${span}` : `${span} ago`
+}
+
+/** `Thu 1 Oct, 18:00 UTC (in 6 days)`, or null for no instant. */
+function when(value, now = Date.now()) {
+  if (!value) return null
+  const ms = value instanceof Date ? value.getTime() : Date.parse(value)
+  if (Number.isNaN(ms)) return null
+  return `${UTC_FORMAT.format(ms).replace(/,? (\d\d:\d\d)$/, ', $1')} UTC (${relative(ms, now)})`
+}
+
+/** Just the distance: `3 days ago`. */
+function ago(value, now = Date.now()) {
+  if (!value) return null
+  const ms = value instanceof Date ? value.getTime() : Date.parse(value)
+  return Number.isNaN(ms) ? null : relative(ms, now)
+}
+
+const SOURCES = {
+  forced: 'the monthly forced wipe',
+  rule: 'the server’s own schedule',
+  once: 'rescheduled by the operator',
+}
+
+/** The next wipe in words, with what decided it — or `null` for no schedule. */
+function nextWipeText(server, now = Date.now()) {
+  const next = server.nextWipe
+  if (!next) return null
+  return `${when(next.at, now)} — ${SOURCES[next.source] || next.source}`
+}
+
+/** Players, as a number out of the maximum, for a server that is up. */
+const playerCount = (server) => (server.maxPlayers ? `${server.players}/${server.maxPlayers}` : String(server.players))
+
+/**
+ * Cut a list of lines to fit one embed field (1 024 characters) and a count,
+ * ending in "and N more" when it had to cut.
+ */
+function fitLines(lines, { max = lines.length, limit = 1000 } = {}) {
+  const kept = []
+  let length = 0
+  for (const line of lines.slice(0, max)) {
+    if (length + line.length + 1 > limit - 20) break
+    kept.push(line)
+    length += line.length + 1
+  }
+  const rest = lines.length - kept.length
+  return rest > 0 ? `${kept.join('\n')}\nand ${rest} more` : kept.join('\n')
+}
+
+module.exports = {
+  levelFor,
+  viewerOf,
+  refuse,
+  pageUrl,
+  serverUrl,
+  pickServer,
+  pickRefusal,
+  listServers,
+  relative,
+  when,
+  ago,
+  nextWipeText,
+  playerCount,
+  fitLines,
+}

server/commands/index.js

@@ -0,0 +1,16 @@
+// ── The slash commands (phase 16, R11, D126) ──────────────────────────────
+//
+// Five read-only questions, answered from this module's own tables. No write
+// verbs, and no `/link`: the account link stays on R1's two surfaces.
+//
+// Registered as ONE batch in `index.js`. Names are bare words (§32.4 reading 1):
+// Discord scopes commands to the bot that owns them, and one module per site
+// (website#204) means no other module competes for them. None collides with the
+// bot's own built-ins, which core cannot see and the bot resolves against us.
+module.exports = [
+  require('./status.command'),
+  require('./wipe.command'),
+  require('./top.command'),
+  require('./online.command'),
+  require('./clan.command'),
+]

server/commands/online.command.js

@@ -0,0 +1,93 @@
+// ── `/online [server]` — how many, and who, where the caller may see it ─────
+//
+// The command with the gate. The org lead's rule (2026-09-22) is that nothing
+// names who is online by default: the COUNT is public and the NAMES reach the
+// server's presence audience (D42, per-server override D45), staff unless an
+// operator widened it.
+//
+// And D127 on top of it: **a caller inside a narrower-than-public audience gets
+// the names PRIVATELY.** The answer is posted where the command was run, and a
+// moderator's `/online` in a public channel would otherwise hand the roll call to
+// everyone reading the channel. Only a server whose audience is `public` posts
+// its names in the open.
+
+const c = require('./common')
+const events = require('../model/events/events.model')
+const visibility = require('../model/visibility/visibility.model')
+
+/** Fifty names, then "and N more" (§32.4 reading 2). */
+const LIMIT = 50
+
+// The link nudge, and only when it is TRUE — module-uo's rule. Linking a Discord
+// account to a site account earns `signed_in` and nothing above it; `staff` is a
+// role an operator grants. So a server that shows names to staff is not a reason
+// to tell anybody to link.
+function linkNudge(actor, required) {
+  if (actor && actor.isLinked) return null
+  if (required !== 'signed_in') return null
+  return 'Link your Discord account on the site to see who is on — this server shows names to signed-in members.'
+}
+
+async function forServer(server, actor, level) {
+  const required = await visibility.presenceFor(server.id)
+  const visible = visibility.meets(level, required)
+  const count = server.online ? server.players : 0
+
+  // Offline, or nobody on: there are no names to decide about, and saying who
+  // was on when the server went down would be the presence board's last word
+  // presented as now.
+  if (!server.online) return { text: `${server.name} is offline.`, url: c.serverUrl(server) }
+  if (!visible || count === 0) {
+    return {
+      title: `${server.name} — ${count} online`,
+      url: c.serverUrl(server),
+      ...(visible ? {} : { notice: linkNudge(actor, required) }),
+    }
+  }
+
+  const players = await events.online(server.id)
+  const names = players.map((p) => (p.sleeping ? `${p.name || 'Unknown player'} (sleeping)` : p.name || 'Unknown player'))
+  return {
+    title: `${server.name} — ${players.length} online`,
+    url: c.serverUrl(server),
+    text: c.fitLines(names, { max: LIMIT, limit: 1900 }),
+    // D127. Anything short of `public` is for the caller alone.
+    ephemeral: required !== 'public',
+  }
+}
+
+async function handler({ options, actor }) {
+  const now = Date.now()
+  const picked = c.pickServer(await c.listServers(now), options && options.server)
+  const refusal = c.pickRefusal(picked)
+  if (refusal) return refusal
+
+  const level = await c.levelFor(actor)
+  if (picked.server) return forServer(picked.server, actor, level)
+
+  // The fleet: counts only, which are public. Names are one server's question,
+  // and the closing line offers it only when naming a server would show some.
+  const visibleSomewhere = (
+    await Promise.all(picked.all.map(async (s) => visibility.meets(level, await visibility.presenceFor(s.id))))
+  ).some(Boolean)
+  return {
+    title: 'Online now',
+    url: c.pageUrl('/rust'),
+    fields: picked.all.slice(0, 25).map((s) => ({
+      name: s.name,
+      value: s.online ? `${s.players} online` : 'Offline',
+      inline: true,
+    })),
+    ...(visibleSomewhere ? { text: 'Name a server to see who is on.' } : {}),
+  }
+}
+
+module.exports = {
+  name: 'online',
+  description: 'How many are on a Rust server, and who, where this site shows names',
+  options: [{ name: 'server', type: 'string', description: 'Server name or id (counts for all when left out)', required: false }],
+  // Everyone, deliberately: `linked` would hide the command from the unlinked
+  // members the nudge exists to invite. The gate is inside the handler.
+  access: 'everyone',
+  handler,
+}

server/commands/status.command.js

@@ -0,0 +1,60 @@
+// ── `/status [server]` — is it up, how full, when did it wipe ───────────────
+//
+// Public at every setting: everything here is on the public server list already.
+// The count is a number and names nobody; the names are `/online`'s business.
+
+const c = require('./common')
+
+/** One line per server, for the fleet view. */
+function summary(server, now) {
+  const parts = [server.online ? `Online · ${c.playerCount(server)}` : 'Offline']
+  if (server.wipedAt) parts.push(`wiped ${c.ago(server.wipedAt, now)}`)
+  return parts.join(' · ')
+}
+
+function detail(server, now) {
+  const fields = [
+    { name: 'Status', value: server.online ? 'Online' : 'Offline', inline: true },
+    { name: 'Players', value: server.online ? c.playerCount(server) : '—', inline: true },
+  ]
+  if (server.worldSize) {
+    fields.push({ name: 'Map', value: server.seed != null ? `${server.worldSize} · seed ${server.seed}` : String(server.worldSize), inline: true })
+  }
+  if (server.wipedAt) fields.push({ name: 'Last wipe', value: c.when(server.wipedAt, now), inline: false })
+  const next = c.nextWipeText(server, now)
+  if (next) fields.push({ name: 'Next wipe', value: next, inline: false })
+
+  // An offline server says when it was last heard from, which is the difference
+  // between "down for a restart" and "gone for a week". A server nothing has ever
+  // heard from says so rather than printing the epoch.
+  if (!server.online) {
+    fields.push({ name: 'Last seen', value: server.lastSeenAt ? c.when(server.lastSeenAt, now) : 'never', inline: false })
+  }
+  return { title: server.name, url: c.serverUrl(server), fields }
+}
+
+async function handler({ options }) {
+  const now = Date.now()
+  const picked = c.pickServer(await c.listServers(now), options && options.server)
+  const refusal = c.pickRefusal(picked)
+  if (refusal) return refusal
+  if (picked.server) return detail(picked.server, now)
+
+  // An embed takes 25 fields. A fleet larger than that is a site that has a
+  // server list page, and the title links to it.
+  return {
+    title: 'Rust servers',
+    url: c.pageUrl('/rust'),
+    fields: picked.all.slice(0, 25).map((s) => ({ name: s.name, value: summary(s, now), inline: false })),
+  }
+}
+
+module.exports = {
+  name: 'status',
+  description: 'Is a Rust server up, how many are on, and when it last wiped',
+  options: [{ name: 'server', type: 'string', description: 'Server name or id (all servers when left out)', required: false }],
+  // Everyone: nothing here is narrower than public, and the gates that DO matter
+  // in other commands are resolved inside their handlers.
+  access: 'everyone',
+  handler,
+}

server/commands/top.command.js

@@ -0,0 +1,85 @@
+// ── `/top [stat] [server] [alltime]` — the leaderboard's top ten (D126) ─────
+//
+// Public at every setting, as on the web: the leaderboard's NAMES are public, and
+// only `lastSeen` sits behind presence (a tally refreshes it every minute a player
+// is on, so it is the Online tab by another name). This answer never carries a
+// `lastSeen`, and never a Steam id — `events.leaderboard` is asked with
+// `presence: false`, so the field is not there to leak.
+
+const c = require('./common')
+const events = require('../model/events/events.model')
+
+/** Ten rows: a summary a person reads, not a table they scroll (§32.4 reading 2). */
+const LIMIT = 10
+
+// `stat`'s choices are fixed, so they are a `choices` list rather than free
+// text. The value is the leaderboard's own sort key.
+const STATS = {
+  kills: { sort: 'kills', label: 'kills', value: (r) => r.kills },
+  deaths: { sort: 'deaths', label: 'deaths', value: (r) => r.deaths },
+  npckills: { sort: 'npcKills', label: 'NPC kills', value: (r) => r.npcKills },
+  playtime: { sort: 'playtime', label: 'playtime', value: (r) => r.playtimeSec, format: hours },
+}
+
+function hours(sec) {
+  const h = Math.floor(sec / 3600)
+  const m = Math.floor((sec % 3600) / 60)
+  return h ? `${h}h ${m}m` : `${m}m`
+}
+
+async function handler({ options }) {
+  const now = Date.now()
+  const stat = STATS[(options && options.stat) || 'kills'] || STATS.kills
+
+  // A leaderboard is one server's. With several and none named the command asks
+  // rather than choosing one, privately — the question is for the caller.
+  const picked = c.pickServer(await c.listServers(now), options && options.server)
+  const refusal = c.pickRefusal(picked, { needOne: true })
+  if (refusal) return refusal
+  const { server } = picked
+
+  // The current wipe unless asked for all-time. A server that has not reported
+  // a wipe yet has nothing to scope to, and all-time is the honest answer.
+  const allTime = Boolean(options && options.alltime) || !server.wipeId
+  const rows = await events.leaderboard({
+    serverId: server.id,
+    wipeId: allTime ? null : server.wipeId,
+    sort: stat.sort,
+    limit: LIMIT,
+    presence: false,
+  })
+
+  const scope = allTime ? 'all time' : 'this wipe'
+  const title = `${server.name} — top ${stat.label}, ${scope}`
+  if (!rows.length) return { title, url: c.serverUrl(server), text: `Nobody is on the board for ${scope} yet.` }
+
+  const format = stat.format || String
+  return {
+    title,
+    url: c.serverUrl(server),
+    text: rows.map((r, i) => `${i + 1}. ${r.name || 'Unknown player'} — ${format(stat.value(r))}`).join('\n'),
+  }
+}
+
+module.exports = {
+  name: 'top',
+  description: 'The top ten players on a Rust server by kills, deaths, NPC kills or playtime',
+  options: [
+    {
+      name: 'stat',
+      type: 'string',
+      description: 'What to rank by (kills when left out)',
+      required: false,
+      choices: [
+        { name: 'Kills', value: 'kills' },
+        { name: 'Deaths', value: 'deaths' },
+        { name: 'NPC kills', value: 'npckills' },
+        { name: 'Playtime', value: 'playtime' },
+      ],
+    },
+    { name: 'server', type: 'string', description: 'Server name or id (needed when there are several)', required: false },
+    { name: 'alltime', type: 'boolean', description: 'Every wipe rather than the current one', required: false },
+  ],
+  access: 'everyone',
+  handler,
+}

server/commands/wipe.command.js

@@ -0,0 +1,38 @@
+// ── `/wipe [server]` — when it wipes next, and when it last did (D128) ──────
+//
+// Public: a wipe date is announced to bring players back. The next wipe is the
+// operator's schedule, computed on this read (`model/servers/nextWipe.js`); a
+// server with no schedule says so and shows only the last wipe it reported.
+
+const c = require('./common')
+
+function lines(server, now) {
+  return [
+    `Next: ${c.nextWipeText(server, now) || 'no schedule set'}`,
+    `Last: ${server.wipedAt ? c.when(server.wipedAt, now) : 'not reported yet'}`,
+  ].join('\n')
+}
+
+async function handler({ options }) {
+  const now = Date.now()
+  const picked = c.pickServer(await c.listServers(now), options && options.server)
+  const refusal = c.pickRefusal(picked)
+  if (refusal) return refusal
+
+  if (picked.server) {
+    return { title: `${picked.server.name} — wipes`, url: c.serverUrl(picked.server), text: lines(picked.server, now) }
+  }
+  return {
+    title: 'Wipes',
+    url: c.pageUrl('/rust'),
+    fields: picked.all.slice(0, 25).map((s) => ({ name: s.name, value: lines(s, now), inline: false })),
+  }
+}
+
+module.exports = {
+  name: 'wipe',
+  description: 'When a Rust server wipes next, and when it last wiped',
+  options: [{ name: 'server', type: 'string', description: 'Server name or id (all servers when left out)', required: false }],
+  access: 'everyone',
+  handler,
+}

server/configEdit.js

@@ -0,0 +1,527 @@
+// ── Editing a plugin's config without rewriting the numbers ───────────────
+//
+// R18's base tier generates a form from a config file's VALUES — a boolean
+// becomes a toggle, a number a field, a string a text box — so it works for
+// whatever plugins an operator happens to have installed, including ones added
+// after we shipped. This file is the half of that which cannot be done naively.
+//
+// ── The trap ──────────────────────────────────────────────────────────────
+//
+// **JavaScript cannot tell `1` from `1.0`.** `JSON.parse('{"Rate":1.0}')` yields
+// the number `1`, and `JSON.stringify` writes it back as `1`. Both frameworks
+// deserialize a config into typed C# classes, so a naive read-modify-write
+// silently rewrites every whole-numbered float as an integer — **on fields
+// nobody touched** — and Newtonsoft may coerce it or may throw. A throw at load
+// means the plugin does not come back, and R6/R17 make four of them required.
+//
+// The fields at risk are exactly the ones a Rust server tunes: gather rates,
+// multipliers, scales.
+//
+// ── So nothing here ever parses, mutates and re-serialises ────────────────
+//
+// `scan` is a JSON reader that records, for every value, the **span of source
+// text** it came from. `applyEdits` splices new literals into those spans and
+// leaves every other byte of the document exactly as it was — including the
+// author's indentation, key order, and the `.0` on a float nobody edited.
+//
+// Two rules fall out of that and both are deliberate:
+//
+//  1. **A number's new value arrives as the literal text an admin typed**, never
+//     as a JavaScript number. `2.50` stays `2.50`; `1.0` stays `1.0`. The value
+//     never becomes a `Number` anywhere in this module, which is the only way to
+//     be sure it cannot be re-serialised into something else.
+//  2. **The generated form is type-preserving.** An edit may change what a value
+//     IS, never what KIND of thing it is; changing a number into a string, or
+//     adding a key, is a structural change and belongs in the raw-JSON tier,
+//     where the admin is editing the document itself.
+//
+// Nothing in this file touches the network, a database, or core.
+
+/** Value kinds this module names, in the language the form speaks. */
+const KINDS = ['object', 'array', 'string', 'number', 'boolean', 'null']
+
+/**
+ * A JSON number, by the grammar rather than by `Number()`.
+ *
+ * Used to judge a literal an admin typed. `Number('0x10')`, `Number('')` and
+ * `Number(' 1 ')` are all happily finite and none of the three is JSON, so the
+ * check has to be the grammar — which is also what keeps `1.0` and `1e3`
+ * acceptable, since preserving those is the entire point.
+ */
+const JSON_NUMBER = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/
+
+/**
+ * Words that make a value a secret.
+ *
+ * Matched against the key split into WORDS, not as a substring: `Monkey` and
+ * `Keybind` contain "key" and neither is a credential, and a config editor that
+ * masked every third field would teach an operator to ignore the mask.
+ */
+const SECRET_WORDS = new Set([
+  'key',
+  'keys',
+  'apikey',
+  'token',
+  'tokens',
+  'secret',
+  'secrets',
+  'password',
+  'passwd',
+  'pass',
+  'webhook',
+  'webhooks',
+  'credential',
+  'credentials',
+  'auth',
+])
+
+class JsonScanError extends Error {}
+
+/**
+ * Reads `text` into a tree of nodes that remember where they came from.
+ *
+ * Every node carries `start` and `end`, the half-open span of the value in the
+ * source. A caller that only wants the data can read `value`; a caller that
+ * wants to CHANGE the data uses the span, because the span is the only thing
+ * that survives a round trip unchanged.
+ *
+ * @param {string} text
+ * @returns {object} the root node
+ * @throws {JsonScanError} with a position, on anything that is not JSON
+ */
+function scan(text) {
+  const src = String(text)
+  let at = 0
+
+  function fail(message) {
+    throw new JsonScanError(`${message} at offset ${at}`)
+  }
+
+  function ws() {
+    while (at < src.length && (src[at] === ' ' || src[at] === '\t' || src[at] === '\n' || src[at] === '\r')) at += 1
+  }
+
+  function literal(word, value) {
+    if (src.startsWith(word, at)) {
+      const start = at
+      at += word.length
+      return { type: word === 'null' ? 'null' : 'boolean', value, start, end: at }
+    }
+    return null
+  }
+
+  function string() {
+    const start = at
+    at += 1 // the opening quote
+
+    let out = ''
+
+    while (at < src.length) {
+      const ch = src[at]
+
+      if (ch === '"') {
+        at += 1
+        return { type: 'string', value: out, start, end: at }
+      }
+
+      if (ch === '\\') {
+        const esc = src[at + 1]
+        at += 2
+
+        if (esc === 'u') {
+          const hex = src.slice(at, at + 4)
+          if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail('bad unicode escape')
+          out += String.fromCharCode(parseInt(hex, 16))
+          at += 4
+        } else if (esc === 'n') out += '\n'
+        else if (esc === 't') out += '\t'
+        else if (esc === 'r') out += '\r'
+        else if (esc === 'b') out += '\b'
+        else if (esc === 'f') out += '\f'
+        else if (esc === '"' || esc === '\\' || esc === '/') out += esc
+        else fail('bad escape')
+
+        continue
+      }
+
+      out += ch
+      at += 1
+    }
+
+    return fail('unterminated string')
+  }
+
+  function number() {
+    const start = at
+    if (src[at] === '-') at += 1
+    while (at < src.length && /[0-9]/.test(src[at])) at += 1
+    if (src[at] === '.') {
+      at += 1
+      while (at < src.length && /[0-9]/.test(src[at])) at += 1
+    }
+    if (src[at] === 'e' || src[at] === 'E') {
+      at += 1
+      if (src[at] === '+' || src[at] === '-') at += 1
+      while (at < src.length && /[0-9]/.test(src[at])) at += 1
+    }
+
+    const raw = src.slice(start, at)
+    if (!JSON_NUMBER.test(raw)) fail(`'${raw}' is not a number`)
+
+    // `raw` is the fact; `value` is a convenience for rendering and comparison,
+    // and is never written back to the document.
+    return { type: 'number', value: Number(raw), raw, start, end: at }
+  }
+
+  function value() {
+    ws()
+    const ch = src[at]
+
+    if (ch === '{') return object()
+    if (ch === '[') return array()
+    if (ch === '"') return string()
+    if (ch === '-' || (ch >= '0' && ch <= '9')) return number()
+
+    const lit = literal('true', true) || literal('false', false) || literal('null', null)
+    if (lit) return lit
+
+    return fail('unexpected character')
+  }
+
+  function object() {
+    const start = at
+    at += 1 // {
+    const children = []
+    ws()
+
+    if (src[at] === '}') {
+      at += 1
+      return { type: 'object', children, start, end: at }
+    }
+
+    for (;;) {
+      ws()
+      if (src[at] !== '"') fail('expected a key')
+      const key = string()
+      ws()
+      if (src[at] !== ':') fail('expected a colon')
+      at += 1
+
+      const child = value()
+      child.key = key.value
+      child.keyStart = key.start
+      child.keyEnd = key.end
+      children.push(child)
+
+      ws()
+      if (src[at] === ',') {
+        at += 1
+        continue
+      }
+      if (src[at] === '}') {
+        at += 1
+        return { type: 'object', children, start, end: at }
+      }
+      return fail('expected a comma or a closing brace')
+    }
+  }
+
+  function array() {
+    const start = at
+    at += 1 // [
+    const children = []
+    ws()
+
+    if (src[at] === ']') {
+      at += 1
+      return { type: 'array', children, start, end: at }
+    }
+
+    for (;;) {
+      const child = value()
+      child.index = children.length
+      children.push(child)
+
+      ws()
+      if (src[at] === ',') {
+        at += 1
+        continue
+      }
+      if (src[at] === ']') {
+        at += 1
+        return { type: 'array', children, start, end: at }
+      }
+      return fail('expected a comma or a closing bracket')
+    }
+  }
+
+  const root = value()
+  ws()
+  if (at !== src.length) fail('trailing content')
+
+  return root
+}
+
+/** Splits a config key into words, across camelCase, snake_case, spaces and dots. */
+function words(key) {
+  return String(key)
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .split(/[^A-Za-z0-9]+/)
+    .filter(Boolean)
+    .map((w) => w.toLowerCase())
+}
+
+/**
+ * Whether a key names a credential. See `SECRET_WORDS`.
+ *
+ * **A field flagged here is not emptied.** D37 decided the raw tier shows real
+ * values — an admin can already read the file over SSH — so the API answers with
+ * the document as it is, the form renders a flagged field masked with a reveal
+ * control, and the flag's load-bearing use is the audit trail, where the values
+ * genuinely never appear.
+ */
+function isSecretKey(key) {
+  return words(key).some((w) => SECRET_WORDS.has(w))
+}
+
+/** A pointer as a person reads it: `Settings.Rates[0].Wood`. */
+function pointerPath(pointer) {
+  return pointer
+    .map((step) => (typeof step === 'number' ? `[${step}]` : step))
+    .join('.')
+    .replace(/\.\[/g, '[')
+}
+
+/**
+ * Walks a scanned tree into the flat description the form is built from.
+ *
+ * **What is NOT here is as deliberate as what is.** There are no descriptions,
+ * no minimums, no maximums and no allowed-value sets, because a config file
+ * carries none: the key name is the entire label. An empty array and a `null`
+ * carry no type at all, so nothing can be inferred for them and they are marked
+ * `advanced` — the raw tier is where a value with no shape gets edited.
+ *
+ * @param {object} root      from `scan`
+ * @param {object} [options]
+ * @param {number} [options.maxDepth]  past this, a subtree is advanced-only
+ * @param {string[]} [options.locked]  top-level keys that may not be edited (D38)
+ */
+function describe(root, { maxDepth = 6, locked = [] } = {}) {
+  const lockedSet = new Set(locked.map((k) => String(k).toLowerCase()))
+  const fields = []
+
+  function visit(node, pointer, depth, inheritedSecret, inheritedLock) {
+    const key = pointer.length ? pointer[pointer.length - 1] : ''
+    const secret = inheritedSecret || (typeof key === 'string' && isSecretKey(key))
+    const isLocked =
+      inheritedLock || (pointer.length === 1 && typeof key === 'string' && lockedSet.has(key.toLowerCase()))
+
+    if (node.type === 'object' || node.type === 'array') {
+      const tooDeep = depth >= maxDepth
+
+      fields.push({
+        pointer: [...pointer],
+        path: pointerPath(pointer),
+        key: typeof key === 'number' ? `[${key}]` : key,
+        type: node.type,
+        depth,
+        count: node.children.length,
+        secret,
+        locked: isLocked,
+        // An empty container has nothing to infer a member's shape from, and a
+        // container past the depth limit has more shape than a form should try
+        // to draw. Both are honest reasons to send somebody to the raw tier.
+        advanced: tooDeep || node.children.length === 0,
+        ...(tooDeep ? { reason: 'deeper than the form will draw' } : {}),
+        ...(node.children.length === 0 ? { reason: 'empty, so there is no shape to read' } : {}),
+      })
+
+      if (tooDeep) return
+
+      node.children.forEach((child, index) => {
+        visit(child, [...pointer, node.type === 'array' ? index : child.key], depth + 1, secret, isLocked)
+      })
+      return
+    }
+
+    fields.push({
+      pointer: [...pointer],
+      path: pointerPath(pointer),
+      key: typeof key === 'number' ? `[${key}]` : key,
+      type: node.type,
+      depth,
+      // A number is reported as its LITERAL as well as its value. The literal is
+      // what the form must round-trip; the value is for display and sorting.
+      ...(node.type === 'number' ? { raw: node.raw } : {}),
+      value: node.value,
+      secret,
+      locked: isLocked,
+      // `null` has no type, so there is nothing to render but a raw editor.
+      advanced: node.type === 'null',
+      ...(node.type === 'null' ? { reason: 'null carries no type to read' } : {}),
+    })
+  }
+
+  visit(root, [], 0, false, false)
+  return fields
+}
+
+/** Finds the node a pointer names, or null. */
+function resolve(root, pointer) {
+  let node = root
+
+  for (const step of pointer) {
+    if (!node || (node.type !== 'object' && node.type !== 'array')) return null
+
+    if (node.type === 'array') {
+      if (typeof step !== 'number') return null
+      node = node.children[step]
+    } else {
+      node = node.children.find((child) => child.key === step)
+    }
+
+    if (!node) return null
+  }
+
+  return node
+}
+
+/** The exact source text a node was read from. */
+function literalOf(text, node) {
+  return String(text).slice(node.start, node.end)
+}
+
+/**
+ * Turns one edit into the literal that will be spliced in, or explains why not.
+ *
+ * `raw` is used verbatim for a number — that is the whole mechanism — and is
+ * validated against the JSON grammar first, because verbatim and unvalidated
+ * would be a way to write anything at all into somebody's config file.
+ */
+function literalFor(node, edit) {
+  if (node.type === 'number') {
+    const raw = String(edit.raw !== undefined && edit.raw !== null ? edit.raw : edit.value).trim()
+    if (!JSON_NUMBER.test(raw)) return { error: `'${raw}' is not a number` }
+    return { literal: raw }
+  }
+
+  if (node.type === 'string') {
+    if (typeof edit.value !== 'string') return { error: 'expected text' }
+    return { literal: JSON.stringify(edit.value) }
+  }
+
+  if (node.type === 'boolean') {
+    if (typeof edit.value !== 'boolean') return { error: 'expected true or false' }
+    return { literal: edit.value ? 'true' : 'false' }
+  }
+
+  return { error: `a ${node.type} is edited in the raw tier` }
+}
+
+/**
+ * Applies a set of edits to a document and returns the new text.
+ *
+ * Spans are spliced from the **end of the document backwards**, so that an
+ * earlier edit never moves a later edit's offsets. Every edit is resolved and
+ * checked before any splice happens: a refusal leaves the caller with the
+ * original text rather than a partly-edited one.
+ *
+ * @param {string} text
+ * @param {Array<{pointer: Array<string|number>, value?: any, raw?: string}>} edits
+ * @returns {{ text?: string, changes?: object[], error?: string }}
+ */
+function applyEdits(text, edits, { locked = [] } = {}) {
+  let root
+
+  try {
+    root = scan(text)
+  } catch (err) {
+    return { error: `the file on the server is not valid JSON: ${err.message}` }
+  }
+
+  const lockedSet = new Set(locked.map((k) => String(k).toLowerCase()))
+  const staged = []
+  const seen = new Set()
+
+  for (const edit of edits || []) {
+    const pointer = Array.isArray(edit.pointer) ? edit.pointer : null
+    if (!pointer || pointer.length === 0) return { error: 'an edit must name a field' }
+
+    const path = pointerPath(pointer)
+    if (seen.has(path)) return { error: `'${path}' is edited twice in one save` }
+    seen.add(path)
+
+    if (typeof pointer[0] === 'string' && lockedSet.has(pointer[0].toLowerCase())) {
+      return { error: `'${path}' cannot be edited from the website` }
+    }
+
+    const node = resolve(root, pointer)
+    if (!node) return { error: `'${path}' is not in this file` }
+
+    const { literal, error } = literalFor(node, edit)
+    if (error) return { error: `'${path}': ${error}` }
+
+    staged.push({
+      path,
+      pointer,
+      start: node.start,
+      end: node.end,
+      from: literalOf(text, node),
+      to: literal,
+      secret: pointer.some((step) => typeof step === 'string' && isSecretKey(step)),
+    })
+  }
+
+  // Nothing to do is not an error, but it must not produce a write either: a
+  // save with no changes would spend a reload — and a reload is the one part of
+  // this feature that can take a plugin down.
+  const changed = staged.filter((s) => s.from !== s.to)
+  if (changed.length === 0) return { text: String(text), changes: [] }
+
+  let out = String(text)
+
+  for (const edit of [...changed].sort((a, b) => b.start - a.start)) {
+    out = out.slice(0, edit.start) + edit.to + out.slice(edit.end)
+  }
+
+  // The result must still be JSON. It always is when the pieces are — this is a
+  // guard against a bug in this file, not against the caller.
+  try {
+    scan(out)
+  } catch (err) {
+    return { error: `the edit produced something that is not JSON: ${err.message}` }
+  }
+
+  return { text: out, changes: changed.map(redactChange) }
+}
+
+/**
+ * What the audit trail records for one changed field.
+ *
+ * **A secret's values are never written down.** The raw tier shows real values
+ * to an admin who asks for them, which is a deliberate decision (D37) about a
+ * page somebody has to open — but an activity log is read by more people, for
+ * longer, and usually by somebody who was not there. Those are different
+ * exposures and they get different answers.
+ */
+function redactChange(change) {
+  return {
+    path: change.path,
+    from: change.secret ? '***' : change.from,
+    to: change.secret ? '***' : change.to,
+    ...(change.secret ? { secret: true } : {}),
+  }
+}
+
+module.exports = {
+  KINDS,
+  JSON_NUMBER,
+  JsonScanError,
+  scan,
+  describe,
+  resolve,
+  applyEdits,
+  isSecretKey,
+  pointerPath,
+  words,
+}

server/core.js

@@ -86,6 +86,14 @@ module.exports = {
   // that needs an identity needs to *read* one.
   auth: { getUserFromRequest: (...args) => need().auth.getUserFromRequest(...args) },
 
+  // One user by id (MODULE_API.md §2.3, 1.1.0). Here for the presence gate
+  // (`model/visibility`): `getUserFromRequest` decodes a token and nothing more,
+  // so the role in it is the role the account had when the token was minted. A
+  // moderator demoted this morning would keep reading who is online until their
+  // token expired. Re-reading the row is what makes a demotion — or a ban — take
+  // effect on the next request, the same promise core's admin tier makes.
+  users: { getById: (...args) => need().users.getById(...args) },
+
   // Core's middleware, taken as values rather than wrapped: express stores the
   // function reference at mount time, so a wrapper is what would end up in the
   // stack. Routers are built inside `register()`, so `ctx` is set by then.
@@ -141,9 +149,41 @@ module.exports = {
   // would be worse, since a module has more than one thing it could reconcile.
   reconcileEvents: () => need().events.reconcile(),
 
+  // MODULE_API 1.11.0 (PLAN_FIXES F14, D170, D183). The game ended one of this
+  // module's ledgered resources at its own deadline — a zone the plugin erased
+  // when its time was up (`world.expired`). Core files it `expired`: terminal,
+  // never taken back at teardown, and not `orphaned`, which is reconcile's word
+  // for something that vanished with nobody asking. Fire and forget, and a
+  // `{ kind, ref }` no run ledgered is not an error.
+  expireEvent: (resource) => need().events.expired(resource),
+
+  // Teams (MODULE_API.md §2.3, 1.6.0) — the push half of the provider this
+  // module registers (`model/clans/teamProvider.js`). Three calls, all
+  // fire-and-forget, and core's contract is that none of them can make this
+  // module's call site slow or turn a background failure into its error:
+  //
+  //   publish(event)       a membership or leadership change, as it happened
+  //   reconcile({reason})  "the set may have changed, come and ask" — debounced
+  //   pushActivity(items)  the per-Team feed, idempotent on each item's dedupeKey
+  //
+  // Correctness comes from reconciliation either way; `publish` only makes a
+  // change visible sooner. Wrapped as calls, like `emit`, so a file that takes
+  // `core.teams` at require time still resolves `ctx` when it is used.
+  teams: {
+    publish: (event) => need().teams.publish(event),
+    reconcile: (options) => need().teams.reconcile(options),
+    pushActivity: (items) => need().teams.activity.push(items),
+  },
+
   // Deployment facts. `moduleRoot` is the absolute path to `modules/<id>/` — the
   // only correct way to find a file you shipped, because the working directory is
   // core's and the module's location is the loader's business.
   get moduleRoot() { return need().paths.moduleRoot },
   get moduleId() { return need().moduleId },
+
+  // The site's public address, with no trailing slash (§2.3, 1.1.0). Phase 16's
+  // slash commands link an answer's title to its page; a chat message has no
+  // origin to be relative to. A getter over core's getter, so an operator who
+  // changes `APP_BASE_URL` is read at the call, never captured at load.
+  get baseUrl() { return need().site.baseUrl },
 }

server/db/purge.sql

@@ -19,6 +19,37 @@
 -- it knows this module registered, because it is the side that knows which
 -- registrant owned what.
 
+-- Phase 17. `rust_perm_group_chat` before `rust_perm_groups`, which it
+-- references; the rest of this phase is columns, which go with their tables.
+DROP TABLE IF EXISTS rust_perm_group_chat;
+DROP TABLE IF EXISTS rust_title_rules;
+
+-- Phase 14.
+DROP TABLE IF EXISTS rust_map_overrides;
+DROP TABLE IF EXISTS rust_map_images;
+
+-- Phase 13b.
+DROP TABLE IF EXISTS rust_perm_run_grants;
+
+-- Phase 7b.
+DROP TABLE IF EXISTS rust_clan_boards;
+DROP TABLE IF EXISTS rust_clan_members;
+DROP TABLE IF EXISTS rust_clans;
+DROP TABLE IF EXISTS rust_settings;
+DROP TABLE IF EXISTS rust_config_writes;
+
+-- Phase 7. Children before parents: every one of these carries a foreign key
+-- into `rust_servers`, `users` or `rust_perm_groups`.
+DROP TABLE IF EXISTS rust_perm_catalogue;
+DROP TABLE IF EXISTS rust_perm_sync;
+DROP TABLE IF EXISTS rust_perm_revocations;
+DROP TABLE IF EXISTS rust_perm_drift;
+DROP TABLE IF EXISTS rust_perm_pushed;
+DROP TABLE IF EXISTS rust_perm_grants;
+DROP TABLE IF EXISTS rust_perm_group_members;
+DROP TABLE IF EXISTS rust_perm_group_permissions;
+DROP TABLE IF EXISTS rust_perm_groups;
+DROP TABLE IF EXISTS rust_account_links;
 DROP TABLE IF EXISTS rust_ingest_cursor;
 DROP TABLE IF EXISTS rust_presence;
 DROP TABLE IF EXISTS rust_events;

server/db/schema.sql

@@ -291,6 +291,315 @@ CREATE TABLE IF NOT EXISTS rust_ingest_cursor (
 );
 
 
+-- ── Who owns which Steam account ──────────────────────────────────────────
+--
+-- R1's identity link, and the reason it is a table rather than a column on
+-- `rust_players`: a link is a fact about a WEBSITE USER that happens to be keyed
+-- by a Steam id, and it outlives every row this module writes about play. A
+-- column here would be null for the overwhelming majority of players and would
+-- be deleted by any sweep that pruned inactive ones.
+--
+-- **Keyed on `steam_id` alone, fleet-wide.** `rust_players` already made that
+-- call in protocol 2 and it is the truth of the thing: a Steam account is one
+-- person across every server an operator runs, where stats are per server and
+-- per wipe. Linking on one server links for the fleet, because there is nothing
+-- else it could honestly mean.
+--
+-- **One Steam id, at most one user** — that is what the primary key buys, and it
+-- is load-bearing rather than tidy. Phase 7 makes the site the author of who may
+-- do what in game and phase 13 makes it the thing that hands out loot; both are
+-- grants against a Steam id, and both assume the question "whose is this?" has
+-- exactly one answer.
+--
+-- The reverse is deliberately NOT constrained: one website user may hold several
+-- Steam accounts. People have a second account, or a family shares a site login,
+-- and refusing that would be inventing a rule the game does not have.
+--
+-- `ON DELETE CASCADE` from `users`: a deleted account's links go with it. The
+-- alternative is a row naming a user id that resolves to nobody, which every
+-- read would then have to defend against.
+CREATE TABLE IF NOT EXISTS rust_account_links (
+  steam_id   VARCHAR(32)  NOT NULL PRIMARY KEY,
+  user_id    INT          NOT NULL,
+  -- What the player was called in game when they linked. A display name, kept
+  -- so an operator reading the admin panel sees a person rather than a number;
+  -- never used to identify anybody, because a Rust name changes on a whim.
+  name       VARCHAR(191) NULL,
+  -- Which server minted the code. Not part of the identity — the link is
+  -- fleet-wide — but an operator asking "where did this come from" has no other
+  -- way to find out, and a support conversation starts there.
+  server_id  VARCHAR(64)  NULL,
+  linked_at  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_links_user FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+  KEY idx_rust_links_user (user_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+
+-- ── Site-owned permissions (phase 7, R2) ──────────────────────────────────
+--
+-- The website is the author of record for who may do what in game, and the
+-- framework's own permission store is an ENFORCEMENT CACHE. That is one
+-- sentence with three consequences, and the tables below are shaped by them:
+--
+--   • Every third-party plugin honours a site grant with no adapter, because
+--     they all already call `UserHasPermission`. Nothing here is read by the
+--     game directly; it is pushed into the store the game already consults.
+--   • A wipe stops being a data-loss event. The game forgets and the site does
+--     not, so the next sync puts it all back.
+--   • A hand edit is REPORTED, never silently overwritten (D31). Which means
+--     the site has to be able to tell a grant it made from one somebody typed
+--     at a console — and that is a fact only the site can hold, because the
+--     store records who granted a permission nowhere.
+--
+-- ── A grant is against a WEBSITE USER (D28) ───────────────────────────────
+--
+-- Not against a Steam id, though a Steam id is what reaches the game. The site
+-- authors privilege for a PERSON: phase 13's earned entitlements follow whoever
+-- earned them, and an account unlinked from a person takes their privileges
+-- with it. The Steam ids are resolved from `rust_account_links` at push time,
+-- so a player who links a second account gets what they hold on both — which is
+-- the honest reading of "this person may do this".
+--
+-- A user with no linked account is authored against perfectly well and simply
+-- reaches nobody until they link. That is visible on the admin screen rather
+-- than silent, because a grant that reaches nothing looks identical to a grant
+-- that worked from every other angle.
+--
+-- ── Scope (D29) ───────────────────────────────────────────────────────────
+--
+-- Every authored row carries one: a server id, or `*` for the whole fleet. The
+-- game stores permissions per server (each has its own store), an operator
+-- running a modded server and a vanilla one will not want one set on both, and
+-- a single-server community never has to think about it.
+
+
+-- ── Groups ────────────────────────────────────────────────────────────────
+--
+-- Mirrored into the game as REAL groups (D30) rather than flattened into
+-- per-player grants. Third-party plugins read group membership, BetterChat's
+-- group API (R15, phase 17) has something to hang on, and an operator reading
+-- `oxide.show groups` sees what the website shows.
+--
+-- The cost of that fidelity is written down in PLAN.md §12.2 rule 4 and does
+-- not go away: **a player the store has never seen cannot be put in a group**,
+-- while a direct grant to the same id works immediately. The sync reports those
+-- members as pending and the membership lands on their first connection.
+--
+-- The name is the primary key, fleet-wide, even though the row carries a scope:
+-- one `vip` on the site is one `vip` in the game, pushed to the servers its
+-- scope names. Two groups of the same name with different scopes would be two
+-- definitions of one name in every store that received both.
+CREATE TABLE IF NOT EXISTS rust_perm_groups (
+  name        VARCHAR(64)   NOT NULL PRIMARY KEY,
+  title       VARCHAR(120)  NOT NULL DEFAULT '',
+  rank        INT           NOT NULL DEFAULT 0,
+  scope       VARCHAR(64)   NOT NULL DEFAULT '*',
+  created_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+
+-- What each group carries. A row per permission rather than a list on the group
+-- for the ordinary reason: "which groups grant kits.vip" is the question an
+-- operator asks when they are about to remove a plugin, and that is a WHERE
+-- clause here and a scan of every row in the other shape.
+CREATE TABLE IF NOT EXISTS rust_perm_group_permissions (
+  group_name  VARCHAR(64)   NOT NULL,
+  permission  VARCHAR(128)  NOT NULL,
+  PRIMARY KEY (group_name, permission),
+  CONSTRAINT fk_rust_perm_group_permissions_group
+    FOREIGN KEY (group_name) REFERENCES rust_perm_groups (name) ON DELETE CASCADE
+);
+
+
+-- Who is in each group — by website user, like every other authored row.
+--
+-- `added_by` is an admin's user id and deliberately carries NO foreign key: a
+-- staff member's account being deleted must not delete the record of what they
+-- did, and `ON DELETE SET NULL` would quietly rewrite history to "nobody".
+-- The activity log is the audit trail; this column is a convenience beside it.
+CREATE TABLE IF NOT EXISTS rust_perm_group_members (
+  group_name  VARCHAR(64)  NOT NULL,
+  user_id     INT          NOT NULL,
+  added_by    INT          NULL,
+  added_at    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (group_name, user_id),
+  KEY idx_rust_perm_members_user (user_id),
+  CONSTRAINT fk_rust_perm_members_group
+    FOREIGN KEY (group_name) REFERENCES rust_perm_groups (name) ON DELETE CASCADE,
+  CONSTRAINT fk_rust_perm_members_user
+    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+);
+
+
+-- ── Direct grants ─────────────────────────────────────────────────────────
+--
+-- A permission held by one person, without a group. It is not a lesser version
+-- of membership: it is the shape that reaches a player who has never connected
+-- to that server, which is exactly what an entitlement earned on the website at
+-- three in the morning has to do (R16).
+--
+-- `source` is why this table does not need changing in phase 13. Every later
+-- author — an event action granting the right to redeem a kit, a lease handing
+-- out a weekend group — writes a row here with its own source rather than a
+-- store of its own, so there is one answer to "why does this player have this"
+-- and one place the push reads.
+CREATE TABLE IF NOT EXISTS rust_perm_grants (
+  id          INT UNSIGNED  NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  user_id     INT           NOT NULL,
+  permission  VARCHAR(128)  NOT NULL,
+  scope       VARCHAR(64)   NOT NULL DEFAULT '*',
+  source      VARCHAR(32)   NOT NULL DEFAULT 'admin',
+  note        VARCHAR(255)  NULL,
+  granted_by  INT           NULL,
+  granted_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_rust_perm_grant (user_id, permission, scope),
+  KEY idx_rust_perm_grant_user (user_id),
+  CONSTRAINT fk_rust_perm_grants_user
+    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+);
+
+
+-- ── What this site has actually put in each game ──────────────────────────
+--
+-- The site's memory of its own authorship, one row per thing it has confirmed
+-- into one server's store. It is the table that makes D31 possible at all.
+--
+-- Three sets, and every interesting question is the difference between two of
+-- them:
+--
+--   desired − pushed   what to apply
+--   pushed  − desired  what to RETIRE, because the site put it there and has
+--                      since withdrawn it
+--   present − desired  drift: somebody else put it there
+--
+-- Without the middle row a withdrawn grant is indistinguishable from a hand
+-- edit, and those two have opposite correct answers. Inferring it from absence
+-- is the mistake this table exists to prevent.
+--
+-- It is keyed by Steam id rather than by user, because it records what is in the
+-- GAME, and the game has never heard of a website account. Unlinking an account
+-- therefore leaves its row here until the next sync retires it — which is the
+-- correct behaviour and would be impossible to express keyed the other way.
+CREATE TABLE IF NOT EXISTS rust_perm_pushed (
+  server_id  VARCHAR(64)   NOT NULL,
+  -- `grant` | `member` | `group-permission` | `group`
+  kind       VARCHAR(24)   NOT NULL,
+  -- a Steam id, or a group name
+  subject    VARCHAR(64)   NOT NULL,
+  -- a permission, a group name, or '' for the existence of a group
+  object     VARCHAR(128)  NOT NULL,
+  pushed_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (server_id, kind, subject, object),
+  CONSTRAINT fk_rust_perm_pushed_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+);
+
+
+-- ── Drift ─────────────────────────────────────────────────────────────────
+--
+-- What a sync found in a server's store that the site did not author, within
+-- the namespace the site claims. Rows appear and disappear with the report:
+-- this is the CURRENT difference, not a history of differences, and a hand edit
+-- that somebody has since removed should stop being on the screen.
+--
+-- Nothing here is ever removed from the game by the sync itself. An operator
+-- typing `oxide.grant` during an incident is drift, not an error, and the two
+-- answers offered to them — adopt it, or revoke it — are both a person's
+-- decision.
+CREATE TABLE IF NOT EXISTS rust_perm_drift (
+  id          INT UNSIGNED  NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  server_id   VARCHAR(64)   NOT NULL,
+  kind        VARCHAR(24)   NOT NULL,
+  subject     VARCHAR(64)   NOT NULL,
+  object      VARCHAR(128)  NOT NULL,
+  first_seen  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  last_seen   DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_rust_perm_drift (server_id, kind, subject, object),
+  CONSTRAINT fk_rust_perm_drift_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+);
+
+
+-- ── Removing something the site never put there ───────────────────────────
+--
+-- Revoking a drift row cannot go through `rust_perm_pushed`, because the whole
+-- point of a drift row is that it was never pushed. It cannot go through the
+-- authored tables either: a foreign grant often names a Steam id that belongs
+-- to no website account at all, and there is no user to author it against.
+--
+-- So a revoke is its own instruction with its own lifetime: queued by a person,
+-- carried in the next sync's retire list, and deleted once a report says the
+-- game no longer has it. A server that is offline keeps the instruction until
+-- it comes back, which is the behaviour an operator expects from a website that
+-- claims to be the author of record.
+CREATE TABLE IF NOT EXISTS rust_perm_revocations (
+  id            INT UNSIGNED  NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  server_id     VARCHAR(64)   NOT NULL,
+  kind          VARCHAR(24)   NOT NULL,
+  subject       VARCHAR(64)   NOT NULL,
+  object        VARCHAR(128)  NOT NULL,
+  requested_by  INT           NULL,
+  requested_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_rust_perm_revocation (server_id, kind, subject, object),
+  CONSTRAINT fk_rust_perm_revocations_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+);
+
+
+-- ── The state of the mirror, per server ───────────────────────────────────
+--
+-- One row per configured server: whether its store currently matches what the
+-- site authors, when that was last true, and what the last report said.
+--
+-- `dirty` is how everything that should provoke a sync says so without knowing
+-- anything about syncing: an admin writing a grant, a drift hook firing in the
+-- game, a server reporting a new boot id or a new wipe. The loop owns WHEN, and
+-- every other part of the module owns WHETHER.
+--
+-- `desired_hash` and `synced_hash` are the cheap half of that question. A loop
+-- that pushed the whole set every tick would work and would also write to six
+-- game servers every thirty seconds for ever; comparing a hash costs one query
+-- and skips the round trip when nothing has changed. The periodic audit below
+-- is what keeps that from being a way to never notice drift.
+CREATE TABLE IF NOT EXISTS rust_perm_sync (
+  server_id        VARCHAR(64)  NOT NULL PRIMARY KEY,
+  -- `pending` | `ok` | `failed`
+  state            VARCHAR(24)  NOT NULL DEFAULT 'pending',
+  dirty            TINYINT(1)   NOT NULL DEFAULT 1,
+  desired_hash     VARCHAR(64)  NULL,
+  synced_hash      VARCHAR(64)  NULL,
+  boot_id          VARCHAR(64)  NULL,
+  wipe_id          VARCHAR(48)  NULL,
+  last_attempt_at  DATETIME     NULL,
+  last_ok_at       DATETIME     NULL,
+  report           LONGTEXT     NULL,
+  error            VARCHAR(191) NULL,
+  updated_at       DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_perm_sync_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+);
+
+
+-- ── What each server's plugins have registered ────────────────────────────
+--
+-- The option source the authoring form offers (D33), cached from the live read
+-- so that opening the form is not six round trips to six game hosts.
+--
+-- It is a cache of a fact that changes when an operator loads a plugin, and it
+-- is refreshed on every sync — which is also why a name that has stopped being
+-- registered disappears from the form rather than lingering as a choice that
+-- silently does nothing.
+CREATE TABLE IF NOT EXISTS rust_perm_catalogue (
+  server_id   VARCHAR(64)   NOT NULL,
+  permission  VARCHAR(128)  NOT NULL,
+  seen_at     DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (server_id, permission),
+  CONSTRAINT fk_rust_perm_catalogue_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+);
+
+
 -- ── Changes to tables that already shipped ────────────────────────────────
 --
 -- An ALTER below the CREATE, never an edit to it: `CREATE TABLE IF NOT EXISTS`
@@ -309,3 +618,396 @@ ALTER TABLE rust_server_state ADD COLUMN IF NOT EXISTS wipe_id VARCHAR(48) NULL;
 -- a server is up), and `last_seen_at` is when a `server.hello` last arrived. Only
 -- a successful refresh moves it.
 ALTER TABLE rust_server_state ADD COLUMN IF NOT EXISTS last_seen_at DATETIME NULL;
+
+
+-- ── Configuration written from the site (phase 7b, R18) ───────────────────
+--
+-- The audit trail for the most powerful thing this website can do to somebody's
+-- game host: write a file on it. One row per save attempt, including the ones
+-- that were refused and the ones the plugin rolled back — a write that did not
+-- land is exactly the row an operator asking "why is ZoneManager down" needs to
+-- find.
+--
+-- **No file bodies.** `changes` holds the fields that changed and their before
+-- and after LITERALS, which is what a person reading this wants, and secrets are
+-- redacted on the way in (`configEdit.redactChange`). D37 lets an admin read a
+-- credential on the page they opened deliberately; this table is read by more
+-- people, for longer, and usually by somebody who was not there.
+--
+-- The versions bracket the write: `version_before` is what the plugin said the
+-- file was when it was read, `version_after` what it is now. They are the
+-- plugin's own hashes, echoed — this module never computes one.
+CREATE TABLE IF NOT EXISTS rust_config_writes (
+  id              BIGINT       NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  server_id       VARCHAR(64)  NOT NULL,
+  path            VARCHAR(255) NOT NULL,
+  plugin          VARCHAR(128) NULL,
+  -- What the admin asked us to reload. NULL is an honest value: a file whose
+  -- plugin is not loaded is written and not reloaded, and saying so is the
+  -- difference between "saved" and "in effect".
+  reload_target   VARCHAR(128) NULL,
+  -- `form` or `raw`. Which tier an edit came through changes how it should be
+  -- read: a form edit is type-preserving and narrow, a raw edit replaced the
+  -- whole document.
+  tier            VARCHAR(16)  NOT NULL DEFAULT 'form',
+  user_id         INT          NULL,
+  -- `applied` | `rolled-back` | `refused` | `unreachable` | `reloading` (protocol 13)
+  outcome         VARCHAR(24)  NOT NULL,
+  reloaded        TINYINT(1)   NOT NULL DEFAULT 0,
+  changes         LONGTEXT     NULL,
+  version_before  VARCHAR(64)  NULL,
+  version_after   VARCHAR(64)  NULL,
+  detail          VARCHAR(500) NULL,
+  created_at      DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_config_writes_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE,
+  -- A deleted account must not delete the record that they changed a setting.
+  -- The row stays and the name goes; the alternative is an audit trail that a
+  -- person can erase by closing their account.
+  CONSTRAINT fk_rust_config_writes_user
+    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL,
+  KEY idx_rust_config_writes_server (server_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Protocol 13 (PLAN_FIXES.md F9, D177–D179). A save that reloads a plugin no
+-- longer waits for the reload: it is recorded as `reloading` the moment the files
+-- land, and ingest settles it from the plugin's `config.outcome`.
+--
+--   • `write_id` is the plugin's own name for the write — the frame carries it,
+--     and the sidecar's request ids restart with the sidecar, so they cannot.
+--   • `settle_by` is when a write that never heard back is LOST rather than slow:
+--     two of the plugin's ceilings (the edit's reload and a restore's) plus
+--     slack. Reads report `lost` past it; the row itself stays `reloading`, so an
+--     outcome that arrives late — a link that was down — still settles it.
+--   • `log_tail` is the server's log at the moment a reload failed. It used to go
+--     straight back to the browser that asked; nothing is waiting now, so the
+--     page reads it from here. Operator console output: admin-only like the rest.
+--   • `restored` is whether the plugin came back on its old file after a
+--     rollback. NULL when there was no rollback.
+ALTER TABLE rust_config_writes ADD COLUMN IF NOT EXISTS write_id VARCHAR(64) NULL;
+ALTER TABLE rust_config_writes ADD COLUMN IF NOT EXISTS settle_by DATETIME NULL;
+ALTER TABLE rust_config_writes ADD COLUMN IF NOT EXISTS settled_at DATETIME NULL;
+ALTER TABLE rust_config_writes ADD COLUMN IF NOT EXISTS log_tail TEXT NULL;
+ALTER TABLE rust_config_writes ADD COLUMN IF NOT EXISTS restored TINYINT(1) NULL;
+CREATE INDEX IF NOT EXISTS idx_rust_config_writes_write ON rust_config_writes (server_id, write_id);
+
+
+-- ── Who may see who is online (the presence fix, 2026-09-22) ──────────────
+--
+-- The org lead's rule: **nothing tells who is online by default.** The Online
+-- list, the killfeed, chat and every other frame that says a named player was on
+-- the server reach STAFF unless an operator deliberately widens them. A count is
+-- not a name and stays public.
+--
+-- Two places, because the decision has two shapes:
+--
+--   • `rust_settings` holds the FLEET default — one row per key. A key/value
+--     table rather than a column per setting, because phase 9's clan-roster
+--     audience is the next key and a table that grows a column per setting grows
+--     an ALTER per setting.
+--   • `rust_servers.presence_audience` is an optional PER-SERVER override. NULL
+--     means "inherit the fleet default", which is not the same as any audience —
+--     an operator who later narrows the fleet must narrow every server that never
+--     chose otherwise.
+--
+-- The stored value is a word (`staff` · `signed_in` · `public`) and an unknown
+-- word reads as `staff` (`model/visibility`): a typo in a row must narrow, never
+-- widen.
+CREATE TABLE IF NOT EXISTS rust_settings (
+  setting_key  VARCHAR(64)   NOT NULL PRIMARY KEY,
+  value        VARCHAR(255)  NOT NULL,
+  updated_by   INT           NULL,
+  updated_at   DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_settings_user
+    FOREIGN KEY (updated_by) REFERENCES users (id) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS presence_audience VARCHAR(16) NULL;
+
+
+-- ── Clans (phase 9, protocol 6) ───────────────────────────────────────────
+--
+-- Rust's FIRST-PARTY clans, which this module answers core's Team questions
+-- from (R5, PLAN.md §24). Three tables, and the split is the same one the rest
+-- of this file makes: what a board said (`rust_clans`, `rust_clan_members`),
+-- and what this module knows about the board itself (`rust_clan_boards`).
+--
+-- **`external_id` is the Team's identity, and it is NOT the game's clan id.**
+-- It is `<serverId>:<clanId>:<createdMs>` (D52). The game keeps clans in
+-- `clans.<version>.db` with the version hard-coded, so a game update that bumps
+-- it starts a fresh file whose ids restart at 1. Keyed on the id alone, the new
+-- clan #1 would inherit the old clan #1's Team — its forum, its members-only
+-- history — and core would read the swap as a rename.
+--
+-- **A clan that leaves the board is marked gone, not deleted.** `gone_at` is set
+-- only when a board that is COMPLETE for its server no longer carries it: a
+-- board truncated at the game's 100-clan ceiling (D55) proves nothing about a
+-- clan it does not list. A gone clan is not offered to core, which is what lets
+-- core archive its Team.
+CREATE TABLE IF NOT EXISTS rust_clans (
+  external_id   VARCHAR(160)  NOT NULL PRIMARY KEY,
+  server_id     VARCHAR(64)   NOT NULL,
+  clan_id       BIGINT        NOT NULL,
+  created_ms    BIGINT        NOT NULL,
+  name          VARCHAR(191)  NOT NULL,
+  -- `#rrggbb`, as the plugin spells it. Stored as sent rather than parsed, and
+  -- re-checked on the way out (`model/clans`), because it ends up in a style.
+  color         VARCHAR(16)   NULL,
+  score         BIGINT        NOT NULL DEFAULT 0,
+  member_count  INT UNSIGNED  NOT NULL DEFAULT 0,
+  max_members   INT UNSIGNED  NULL,
+  first_seen    DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at    DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  gone_at       DATETIME      NULL,
+  CONSTRAINT fk_rust_clans_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE,
+  KEY idx_rust_clans_server (server_id, gone_at),
+  KEY idx_rust_clans_game_id (server_id, clan_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- One row per member per clan, replaced whole from each board.
+--
+-- `rank` is the role's rank, and **rank 1 is leader** — the game's own rule, and
+-- several members may hold it. It is NULL when the member's role id matched no
+-- role on the board: "not known" must never be read as "leads this clan".
+--
+-- There is deliberately no `last_seen`. The game has one; the plugin does not
+-- send it, because when somebody was last on is presence (PLAN.md §23).
+CREATE TABLE IF NOT EXISTS rust_clan_members (
+  external_id   VARCHAR(160)  NOT NULL,
+  steam_id      VARCHAR(32)   NOT NULL,
+  name          VARCHAR(191)  NULL,
+  role_rank     INT           NULL,
+  role_name     VARCHAR(64)   NULL,
+  joined_ms     BIGINT        NULL,
+  PRIMARY KEY (external_id, steam_id),
+  CONSTRAINT fk_rust_clan_members_clan
+    FOREIGN KEY (external_id) REFERENCES rust_clans (external_id) ON DELETE CASCADE,
+  KEY idx_rust_clan_members_steam (steam_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- What this module knows about each server's clan board, as opposed to what the
+-- board said.
+--
+-- **Freshness is judged by THIS side's clock.** `board_t` is the plugin's own
+-- timestamp on the board; `seen_at` is when this module first saw that value.
+-- A board whose `t` stops advancing is a game that stopped talking, and the
+-- age of `seen_at` is how long ago that was — comparing `board_t` to the
+-- website's clock instead would let a game host whose clock runs ahead make a
+-- stale board look current for as long as the skew lasts.
+--
+-- `umod_clans` is whether the optional uMod Clans plugin is loaded on that
+-- server (D47): its clans are a separate system and never Teams, and the admin
+-- page says so.
+CREATE TABLE IF NOT EXISTS rust_clan_boards (
+  server_id    VARCHAR(64)   NOT NULL PRIMARY KEY,
+  board_t      BIGINT        NULL,
+  seen_at      DATETIME      NULL,
+  enabled      TINYINT(1)    NOT NULL DEFAULT 1,
+  supported    TINYINT(1)    NOT NULL DEFAULT 0,
+  truncated    TINYINT(1)    NOT NULL DEFAULT 0,
+  backend      VARCHAR(64)   NULL,
+  reason       VARCHAR(255)  NULL,
+  umod_clans   TINYINT(1)    NOT NULL DEFAULT 0,
+  clan_count   INT UNSIGNED  NOT NULL DEFAULT 0,
+  updated_at   DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_clan_boards_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+
+-- ── What an event granted (phase 13b, protocol 10) ────────────────────────
+--
+-- `rust.kit.entitle`'s ledger: one row per run, step, website user and
+-- permission (PLAN.md §29, D84). It is a table of its own, and not rows in
+-- `rust_perm_grants`, because that table is UNIQUE on (user, permission,
+-- scope): an admin grant of the same kit would collide with an event's, and a
+-- revert deleting "the" row would take the admin's grant with it. The push reads
+-- the UNION of the two, so a permission held both ways survives either being
+-- withdrawn.
+--
+-- The grant reaches every account the user has linked (D28), like any other.
+-- The CREDIT does not: `steam_id` is the account that took part, and one win is
+-- one extra use of the kit on that account (D103). `permission` is empty for a
+-- kit anybody may redeem — the credit is then the whole reward.
+--
+-- `idem_key` is core's idempotency key for the step. It is what a revert has
+-- when core lost the answer and holds no resource: without it the rows a lost
+-- answer wrote would be a grant nothing could ever withdraw.
+--
+-- `server_id` is the kit's server and the only one the grant reaches (D102).
+-- There is no foreign key to `rust_servers`: a server deleted mid-event must not
+-- delete the ledger a revert needs to find.
+CREATE TABLE IF NOT EXISTS rust_perm_run_grants (
+  id          INT UNSIGNED  NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  run_id      VARCHAR(64)   NOT NULL,
+  step_id     VARCHAR(64)   NOT NULL,
+  idem_key    VARCHAR(190)  NOT NULL DEFAULT '',
+  user_id     INT           NOT NULL,
+  server_id   VARCHAR(64)   NOT NULL,
+  steam_id    VARCHAR(32)   NOT NULL,
+  permission  VARCHAR(128)  NOT NULL DEFAULT '',
+  kit         VARCHAR(128)  NOT NULL,
+  credit      TINYINT(1)    NOT NULL DEFAULT 1,
+  granted_at  DATETIME      NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_rust_perm_run_grant (run_id, step_id, user_id, permission),
+  KEY idx_rust_perm_run_grant_server (server_id),
+  KEY idx_rust_perm_run_grant_key (run_id, idem_key),
+  CONSTRAINT fk_rust_perm_run_grants_user
+    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- The news switch (D104): whether a published news post is also said in this
+-- server's chat. Off, because core enqueues every registered leg for every
+-- post, and without it the day this module updates every post would start
+-- appearing in every server's chat.
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS announce_news TINYINT(1) NOT NULL DEFAULT 0;
+
+-- ── The map (phase 14, protocol 11) ───────────────────────────────────────
+--
+-- One row per server holding the picture of its CURRENT map (PLAN.md §30.2),
+-- replaced whole when the map changes. The picture lives here and not in core's
+-- `/uploads`, which core serves to anybody by URL and no purge would reach
+-- (§30.5). One row per server bounds it at about a megabyte each.
+--
+-- `bytes` and `sha256` are NULL for a server whose game has no picture yet
+-- (`source = 'none'`): the row still carries the geometry and the monuments, so
+-- the page can draw the live layers on a plain background, and an admin's
+-- render replaces it. `map_key` says WHICH map and `sha256` which picture of it.
+--
+-- `derivation` is `DERIVATION_VERSION` (R9) — how the geometry columns were
+-- worked out from what the plugin said. A row whose number is older is
+-- re-derived from a fresh `map.info` without fetching the bytes again.
+--
+-- `monuments` is JSON as the plugin sent it: kind, label, the `kind#n` token and
+-- x/z. It changes only with the map, so it belongs to this row and not to the
+-- live answer.
+CREATE TABLE IF NOT EXISTS rust_map_images (
+  server_id       VARCHAR(64)    NOT NULL PRIMARY KEY,
+  map_key         VARCHAR(160)   NOT NULL,
+  sha256          CHAR(64)       NULL,
+  source          VARCHAR(16)    NOT NULL,
+  width           INT UNSIGNED   NOT NULL,
+  height          INT UNSIGNED   NOT NULL,
+  ocean_margin    INT UNSIGNED   NOT NULL,
+  world_size      INT UNSIGNED   NOT NULL,
+  grid_cells      INT UNSIGNED   NOT NULL,
+  grid_cell_size  DECIMAL(10,3)  NOT NULL,
+  background      VARCHAR(16)    NULL,
+  derivation      INT UNSIGNED   NOT NULL,
+  monuments       MEDIUMTEXT     NOT NULL,
+  bytes           MEDIUMBLOB     NULL,
+  fetched_at      DATETIME       NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_map_images_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Per-server overrides of the map's switches (D114): a layer's audience, or the
+-- own-and-mates view. The fleet defaults are rows in `rust_settings`
+-- (`map.layer.<layer>.audience`, `map.mates`); a server with no row here
+-- inherits them. A table of its own rather than five more columns on
+-- `rust_servers`, because the set of switches is the part most likely to grow.
+--
+-- `value` is a word (`staff` · `signed_in` · `public`, or `on` · `off`), and a
+-- word this build does not recognise NARROWS (`model/map`).
+CREATE TABLE IF NOT EXISTS rust_map_overrides (
+  server_id   VARCHAR(64)  NOT NULL,
+  setting     VARCHAR(64)  NOT NULL,
+  value       VARCHAR(16)  NOT NULL,
+  updated_by  INT          NULL,
+  updated_at  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (server_id, setting),
+  CONSTRAINT fk_rust_map_overrides_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE,
+  CONSTRAINT fk_rust_map_overrides_user
+    FOREIGN KEY (updated_by) REFERENCES users (id) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- ── The next wipe (phase 16, D128 · D130) ─────────────────────────────────
+--
+-- What an operator says about a server's wipe calendar: a rule, and an optional
+-- one-off date. The next wipe itself is NOT stored — it is computed from these on
+-- every read (`model/servers/nextWipe.js`), so nothing rolls it forward after a
+-- wipe and nothing can go stale.
+--
+--   wipe_rule     `none` · `forced` · `weekly` · `biweekly`. `none` forecasts
+--                 nothing; every other rule includes Facepunch's forced wipe.
+--   wipe_day      0 (Sunday) … 6, for weekly and biweekly
+--   wipe_time     `HH:MM`, 24-hour, on the wall clock of…
+--   wipe_tz       an IANA zone. The server's own, because a wipe announced as
+--                 "Thursday 14:00" means 14:00 where the operator is, summer or
+--                 winter; a UTC time would drift by an hour twice a year.
+--   wipe_anchor   one wipe on a biweekly rule, which says WHICH weeks
+--   wipe_once_at  a one-off wipe, UTC. While it is in the future it IS the next
+--                 wipe; once passed it is ignored rather than cleared.
+--
+-- A word this build does not recognise reads as `none`: a forecast nobody made
+-- must not appear.
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_rule VARCHAR(16) NOT NULL DEFAULT 'none';
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_day TINYINT NULL;
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_time CHAR(5) NULL;
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_tz VARCHAR(64) NULL;
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_anchor DATE NULL;
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS wipe_once_at DATETIME NULL;
+
+-- ── The optional mods (phase 17, protocol 12) ─────────────────────────────
+--
+-- Chat titles (D135): an operator's rules, per server, in their own order. A
+-- rule ranks the CURRENT wipe by one stat and gives its top N a title. The
+-- titles themselves are not stored: they are computed from the standings each
+-- time they are pushed or shown, so nothing rolls them over at a wipe and
+-- nothing can go stale (`model/titles`).
+--
+--   stat      `kills` · `npckills` · `playtime`
+--   top_n     1–10
+--   text      at most 24 characters, with `[ ] < > { }` stripped on save so an
+--             operator's title can carry no markup of its own (§33.4)
+--   color     `#rrggbb`
+--   position  the operator's order, which is also precedence (D136)
+CREATE TABLE IF NOT EXISTS rust_title_rules (
+  id         INT UNSIGNED  NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  server_id  VARCHAR(64)   NOT NULL,
+  position   INT           NOT NULL DEFAULT 0,
+  stat       VARCHAR(16)   NOT NULL,
+  top_n      TINYINT       NOT NULL DEFAULT 1,
+  text       VARCHAR(24)   NOT NULL,
+  color      CHAR(7)       NOT NULL DEFAULT '#ffaa55',
+  KEY idx_rust_title_rules_server (server_id, position),
+  CONSTRAINT fk_rust_title_rules_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- How many titles one player shows (D136): `first` the first rule they meet,
+-- `all`, or `upto` `title_max` of them. A word this build does not know reads
+-- as `first`, the fewest.
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS title_mode VARCHAR(8) NOT NULL DEFAULT 'first';
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS title_max TINYINT NOT NULL DEFAULT 2;
+
+-- Where a news post goes on this server when `announce_news` is on (D142):
+-- `chat` or `popup`. A popup needs PopupNotifications, which is optional
+-- (D141), and a server without it refuses with a reason.
+ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS news_delivery VARCHAR(8) NOT NULL DEFAULT 'chat';
+
+-- A group's BetterChat style (D138): all twelve fields or none, one row each,
+-- as the text BetterChat's own `chat group set` takes. A style is authored with
+-- the group and dies with it; the push, the drift and the removal (D139) are the
+-- permission mirror's, like everything else about a group.
+CREATE TABLE IF NOT EXISTS rust_perm_group_chat (
+  group_name  VARCHAR(64)   NOT NULL,
+  field       VARCHAR(32)   NOT NULL,
+  value       VARCHAR(255)  NOT NULL,
+  PRIMARY KEY (group_name, field),
+  CONSTRAINT fk_rust_perm_group_chat_group
+    FOREIGN KEY (group_name) REFERENCES rust_perm_groups (name) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- What a pushed style field HELD when it landed (kind `chat-field`, subject the
+-- group, object the field). Every other ledger row is a fact with no value — a
+-- grant is held or it is not — and a field is not: the value is what tells a
+-- field this site set from one somebody changed by hand (§33.2). NULL on every
+-- other kind.
+ALTER TABLE rust_perm_pushed ADD COLUMN IF NOT EXISTS value VARCHAR(255) NULL;
+
+-- The value a changed field holds in the game, for a `chat-field` drift row.
+-- NULL on every other kind: a foreign grant is its own description.
+ALTER TABLE rust_perm_drift ADD COLUMN IF NOT EXISTS detail VARCHAR(255) NULL;

server/engagement/audiences.js

@@ -0,0 +1,107 @@
+// ── Named sets of people, over this module's own data ─────────────────────
+//
+// `registerAudiences` (MODULE_API.md §2.4; PLAN.md §25.2). An operator points a
+// rule or a segment at one of these; core calls `resolve` when a rule fires.
+//
+// Three properties, each the contract rather than a style:
+//
+//   • **A resolver returns website user ids and nothing else.** Never an
+//     address, a channel or a Steam id: core maps ids to people after the
+//     preferences, the suppression list and the verification gate, and a module
+//     that could hand it anything else would have a way to send mail.
+//   • **One that fails answers NOBODY** — never everybody, never its last good
+//     answer. A throw here is caught and returned as `[]`, and core treats a
+//     throw the same way; both are here so the property does not rest on
+//     either side alone.
+//   • **Params are constants**, fixed when an operator saves the rule. "The clan
+//     this event was about" is therefore not expressible as an audience — a
+//     clan trigger carries its own recipients instead (`emit.js`).
+
+const core = require('../core')
+
+const log = core.logger('audiences')
+
+const LINKS = 'rust_account_links'
+
+/** Wraps a resolver so a failure is an empty set, logged, and never a throw. */
+function safe(id, fn) {
+  return async (params) => {
+    try {
+      const rows = await fn(params || {})
+      return rows.map((r) => Number(r.userId)).filter((n) => Number.isInteger(n) && n > 0)
+    } catch (err) {
+      log.warn('an audience could not be resolved; it answers nobody', { audience: id, error: err.message })
+      return []
+    }
+  }
+}
+
+const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null)
+
+const AUDIENCES = Object.freeze([
+  {
+    id: 'rust.clan.members',
+    label: 'Members of a clan',
+    params: [{ id: 'clan', type: 'string', required: true }],
+    ceiling: 'members',
+    // A clan's LINKED members, as the store holds them now. A clan that has
+    // been disbanded has no roster, so a rule saved against it resolves to
+    // nobody — which is the truth, and not the same as the audience being gone.
+    resolve: safe('rust.clan.members', async ({ clan }) => {
+      const key = text(clan)
+      if (!key) return []
+      return core.query(
+        `SELECT DISTINCT l.user_id AS userId
+           FROM rust_clan_members m
+           JOIN rust_clans c ON c.external_id = m.external_id AND c.gone_at IS NULL
+           JOIN ${LINKS} l ON l.steam_id = m.steam_id
+          WHERE m.external_id = ?`,
+        [key],
+      )
+    }),
+  },
+  {
+    id: 'rust.server.players',
+    label: 'Everyone who has played on a server',
+    params: [{ id: 'serverId', type: 'string', required: true }],
+    ceiling: 'authenticated',
+    // Linked accounts with a stats row on this server in ANY wipe. The stats
+    // table is the record of having played, and it outlives both wipes and the
+    // raw event history (R12).
+    resolve: safe('rust.server.players', async ({ serverId }) => {
+      const id = text(serverId)
+      if (!id) return []
+      return core.query(
+        `SELECT DISTINCT l.user_id AS userId
+           FROM rust_player_wipe_stats s
+           JOIN ${LINKS} l ON l.steam_id = s.steam_id
+          WHERE s.server_id = ?`,
+        [id],
+      )
+    }),
+  },
+  {
+    id: 'rust.wipe.participants',
+    label: 'Everyone playing a server\'s current wipe',
+    params: [{ id: 'serverId', type: 'string', required: true }],
+    ceiling: 'authenticated',
+    // The same, narrowed to the wipe the server is on NOW. Resolved at send
+    // time, so a rule saved last month reaches this month's players — which is
+    // what "current" has to mean for a parameter fixed when the rule was saved.
+    // A server with no known wipe resolves to nobody rather than to every wipe.
+    resolve: safe('rust.wipe.participants', async ({ serverId }) => {
+      const id = text(serverId)
+      if (!id) return []
+      return core.query(
+        `SELECT DISTINCT l.user_id AS userId
+           FROM rust_server_state st
+           JOIN rust_player_wipe_stats s ON s.server_id = st.server_id AND s.wipe_id = st.wipe_id
+           JOIN ${LINKS} l ON l.steam_id = s.steam_id
+          WHERE st.server_id = ? AND st.wipe_id IS NOT NULL`,
+        [id],
+      )
+    }),
+  },
+])
+
+module.exports = { AUDIENCES }

server/engagement/emit.js

@@ -0,0 +1,594 @@
+// ── What happened, told to core's engagement engine ───────────────────────
+//
+// The fan-out behind `triggers.js` (PLAN.md §25). Ingest calls `onEvent` for
+// every frame it stores; the refresh calls `serverObserved` for every poll;
+// ingest calls `checkLeader` after a batch; the prune timer calls
+// `sweepLoginDenied`; the link route calls `linked`.
+//
+// **Nothing here decides who is told.** It says what happened and, for a
+// personal or clan event, who it is ABOUT. Core applies the rule, the ceiling,
+// the preference, the suppression list and the verification gate. A module
+// cannot send mail (MODULE_API.md §2.7), and this file is not the back door.
+//
+// **Nothing here throws into its caller.** Every entry point catches, because
+// its callers are the ingest cursor and the refresh loop — a malformed frame or
+// a core-side contract problem must cost one notification and never the feed.
+//
+// ── Three rules the whole file follows ────────────────────────────────────
+//
+//   1. **Emit on the transition, never on the poll** (R7). A server that is
+//      still up is not news. Transitions are tracked in memory, and a FIRST
+//      sighting is never one — so a website restart announces nothing.
+//
+//   2. **A replayed event notifies only while it is still news** (D63). After an
+//      outage the cursor replays hours of frames. A broadcast older than 15
+//      minutes tells nobody; a personal or staff event is kept for 24 hours,
+//      because "your base was raided at 03:10" is still true and still wanted.
+//
+//   3. **Every emit carries a dedupe key made from the EVENT, not the store.**
+//      Core's outbox is unique on (rule, user, channel, key), so the same frame
+//      replayed after a crash is a no-op. The key is built from what the event
+//      says — its server, time and subject — rather than from the sidecar's row
+//      id, because a sidecar whose database is replaced starts its ids again
+//      and would otherwise have every new alert swallowed as a repeat of an old
+//      one.
+
+const crypto = require('crypto')
+
+const core = require('../core')
+
+const clans = require('../model/clans/clans.model')
+const clansDb = require('../model/clans/clans.db')
+const eventsDb = require('../model/events/events.db')
+const linksDb = require('../model/links/links.db')
+const serversDb = require('../model/servers/servers.db')
+const { TRIGGER_IDS: T, PATHS, serverPath, leaderboardPath, clanPath } = require('./triggers')
+
+const log = core.logger('engagement')
+
+/** How old a broadcast may be and still be news (D63). */
+const BROADCAST_MAX_AGE_MS = 15 * 60 * 1000
+
+/** How old a personal or staff event may be and still be worth telling (D63). */
+const PERSONAL_MAX_AGE_MS = 24 * 60 * 60 * 1000
+
+/**
+ * How long a login attempt waits for its approval before it counts as denied
+ * (D64, PLAN.md §16.5). The game raises no rejection hook, so a denial is the
+ * ABSENCE of an approval — which is only knowable after a wait.
+ */
+const LOGIN_APPROVAL_WINDOW_MS = 60 * 1000
+
+/** How far BEFORE an attempt an approval may be stamped and still answer it — clock grain, not policy. */
+const LOGIN_APPROVAL_SLACK_MS = 5 * 1000
+
+const STRUCTURE_LABELS = Object.freeze({
+  block: 'building block',
+  door: 'door',
+  wall: 'external wall',
+  cupboard: 'tool cupboard',
+})
+
+// ── Small helpers ──────────────────────────────────────────────────────────
+
+const str = (value) => (value === undefined || value === null || value === '' ? undefined : String(value))
+
+/** `rust:<what>:<sha1 of the parts>` — readable prefix, bounded length. */
+function dedupeKey(what, ...parts) {
+  const digest = crypto.createHash('sha1').update(parts.map((p) => String(p ?? '')).join('\u0000')).digest('hex')
+  return `rust:${what}:${digest}`
+}
+
+function frameTime(item, frame) {
+  const t = Number(frame && frame.t) || Number(item && item.t)
+  return Number.isFinite(t) && t > 0 ? t : Date.now()
+}
+
+/** D63, as a question: is an event from `t` still worth telling, for this family? */
+function stillNews(t, maxAgeMs, now = Date.now()) {
+  return now - t <= maxAgeMs
+}
+
+function serverVars(server) {
+  const serverId = String(server.id)
+  return { serverId, server: server.name || serverId, serverUrl: serverPath(serverId) }
+}
+
+/**
+ * The headline every trigger carries (`triggers.js` HEADLINE).
+ *
+ * Core's generic bodies fall back to a trigger's LABEL and DESCRIPTION when the
+ * payload has no `title`/`intro`, and on a multi-server site that fallback says
+ * "A server came online" without ever saying which. So the sentence is written
+ * here, from the payload, and core renders it. Plain register, no conditionals:
+ * a missing part falls back to a neutral word rather than leaving a hole.
+ */
+const HEADLINES = Object.freeze({
+  'rust.base.destroyed': (d) => ({
+    title: `Your base on ${d.server} is being raided`,
+    intro: `A ${d.structure} was destroyed${d.atGrid || ''} on ${d.server}.`,
+  }),
+  'rust.wipe.started': (d) => ({
+    title: `${d.server} has wiped`,
+    intro: `A new wipe has started on ${d.server}: a fresh map, and a fresh start for everyone.`,
+  }),
+  'rust.server.online': (d) => ({
+    title: `${d.server} is online`,
+    intro: `${d.server} is back up and talking to the website.`,
+  }),
+  'rust.server.offline': (d) => ({
+    title: `${d.server} is offline`,
+    intro: `${d.server} stopped, or stopped talking to the website.`,
+  }),
+  'rust.leaderboard.topped': (d) => ({
+    title: `${d.leader} leads ${d.server}`,
+    intro: `${d.leader} now leads this wipe's kills on ${d.server}, with ${d.kills}.`,
+  }),
+  'rust.player.linked': (d) => ({
+    title: 'A Steam account was linked to your account',
+    intro: `The Steam account ${d.player || d.steamId} was linked with an in-game code. `
+      + 'If that was not you, unlink it from your Rust account page.',
+  }),
+  'rust.kit.entitled': (d) => ({
+    title: `You earned ${d.kit} on ${d.server}`,
+    intro: `An event on ${d.server} rewarded you: the ${d.kit} kit is waiting in the Kits menu, `
+      + 'with one extra use. Redeem it in game.',
+  }),
+  'rust.clan.member.left': (d) => ({
+    title: `${d.member || 'A member'} left ${d.clan}`,
+    intro: `${d.member || 'A member'} left ${d.clan} on ${d.server}.`,
+  }),
+  'rust.clan.member.kicked': (d) => ({
+    title: `${d.member || 'A member'} was removed from ${d.clan}`,
+    intro: `${d.by || 'A clan leader'} removed ${d.member || 'a member'} from ${d.clan} on ${d.server}.`,
+  }),
+  'rust.clan.disbanded': (d) => ({
+    title: `${d.clan} was disbanded`,
+    intro: `${d.by || 'A clan leader'} disbanded ${d.clan} on ${d.server}.`,
+  }),
+  'rust.player.reported': (d) => ({
+    title: `${d.player || d.steamId} was reported on ${d.server}`,
+    intro: `${d.reporter || 'A player'} reported ${d.player || d.steamId}`
+      + `${d.reportType ? ` (${d.reportType})` : ''}${d.topic ? `: ${d.topic}` : '.'}`,
+  }),
+  'rust.player.banned': (d) => ({
+    title: `${d.player || d.steamId} was banned on ${d.server}`,
+    intro: d.reason ? `Reason given: ${d.reason}` : 'No reason was given.',
+  }),
+  'rust.player.unbanned': (d) => ({
+    title: `${d.player || d.steamId} was unbanned on ${d.server}`,
+    intro: `The ban on ${d.player || d.steamId} (${d.steamId}) was lifted.`,
+  }),
+  'rust.login.denied': (d) => ({
+    title: `A login to ${d.server} was not approved`,
+    intro: `${d.player || 'Someone'} (${d.steamId}) tried to join ${d.server} and was not let in within a minute.`,
+  }),
+})
+
+function headline(triggerId, data) {
+  const make = HEADLINES[triggerId]
+  return make ? make(data || {}) : {}
+}
+
+/**
+ * Hands one event to core. Never throws.
+ *
+ * Core throws on a contract mismatch outside production, which is how a
+ * declaration and an emitter drifting apart is meant to be found. It is logged
+ * at `error` here rather than re-thrown, because the caller is the ingest
+ * cursor — and an `error` line is what a rig walk reads.
+ */
+function fire(triggerId, envelope) {
+  try {
+    const data = envelope.data || {}
+    core.emit(triggerId, { ...envelope, data: { ...headline(triggerId, data), ...data } })
+    return true
+  } catch (err) {
+    log.error('core refused an emit', { trigger: triggerId, error: err.message })
+    return false
+  }
+}
+
+/** Steam id -> website user id, for the ids that are linked. Unlinked ones are simply absent. */
+async function usersFor(steamIds) {
+  const ids = [...new Set((steamIds || []).map(String).filter(Boolean))]
+  if (!ids.length) return new Map()
+  const rows = await linksDb.userIdsForSteamIds(ids)
+  return new Map(rows.map((r) => [String(r.steamId), Number(r.userId)]))
+}
+
+// ── Per-kind handlers ──────────────────────────────────────────────────────
+
+/**
+ * The raid alert (D59-D61, D66, D67).
+ *
+ * One emit per authorised, LINKED person, each with `ownerUserId` — so the
+ * `owner` ceiling holds per emit and "nobody else" is structural rather than a
+ * filter somebody could forget. Two Steam accounts held by one website user are
+ * one person: they get one alert, online if either account is.
+ */
+async function onRaid(server, item, frame) {
+  const t = frameTime(item, frame)
+  if (!stillNews(t, PERSONAL_MAX_AGE_MS)) return 0
+
+  // D67: no cupboard, nobody to tell. Absent — not empty — is also what a
+  // protocol-6 plugin sends, so a half-upgraded deployment alerts nobody rather
+  // than guessing an owner from the placer.
+  if (!frame.buildingId || !Array.isArray(frame.authorized)) return 0
+
+  const authorized = frame.authorized.filter((a) => a && a.steamId)
+  const attacker = str(frame.attackerId)
+
+  // An authorised attacker is demolishing their own base, or a teammate's.
+  if (attacker && authorized.some((a) => String(a.steamId) === attacker)) return 0
+
+  const users = await usersFor(authorized.map((a) => a.steamId))
+  if (!users.size) return 0
+
+  const byUser = new Map()
+  for (const a of authorized) {
+    const userId = users.get(String(a.steamId))
+    if (!userId) continue
+    byUser.set(userId, byUser.get(userId) === true || a.online === true)
+  }
+
+  const base = {
+    ...serverVars(server),
+    building: String(frame.buildingId),
+    structure: STRUCTURE_LABELS[frame.structure] || 'structure',
+    grid: str(frame.grid),
+    atGrid: str(frame.grid) ? ` in ${frame.grid}` : undefined,
+  }
+  const key = dedupeKey('raid', server.id, frame.buildingId, t, frame.prefab)
+
+  let sent = 0
+  for (const [userId, online] of byUser) {
+    if (fire(T['rust.base.destroyed'], {
+      data: { ...base, ownerOnline: online },
+      ownerUserId: userId,
+      dedupeKey: key,
+      occurredAt: t,
+    })) sent += 1
+  }
+  return sent
+}
+
+async function onWipe(server, item, frame) {
+  const t = frameTime(item, frame)
+  if (!stillNews(t, BROADCAST_MAX_AGE_MS)) return 0
+  const wipeId = str(frame.wipeId)
+  if (!wipeId) return 0
+
+  return fire(T['rust.wipe.started'], {
+    data: { ...serverVars(server), wipeId },
+    dedupeKey: dedupeKey('wipe', server.id, wipeId),
+    occurredAt: t,
+  }) ? 1 : 0
+}
+
+/**
+ * Clan departures and disbands. Recipients travel on the envelope, because
+ * "the clan this was about" is a different set every firing.
+ *
+ * Nobody is told about what they did themselves: the leaver is not told they
+ * left, the one who kicked is not told they kicked, the one who disbanded is not
+ * told they disbanded. The one KICKED is told — it happened to them.
+ */
+async function onClan(server, item, frame) {
+  const t = frameTime(item, frame)
+  if (!stillNews(t, PERSONAL_MAX_AGE_MS)) return 0
+
+  const externalId = await clans.resolveExternalId(server.id, frame)
+  if (!externalId) return 0
+
+  const kind = frame.kind
+  const subject = str(frame.steamId)
+  let steamIds
+  let actor
+
+  if (kind === 'clan.disbanded') {
+    // From the frame (protocol 7): by the time this runs the next board may
+    // already have removed the roster the store would answer with.
+    steamIds = Array.isArray(frame.members) ? frame.members.map(String) : null
+    if (!steamIds) steamIds = (await clansDb.listMembers(externalId)).map((m) => String(m.steamId))
+    actor = subject
+  } else {
+    steamIds = (await clansDb.listMembers(externalId)).map((m) => String(m.steamId))
+    if (kind === 'clan.member.kicked') {
+      if (subject) steamIds.push(subject)
+      actor = str(frame.bySteamId)
+    } else {
+      actor = subject
+    }
+  }
+
+  const users = await usersFor(steamIds.filter((id) => id !== actor))
+  const recipientUserIds = [...new Set(users.values())]
+  if (!recipientUserIds.length) return 0
+
+  const data = {
+    ...serverVars(server),
+    clanKey: externalId,
+    clan: str(frame.clanName) || 'your clan',
+    clanUrl: clanPath(externalId),
+  }
+  if (kind === 'clan.member.left') data.member = str(frame.name)
+  if (kind === 'clan.member.kicked') {
+    data.member = str(frame.name)
+    data.by = str(frame.byName)
+  }
+  if (kind === 'clan.disbanded') data.by = str(frame.name)
+
+  const triggerId = kind === 'clan.disbanded' ? T['rust.clan.disbanded'] : T[`rust.${kind}`]
+
+  return fire(triggerId, {
+    data,
+    recipientUserIds,
+    dedupeKey: dedupeKey(kind, server.id, externalId, subject, t),
+    occurredAt: t,
+  }) ? 1 : 0
+}
+
+async function onReported(server, item, frame) {
+  const t = frameTime(item, frame)
+  if (!stillNews(t, PERSONAL_MAX_AGE_MS)) return 0
+  const steamId = str(frame.targetId)
+  if (!steamId) return 0
+
+  return fire(T['rust.player.reported'], {
+    data: {
+      ...serverVars(server),
+      steamId,
+      player: str(frame.targetName),
+      reporter: str(frame.reporterName),
+      reportType: str(frame.reportType),
+      topic: str(frame.subject),
+      message: str(frame.message),
+    },
+    dedupeKey: dedupeKey('reported', server.id, steamId, frame.reporterId, t),
+    occurredAt: t,
+  }) ? 1 : 0
+}
+
+async function onBan(server, item, frame) {
+  const t = frameTime(item, frame)
+  if (!stillNews(t, PERSONAL_MAX_AGE_MS)) return 0
+  const steamId = str(frame.steamId)
+  if (!steamId) return 0
+
+  const banned = frame.kind === 'player.banned'
+  const data = { ...serverVars(server), steamId, player: str(frame.name) }
+  // The address the frame carries is deliberately NOT copied: no trigger
+  // declares one, so no template can ever put it in a mail.
+  if (banned) data.reason = str(frame.reason)
+
+  return fire(banned ? T['rust.player.banned'] : T['rust.player.unbanned'], {
+    data,
+    dedupeKey: dedupeKey(frame.kind, server.id, steamId, t),
+    occurredAt: t,
+  }) ? 1 : 0
+}
+
+const HANDLERS = Object.freeze({
+  'entity.destroyed': onRaid,
+  'server.wipe': onWipe,
+  'clan.member.left': onClan,
+  'clan.member.kicked': onClan,
+  'clan.disbanded': onClan,
+  'player.reported': onReported,
+  'player.banned': onBan,
+  'player.unbanned': onBan,
+})
+
+/**
+ * One stored frame. Called by ingest BEFORE the frame is applied, because
+ * applying a disband deletes the roster a clan notification is sent to.
+ *
+ * @returns {Promise<number>} emits handed to core, for the log and the tests
+ */
+async function onEvent(server, item) {
+  const frame = (item && item.frame) || {}
+  const kind = (item && item.kind) || frame.kind
+  const handler = HANDLERS[kind]
+  if (!handler || !server) return 0
+
+  try {
+    return await handler(server, item, { ...frame, kind })
+  } catch (err) {
+    log.warn('could not raise a notification', { server: server.id, kind, error: err.message })
+    return 0
+  }
+}
+
+// ── Transitions tracked in memory ──────────────────────────────────────────
+//
+// Deliberately NOT persisted. The question each one answers is "has THIS
+// process seen a previous value", and a value restored from the database would
+// make the first poll after a restart a transition against state the game may
+// have left hours ago.
+
+const tracker = { online: new Map(), leader: new Map() }
+
+/** Forget every tracked value. For the tests. */
+function reset() {
+  tracker.online.clear()
+  tracker.leader.clear()
+}
+
+/**
+ * One poll's verdict on one server (D68): is its game connected now?
+ *
+ * Synchronous and fire-and-forget — the refresh must not wait on core.
+ */
+function serverObserved(server, connected) {
+  try {
+    if (!server) return 0
+    const id = String(server.id)
+    const now = Boolean(connected)
+    const before = tracker.online.get(id)
+    tracker.online.set(id, now)
+
+    // First sight is never a transition: a restart announces nothing.
+    if (before === undefined || before === now) return 0
+
+    return fire(now ? T['rust.server.online'] : T['rust.server.offline'], {
+      data: serverVars(server),
+      // A transition observed by a poll is observed NOW, so it needs no age check;
+      // the key is per minute so that one real flap is one event even if two
+      // polls land either side of a restart of this process.
+      dedupeKey: dedupeKey(now ? 'online' : 'offline', id, Math.floor(Date.now() / 60000)),
+    }) ? 1 : 0
+  } catch (err) {
+    log.warn('could not raise a server transition', { server: server && server.id, error: err.message })
+    return 0
+  }
+}
+
+/**
+ * After a batch: has somebody new taken the lead in this wipe's kills? (D64)
+ *
+ * Only a STRICT lead counts. The leaderboard breaks a tie on who was seen last,
+ * so two players level on kills trade the top row every time either one moves —
+ * and reading the top row alone would announce a new leader each time.
+ */
+async function checkLeader(server) {
+  try {
+    const state = await serversDb.getState(server.id)
+    const wipeId = state && state.wipeId
+    if (!wipeId) return 0
+
+    const rows = await eventsDb.leaderboard({ serverId: server.id, wipeId, sort: 'kills', limit: 2 })
+    const top = rows[0]
+    const kills = top ? Number(top.kills) || 0 : 0
+    const id = String(server.id)
+    const before = tracker.leader.get(id)
+
+    if (!top || kills <= 0) {
+      tracker.leader.set(id, { wipeId, steamId: null })
+      return 0
+    }
+
+    const tied = rows[1] && Number(rows[1].kills) === kills
+    const steamId = String(top.steamId)
+
+    // First sight, or a new wipe: remember, announce nothing.
+    if (!before || before.wipeId !== wipeId) {
+      tracker.leader.set(id, { wipeId, steamId: tied ? null : steamId })
+      return 0
+    }
+
+    if (tied || before.steamId === steamId) return 0
+
+    tracker.leader.set(id, { wipeId, steamId })
+
+    return fire(T['rust.leaderboard.topped'], {
+      data: {
+        ...serverVars(server),
+        leader: str(top.name) || 'A player',
+        kills,
+        leaderboardUrl: leaderboardPath(id),
+      },
+      dedupeKey: dedupeKey('leader', id, wipeId, steamId, kills),
+    }) ? 1 : 0
+  } catch (err) {
+    log.warn('could not check the leaderboard', { server: server && server.id, error: err.message })
+    return 0
+  }
+}
+
+/**
+ * Login attempts that were never approved (D64).
+ *
+ * A query over what is stored rather than a timer per attempt, so a restart
+ * loses nothing and running it twice is a no-op (the key is the attempt's own
+ * server, Steam id and time). Bounded by D63's personal age: an attempt a day
+ * old is not worth a staff mail.
+ */
+async function sweepLoginDenied(servers, now = Date.now()) {
+  let sent = 0
+  for (const server of servers || []) {
+    try {
+      const rows = await eventsDb.unapprovedLogins({
+        serverId: server.id,
+        from: now - PERSONAL_MAX_AGE_MS,
+        to: now - LOGIN_APPROVAL_WINDOW_MS,
+        windowMs: LOGIN_APPROVAL_WINDOW_MS,
+        slackMs: LOGIN_APPROVAL_SLACK_MS,
+      })
+      for (const row of rows) {
+        const t = Number(row.t)
+        if (fire(T['rust.login.denied'], {
+          data: {
+            ...serverVars(server),
+            steamId: String(row.steamId),
+            player: str(row.name),
+            attemptedAt: new Date(t),
+          },
+          dedupeKey: dedupeKey('login-denied', server.id, row.steamId, t),
+          occurredAt: t,
+        })) sent += 1
+      }
+    } catch (err) {
+      log.warn('could not sweep login attempts', { server: server && server.id, error: err.message })
+    }
+  }
+  return sent
+}
+
+/** A Steam account was just linked (R1). Called by the link route, once, on a NEW link. */
+function linked({ userId, steamId, name }) {
+  try {
+    const uid = Number(userId)
+    if (!Number.isInteger(uid) || uid < 1 || !steamId) return 0
+    return fire(T['rust.player.linked'], {
+      data: { steamId: String(steamId), player: str(name), accountUrl: PATHS.account },
+      ownerUserId: uid,
+      dedupeKey: dedupeKey('linked', steamId, uid),
+    }) ? 1 : 0
+  } catch (err) {
+    log.warn('could not raise the link notification', { error: err.message })
+    return 0
+  }
+}
+
+/**
+ * `rust.kit.entitled` for each user one reward step granted (phase 13b). Never
+ * throws: a notification that could not be raised must not fail the grant it
+ * is about. Returns how many were raised.
+ */
+function entitled({ userIds, kit, server, mode, runId, stepId }) {
+  let raised = 0
+  try {
+    const rewardKey = `${runId}:${stepId}`
+    for (const userId of new Set(userIds || [])) {
+      const uid = Number(userId)
+      if (!Number.isInteger(uid) || uid < 1) continue
+      const ok = fire(T['rust.kit.entitled'], {
+        data: { rewardKey, kit: String(kit), ...serverVars(server), ...(mode ? { mode: String(mode) } : {}), accountUrl: PATHS.account },
+        ownerUserId: uid,
+        dedupeKey: dedupeKey('entitled', runId, stepId, uid),
+      })
+      if (ok) raised++
+    }
+  } catch (err) {
+    log.warn('could not raise the reward notification', { error: err.message })
+  }
+  return raised
+}
+
+module.exports = {
+  onEvent,
+  serverObserved,
+  checkLeader,
+  sweepLoginDenied,
+  linked,
+  entitled,
+  reset,
+  dedupeKey,
+  headline,
+  stillNews,
+  BROADCAST_MAX_AGE_MS,
+  PERSONAL_MAX_AGE_MS,
+  LOGIN_APPROVAL_WINDOW_MS,
+  STRUCTURE_LABELS,
+}

server/engagement/seeds.js

@@ -0,0 +1,334 @@
+// ── What the notifications read like, and the rules that use them ─────────
+//
+// `registerEngagementSeeds` (MODULE_API.md §2.4 and §1.1 under 1.9.0; PLAN.md
+// §25.2). Data only: nothing here names a recipient, and nothing here turns a
+// rule on.
+//
+// ── Two bespoke bodies, and why only two ──────────────────────────────────
+//
+// A body earns its place when the message has something to say that core's
+// structural projection cannot. The raid alert does — it is the one message
+// here somebody acts on at 3am, and it must say WHERE and WHAT in the first
+// line. The wipe does — it is the one broadcast a whole community waits for.
+// Everything else is "this happened, here is the link", which is exactly what
+// core's `notify.event` / `inapp.event` already say, so it points at those and
+// authors nothing (§4.6.1 property 1).
+//
+// The register is plain, not in-universe. Rust has no court or herald to write
+// in the voice of, and a raid alert dressed as fiction is a raid alert read a
+// second later than it should be.
+//
+// ── Three rules for editing a body ────────────────────────────────────────
+//
+//   1. **No conditionals, and never an optional inside a clause.** An unset
+//      optional interpolates to the EMPTY STRING. `atGrid` is a fragment that
+//      carries its own leading space for exactly that reason; `grid` on its own
+//      belongs on a line of its own or nowhere.
+//   2. **No brand.** `siteName` and friends are supplied by the renderer, so one
+//      image mails as whichever site it is running as.
+//   3. **Bump `seedVersion` when a body changes, never for a comment.** It is how
+//      a better default reaches deployments whose operators did not edit it.
+//
+// ── One rule group per family ─────────────────────────────────────────────
+//
+// A group is seeded ONCE (per deployment, per key), so a rule appended to a
+// group in a later version reaches fresh installs only. Eight families, eight
+// keys: a future raid rule takes `raid-v2` without disturbing anybody's clan
+// rules. Every rule is disabled — core ignores `enabled` rather than trusting it
+// — so installing this module mails nobody until an operator decides it should.
+
+// ── Block helpers ──────────────────────────────────────────────────────────
+
+const text = (id, body, opts = {}) => ({
+  id,
+  type: 'email.text',
+  props: opts.muted ? { text: body, muted: true } : { text: body },
+})
+const heading = (id, body, level = 'h1') => ({ id, type: 'email.heading', props: { level, text: body } })
+const button = (id, label, url, textLead) => ({
+  id,
+  type: 'email.button',
+  props: textLead ? { label, url, textLead } : { label, url },
+})
+const divider = (id) => ({ id, type: 'email.divider', props: {} })
+
+// Every email ends with the unsubscribe pair; `unsubscribeUrl` is core's
+// per-delivery variable, not something a trigger declares.
+const unsubscribe = () => [
+  divider('rule'),
+  button('unsub', 'Unsubscribe', '{{unsubscribeUrl}}', 'To stop these messages, use this link:'),
+]
+
+const email = (key, name, triggerId, subject, blocks) => ({
+  key,
+  name,
+  channel: 'email',
+  triggerId,
+  triggerVersion: 1,
+  seedVersion: 1,
+  subject,
+  blocks: [...blocks, ...unsubscribe()],
+})
+
+/** In-app: heading = the row's title, button = its one action, the rest = its body. */
+const inapp = (key, name, triggerId, title, body, action, url) => ({
+  key,
+  name,
+  channel: 'inapp',
+  triggerId,
+  triggerVersion: 1,
+  seedVersion: 1,
+  subject: null,
+  blocks: [heading('h', title, 'h3'), text('intro', body), button('cta', action, url)],
+})
+
+const TEMPLATES = Object.freeze([
+  email(
+    'rust.base.destroyed',
+    'Rust — your base was raided',
+    'rust.base.destroyed',
+    'Your base on {{server}} is being raided',
+    [
+      heading('h', 'Your base is being raided'),
+      text('p1', 'A {{structure}} of a base you are authorised on was destroyed{{atGrid}} on {{server}}.'),
+      text('p2',
+        'You are getting this because you are on the base\'s tool cupboard. Further damage to the '
+        + 'same base will not send another alert for a while.', { muted: true }),
+      button('cta', 'Open the server page', '{{serverUrl}}'),
+    ],
+  ),
+  inapp(
+    'rust.base.destroyed-inapp',
+    'Rust — your base was raided (in-app)',
+    'rust.base.destroyed',
+    'Your base is being raided',
+    'A {{structure}} was destroyed{{atGrid}} on {{server}}.',
+    'Open the server',
+    '{{serverUrl}}',
+  ),
+  email(
+    'rust.wipe.started',
+    'Rust — a server wiped',
+    'rust.wipe.started',
+    '{{server}} has wiped',
+    [
+      heading('h', '{{server}} has wiped'),
+      text('p1', 'A new wipe has started on {{server}}: a fresh map, and a fresh start for everyone.'),
+      button('cta', 'Open the server page', '{{serverUrl}}'),
+    ],
+  ),
+  inapp(
+    'rust.wipe.started-inapp',
+    'Rust — a server wiped (in-app)',
+    'rust.wipe.started',
+    '{{server}} has wiped',
+    'A new wipe has started: a fresh map, and a fresh start for everyone.',
+    'Open the server',
+    '{{serverUrl}}',
+  ),
+])
+
+// ── The rules — every one of them off ──────────────────────────────────────
+
+/** Core's generic bodies (§4.6.1 property 1). */
+const GENERIC = { email: 'notify.event', inapp: 'inapp.event', digest: 'notify.digest' }
+
+/** This module's bodies for a trigger, and core's digest. */
+const bodies = (key) => ({ email: key, inapp: `${key}-inapp`, digest: 'notify.digest' })
+
+const RULE_GROUPS = Object.freeze([
+  {
+    key: 'raid-v1',
+    note: 'module-rust: the raid alert (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.base.destroyed',
+        name: 'Raid alert — offline owners',
+        audience: 'owner',
+        // Push is allowed because this trigger is also a stream (D65); the
+        // tickle carries no content, and the app pulls the inbox row.
+        channels: ['email', 'inapp', 'push'],
+        template_keys: bodies('rust.base.destroyed'),
+        // Per BUILDING (the subjectKey): a raid is dozens of walls and one alert.
+        cooldown_seconds: 1800,
+        max_sends_per_hour: 500,
+        // D61: "offline raid alert" is this condition, not code. An operator who
+        // wants online raids too deletes it.
+        conditions: { variable: 'ownerOnline', cmp: 'eq', value: false },
+      },
+    ],
+  },
+  {
+    key: 'wipe-v1',
+    note: 'module-rust: wipe announcements (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.wipe.started',
+        name: 'Server wiped',
+        audience: 'subscribers',
+        channels: ['email', 'inapp', 'push'],
+        template_keys: bodies('rust.wipe.started'),
+        cooldown_seconds: 6 * 3600,
+        max_sends_per_hour: 2000,
+      },
+    ],
+  },
+  {
+    key: 'server-v1',
+    note: 'module-rust: server up and down (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.server.online',
+        name: 'Server came online',
+        audience: 'subscribers',
+        channels: ['inapp', 'push'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 3600,
+        max_sends_per_hour: 2000,
+      },
+      {
+        trigger_id: 'rust.server.offline',
+        name: 'Server went offline',
+        audience: 'subscribers',
+        channels: ['inapp', 'push'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 3600,
+        max_sends_per_hour: 2000,
+        // A plugin reload, or a restart that is back within five minutes, is not
+        // an outage anybody needs to hear about. `cancel_on` withdraws the
+        // pending notice when the server comes back inside the window.
+        delay_seconds: 300,
+        cancel_on: ['rust.server.online'],
+      },
+    ],
+  },
+  {
+    key: 'leaderboard-v1',
+    note: 'module-rust: a new kills leader (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.leaderboard.topped',
+        name: 'New kills leader',
+        audience: 'subscribers',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 3600,
+        max_sends_per_hour: 2000,
+      },
+    ],
+  },
+  {
+    key: 'account-v1',
+    note: 'module-rust: a Steam account was linked (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.player.linked',
+        name: 'Steam account linked',
+        audience: 'owner',
+        // Email as well as in-app: the case this exists for is a link the person
+        // did NOT make, and they will not be looking at the site's inbox for it.
+        channels: ['email', 'inapp'],
+        template_keys: GENERIC,
+        cooldown_seconds: 0,
+        max_sends_per_hour: 200,
+      },
+    ],
+  },
+  {
+    // Its own group, not a rule appended to `account-v1`: a group is seeded once,
+    // so an appended rule would reach fresh installs only (R7).
+    key: 'rewards-v1',
+    note: 'module-rust: an event rewarded you a kit (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.kit.entitled',
+        name: 'Kit reward earned',
+        audience: 'owner',
+        // Email as well: a reward granted at 03:00 is news the person reads the
+        // next morning, before they are next in game or on the site.
+        channels: ['email', 'inapp'],
+        template_keys: GENERIC,
+        cooldown_seconds: 0,
+        max_sends_per_hour: 200,
+      },
+    ],
+  },
+  {
+    key: 'clans-v1',
+    note: 'module-rust: clan departures and disbands (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.clan.member.left',
+        name: 'Clan — a member left',
+        audience: 'members',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 0,
+        max_sends_per_hour: 500,
+      },
+      {
+        trigger_id: 'rust.clan.member.kicked',
+        name: 'Clan — a member was removed',
+        audience: 'members',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 0,
+        max_sends_per_hour: 500,
+      },
+      {
+        trigger_id: 'rust.clan.disbanded',
+        name: 'Clan — disbanded',
+        audience: 'members',
+        channels: ['email', 'inapp'],
+        template_keys: GENERIC,
+        cooldown_seconds: 0,
+        max_sends_per_hour: 500,
+      },
+    ],
+  },
+  {
+    key: 'moderation-v1',
+    note: 'module-rust: reports, bans and unapproved logins, to staff (disabled)',
+    rules: [
+      {
+        trigger_id: 'rust.player.reported',
+        name: 'Player reported',
+        audience: 'staff',
+        channels: ['email', 'inapp'],
+        template_keys: GENERIC,
+        // Per REPORTED player: a pile-on of ten reports is one notice an hour.
+        cooldown_seconds: 3600,
+        max_sends_per_hour: 200,
+      },
+      {
+        trigger_id: 'rust.player.banned',
+        name: 'Player banned',
+        audience: 'staff',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 0,
+        max_sends_per_hour: 200,
+      },
+      {
+        trigger_id: 'rust.player.unbanned',
+        name: 'Player unbanned',
+        audience: 'staff',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 0,
+        max_sends_per_hour: 200,
+      },
+      {
+        trigger_id: 'rust.login.denied',
+        name: 'Login not approved',
+        audience: 'staff',
+        channels: ['inapp'],
+        template_keys: { inapp: GENERIC.inapp },
+        cooldown_seconds: 3600,
+        max_sends_per_hour: 200,
+      },
+    ],
+  },
+])
+
+module.exports = { TEMPLATES, RULE_GROUPS }

server/engagement/streams.js

@@ -0,0 +1,53 @@
+// ── The push facet: which triggers may reach a phone ──────────────────────
+//
+// `registerNotificationStreams` (MODULE_API.md §2.4). A stream is what a device
+// subscribes to, and **core delivers an engagement rule's push only to devices
+// subscribed to a stream whose id IS the trigger id** (`pushChannel.deliver` ->
+// `publishToUsers(row.trigger_id)`). So a trigger with no stream here can never
+// buzz a phone, however its rule is set — which is exactly how the families
+// that should not are kept off it (D65).
+//
+// Every id here is ALSO a trigger in `triggers.js`. That is the one namespace
+// core enforces across both facets: one event, with a payload contract and a
+// subscription toggle, owned by one module. An id that appeared only here would
+// be a toggle nothing could ever fire.
+//
+// **The tickle carries nothing.** A push is `{ stream, ref }` and the app pulls
+// the real item over the authenticated inbox API, so a leaked relay topic says
+// that something happened and not what. That is core's guarantee and it is why
+// a raid alert may be a push at all.
+
+const STREAMS = Object.freeze([
+  {
+    id: 'rust.base.destroyed',
+    label: 'Your base was raided',
+    description: 'Part of a base you are authorised on was destroyed by another player.',
+    // Delivered only to the owner's devices, never fanned out: `owner` ceiling,
+    // one emit per authorised person (D59).
+    personal: true,
+    requiresLinkedAccount: true,
+  },
+  {
+    id: 'rust.server.online',
+    label: 'A server came online',
+    description: 'A Rust server started or came back.',
+    personal: false,
+    requiresLinkedAccount: false,
+  },
+  {
+    id: 'rust.server.offline',
+    label: 'A server went offline',
+    description: 'A Rust server stopped or stopped answering.',
+    personal: false,
+    requiresLinkedAccount: false,
+  },
+  {
+    id: 'rust.wipe.started',
+    label: 'A server wiped',
+    description: 'A Rust server started a new wipe.',
+    personal: false,
+    requiresLinkedAccount: false,
+  },
+])
+
+module.exports = { STREAMS }

server/engagement/triggers.js

@@ -0,0 +1,414 @@
+// ── What can happen, as core's engagement engine is told it ───────────────
+//
+// The payload contracts behind every notification this module can cause
+// (MODULE_API.md §2.4, `registerEventTriggers`; PLAN.md §25). A trigger says
+// what an event IS, what a template may interpolate, and — the part that is a
+// security boundary — the widest audience a rule on it may EVER be given.
+//
+// ── The ceiling is containment, not size ──────────────────────────────────
+//
+// `owner` is not a small `staff`, and `staff` does not permit `owner`. For the
+// raid alert "one person" is the person whose base it was; for a ban it is
+// nobody outside the staff room. Each ceiling below is chosen against that
+// lattice and not against a ladder, and core refuses a rule that widens one.
+//
+// ── What no variable here carries, on purpose ─────────────────────────────
+//
+//   • An IP address. The login and ban frames carry one; the triggers do not,
+//     so no template an operator writes can put an address in a mail. The
+//     admin feed still shows it, to staff, where it is useful.
+//   • The raider (D66). The raid alert says what was destroyed, where and
+//     when. Who did it is gameplay intelligence the game does not hand the
+//     victim, and a variable that is not declared cannot be interpolated.
+//   • A Steam id other than the subject's own.
+//
+// ── Why `subjectKey` is what it is ────────────────────────────────────────
+//
+// Core's cooldown is per (rule, user, subject, channel). So the subject is the
+// thing a recipient should hear about once per cooldown: a BUILDING for a raid
+// (however many walls fall), a SERVER for a broadcast (however often it
+// bounces), a CLAN for a membership change. A subject that changed every firing
+// — a boot id, a timestamp — would make every cooldown a no-op.
+//
+// ── `version` ──────────────────────────────────────────────────────────────
+//
+// The prop-schema version a template records it was authored against. Bump one
+// on a rename or a type change, never for a label.
+
+const ID = 'rust'
+
+/** Site-relative paths, built the way the client registers them. */
+const PATHS = {
+  servers: `/${ID}`,
+  account: `/player/${ID}`,
+}
+
+// A server id is VARCHAR(64) of the operator's choosing, and a clan's
+// `externalId` is `<serverId>:<clanId>:<createdMs>`. Core validates a `url`
+// variable against a character class with no `:` in it, so every id that goes
+// into a path is percent-encoded — without it the clan link would be dropped at
+// emit in production, silently, for every clan there is.
+const serverPath = (serverId) => `/${ID}/servers/${encodeURIComponent(serverId)}`
+const leaderboardPath = (serverId) => `${serverPath(serverId)}?tab=leaderboard`
+const clanPath = (externalId) => `/${ID}/clans/${encodeURIComponent(externalId)}`
+
+const V1 = 1
+
+// ── Shared variables ───────────────────────────────────────────────────────
+
+// **Every trigger carries its own headline.** Most rules here point at core's
+// generic `notify.event` / `inapp.event`, and core's structural projection fills
+// `title` and `intro` from the trigger's LABEL and DESCRIPTION only when the
+// payload does not define them — "the payload wins, the projection fills gaps"
+// (ENGAGEMENT.md §4.6.1). Without these two, the phase-10 walk rendered a
+// multi-server site's notice as "A server came online. A server's game
+// started…" — true, and useless, because it never said which. The emitter
+// writes the sentence (`emit.js` `headline`); an operator's own template can
+// still ignore it and interpolate the parts.
+const HEADLINE = [
+  { name: 'title', type: 'string', required: false, example: 'Main is back online',
+    description: 'A one-line headline naming what happened and where. Core generic bodies use it as the title.' },
+  { name: 'intro', type: 'string', required: false, example: 'Main is back up and taking players.',
+    description: 'One sentence of detail. Core generic bodies use it as the body.' },
+]
+
+const SERVER = [
+  { name: 'serverId', type: 'string', required: true, example: 'main',
+    description: 'The server the event happened on, as configured in Admin -> Rust. Also the cooldown subject for broadcasts.' },
+  { name: 'server', type: 'string', required: true, example: 'Runic Gateway | Main',
+    description: 'The server\'s display name.' },
+  { name: 'serverUrl', type: 'url', required: false, example: '/rust/servers/main',
+    description: 'Site-relative path to the server\'s page.' },
+]
+
+const CLAN = [
+  { name: 'clanKey', type: 'string', required: true, example: 'main:12:1790142840000',
+    description: 'The clan\'s stable identity. The cooldown subject; not meant for display.' },
+  { name: 'clan', type: 'string', required: true, example: 'The Rust Belt',
+    description: 'The clan\'s name.' },
+  { name: 'clanUrl', type: 'url', required: false, example: '/rust/clans/main%3A12%3A1790142840000',
+    description: 'Site-relative path to the clan\'s page.' },
+]
+
+// ── The raid alert ─────────────────────────────────────────────────────────
+
+const RAID = {
+  id: 'rust.base.destroyed',
+  label: 'Your base was raided',
+  description:
+    'Part of a base you are authorised on was destroyed by another player: a wall, a door, ' +
+    'an external wall or gate, or the tool cupboard.',
+  kind: 'event',
+  // One per base per cooldown, however many walls fall. The building is the
+  // tool cupboard's id — the game's own answer to "which base is this".
+  subjectKey: 'building',
+  // One emit per authorised, linked person, each with `ownerUserId` set (D59).
+  // `owner` is the ceiling AND the default: there is nobody else this may reach.
+  audience: 'owner',
+  ceiling: 'owner',
+  version: V1,
+  variables: [
+    ...SERVER,
+    ...HEADLINE,
+    { name: 'building', type: 'string', required: true, example: '8113',
+      description: 'The base, as the id of its tool cupboard. The cooldown subject.' },
+    { name: 'structure', type: 'string', required: true, example: 'door',
+      description: 'What was destroyed: "building block", "door", "external wall" or "tool cupboard".' },
+    { name: 'grid', type: 'string', required: false, example: 'H7',
+      description: 'The map grid square. Absent when the server could not work one out.' },
+    // A FRAGMENT, for use inside a sentence. An unset optional interpolates to
+    // the empty string, so "your door in {{grid}} was destroyed" reads "your
+    // door in  was destroyed" when the grid is unknown; this carries its own
+    // leading space and vanishes cleanly instead.
+    { name: 'atGrid', type: 'string', required: false, example: ' in H7',
+      description: 'Sentence fragment: " in H7" with its own leading space, or nothing when the grid is unknown.' },
+    { name: 'ownerOnline', type: 'boolean', required: true, example: false,
+      description: 'Whether YOU were online when it happened. The seeded rule alerts only when this is false.' },
+  ],
+}
+
+// ── Server lifecycle ───────────────────────────────────────────────────────
+//
+// `everyone` because a server being up is what a server page already says to
+// anyone. The DEFAULT is `subscribers` — the people who asked — and an operator
+// widens deliberately.
+
+const BROADCASTS = [
+  {
+    id: 'rust.wipe.started',
+    label: 'A server wiped',
+    description: 'A server started a new wipe: a fresh map, and everything built on the old one gone.',
+    kind: 'event',
+    subjectKey: 'serverId',
+    audience: 'subscribers',
+    ceiling: 'everyone',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'wipeId', type: 'string', required: true, example: '1790142840-3000-1234',
+        description: 'The new wipe\'s identity.' },
+    ],
+  },
+  {
+    id: 'rust.server.online',
+    label: 'A server came online',
+    description: 'A server\'s game started, or came back after being unreachable.',
+    kind: 'event',
+    subjectKey: 'serverId',
+    audience: 'subscribers',
+    ceiling: 'everyone',
+    version: V1,
+    variables: [...SERVER, ...HEADLINE],
+  },
+  {
+    id: 'rust.server.offline',
+    label: 'A server went offline',
+    description: 'A server\'s game stopped, crashed, or stopped talking to the website.',
+    kind: 'event',
+    subjectKey: 'serverId',
+    audience: 'subscribers',
+    ceiling: 'everyone',
+    version: V1,
+    variables: [...SERVER, ...HEADLINE],
+  },
+  {
+    id: 'rust.leaderboard.topped',
+    label: 'A new kills leader',
+    description: 'Somebody new leads the current wipe\'s kills on a server.',
+    kind: 'event',
+    subjectKey: 'serverId',
+    audience: 'subscribers',
+    ceiling: 'everyone',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'leader', type: 'string', required: true, example: 'Marisol',
+        description: 'The new leader\'s in-game name.' },
+      { name: 'kills', type: 'int', required: true, example: 42,
+        description: 'Their kills this wipe.' },
+      { name: 'leaderboardUrl', type: 'url', required: false, example: '/rust/servers/main?tab=leaderboard',
+        description: 'Site-relative path to the server\'s leaderboard.' },
+    ],
+  },
+]
+
+// ── The player's own account ───────────────────────────────────────────────
+
+const ACCOUNT = {
+  id: 'rust.player.linked',
+  label: 'A Steam account was linked',
+  description: 'A Steam account was linked to your website account with an in-game code.',
+  kind: 'event',
+  subjectKey: 'steamId',
+  // PLAN.md §10 said `self`; core has no such ceiling (§25.1). `owner` with the
+  // linking user as `ownerUserId` is the value that exists and means the same.
+  audience: 'owner',
+  ceiling: 'owner',
+  version: V1,
+  variables: [
+    ...HEADLINE,
+    { name: 'steamId', type: 'string', required: true, example: '76561198000000001',
+      description: 'The Steam account that was linked. Also the cooldown subject.' },
+    { name: 'player', type: 'string', required: false, example: 'Marisol',
+      description: 'The in-game name the game reported when it was linked.' },
+    { name: 'accountUrl', type: 'url', required: false, example: '/player/rust',
+      description: 'Site-relative path to your Rust account page.' },
+  ],
+}
+
+// ── A reward (phase 13b) ───────────────────────────────────────────────────
+//
+// Deferred from phase 10 (D64) to the phase that grants something. Emitted once
+// per recipient USER when an event's `rust.kit.entitle` writes their rows, with
+// that user as `ownerUserId` — so, like the link notice, `owner` is both the
+// ceiling and the only audience there is: a reward is nobody else's news.
+//
+// The subject is the run and the step, so one award is one notification however
+// often a retried step writes the same rows.
+
+const REWARD = {
+  id: 'rust.kit.entitled',
+  label: 'An event rewarded you a kit',
+  description: 'An event on a Rust server rewarded you: a kit is waiting in the in-game Kits menu, with one extra use.',
+  kind: 'event',
+  subjectKey: 'rewardKey',
+  audience: 'owner',
+  ceiling: 'owner',
+  version: V1,
+  variables: [
+    ...HEADLINE,
+    { name: 'rewardKey', type: 'string', required: true, example: '41:7',
+      description: 'The run and step that awarded it. The cooldown subject; not meant for display.' },
+    { name: 'kit', type: 'string', required: true, example: 'vip-starter',
+      description: 'The kit name, as the server Kits plugin has it.' },
+    ...SERVER,
+    { name: 'mode', type: 'string', required: false, example: 'top',
+      description: 'How the recipients were chosen: everyone, top, minScore, random or topPercent.' },
+    { name: 'accountUrl', type: 'url', required: false, example: '/player/rust',
+      description: 'Site-relative path to your Rust account page.' },
+  ],
+}
+
+// ── Clans ──────────────────────────────────────────────────────────────────
+//
+// `members` ceiling — clan membership is the clan's business (D49). Recipients
+// travel on the envelope as `recipientUserIds`, because "the clan this was
+// about" is a different answer every firing and cannot be a saved audience.
+//
+// No `rust.clan.member.added`: core already fires `team.member.joined` for our
+// clans through the Team sync, and a second trigger would notify twice (D64).
+
+const CLANS = [
+  {
+    id: 'rust.clan.member.left',
+    label: 'Someone left your clan',
+    description: 'A member left a clan you are in.',
+    kind: 'event',
+    subjectKey: 'clanKey',
+    audience: 'members',
+    ceiling: 'members',
+    version: V1,
+    variables: [
+      ...CLAN,
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'member', type: 'string', required: false, example: 'Darrow',
+        description: 'Who left.' },
+    ],
+  },
+  {
+    id: 'rust.clan.member.kicked',
+    label: 'Someone was removed from your clan',
+    description: 'A member was removed from a clan you are in — or you were.',
+    kind: 'event',
+    subjectKey: 'clanKey',
+    audience: 'members',
+    ceiling: 'members',
+    version: V1,
+    variables: [
+      ...CLAN,
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'member', type: 'string', required: false, example: 'Darrow',
+        description: 'Who was removed.' },
+      { name: 'by', type: 'string', required: false, example: 'Marisol',
+        description: 'Who removed them.' },
+    ],
+  },
+  {
+    id: 'rust.clan.disbanded',
+    label: 'Your clan was disbanded',
+    description: 'A clan you were in was disbanded.',
+    kind: 'event',
+    subjectKey: 'clanKey',
+    audience: 'members',
+    ceiling: 'members',
+    version: V1,
+    variables: [
+      ...CLAN,
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'by', type: 'string', required: false, example: 'Marisol',
+        description: 'Who disbanded it.' },
+    ],
+  },
+]
+
+// ── Moderation — staff, and never wider ────────────────────────────────────
+
+const MODERATION = [
+  {
+    id: 'rust.player.reported',
+    label: 'A player was reported',
+    description: 'A player filed an in-game report against another.',
+    kind: 'event',
+    subjectKey: 'steamId',
+    audience: 'staff',
+    ceiling: 'staff',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'steamId', type: 'string', required: true, example: '76561198000000002',
+        description: 'The reported player\'s Steam id. The cooldown subject.' },
+      { name: 'player', type: 'string', required: false, example: 'Darrow',
+        description: 'The reported player\'s name.' },
+      { name: 'reporter', type: 'string', required: false, example: 'Marisol',
+        description: 'Who filed the report.' },
+      { name: 'reportType', type: 'string', required: false, example: 'cheat',
+        description: 'The category the reporter chose.' },
+      { name: 'topic', type: 'string', required: false, example: 'Aimbot at the dome',
+        description: 'The report\'s subject line.' },
+      { name: 'message', type: 'string', required: false, example: 'Headshots through two walls.',
+        description: 'The report\'s text.' },
+    ],
+  },
+  {
+    id: 'rust.player.banned',
+    label: 'A player was banned',
+    description: 'A player was banned on a server.',
+    kind: 'event',
+    subjectKey: 'steamId',
+    audience: 'staff',
+    ceiling: 'staff',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'steamId', type: 'string', required: true, example: '76561198000000002',
+        description: 'The banned player\'s Steam id. The cooldown subject.' },
+      { name: 'player', type: 'string', required: false, example: 'Darrow',
+        description: 'The banned player\'s name.' },
+      { name: 'reason', type: 'string', required: false, example: 'Cheating',
+        description: 'The reason given.' },
+    ],
+  },
+  {
+    id: 'rust.player.unbanned',
+    label: 'A player was unbanned',
+    description: 'A ban on a server was lifted.',
+    kind: 'event',
+    subjectKey: 'steamId',
+    audience: 'staff',
+    ceiling: 'staff',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'steamId', type: 'string', required: true, example: '76561198000000002',
+        description: 'The player\'s Steam id. The cooldown subject.' },
+      { name: 'player', type: 'string', required: false, example: 'Darrow',
+        description: 'The player\'s name.' },
+    ],
+  },
+  {
+    id: 'rust.login.denied',
+    label: 'A login was not approved',
+    description:
+      'Somebody tried to join a server and was not let in within a minute: a ban, a failed ' +
+      'authentication, or a player who gave up while connecting.',
+    kind: 'event',
+    subjectKey: 'steamId',
+    audience: 'staff',
+    ceiling: 'staff',
+    version: V1,
+    variables: [
+      ...SERVER,
+      ...HEADLINE,
+      { name: 'steamId', type: 'string', required: true, example: '76561198000000002',
+        description: 'The Steam id that tried to connect. The cooldown subject.' },
+      { name: 'player', type: 'string', required: false, example: 'Darrow',
+        description: 'The name it connected with.' },
+      { name: 'attemptedAt', type: 'datetime', required: true, example: '2026-09-23T03:10:00Z',
+        description: 'When the attempt was made.' },
+    ],
+  },
+]
+
+const TRIGGERS = Object.freeze([RAID, ...BROADCASTS, ACCOUNT, REWARD, ...CLANS, ...MODERATION])
+
+const TRIGGER_IDS = Object.freeze(Object.fromEntries(TRIGGERS.map((t) => [t.id, t.id])))
+
+module.exports = { TRIGGERS, TRIGGER_IDS, PATHS, serverPath, leaderboardPath, clanPath }

server/eventLeases.js

@@ -0,0 +1,440 @@
+// ── What an event may BORROW on a Rust server (PLAN.md §27, protocol 8) ─────
+//
+// The module never takes a lease and never bounds one. An author puts core's
+// `core.lease` in a step naming a lease, a target, a value and a number of
+// minutes; core reads the baseline, reserves `<lease id>#<target>` against the
+// two-events-one-target index, applies the value with its deadline and restores
+// it at teardown. What is here is the four callables each lease ships, and the
+// option sources that fill its target field.
+//
+// ── The target names the server (D73) ─────────────────────────────────────
+//
+// `core.lease` hands a lease only `{ target }` — never the run's scope — and
+// reserves `<id>#<target>`. So every lease here is TARGETED and every target
+// begins with the server id: `srv-a` for a single value, `srv-a/bear.population`
+// or `srv-a/default/kits.vip` for a family. That makes the ledger's unique index
+// bite at exactly the granularity Rust has: two runs on two servers never
+// collide, and one value on one server has one holder.
+//
+// ── Game convars only (D74) ───────────────────────────────────────────────
+//
+// Vanilla Rust has no gather, craft or smelt rate convar; what it has, and what
+// the plugin's allowlist lends, is decay, the population system, and its two
+// minimum scalars — plus a group's permissions, the "weekend VIP" (D75). The
+// plugin holds the allowlist, the bounds, the seven-day ceiling and the deadline
+// timer. The bounds are declared here AS WELL, because this pair is what core
+// checks when an author saves — a bad value is a refusal on a form rather than a
+// step failing unattended at four in the morning.
+
+const core = require('./core')
+const client = require('./sidecarClient')
+const serversDb = require('./model/servers/servers.db')
+const servers = require('./model/servers/servers.model')
+
+const log = core.logger('leases')
+
+/** Seven days (D77). The plugin holds the same ceiling independently and refuses past it. */
+const MAX_LEASE_MS = 7 * 24 * 60 * 60 * 1000
+
+/** Core's bound on one option source's answer. A source that would exceed it says so in the log. */
+const MAX_OPTIONS = 2000
+
+/** The wire key of the one lease that is not a convar. */
+const GROUP_PERMISSION_KEY = 'group.permission'
+
+/**
+ * Split a target into its server and the rest (D73).
+ *
+ * At the FIRST slash: a server id is `[a-z0-9-]` and never contains one, while
+ * what follows may (a group name is free text an operator typed).
+ */
+function splitTarget(target) {
+  const text = String(target || '').trim()
+  const slash = text.indexOf('/')
+  if (slash < 0) return { serverId: text, rest: '' }
+  return { serverId: text.slice(0, slash), rest: text.slice(slash + 1) }
+}
+
+/**
+ * The server a target names, with its token — or a refusal.
+ *
+ * **`retry: false`**, because the second attempt carries the same params: a
+ * target naming a server that is not configured (or is switched off) is an
+ * authoring mistake or a deleted server, and neither is fixed by waiting.
+ */
+async function serverFor(serverId) {
+  if (!serverId) return { ok: false, retry: false, error: 'the target does not name a server' }
+  const row = await serversDb.getServer(serverId)
+  if (!row) return { ok: false, retry: false, error: `there is no Rust server "${serverId}" on this site` }
+  if (!row.enabled) return { ok: false, retry: false, error: `the Rust server "${row.name || serverId}" is switched off` }
+  return { ok: true, server: servers.withToken(row) }
+}
+
+/** The sentence for a transport failure, naming the server — every notice says which (§25.6). */
+function transportError(server, result, what) {
+  const name = (server && (server.name || server.id)) || 'the server'
+  switch (result.status) {
+    case 'http-503':
+      return `${name} has no game connected, so its ${what} could not be reached`
+    case 'http-504':
+    case 'timeout':
+      return `${name} did not answer about its ${what} in time`
+    case 'protocol-mismatch':
+      return `${name}'s sidecar speaks a different protocol — update the module or the sidecar`
+    default:
+      return `${name} could not be reached about its ${what} (${result.status})`
+  }
+}
+
+/** A plugin's own refusal, which carries a sentence of its own. */
+function pluginError(data, fallback) {
+  return (data && (data.message || data.reason)) || fallback
+}
+
+/**
+ * Build the four callables one lease shares with every other.
+ *
+ * `wire(rest)` turns what follows the server id into the plugin's `{ key,
+ * target }`, or a refusal. The callables differ in nothing else, so they are
+ * built rather than repeated: four copies of this would be four chances for one
+ * of them to forget the drift check, which is the one thing §F says a lease must
+ * not be allowed to skip.
+ */
+function lease({ id, label, description, type, min, max, family, targetLabel, source, example, wire }) {
+  async function resolve(target) {
+    const { serverId, rest } = splitTarget(target)
+    const found = await serverFor(serverId)
+    if (!found.ok) return found
+    const w = wire(rest)
+    if (!w.ok) return { ok: false, retry: false, error: w.error }
+    return { ok: true, server: found.server, key: w.key, target: w.target || undefined }
+  }
+
+  /** The plugin's row for this key and target, or a refusal. */
+  async function row(r) {
+    const result = await client.leaseList(r.server, { key: r.key, target: r.target })
+    if (!result.ok) return { ok: false, error: transportError(r.server, result, 'lease catalogue') }
+    const rows = (result.data && result.data.leases) || []
+    const found = rows.find((x) => x && x.key === r.key && (r.target === undefined || x.target === r.target))
+    if (!found) return { ok: false, retry: false, error: `${r.server.name || r.server.id} does not lend ${r.key}` }
+    if (family && found.family !== family) {
+      return { ok: false, retry: false, error: `${r.key} is not a ${family} value` }
+    }
+    return { ok: true, row: found, data: result.data }
+  }
+
+  return {
+    id,
+    label,
+    description,
+    type,
+    ...(min === undefined ? {} : { min }),
+    ...(max === undefined ? {} : { max }),
+    maxDurationMs: MAX_LEASE_MS,
+    target: { label: targetLabel, source, example },
+
+    async read({ target } = {}) {
+      const r = await resolve(target)
+      if (!r.ok) return r
+      const found = await row(r)
+      if (!found.ok) return found
+
+      // **A key the plugin already holds reads as its BASELINE, not its
+      // current value.** Core's reservation means a second run can never get
+      // this far, so a hold core does not know about is the first attempt of
+      // THIS run whose answer was lost — and the baseline to give back at the
+      // end is what was there before anybody borrowed it, not that attempt's
+      // value. Recording the current value here would restore the event's own
+      // change at teardown and call it baseline.
+      if (found.row.held && found.row.baseline !== undefined && found.row.baseline !== null) {
+        return { ok: true, value: String(found.row.baseline) }
+      }
+
+      if (found.row.unreadable) return { ok: false, retry: false, error: found.row.unreadable }
+      if (found.row.current === undefined || found.row.current === null) {
+        return { ok: false, error: `${r.server.name || r.server.id} could not read ${r.key}` }
+      }
+      return { ok: true, value: String(found.row.current) }
+    },
+
+    async apply(value, until, { target } = {}) {
+      const r = await resolve(target)
+      if (!r.ok) return r
+
+      // **A duration, not the deadline.** `until` is an absolute time computed
+      // here and honoured there, which is a deadline measured against two
+      // clocks; a game host ten minutes fast would end a ten-minute lease the
+      // instant it took it. The absolute time still rides along, for display.
+      const untilMs = new Date(until).getTime()
+      const holdMs = untilMs - Date.now()
+      if (!Number.isFinite(holdMs) || holdMs <= 0) {
+        return { ok: false, error: 'the lease deadline has already passed' }
+      }
+
+      const body = {
+        key: r.key,
+        ...(r.target === undefined ? {} : { target: r.target }),
+        ...(family ? { family } : {}),
+        value: String(value),
+        holdMs: Math.round(holdMs),
+        untilMs,
+      }
+
+      const result = await client.leaseApply(r.server, body)
+
+      if (!result.ok) {
+        // **An apply this end gave up on may still land.** The client's lease
+        // timeout is below the sidecar's own, so the command can still reach
+        // the game after core has been told it failed — and core then releases
+        // its reservation, believing nothing was taken. A release follows it
+        // down the same link, which the plugin handles in order: if the apply
+        // landed, the hold's own baseline goes back; if it never did, the
+        // compare finds nothing held and changes nothing. Not awaited: its
+        // answer changes nothing about this one.
+        if (result.status === 'timeout' || result.status === 'http-504') {
+          client
+            .leaseRelease(r.server, { key: r.key, target: r.target, expected: String(value) })
+            .catch(() => {})
+        }
+        return { ok: false, error: transportError(r.server, result, 'lease') }
+      }
+
+      const data = result.data || {}
+      if (data.kind === 'lease.ok') return { ok: true }
+
+      // A refusal the second attempt would repeat is `retry: false` — the
+      // switch is off, the key is not lent, the value is out of range. One that
+      // might pass later (a value the game could not read this second) is left
+      // to core's default.
+      const permanent = ['events-disabled', 'unknown-key', 'out-of-range', 'too-long', 'unresolved', 'target-gone', 'malformed']
+      return {
+        ok: false,
+        ...(permanent.includes(data.reason) ? { retry: false } : {}),
+        error: pluginError(data, `${r.server.name || r.server.id} refused the lease`),
+      }
+    },
+
+    async restore(baseline, { expected, target } = {}) {
+      const r = await resolve(target)
+      if (!r.ok) return r
+
+      const result = await client.leaseRelease(r.server, {
+        key: r.key,
+        ...(r.target === undefined ? {} : { target: r.target }),
+        expected: expected === undefined || expected === null ? undefined : String(expected),
+        baseline: baseline === undefined || baseline === null ? undefined : String(baseline),
+      })
+
+      if (!result.ok) return { ok: false, error: transportError(r.server, result, 'lease release') }
+
+      const data = result.data || {}
+
+      // **Drift is a 200 carrying `lease.drifted`, not a failure of the call.**
+      // The plugin did what it was asked: it compared, and declined to
+      // overwrite somebody's deliberate change. Core records that as its own
+      // outcome, with the current value beside it.
+      if (data.kind === 'lease.drifted') return { ok: false, drifted: true, current: data.current }
+
+      // A group deleted mid-hold has nothing to give back and nothing owed: a
+      // successful release, not a failure that would leave a ledger row
+      // unresolved for ever over something that is gone.
+      if (data.kind === 'lease.ok') return { ok: true }
+
+      return { ok: false, error: pluginError(data, `${r.server.name || r.server.id} could not give ${r.key} back`) }
+    },
+
+    /**
+     * Whether the plugin still has a record of the hold.
+     *
+     * **Never a comparison with `read()`** (MODULE_API §1.1). A value that
+     * differs from what the run applied is DRIFT, which `restore()` reports so
+     * the row lands `drifted`; answering "not in force" here would orphan the
+     * row first. A convar hold is memory-only on the game, so a restart ends it
+     * and this answers `held: false` — exactly the case core cannot otherwise
+     * see.
+     */
+    async inForce({ target } = {}) {
+      const r = await resolve(target)
+      if (!r.ok) return r
+      const result = await client.leaseList(r.server, { key: r.key, target: r.target })
+      if (!result.ok) return { ok: false, error: transportError(r.server, result, 'lease catalogue') }
+      const holds = (result.data && result.data.holds) || []
+      const held = holds.some((h) => h && h.key === r.key && String(h.target || '') === String(r.target || ''))
+      return { ok: true, held }
+    },
+  }
+}
+
+/** A convar named in the target, of this family. */
+const convarIn = (family) => (rest) =>
+  rest ? { ok: true, key: rest.toLowerCase() } : { ok: false, error: `name the ${family} value after the server, as server/convar` }
+
+const LEASES = [
+  lease({
+    id: 'rust.decay.scale',
+    label: 'Decay rate',
+    description:
+      'How fast unprotected buildings decay. 1 is normal, 0 switches decay off, 2 doubles it. Read on every decay tick, so it takes effect at the next one.',
+    type: 'float',
+    min: 0,
+    max: 10,
+    family: 'decay',
+    targetLabel: 'Which server',
+    source: 'rust.options.servers',
+    example: 'main',
+    wire: (rest) => (rest ? { ok: false, error: 'the decay rate takes only a server as its target' } : { ok: true, key: 'decay.scale' }),
+  }),
+  lease({
+    id: 'rust.population',
+    label: 'Population',
+    description:
+      'How many of one animal or vehicle the game keeps topped up, per square kilometre. Applied on the next spawn tick, so the world fills toward the new number rather than jumping to it.',
+    type: 'float',
+    min: 0,
+    max: 50,
+    family: 'population',
+    targetLabel: 'Which server and population',
+    source: 'rust.options.populations',
+    example: 'main/bear.population',
+    wire: convarIn('population'),
+  }),
+  lease({
+    id: 'rust.spawn.scalar',
+    label: 'Spawn scalar',
+    description:
+      "The population system's minimum spawn rate or density — what it runs at on an empty or quiet server, scaling up toward the maximum as players arrive.",
+    type: 'float',
+    min: 0,
+    max: 10,
+    family: 'spawn',
+    targetLabel: 'Which server and scalar',
+    source: 'rust.options.spawnscalars',
+    example: 'main/spawn.min_rate',
+    wire: convarIn('spawn'),
+  }),
+  lease({
+    id: 'rust.group.permission',
+    label: 'Group permission',
+    description:
+      "Whether a permission group carries a permission — \"group default holds kits.vip until Monday\" makes everybody VIP for the weekend. Given back at the end whether or not the site is still up; the game holds the deadline.",
+    type: 'bool',
+    family: null,
+    targetLabel: 'Which server, group and permission',
+    source: 'rust.options.grouppermissions',
+    example: 'main/default/kits.vip',
+    wire: (rest) => {
+      const slash = rest.lastIndexOf('/')
+      if (slash <= 0 || slash >= rest.length - 1) {
+        return { ok: false, error: 'a group permission is named as server/group/permission' }
+      }
+      return {
+        ok: true,
+        key: GROUP_PERMISSION_KEY,
+        target: `${rest.slice(0, slash).trim().toLowerCase()}/${rest.slice(slash + 1).trim().toLowerCase()}`,
+      }
+    },
+  }),
+]
+
+// ── Option sources (D78: only what this phase's leases read) ─────────────────
+//
+// Every one resolves live, and a server that does not answer contributes
+// nothing rather than failing the whole answer — one server being down must
+// never blank the form for the other five (§9). A source that returns `[]`
+// degrades its field to free text on core's side, which is the right failure:
+// the operator very often already knows the value.
+
+/** Bound one source's answer, and say so in the log when there was more. */
+function bounded(rows, sourceId) {
+  if (rows.length <= MAX_OPTIONS) return rows
+  log.warn('option source truncated', { source: sourceId, available: rows.length, served: MAX_OPTIONS })
+  return rows.slice(0, MAX_OPTIONS)
+}
+
+/** Every enabled server's own answer, in parallel, skipping the ones that fail. */
+async function perServer(ask) {
+  const list = await servers.listForPolling()
+  const settled = await Promise.allSettled(list.map(async (server) => ({ server, result: await ask(server) })))
+  return settled.filter((s) => s.status === 'fulfilled' && s.value.result && s.value.result.ok).map((s) => s.value)
+}
+
+/** The convars one family lends, per server, as whole targets. */
+async function familyOptions(family, sourceId) {
+  const answers = await perServer((server) => client.leaseList(server))
+  const rows = []
+  for (const { server, result } of answers) {
+    for (const r of (result.data && result.data.leases) || []) {
+      if (!r || r.family !== family || r.unreadable) continue
+      rows.push({ value: `${server.id}/${r.key}`, label: r.key, group: server.name || server.id })
+    }
+  }
+  return bounded(rows, sourceId)
+}
+
+const OPTION_SOURCES = [
+  {
+    id: 'rust.options.servers',
+    label: 'Rust servers',
+    description: 'Every enabled server on this site. A lease holds a value on one of them (D73).',
+    async resolve() {
+      const list = await servers.listForPolling()
+      return list.map((s) => ({ value: s.id, label: s.name || s.id }))
+    },
+  },
+  {
+    id: 'rust.options.populations',
+    label: 'Populations',
+    description: 'The animal and vehicle populations each server lends, read live from the game.',
+    async resolve() {
+      return familyOptions('population', 'rust.options.populations')
+    },
+  },
+  {
+    id: 'rust.options.spawnscalars',
+    label: 'Spawn scalars',
+    description: "The population system's rate and density scalars each server lends.",
+    async resolve() {
+      return familyOptions('spawn', 'rust.options.spawnscalars')
+    },
+  },
+  {
+    // Groups times registered permissions is a catalogue bigger than a dropdown
+    // holds on any server with a few plugins, so it narrows by the term.
+    id: 'rust.options.grouppermissions',
+    label: 'Group permissions',
+    description: 'A permission group and a permission some loaded plugin registered, on each server.',
+    searchable: true,
+    async resolve({ q } = {}) {
+      const term = String(q || '').trim().toLowerCase()
+      const answers = await perServer((server) => client.permCatalogue(server))
+      const rows = []
+      for (const { server, result } of answers) {
+        const data = result.data || {}
+        const perms = (data.permissions || []).map((p) => String(p).toLowerCase())
+        for (const g of data.groups || []) {
+          const group = g && g.name ? String(g.name).toLowerCase() : null
+          if (!group) continue
+          for (const perm of perms) {
+            const value = `${server.id}/${group}/${perm}`
+            if (term && !value.includes(term)) continue
+            rows.push({ value, label: `${group} · ${perm}`, group: server.name || server.id })
+          }
+        }
+      }
+      return bounded(rows, 'rust.options.grouppermissions')
+    },
+  },
+]
+
+module.exports = {
+  MAX_LEASE_MS,
+  MAX_OPTIONS,
+  LEASES,
+  OPTION_SOURCES,
+  splitTarget,
+  serverFor,
+  transportError,
+  pluginError,
+  perServer,
+  bounded,
+}

server/eventRewards.js

@@ -0,0 +1,900 @@
+// ── What an event GIVES on a Rust server (PLAN.md §29, protocol 10) ───────
+//
+// 13a made things in the world. This file records who was there, gives them
+// something they can redeem, and can tell the server. Four verbs:
+//
+//   rust.participation.open     the game starts counting who takes part (D81)
+//   rust.participation.collect  core files the count as the run's participants
+//   rust.kit.entitle            the right to redeem a kit, and one more use of
+//                               it (R16, D103), for the people a mode picks
+//   rust.announce               one line in a server's chat, or every server's
+//
+// …and the announce leg, `rust.chat`, which says a published news post in the
+// chat of every server whose switch is on (D104).
+//
+// Phase 17 gave both a delivery — chat, or a popup through PopupNotifications
+// (D141, D142) — and a VOICE: the style of one permission group, which the
+// plugin says the line in with no player as its sender (D140).
+//
+// ── Who decides what ─────────────────────────────────────────────────────────
+//
+// The GAME counts: presence, kills, the score (D81, D99). The SITE picks the
+// recipients and holds the reward: the tally is read, a mode chosen per event
+// picks from it (D101), and a row per recipient goes into
+// `rust_perm_run_grants`, which the permission mirror pushes like any other
+// grant (D84). So a reward granted at 03:00 to somebody offline is waiting when
+// they next log in, and a wipe cannot take it away: the site re-pushes it.
+//
+// ── An action is never handed the participants ──────────────────────────────
+//
+// Core records participants from `collect`'s answer, but does not give them to
+// a later step. So `kit.entitle` reads the tally from the plugin itself, as
+// `uo.item.grant` reads it from the shard, and does not depend on a collect step
+// having run.
+
+const crypto = require('node:crypto')
+
+const core = require('./core')
+const client = require('./sidecarClient')
+const servers = require('./model/servers/servers.model')
+const permDb = require('./model/permissions/permissions.db')
+const linksDb = require('./model/links/links.db')
+const emit = require('./engagement/emit')
+const voice = require('./model/permissions/voice')
+const { serverFor, transportError, pluginError, perServer, bounded } = require('./eventLeases')
+const { BUDGET_MS } = require('./eventWorld')
+
+const log = core.logger('rewards')
+
+// Mirrors of the plugin's bounds (§29.5). The plugin's are authoritative, and
+// an operator may set them lower; these price a step and refuse a bad one on
+// the authoring form rather than at four in the morning.
+const MAX_RECIPIENTS = 100
+const MAX_CHAT = 256
+const TALLY_MAX_MINUTES = 7 * 24 * 60
+const MAX_KILL_WEIGHT = 1000
+const DEFAULT_KILL_WEIGHT = 5
+
+const SCORES = ['seconds', 'kills', 'both']
+const KILLS_OF = ['players', 'npcs', 'both']
+const MODES = ['everyone', 'top', 'minScore', 'random', 'topPercent']
+
+/** The fleet, in `rust.announce`'s `server` param (D105). */
+const EVERY_SERVER = '*'
+
+/** Where a line goes (D141). Chat is the default and what every server can do. */
+const DELIVERIES = ['chat', 'popup']
+
+/** The plugin's refusals a second attempt would repeat. */
+const PERMANENT = new Set([
+  'events-disabled',
+  'malformed',
+  'out-of-range',
+  'already-open',
+  'no-zone',
+  'ambiguous-zone',
+  'too-many',
+  'too-long',
+  'kits-missing',
+  // Protocol 12: a popup on a server without PopupNotifications. Waiting does not
+  // install it.
+  'popup-unavailable',
+])
+
+const BUDGETS = [
+  {
+    id: 'rust.grants',
+    label: 'Kit rewards',
+    unit: 'rewards',
+    description:
+      'Kits an event rewards: one per recipient, each the right to redeem the kit and one more use of it. A mode that is not a count is priced at the most it could grant.',
+  },
+  {
+    id: 'rust.announcements',
+    label: 'Chat announcements',
+    unit: 'lines',
+    description: 'Lines an event says in a server\'s chat: one per server reached.',
+  },
+]
+
+/** A transport failure, classified. Only a missing configuration is one waiting cannot fix. */
+function transportFailure(server, result, what) {
+  const permanent = result.status === 'not-configured' || result.status === 'no-token'
+  return { ok: false, ...(permanent ? { retry: false } : {}), error: transportError(server, result, what) }
+}
+
+/** A plugin refusal carried in a 200, classified by its reason. */
+function refusal(server, data, what) {
+  return {
+    ok: false,
+    ...(PERMANENT.has(data && data.reason) ? { retry: false } : {}),
+    error: pluginError(data, `${server.name || server.id} refused the ${what}`),
+  }
+}
+
+/** One word from a fixed set, or null. Compared without case: an author types these. */
+function oneOf(raw, allowed) {
+  const text = String(raw === undefined || raw === null ? '' : raw).trim().toLowerCase()
+  return allowed.find((a) => a.toLowerCase() === text) || null
+}
+
+/** `<server>:<runId>` for a tally, `<server>:<runId>:<stepId>` for a reward (§29.3). */
+const tallyRef = (serverId, runId) => `${serverId}:${runId}`
+const entitlementRef = (serverId, runId, stepId) => `${serverId}:${runId}:${stepId}`
+
+/** A ref's parts, split at every colon — a server id has none and core's ids are numbers. */
+function refParts(ref) {
+  const [serverId, runId, stepId] = String(ref || '').split(':')
+  return { serverId: serverId || null, runId: runId || null, stepId: stepId || null }
+}
+
+// ── Picking recipients (D101) ────────────────────────────────────────────────
+
+/**
+ * The mode's `count`, checked. Returns `{ ok, value }` or a refusal sentence.
+ * `everyone` takes none.
+ */
+function checkCount(mode, raw) {
+  if (mode === 'everyone') return { ok: true, value: null }
+
+  const value = Number(raw)
+  if (mode === 'top' || mode === 'random') {
+    if (!Number.isInteger(value) || value < 1 || value > MAX_RECIPIENTS) {
+      return { ok: false, error: `${mode} names 1 to ${MAX_RECIPIENTS} people, and "${raw}" is not that` }
+    }
+  } else if (mode === 'topPercent') {
+    if (!Number.isFinite(value) || value <= 0 || value > 100) {
+      return { ok: false, error: `topPercent is a percentage above 0 and at most 100, not "${raw}"` }
+    }
+  } else if (!Number.isFinite(value) || value < 0) {
+    return { ok: false, error: `minScore is a score of 0 or more, not "${raw}"` }
+  }
+
+  return { ok: true, value }
+}
+
+/** Highest first; a tie keeps the order the game joined them in, so a list reads the same twice. */
+function ranked(people) {
+  return [...people].sort((a, b) => b.score - a.score || a.joinedAt - b.joinedAt || a.steamId.localeCompare(b.steamId))
+}
+
+/** The first `n` of a ranked list, and everybody tied with the last one in (D101). */
+function withTies(list, n) {
+  if (n <= 0 || !list.length) return []
+  if (n >= list.length) return list
+  const floor = list[n - 1].score
+  return list.filter((p, i) => i < n || p.score === floor)
+}
+
+/**
+ * Who a mode picks from a tally. Pure, and the whole of D101:
+ *
+ *   everyone    every participant who scored above zero
+ *   top         the N highest scores, ties in
+ *   minScore    a score of at least X
+ *   random      N drawn from everyone who took part, seeded by the step's key
+ *   topPercent  the highest X per cent, rounded up, ties in
+ *
+ * A score of zero earns nothing in the ranked modes: "the highest scores" of a
+ * tally where nobody scored is nobody. `random` draws from everyone present,
+ * which is the point of a raffle.
+ *
+ * **The draw is seeded by the idempotency key**, so a retry after a lost answer
+ * draws the same winners — each person's place is a hash of the key and their
+ * Steam id, which needs no generator state to reproduce.
+ */
+function pickRecipients(people, mode, count, seedKey) {
+  const scored = ranked(people.filter((p) => p.score > 0))
+
+  switch (mode) {
+    case 'everyone':
+      return scored
+    case 'top':
+      return withTies(scored, count)
+    case 'minScore':
+      return ranked(people.filter((p) => p.score >= count))
+    case 'topPercent':
+      return withTies(scored, Math.ceil((scored.length * count) / 100))
+    case 'random': {
+      const draw = (p) => crypto.createHash('sha256').update(`${seedKey}\u0000${p.steamId}`).digest('hex')
+      return [...people].sort((a, b) => draw(a).localeCompare(draw(b))).slice(0, count)
+    }
+    default:
+      return []
+  }
+}
+
+/** The tally's rows as numbers, whatever the wire carried. */
+function peopleOf(data) {
+  return ((data && data.people) || [])
+    .filter((p) => p && p.steamId)
+    .map((p) => ({
+      steamId: String(p.steamId),
+      name: p.name ? String(p.name) : String(p.steamId),
+      seconds: Number(p.seconds) || 0,
+      kills: Number(p.kills) || 0,
+      score: Number(p.score) || 0,
+      joinedAt: Number(p.joinedAt) || 0,
+    }))
+}
+
+/** Steam id -> website user, for the ids that are linked. */
+async function usersFor(steamIds) {
+  const ids = [...new Set(steamIds.map(String))]
+  if (!ids.length) return new Map()
+  const rows = await linksDb.userIdsForSteamIds(ids)
+  return new Map(rows.map((r) => [String(r.steamId), Number(r.userId)]))
+}
+
+/** The tally for a run on one server, or a classified failure. */
+async function readTally(server, runId) {
+  const result = await client.tallySnapshot(server, runId)
+  if (!result.ok) return transportFailure(server, result, 'tally')
+  const data = result.data || {}
+  if (data.kind !== 'tally.snapshot') {
+    // `no-tally` is permanent for THIS step: the tally it reads was never opened
+    // on this server, or teardown already closed it.
+    if (data.reason === 'no-tally') {
+      return {
+        ok: false,
+        retry: false,
+        error: `${server.name || server.id} holds no tally for this run — open one with rust.participation.open on the same server first`,
+      }
+    }
+    return refusal(server, data, 'tally')
+  }
+  return { ok: true, data }
+}
+
+// ── The kit, as its server's Kits plugin describes it ───────────────────────
+
+/**
+ * `<serverId>/<kit>` split at the FIRST slash: a server id never contains one,
+ * and a kit name is whatever an operator typed into Kits.
+ */
+function splitKit(value) {
+  const text = String(value || '').trim()
+  const slash = text.indexOf('/')
+  if (slash <= 0 || slash === text.length - 1) return null
+  return { serverId: text.slice(0, slash), kit: text.slice(slash + 1) }
+}
+
+/** What a kit rewards, as the source's label says it and the verb checks it (R16, D103). */
+function kitReward(row) {
+  const permission = String(row.permission || '').trim().toLowerCase()
+  const max = Number(row.max) || 0
+  return { permission, max, rewardsNothing: !permission && max <= 0 }
+}
+
+async function readKit(server, kit) {
+  const result = await client.kits(server)
+  if (!result.ok) return transportFailure(server, result, 'kits')
+  const data = result.data || {}
+  if (data.kind !== 'kits.list') return refusal(server, data, 'kit list')
+
+  const row = (data.kits || []).find((k) => k && String(k.name).toLowerCase() === kit.toLowerCase())
+  if (!row) return { ok: false, retry: false, error: `${server.name || server.id} has no kit called "${kit}"` }
+
+  const reward = kitReward(row)
+  if (reward.rewardsNothing) {
+    return {
+      ok: false,
+      retry: false,
+      error: `the kit "${row.name}" is open to everyone and has no use limit, so a reward of it gives nobody anything — give it a permission or a maximum number of uses in Kits`,
+    }
+  }
+
+  return { ok: true, kit: String(row.name), ...reward, maxRecipients: Number(data.maxRecipients) || MAX_RECIPIENTS }
+}
+
+// ── The verbs ────────────────────────────────────────────────────────────────
+
+const participationOpen = {
+  id: 'rust.participation.open',
+  label: 'Start counting participants',
+  description:
+    'The game counts who takes part from here on: time present, kills, or both — in a zone this run opened, or on the whole server. It stops after its minutes; teardown forgets it.',
+  // It watches rather than changes anything, but it is ledgered, like
+  // `uo.participation.open`: the game holds a tally for the run, and teardown
+  // gives it back.
+  risk: 'inspect',
+  reversible: 'ledger',
+  version: 1,
+  budgetMs: BUDGET_MS,
+  params: [
+    { name: 'server', type: 'string', required: true, example: 'main', source: 'rust.options.servers',
+      description: 'Which server counts.' },
+    { name: 'zone', type: 'string', required: false, example: 'Airfield brawl', source: 'rust.options.runzones',
+      description: 'The name an earlier "Open a zone" step of this run gave its zone. Left blank, the whole server counts (D100).' },
+    { name: 'score', type: 'string', required: true, example: 'both', source: 'rust.options.scoremodes',
+      description: 'What earns a place: seconds present, kills, or both.' },
+    { name: 'killsOf', type: 'string', required: false, example: 'npcs', source: 'rust.options.killsof',
+      description: 'Whose deaths count as a kill: players, NPCs (animals included), or both. The last hit gets it. Needed unless the score is seconds.' },
+    { name: 'killWeight', type: 'float', required: false, example: DEFAULT_KILL_WEIGHT,
+      description: `For a score of both: how many minutes one kill is worth. Left blank, ${DEFAULT_KILL_WEIGHT}.` },
+    { name: 'minutes', type: 'int', required: false, example: 60,
+      description: `How long it counts, up to ${TALLY_MAX_MINUTES} (seven days). Left blank, seven days. The game forgets a tally seven days after it opened, however long it counted.` },
+  ],
+  cost: () => ({}),
+
+  async perform({ runId, idempotencyKey, params, verify }) {
+    const score = oneOf(params.score, SCORES)
+    if (!score) return { ok: false, retry: false, error: `a tally scores seconds, kills or both, not "${params.score}"` }
+
+    const killsOf = score === 'seconds' ? null : oneOf(params.killsOf, KILLS_OF)
+    if (score !== 'seconds' && !killsOf) {
+      return { ok: false, retry: false, error: 'a tally that counts kills says whose: players, npcs or both' }
+    }
+
+    let killWeight
+    if (score === 'both') {
+      const raw = params.killWeight
+      killWeight = raw === undefined || raw === null || raw === '' ? DEFAULT_KILL_WEIGHT : Number(raw)
+      if (!Number.isFinite(killWeight) || killWeight < 0 || killWeight > MAX_KILL_WEIGHT) {
+        return { ok: false, retry: false, error: `a kill is worth 0 to ${MAX_KILL_WEIGHT} minutes, not "${raw}"` }
+      }
+    }
+
+    let minutes
+    if (params.minutes !== undefined && params.minutes !== null && params.minutes !== '') {
+      minutes = Number(params.minutes)
+      if (!Number.isInteger(minutes) || minutes < 1 || minutes > TALLY_MAX_MINUTES) {
+        return { ok: false, retry: false, error: `a tally counts for 1 to ${TALLY_MAX_MINUTES} minutes, not "${params.minutes}"` }
+      }
+    }
+
+    const zone = String(params.zone || '').trim()
+    const found = await serverFor(String(params.server || '').trim())
+    if (!found.ok) return found
+
+    // Whether the zone exists is not asked in a dry run: it is opened by an
+    // earlier step of the same run, so before the run it never does.
+    if (verify) return { ok: true }
+
+    const result = await client.tallyOpen(found.server, {
+      runId: String(runId),
+      key: idempotencyKey,
+      score,
+      ...(killsOf ? { killsOf } : {}),
+      ...(killWeight === undefined ? {} : { killWeight }),
+      ...(minutes === undefined ? {} : { holdMs: minutes * 60000 }),
+      ...(zone ? { zone } : {}),
+    })
+    if (!result.ok) return transportFailure(found.server, result, 'tally')
+    const data = result.data || {}
+    if (data.kind !== 'tally.ok') return refusal(found.server, data, 'tally')
+
+    return {
+      ok: true,
+      resources: [
+        {
+          kind: 'tally',
+          ref: tallyRef(found.server.id, runId),
+          payload: { serverId: found.server.id, score, ...(zone ? { zone } : {}) },
+        },
+      ],
+      detail: {
+        server: found.server.name || found.server.id,
+        counting: zone ? `in the zone "${zone}"` : 'on the whole server',
+        ...(data.repeat ? { repeat: true, note: 'answered from the first attempt; the tally was already open' } : {}),
+      },
+    }
+  },
+
+  /**
+   * Forget the tally on every server the ledger names — or, when core lost the
+   * answer and holds none, on every server, since `runId` is all a tally is
+   * keyed by. A tally already gone is a success.
+   */
+  async revert({ runId, resources }) {
+    const targets = resources && resources.length
+      ? [...new Set(resources.map((r) => (r.payload && r.payload.serverId) || refParts(r.ref).serverId))]
+      : (await servers.listForPolling()).map((s) => s.id)
+
+    const failed = []
+    const errors = []
+    for (const serverId of targets) {
+      const found = await serverFor(serverId)
+      if (!found.ok) {
+        // A server deleted or switched off cannot be asked, and its tally ends on
+        // its own seven days after it opened; the ledger row is not held for it.
+        continue
+      }
+      const result = await client.tallyClose(found.server, { runId: String(runId) })
+      const refused = result.ok && (!result.data || result.data.kind !== 'tally.ok')
+      if (!result.ok || refused) {
+        failed.push(...(resources || []).filter((r) => refParts(r.ref).serverId === serverId).map((r) => r.ref))
+        errors.push(result.ok ? pluginError(result.data, `${found.server.name || found.server.id} refused to close the tally`) : transportError(found.server, result, 'tally'))
+      }
+    }
+
+    if (!errors.length) return { ok: true }
+    if (!resources || !resources.length || failed.length === resources.length) return { ok: false, error: errors.join('; ') }
+    return { ok: true, failed }
+  },
+
+  /** A tally is in force while its server still holds it. A server that cannot be asked has said nothing. */
+  async reconcile({ runId, resources }) {
+    const inForce = []
+    for (const r of resources || []) {
+      const found = await serverFor(refParts(r.ref).serverId)
+      if (!found.ok) {
+        inForce.push(r.ref)
+        continue
+      }
+      const result = await client.tallySnapshot(found.server, runId)
+      const gone = result.ok && result.data && result.data.kind !== 'tally.snapshot' && result.data.reason === 'no-tally'
+      if (!gone) inForce.push(r.ref)
+    }
+    return { ok: true, inForce }
+  },
+}
+
+const participationCollect = {
+  id: 'rust.participation.collect',
+  label: 'Record participants',
+  description:
+    'Files everybody the tally counted as this run\'s participants, with their score, time and kills. The tally keeps counting if its minutes are not up.',
+  risk: 'inspect',
+  reversible: 'none',
+  version: 1,
+  budgetMs: BUDGET_MS,
+  params: [
+    { name: 'server', type: 'string', required: true, example: 'main', source: 'rust.options.servers',
+      description: 'The server whose tally to read.' },
+  ],
+  cost: () => ({}),
+
+  async perform({ runId, params, verify }) {
+    const found = await serverFor(String(params.server || '').trim())
+    if (!found.ok) return found
+    if (verify) return { ok: true }
+
+    const tally = await readTally(found.server, runId)
+    if (!tally.ok) return tally
+
+    const people = peopleOf(tally.data)
+    const users = await usersFor(people.map((p) => p.steamId))
+
+    return {
+      ok: true,
+      // The member vocabulary is the Steam id, as the team provider's is.
+      participants: people.map((p) => ({
+        memberKey: p.steamId,
+        ...(users.has(p.steamId) ? { userId: users.get(p.steamId) } : {}),
+        score: p.score,
+        ...(p.joinedAt > 0 ? { joinedAt: new Date(p.joinedAt).toISOString() } : {}),
+        meta: { name: p.name, seconds: p.seconds, kills: p.kills },
+      })),
+      detail: {
+        server: found.server.name || found.server.id,
+        participants: people.length,
+        linked: users.size,
+        ...(Number(tally.data.overflow) > 0 ? { overflow: Number(tally.data.overflow) } : {}),
+      },
+    }
+  },
+}
+
+const kitEntitle = {
+  id: 'rust.kit.entitle',
+  label: 'Reward a kit',
+  description:
+    'Gives the people a mode picks from this run\'s tally the right to redeem a kit on its server, and one more use of it. Waits for them if they are offline. Teardown withdraws what is not yet redeemed.',
+  risk: 'change',
+  reversible: 'ledger',
+  version: 1,
+  budgetMs: BUDGET_MS,
+  params: [
+    { name: 'kit', type: 'string', required: true, example: 'main/vip-starter', source: 'rust.options.kits',
+      description: 'The kit, as server/kit. The reward reaches only that server (D102).' },
+    { name: 'recipients', type: 'string', required: true, example: 'top', source: 'rust.options.recipientmodes',
+      description: 'Who gets it: everyone who scored, the top N, a score of at least X, N drawn at random, or the top X per cent.' },
+    { name: 'count', type: 'float', required: false, example: 3,
+      description: 'N for top and random, X for a minimum score, the percentage for top per cent. Not used for everyone.' },
+  ],
+
+  // Priced before the tally is read, so at the most it could grant: the count
+  // for a count, and the server's recipient bound for every other mode. An
+  // author who wants a tight cap picks a count.
+  cost: (p) => {
+    const mode = oneOf(p.recipients, MODES)
+    const n = Math.round(Number(p.count) || 0)
+    return { 'rust.grants': mode === 'top' || mode === 'random' ? Math.max(0, n) : MAX_RECIPIENTS }
+  },
+
+  async perform({ runId, stepId, idempotencyKey, params, verify }) {
+    const parsed = splitKit(params.kit)
+    if (!parsed) return { ok: false, retry: false, error: `"${params.kit}" is not a kit — pick one from the list, as server/kit` }
+
+    const mode = oneOf(params.recipients, MODES)
+    if (!mode) return { ok: false, retry: false, error: `recipients is one of ${MODES.join(', ')}, not "${params.recipients}"` }
+
+    const count = checkCount(mode, params.count)
+    if (!count.ok) return { ok: false, retry: false, error: count.error }
+
+    const found = await serverFor(parsed.serverId)
+    if (!found.ok) return found
+    const server = found.server
+
+    const kit = await readKit(server, parsed.kit)
+    if (!kit.ok) return kit
+
+    if ((mode === 'top' || mode === 'random') && count.value > kit.maxRecipients) {
+      return { ok: false, retry: false, error: `${server.name || server.id} rewards at most ${kit.maxRecipients} people in one step, not ${count.value}` }
+    }
+
+    if (verify) return { ok: true }
+
+    const ref = entitlementRef(server.id, runId, stepId)
+    const resource = { kind: 'entitlement', ref, payload: { serverId: server.id, kit: kit.kit } }
+
+    // A repeated key finds its rows already written and changes nothing — the
+    // rows ARE the grant, and a set written twice is the same set.
+    const existing = await permDb.listRunGrantsForStep(runId, stepId)
+    if (existing.length) {
+      return {
+        ok: true,
+        resources: [resource],
+        detail: { repeat: true, granted: new Set(existing.map((r) => r.userId)).size, note: 'answered from the first attempt; nothing new was granted' },
+      }
+    }
+
+    const tally = await readTally(server, runId)
+    if (!tally.ok) return tally
+
+    const picked = pickRecipients(peopleOf(tally.data), mode, count.value, idempotencyKey)
+    const bound = Number(tally.data.maxRecipients) || kit.maxRecipients
+    if (picked.length > bound) {
+      return {
+        ok: false,
+        retry: false,
+        error: `${picked.length} people qualify, and ${server.name || server.id} rewards at most ${bound} in one step — pick a count-based mode or a higher bar`,
+      }
+    }
+
+    const users = await usersFor(picked.map((p) => p.steamId))
+    const rows = []
+    const byUser = new Set()
+    const missed = []
+
+    for (const p of picked) {
+      const userId = users.get(p.steamId)
+      if (!userId) {
+        missed.push(p.name)
+        continue
+      }
+      // One reward per website user: two linked accounts that both took part are
+      // one person, and one win is one use (D103). The higher score, being
+      // earlier in the list, is the account that gets the credit.
+      if (byUser.has(userId)) continue
+      byUser.add(userId)
+      rows.push({
+        runId,
+        stepId,
+        idemKey: idempotencyKey,
+        userId,
+        serverId: server.id,
+        steamId: p.steamId,
+        permission: kit.permission,
+        kit: kit.kit,
+        credit: kit.max > 0,
+      })
+    }
+
+    await permDb.insertRunGrants(rows)
+    await permDb.markDirty(server.id)
+
+    emit.entitled({ userIds: [...byUser], kit: kit.kit, server, mode, runId, stepId })
+
+    log.info('kit rewarded', { server: server.id, run: runId, step: stepId, kit: kit.kit, mode, granted: rows.length, missed: missed.length })
+
+    return {
+      ok: true,
+      resources: [resource],
+      detail: {
+        kit: kit.kit,
+        server: server.name || server.id,
+        mode,
+        ...(count.value === null ? {} : { count: count.value }),
+        granted: rows.length,
+        ...(missed.length ? { missed: missed.slice(0, 50), missedCount: missed.length, note: 'missed took part but have linked no website account' } : {}),
+      },
+    }
+  },
+
+  /**
+   * Withdraw a step's rows and push. The permission goes and each unredeemed
+   * credit is put back by the plugin; a redemption already made stands (R16).
+   * A row already gone is a success.
+   */
+  async revert({ runId, resources, idempotencyKey }) {
+    const touched = new Set()
+
+    if (!resources || !resources.length) {
+      for (const serverId of await permDb.deleteRunGrantsForKey(runId, idempotencyKey)) touched.add(serverId)
+    } else {
+      for (const r of resources) {
+        const { runId: refRun, stepId } = refParts(r.ref)
+        if (!stepId) continue
+        for (const serverId of await permDb.deleteRunGrantsForStep(refRun || runId, stepId)) touched.add(serverId)
+      }
+    }
+
+    for (const serverId of touched) await permDb.markDirty(serverId)
+    return { ok: true }
+  },
+
+  /** The site holds the entitlement and re-pushes it, so a restart or a wipe cannot take it away. */
+  async reconcile({ resources }) {
+    return { ok: true, inForce: (resources || []).map((r) => r.ref) }
+  },
+}
+
+/**
+ * The body of a chat line: its delivery, and the voice's format when the line
+ * goes to chat and a voice is chosen (D140). A popup is not a chat line and
+ * carries no format. Chat, the default, is left off the wire — the shape a
+ * protocol-11 caller sent — so a line with nothing new looks exactly as before.
+ */
+function lineBody(base, delivery, format) {
+  return {
+    ...base,
+    ...(delivery === 'popup' ? { delivery } : {}),
+    ...(delivery !== 'popup' && format ? { format } : {}),
+  }
+}
+
+/**
+ * Say one line on one server, and classify the answer. `repeat` is a success:
+ * the plugin remembered the key, and the line was already said.
+ */
+async function sayOn(server, body) {
+  const result = await client.chat(server, body)
+  if (!result.ok) return { state: 'down', result }
+  const data = result.data || {}
+  if (data.kind !== 'chat.ok') return { state: 'refused', data }
+  return { state: data.said === false ? 'repeat' : 'said', data }
+}
+
+const announce = {
+  id: 'rust.announce',
+  label: 'Say it in game chat',
+  description: 'One line in a Rust server\'s chat, or in every server\'s. A line said cannot be taken back.',
+  risk: 'notify',
+  reversible: 'none',
+  version: 1,
+  budgetMs: BUDGET_MS,
+  params: [
+    { name: 'server', type: 'string', required: true, example: 'main', source: 'rust.options.chatservers',
+      description: 'Which server, or * for every server (D105).' },
+    { name: 'message', type: 'string', required: true, example: 'The airfield brawl starts in five minutes!',
+      description: `The line, up to ${MAX_CHAT} characters.` },
+    // Optional, and the action stays version 1: a bump would stop every step
+    // already written from dispatching until somebody re-saved it (§33.2).
+    { name: 'delivery', type: 'string', required: false, example: 'chat', source: 'rust.options.delivery',
+      description: 'chat (the default), or popup — which needs PopupNotifications on the server, and is refused with a reason where it is missing (D141).' },
+  ],
+
+  // One per server reached. `*` is priced at the enabled servers when core asks,
+  // which is synchronous — so at the count this module last saw.
+  cost: (p) => ({ 'rust.announcements': String(p.server || '').trim() === EVERY_SERVER ? Math.max(1, servers.lastEnabledCount()) : 1 }),
+
+  async perform({ runId, idempotencyKey, params, verify }) {
+    const message = String(params.message || '').replace(/\s+/g, ' ').trim()
+    if (!message) return { ok: false, retry: false, error: 'a chat line needs a message' }
+    if (message.length > MAX_CHAT) {
+      return { ok: false, retry: false, error: `a chat line is at most ${MAX_CHAT} characters, and this one is ${message.length}` }
+    }
+
+    const rawDelivery = params.delivery === undefined || params.delivery === null || params.delivery === '' ? 'chat' : params.delivery
+    const delivery = oneOf(rawDelivery, DELIVERIES)
+    if (!delivery) return { ok: false, retry: false, error: `a line is delivered to chat or to a popup, not to "${rawDelivery}"` }
+
+    const target = String(params.server || '').trim()
+    let list
+    if (target === EVERY_SERVER) {
+      list = await servers.listForPolling()
+      if (!list.length) return { ok: false, retry: false, error: 'there are no enabled Rust servers to say it on' }
+    } else {
+      const found = await serverFor(target)
+      if (!found.ok) return found
+      list = [found.server]
+    }
+
+    if (verify) return { ok: true }
+
+    const format = delivery === 'chat' ? await voice.currentFormat() : null
+    const body = lineBody({ key: idempotencyKey || `run:${runId}`, message, event: true }, delivery, format)
+    const outcomes = await Promise.all(list.map(async (server) => ({ server, ...(await sayOn(server, body)) })))
+    const name = (o) => o.server.name || o.server.id
+
+    // One server named: its answer is the step's.
+    if (target !== EVERY_SERVER) {
+      const o = outcomes[0]
+      if (o.state === 'down') return transportFailure(o.server, o.result, 'chat')
+      if (o.state === 'refused') return refusal(o.server, o.data, 'chat line')
+      return { ok: true, detail: { said: [name(o)], ...(o.state === 'repeat' ? { repeat: true } : {}) } }
+    }
+
+    // Every server: a success for each that took the line, and the rest named
+    // (D104's reason — a line said an hour late in a restarted server is noise).
+    const said = outcomes.filter((o) => o.state === 'said' || o.state === 'repeat').map(name)
+    const down = outcomes.filter((o) => o.state === 'down').map(name)
+    const refused = outcomes.filter((o) => o.state === 'refused').map((o) => `${name(o)}: ${pluginError(o.data, 'refused')}`)
+
+    if (!said.length && refused.length) return { ok: false, retry: false, error: refused.join('; ') }
+    if (!said.length) return { ok: false, error: `no server could be reached: ${down.join(', ')}` }
+
+    return { ok: true, detail: { said, ...(down.length ? { down } : {}), ...(refused.length ? { refused } : {}) } }
+  },
+}
+
+// ── The announce leg (D104) ──────────────────────────────────────────────────
+
+/** A news post as one chat line: its title, or failing that its excerpt, flattened and bounded. */
+function chatLine(post) {
+  const text = String((post && (post.title || post.excerpt)) || '').replace(/\s+/g, ' ').trim()
+  return text.length > MAX_CHAT ? `${text.slice(0, MAX_CHAT - 1)}…` : text
+}
+
+/**
+ * The plugin's memory of recent keys, keyed off the post: its id when core's
+ * news path gives one, else what it says — `core.announce` hands a leg a post
+ * with no id. Either way a retried leg never says the same line twice.
+ */
+function chatKey(post, line) {
+  if (post && post.id !== undefined && post.id !== null) return `news:${post.id}`
+  return `news:${crypto.createHash('sha1').update(line).digest('hex')}`
+}
+
+const LEG = {
+  leg: 'rust.chat',
+  label: 'Rust in-game chat',
+
+  /**
+   * Say a post in the chat of every server whose switch is on. Never throws, as
+   * every leg client must not. The answer is one outcome per switched-on
+   * server, for `classify`.
+   */
+  async dispatch(post) {
+    try {
+      const line = chatLine(post)
+      if (!line) return { ok: false, empty: true, outcomes: [] }
+
+      const list = (await servers.listForPolling()).filter((s) => s.announceNews)
+      const key = chatKey(post, line)
+      // Read once for the post, not once per server: every server says it in the
+      // same voice (D140). Each server's own delivery decides chat or popup (D142).
+      const format = list.some((s) => s.newsDelivery !== 'popup') ? await voice.currentFormat() : null
+      const outcomes = await Promise.all(
+        list.map(async (server) => ({
+          server: server.name || server.id,
+          ...(await sayOn(server, lineBody({ key, message: line }, server.newsDelivery, format))),
+        })),
+      )
+      return { ok: true, outcomes }
+    } catch (err) {
+      log.warn('news chat leg failed', { error: err.message })
+      return { ok: false, error: err.message, outcomes: [] }
+    }
+  },
+
+  /**
+   * `done` when every switched-on server that is up took the line — or when no
+   * server is switched on, since there is nothing to deliver. `retry` only when
+   * every switched-on server is down. A server that refused is named; one that
+   * was down is skipped, never queued (D104).
+   */
+  classify(result) {
+    if (!result || (!result.ok && !result.empty && !result.outcomes)) return { outcome: 'retry', error: (result && result.error) || 'no answer' }
+    if (result.empty) return { outcome: 'terminal', error: 'the post has no title or excerpt to say' }
+    if (!result.ok) return { outcome: 'retry', error: result.error || 'the leg failed' }
+
+    const outcomes = result.outcomes || []
+    if (!outcomes.length) return { outcome: 'done' }
+
+    const took = outcomes.filter((o) => o.state === 'said' || o.state === 'repeat')
+    const down = outcomes.filter((o) => o.state === 'down').map((o) => o.server)
+    const refused = outcomes.filter((o) => o.state === 'refused').map((o) => `${o.server}: ${pluginError(o.data, 'refused')}`)
+
+    if (down.length === outcomes.length) return { outcome: 'retry', error: `every server is down: ${down.join(', ')}` }
+    if (!took.length) return { outcome: 'terminal', error: refused.join('; ') }
+
+    const notes = [...(down.length ? [`skipped (down): ${down.join(', ')}`] : []), ...refused]
+    return notes.length ? { outcome: 'done', error: notes.join('; ') } : { outcome: 'done' }
+  },
+}
+
+// ── Option sources ───────────────────────────────────────────────────────────
+
+/** A fixed choice as a dropdown — core has no enum type, so a source is how a field offers words. */
+const fixed = (id, label, description, rows) => ({ id, label, description, async resolve() { return rows } })
+
+const OPTION_SOURCES = [
+  {
+    // Live from each server's Kits, so the form offers only kits that exist. The
+    // label says what a reward of each one gives (R16, D103).
+    id: 'rust.options.kits',
+    label: 'Kits',
+    description: "Each server's Kits, flagged by what a reward of one gives.",
+    searchable: true,
+    async resolve({ q } = {}) {
+      const term = String(q || '').trim().toLowerCase()
+      const answers = await perServer((server) => client.kits(server))
+      const rows = []
+      for (const { server, result } of answers) {
+        const data = result.data || {}
+        if (data.kind !== 'kits.list') continue
+        for (const k of data.kits || []) {
+          if (!k || !k.name) continue
+          const value = `${server.id}/${k.name}`
+          if (term && !value.toLowerCase().includes(term)) continue
+          const reward = kitReward(k)
+          const flags = [
+            reward.permission ? null : 'open to everyone',
+            reward.max > 0 ? `${reward.max} use${reward.max === 1 ? '' : 's'}` : null,
+            reward.rewardsNothing ? 'rewards nothing' : null,
+          ].filter(Boolean)
+          rows.push({ value, label: flags.length ? `${k.name} · ${flags.join(' · ')}` : String(k.name), group: server.name || server.id })
+        }
+      }
+      return bounded(rows, 'rust.options.kits')
+    },
+  },
+  // Free text: the zones a run will open do not exist when it is authored, and
+  // the name is checked when the step runs (D100). Declared so the field is
+  // documented rather than a bare box, and answers nothing.
+  fixed('rust.options.runzones', 'Zones this run opens', 'The name an earlier "Open a zone" step of the same run gave its zone. Type it; it is checked when the step runs.', []),
+  fixed('rust.options.scoremodes', 'Score', 'What earns a place in a tally.', [
+    { value: 'seconds', label: 'Seconds present' },
+    { value: 'kills', label: 'Kills' },
+    { value: 'both', label: 'Both — minutes plus a weight per kill' },
+  ]),
+  fixed('rust.options.killsof', 'Kills of', 'Whose deaths count as a kill.', [
+    { value: 'players', label: 'Players' },
+    { value: 'npcs', label: 'NPCs, animals included' },
+    { value: 'both', label: 'Players and NPCs' },
+  ]),
+  fixed('rust.options.recipientmodes', 'Recipients', 'Who a reward goes to (D101).', [
+    { value: 'everyone', label: 'Everyone who scored' },
+    { value: 'top', label: 'The top N (ties in)' },
+    { value: 'minScore', label: 'A score of at least X' },
+    { value: 'random', label: 'N drawn at random' },
+    { value: 'topPercent', label: 'The top X per cent (ties in)' },
+  ]),
+  fixed('rust.options.delivery', 'Delivery', 'Where a line goes (D141).', [
+    { value: 'chat', label: 'Chat' },
+    { value: 'popup', label: 'A popup — needs PopupNotifications on the server' },
+  ]),
+  {
+    id: 'rust.options.chatservers',
+    label: 'Chat servers',
+    description: 'Every enabled server, or * for all of them.',
+    async resolve() {
+      const list = await servers.listForPolling()
+      return [{ value: EVERY_SERVER, label: 'Every server' }, ...list.map((s) => ({ value: s.id, label: s.name || s.id }))]
+    },
+  },
+]
+
+const ACTIONS = [participationOpen, participationCollect, kitEntitle, announce]
+
+module.exports = {
+  MAX_RECIPIENTS,
+  MAX_CHAT,
+  EVERY_SERVER,
+  DELIVERIES,
+  BUDGETS,
+  ACTIONS,
+  LEG,
+  OPTION_SOURCES,
+  pickRecipients,
+  checkCount,
+  splitKit,
+  kitReward,
+  chatLine,
+  chatKey,
+  lineBody,
+  refParts,
+}

server/eventWorld.js

@@ -0,0 +1,688 @@
+// ── What an event MAKES on a Rust server (PLAN.md §28, protocol 9) ────────
+//
+// A lease borrows a value that was already there. These three verbs make
+// something that was not — a zone, crates, NPCs — and
+// give it back at teardown. Everything that decides what is allowed lives on the
+// plugin: the allowlist, the bounds, the monument vocabulary, the registry of
+// what each run owns. What is here is the contract's half: declarations core can
+// check an author's step against, and the three callables core calls.
+//
+// ── Four facts from the rig shape all of it (§28.1) ──────────────────────────
+//
+//   * A restart is NOT proof a placed thing is gone. Crates are saved by the
+//     game and come back with the same net id; NPCs are not. So `reconcile` asks
+//     the plugin, which looks — `module-uo`'s `reconcileByBootId` trick would
+//     orphan every crate on every restart.
+//   * A wipe IS proof everything is gone, and the plugin drops its registry.
+//   * The bridge has no at-most-once store, so its registry is keyed by core's
+//     idempotency key: a retried step is answered with the first call's ids.
+//   * Monument names repeat, so a monument is named by kind and instance (D93).
+//
+// ── The ref names the server ─────────────────────────────────────────────────
+//
+// Every resource is `<serverId>:<id>`. `revert` and `reconcile` are handed
+// resources and not the step's params, and a run may reach six servers; the ref
+// is the only place the server can travel with the thing.
+
+const core = require('./core')
+const client = require('./sidecarClient')
+const servers = require('./model/servers/servers.model')
+const { serverFor, transportError, pluginError, perServer, bounded } = require('./eventLeases')
+
+const log = core.logger('world')
+
+/**
+ * The budget every verb here declares. It must EXCEED the client's own timeout
+ * (`TIMEOUT_MS`, 12 s), which in turn exceeds the sidecar's ten-second reply
+ * timeout — otherwise core gives up first and a `retry: false` this module
+ * answered is unreachable (MODULE_API §2.4). `world.test.js` asserts the order.
+ */
+const BUDGET_MS = 15000
+
+// Mirrors of the plugin's bounds (D95, D96). The plugin's are authoritative and
+// an operator may set them lower, in which case its refusal is the one that
+// lands; these exist so a bad step is a refusal on the AUTHORING FORM and in a
+// dry run, rather than a step failing unattended at four in the morning.
+const MAX_CRATES = 25
+const MAX_NPCS = 20
+const MAX_SPREAD = 50
+const MAX_OFFSET = 150
+const ZONE_MIN_RADIUS = 5
+const ZONE_MAX_RADIUS = 150
+const ZONE_MAX_MINUTES = 7 * 24 * 60
+
+/** The ledger kind both verbs file under. */
+const OWNED_KIND = 'world'
+
+/**
+ * What the plugin will place, mirroring its allowlist (D88).
+ *
+ * **Two copies of a short list, deliberately** — `module-uo`'s `GRANTABLE`
+ * argument. This one prices a step (`cost()` is synchronous and cannot ask a
+ * game) and fills the dropdown with every server off; the plugin's is what is
+ * true when this one is wrong.
+ */
+const PLACEABLE = [
+  { key: 'crate.basic', kind: 'crate', label: 'Basic crate' },
+  { key: 'crate.normal', kind: 'crate', label: 'Military crate' },
+  { key: 'crate.normal2', kind: 'crate', label: 'Crate' },
+  { key: 'crate.elite', kind: 'crate', label: 'Elite crate' },
+  { key: 'crate.tools', kind: 'crate', label: 'Tool box' },
+  { key: 'crate.hackable', kind: 'crate', label: 'Locked crate (hackable)' },
+  { key: 'supply.drop', kind: 'crate', label: 'Supply drop' },
+  { key: 'barrel.loot', kind: 'crate', label: 'Loot barrel' },
+  { key: 'npc.scientist', kind: 'npc', label: 'Scientist' },
+  { key: 'npc.scientist.heavy', kind: 'npc', label: 'Heavy scientist' },
+  { key: 'npc.scientist.tethered', kind: 'npc', label: 'Scientist (stays put)' },
+  { key: 'npc.bandit.guard', kind: 'npc', label: 'Bandit guard' },
+]
+
+/** The plugin's refusals a second attempt would repeat. Anything else is left to core's default. */
+const PERMANENT = new Set([
+  'events-disabled',
+  'malformed',
+  'unknown-prefab',
+  'out-of-range',
+  'no-monument',
+  'off-map',
+  'zonemanager-missing',
+])
+
+const BUDGETS = [
+  {
+    id: 'rust.prefabs',
+    label: 'Crates placed',
+    unit: 'crates',
+    description: 'Crates, barrels and supply drops an event puts in the world. Counted per server a run reaches.',
+  },
+  {
+    id: 'rust.npcs',
+    label: 'NPCs placed',
+    unit: 'NPCs',
+    description: 'Scientists and guards an event puts in the world — its own dial, so fights can be capped apart from loot (D89).',
+  },
+  {
+    id: 'rust.zone.minutes',
+    label: 'Zone time',
+    unit: 'minutes',
+    description: 'How long the zones an event opens stand, added up. Every zone declares its minutes, and the game erases it when they run out (D96).',
+  },
+]
+
+/** A number param, or undefined when left blank. */
+function num(raw) {
+  if (raw === undefined || raw === null || raw === '') return undefined
+  const value = Number(raw)
+  return Number.isFinite(value) ? value : NaN
+}
+
+/**
+ * Where a step puts its thing — a monument plus an offset, or raw coordinates,
+ * and exactly one of the two (D87) — and which server that is on.
+ *
+ * A monument value carries its server (`srv-a/harbor_1#2`, D93), so a monument
+ * step needs no `server`; one that gives both must agree. Raw coordinates name
+ * nothing, so they need `server`. Every refusal is `retry: false`: the second
+ * attempt has the same params.
+ */
+function location(params) {
+  const monument = String(params.monument || '').trim()
+  const x = num(params.x)
+  const z = num(params.z)
+  const y = num(params.y)
+  const byCoords = x !== undefined || z !== undefined
+  let serverId = String(params.server || '').trim()
+
+  if (Boolean(monument) === byCoords) {
+    return { ok: false, error: 'a location is a monument or x and z, and exactly one of them' }
+  }
+
+  if (monument) {
+    const slash = monument.indexOf('/')
+    if (slash <= 0 || slash === monument.length - 1) {
+      return { ok: false, error: `"${monument}" is not a monument — pick one from the list, as server/monument` }
+    }
+    const onServer = monument.slice(0, slash)
+    if (serverId && serverId !== onServer) {
+      return { ok: false, error: `that monument is on ${onServer}, not ${serverId}` }
+    }
+    serverId = onServer
+
+    const offsetX = num(params.offsetX) ?? 0
+    const offsetZ = num(params.offsetZ) ?? 0
+    if (Number.isNaN(offsetX) || Number.isNaN(offsetZ)) return { ok: false, error: 'an offset is a number of metres' }
+    if (Math.hypot(offsetX, offsetZ) > MAX_OFFSET) {
+      return { ok: false, error: `an offset from a monument is at most ${MAX_OFFSET} m` }
+    }
+
+    return { ok: true, serverId, wire: { monument: monument.slice(slash + 1), offsetX, offsetZ } }
+  }
+
+  if (x === undefined || z === undefined || Number.isNaN(x) || Number.isNaN(z)) {
+    return { ok: false, error: 'coordinates need both x and z, as numbers' }
+  }
+  if (Number.isNaN(y)) return { ok: false, error: 'y is a number of metres, or left blank for the ground' }
+  if (!serverId) return { ok: false, error: 'coordinates do not say which server — pick one' }
+
+  return { ok: true, serverId, wire: { x, z, ...(y === undefined ? {} : { y }) } }
+}
+
+/** `<serverId>:<id>` — see the header. */
+const refOf = (serverId, id) => `${serverId}:${id}`
+
+/** A ref split back into its server and id, at the FIRST colon (a server id has none). */
+function splitRef(ref) {
+  const text = String(ref || '')
+  const colon = text.indexOf(':')
+  return colon <= 0 ? { serverId: null, id: text } : { serverId: text.slice(0, colon), id: text.slice(colon + 1) }
+}
+
+/**
+ * A zone the plugin erased at its deadline (`world.expired`, PLAN_FIXES F13, F14).
+ *
+ * D96 said the website maps this frame to nothing and learns of it through
+ * `reconcile` and `revert`. The first player walk showed what that costs: three
+ * zones expired in the game on time and sat `confirmed` on the run console until
+ * the runs were cancelled, when teardown found them "already gone" and called that
+ * a success. D170 changed it, and D183 put the record in core: the resource row is
+ * marked `expired`.
+ *
+ * Until protocol 13 this frame could not be recognised at all — the plugin wrote
+ * the zone's kind over the frame's — so `what` is new with it, and a frame without
+ * an `id` names nothing to expire.
+ */
+function expired(serverId, frame) {
+  if (!serverId || !frame || frame.id === undefined || frame.id === null || frame.id === '') return false
+  try {
+    core.expireEvent({ kind: OWNED_KIND, ref: refOf(serverId, String(frame.id)) })
+  } catch (err) {
+    log.warn('could not tell core a zone expired', { server: serverId, id: frame.id, error: err.message })
+    return false
+  }
+  return true
+}
+
+/** Resources grouped by the server each one is on. */
+function byServer(resources) {
+  const groups = new Map()
+  for (const resource of resources || []) {
+    const serverId = (resource.payload && resource.payload.serverId) || splitRef(resource.ref).serverId
+    if (!groups.has(serverId)) groups.set(serverId, [])
+    groups.get(serverId).push(resource)
+  }
+  return groups
+}
+
+/** A transport failure, classified. Only a missing configuration is one waiting cannot fix. */
+function transportFailure(server, result, what) {
+  const permanent = result.status === 'not-configured' || result.status === 'no-token'
+  return { ok: false, ...(permanent ? { retry: false } : {}), error: transportError(server, result, what) }
+}
+
+/**
+ * Send one world write and file what came back.
+ *
+ * One resource per id — per crate, per NPC, per zone — like `module-uo`'s one
+ * per serial, so a group half of which players looted reconciles per crate
+ * rather than all or nothing.
+ */
+async function place(server, send, body, what) {
+  const result = await send(server, body)
+  if (!result.ok) return transportFailure(server, result, what)
+
+  const data = result.data || {}
+  if (data.kind !== 'world.ok') {
+    return {
+      ok: false,
+      ...(PERMANENT.has(data.reason) ? { retry: false } : {}),
+      error: pluginError(data, `${server.name || server.id} refused the ${what}`),
+    }
+  }
+
+  const placed = Array.isArray(data.placed) ? data.placed : []
+  return {
+    ok: true,
+    resources: placed.map((row) => ({
+      kind: OWNED_KIND,
+      ref: refOf(server.id, row.id),
+      payload: {
+        serverId: server.id,
+        what: row.kind,
+        ...(row.prefab ? { prefab: row.prefab } : {}),
+        ...(row.name ? { name: row.name } : {}),
+      },
+    })),
+    ...(data.repeat ? { detail: { repeat: true, note: 'answered from the first attempt; nothing new was placed' } } : {}),
+  }
+}
+
+/**
+ * Give back what a step made.
+ *
+ * **No idempotency key goes with it.** `module-uo` shipped exactly that
+ * mistake: its despawn carried the key the spawn went out under, the shard
+ * recognised a repeat of the DO and answered with the spawn's reply, and every
+ * teardown was a no-op that reported success (MODULE_API §2.4). A repeated
+ * revert is safe here without one — the second finds everything `gone`.
+ *
+ * The one case the key IS for is the lost answer: core knows a dispatch went
+ * out under it and never learned what it made, so `resources` is empty. The
+ * step's server is not known then either — it was a param, and params do not
+ * reach `revert` — so every enabled server is asked to give back whatever this
+ * run placed under that key. A server that cannot be asked leaves the row
+ * visible rather than guessing.
+ */
+async function revert({ runId, resources, idempotencyKey }) {
+  const failed = []
+  const errors = []
+
+  if (!resources || resources.length === 0) {
+    if (!idempotencyKey) return { ok: true }
+    for (const server of await servers.listForPolling()) {
+      const result = await client.worldRevert(server, { runId: String(runId), key: idempotencyKey })
+      if (!result.ok) errors.push(transportError(server, result, 'revert'))
+      else if (!result.data || result.data.kind !== 'world.ok') errors.push(pluginError(result.data, `${server.name || server.id} refused the revert`))
+    }
+    return errors.length ? { ok: false, error: errors.join('; ') } : { ok: true }
+  }
+
+  for (const [serverId, group] of byServer(resources)) {
+    const found = await serverFor(serverId)
+    if (!found.ok) {
+      failed.push(...group.map((r) => r.ref))
+      errors.push(found.error)
+      continue
+    }
+
+    const result = await client.worldRevert(found.server, {
+      runId: String(runId),
+      ids: group.map((r) => splitRef(r.ref).id),
+    })
+
+    if (!result.ok) {
+      failed.push(...group.map((r) => r.ref))
+      errors.push(transportError(found.server, result, 'revert'))
+      continue
+    }
+
+    // **A 200 is not a success on this bridge** — a refusal comes back as one,
+    // carrying `world.error` (`not-ready` while the world is still loading).
+    // Read as success it would mark every row reverted while the game still
+    // held every crate.
+    if (!result.data || result.data.kind !== 'world.ok') {
+      failed.push(...group.map((r) => r.ref))
+      errors.push(pluginError(result.data, `${found.server.name || found.server.id} refused the revert`))
+      continue
+    }
+
+    // `gone` is not reported: a crate a player looted is the point of having
+    // placed it. `refused` IS — the plugin found something there that this run
+    // did not make, and nothing will ever remove it through this path.
+    const refused = new Set(((result.data && result.data.refused) || []).map(String))
+    for (const r of group) if (refused.has(splitRef(r.ref).id)) failed.push(r.ref)
+  }
+
+  if (!failed.length) return { ok: true }
+  if (failed.length === resources.length && errors.length) return { ok: false, error: errors.join('; ') }
+  return { ok: true, failed }
+}
+
+/**
+ * Which of these does the world still hold?
+ *
+ * The plugin LOOKS for each one, by net id or zone id. A server that cannot be
+ * asked has said nothing, so its resources are all reported in force — "I do
+ * not know" is never "it is gone" (MODULE_API §1.1).
+ */
+async function reconcile({ runId, resources }) {
+  const inForce = []
+
+  for (const [serverId, group] of byServer(resources)) {
+    const found = await serverFor(serverId)
+    const result = found.ok ? await client.worldOwned(found.server, { runId: String(runId) }) : null
+
+    if (!result || !result.ok || !result.data || !Array.isArray(result.data.owned)) {
+      inForce.push(...group.map((r) => r.ref))
+      continue
+    }
+
+    const held = new Set(result.data.owned.map((row) => String(row.id)))
+    for (const r of group) if (held.has(splitRef(r.ref).id)) inForce.push(r.ref)
+  }
+
+  return { ok: true, inForce }
+}
+
+/** The location params both verbs share, so two declarations cannot drift apart. */
+const LOCATION_PARAMS = [
+  {
+    name: 'monument',
+    type: 'string',
+    required: false,
+    example: 'main/powerplant_1',
+    source: 'rust.options.monuments',
+    description: 'Where, by monument. Give this OR x and z. Names the server too.',
+  },
+  {
+    name: 'offsetX',
+    type: 'float',
+    required: false,
+    example: 20,
+    description: `Metres east of the monument's centre (negative is west). Up to ${MAX_OFFSET} m from it in all.`,
+  },
+  {
+    name: 'offsetZ',
+    type: 'float',
+    required: false,
+    example: -15,
+    description: "Metres north of the monument's centre (negative is south).",
+  },
+  {
+    name: 'server',
+    type: 'string',
+    required: false,
+    example: 'main',
+    source: 'rust.options.servers',
+    description: 'Which server, when the location is coordinates. A monument already says.',
+  },
+  { name: 'x', type: 'float', required: false, example: -604, description: 'World x, instead of a monument.' },
+  { name: 'z', type: 'float', required: false, example: -342, description: 'World z, instead of a monument.' },
+  {
+    name: 'y',
+    type: 'float',
+    required: false,
+    example: 30,
+    description: 'Height. Left blank, the ground at x and z.',
+  },
+]
+
+const WORLD_COMMON = {
+  // Something appears where there was nothing. §K puts the default-off line
+  // between `inspect` and `change`, so an operator switches these on
+  // deliberately — the right consent for an unattended change to a live world.
+  risk: 'change',
+  reversible: 'ledger',
+  version: 1,
+  budgetMs: BUDGET_MS,
+  revert,
+  reconcile,
+}
+
+/**
+ * One placing verb per KIND (D97), not one verb for both.
+ *
+ * Core learns which caps an action accepts by pricing that action's declared
+ * EXAMPLES once, and drops a dimension priced at zero. So a single verb whose
+ * cost moved between `rust.prefabs` and `rust.npcs` by its `prefab` param could
+ * only ever show the operator the crates cap, and D89's separate dial for fights
+ * would be unreachable. Two verbs, each pricing exactly one dimension, is also
+ * what lets the switchboard allow crates and leave NPCs off.
+ */
+function placeVerb({ id, kind, budget, max, label, description, source, example }) {
+  const noun = kind === 'npc' ? 'NPCs' : 'crates'
+  return {
+    ...WORLD_COMMON,
+    id,
+    label,
+    description,
+    cost: (p) => ({ [budget]: Math.max(0, Math.round(Number(p.count) || 0)) }),
+    params: [
+      {
+        name: 'prefab',
+        type: 'string',
+        required: true,
+        example,
+        source,
+        description: `Which of the server's own ${noun} to place.`,
+      },
+      {
+        name: 'count',
+        type: 'int',
+        required: true,
+        example: 3,
+        description: `How many — 1 to ${max} at a time.`,
+      },
+      {
+        name: 'spread',
+        type: 'float',
+        required: false,
+        example: 10,
+        description: `How widely to scatter a group, up to ${MAX_SPREAD} m. Left blank, 10.`,
+      },
+      ...LOCATION_PARAMS,
+    ],
+
+    async perform({ runId, idempotencyKey, params, verify }) {
+      const known = PLACEABLE.find((x) => x.key === String(params.prefab || '').trim())
+      if (!known || known.kind !== kind) {
+        return { ok: false, retry: false, error: `"${params.prefab}" is not one of the ${noun} a Rust server places for events` }
+      }
+
+      const count = Number(params.count)
+      if (!Number.isInteger(count) || count < 1 || count > max) {
+        return { ok: false, retry: false, error: `place 1 to ${max} ${noun} at a time, and "${params.count}" is not that` }
+      }
+
+      const spread = num(params.spread)
+      if (Number.isNaN(spread) || (spread !== undefined && (spread < 0 || spread > MAX_SPREAD))) {
+        return { ok: false, retry: false, error: `a scatter is 0 to ${MAX_SPREAD} m, not "${params.spread}"` }
+      }
+
+      const where = location(params)
+      if (!where.ok) return { ok: false, retry: false, error: where.error }
+
+      const found = await serverFor(where.serverId)
+      if (!found.ok) return found
+
+      if (verify) return { ok: true }
+
+      return place(
+        found.server,
+        client.worldPlace,
+        {
+          runId: String(runId),
+          key: idempotencyKey,
+          prefab: known.key,
+          count,
+          ...(spread === undefined ? {} : { spread }),
+          ...where.wire,
+        },
+        known.label.toLowerCase(),
+      )
+    },
+  }
+}
+
+const ACTIONS = [
+  {
+    ...WORLD_COMMON,
+    id: 'rust.zone.open',
+    label: 'Open a zone',
+    description:
+      'A ZoneManager zone at a monument or a point, for a set number of minutes. The game erases it when they run out, even if this site is down; teardown erases it sooner.',
+    cost: (p) => ({ 'rust.zone.minutes': Math.max(0, Math.round(Number(p.minutes) || 0)) }),
+    params: [
+      ...LOCATION_PARAMS,
+      {
+        name: 'radius',
+        type: 'float',
+        required: true,
+        example: 40,
+        description: `How far the zone reaches, ${ZONE_MIN_RADIUS} to ${ZONE_MAX_RADIUS} m.`,
+      },
+      {
+        name: 'minutes',
+        type: 'int',
+        required: true,
+        example: 120,
+        description: `How long it stands, up to ${ZONE_MAX_MINUTES} (seven days). Counted against zone time.`,
+      },
+      { name: 'name', type: 'string', required: false, example: 'Airfield brawl', description: 'What the zone is called.' },
+    ],
+
+    async perform({ runId, idempotencyKey, params, verify }) {
+      const where = location(params)
+      if (!where.ok) return { ok: false, retry: false, error: where.error }
+
+      const radius = Number(params.radius)
+      if (!Number.isFinite(radius) || radius < ZONE_MIN_RADIUS || radius > ZONE_MAX_RADIUS) {
+        return { ok: false, retry: false, error: `a zone's radius is ${ZONE_MIN_RADIUS} to ${ZONE_MAX_RADIUS} m, not "${params.radius}"` }
+      }
+
+      const minutes = Number(params.minutes)
+      if (!Number.isInteger(minutes) || minutes < 1 || minutes > ZONE_MAX_MINUTES) {
+        return { ok: false, retry: false, error: `a zone stands for 1 to ${ZONE_MAX_MINUTES} minutes, not "${params.minutes}"` }
+      }
+
+      const found = await serverFor(where.serverId)
+      if (!found.ok) return found
+
+      // The dry run stops here, and has checked everything it can without the
+      // game. It does not ask whether the monument exists: a step authored for
+      // next wipe's map would fail every dry run until the wipe.
+      if (verify) return { ok: true }
+
+      return place(
+        found.server,
+        client.worldZone,
+        {
+          runId: String(runId),
+          key: idempotencyKey,
+          ...where.wire,
+          radius,
+          holdMs: minutes * 60000,
+          ...(params.name ? { name: String(params.name).slice(0, 64) } : {}),
+        },
+        'zone',
+      )
+    },
+  },
+  placeVerb({
+    id: 'rust.crate.place',
+    kind: 'crate',
+    budget: 'rust.prefabs',
+    max: MAX_CRATES,
+    label: 'Place crates',
+    description:
+      'Crates, barrels or a supply drop at a monument or a point, scattered a little. Taken away at teardown; a crate somebody looted is simply gone.',
+    source: 'rust.options.crates',
+    example: 'crate.elite',
+  }),
+  placeVerb({
+    id: 'rust.npc.place',
+    kind: 'npc',
+    budget: 'rust.npcs',
+    max: MAX_NPCS,
+    label: 'Place NPCs',
+    description:
+      'Scientists or guards at a monument or a point. Taken away at teardown. The game does not save NPCs, so a restart ends them; the ledger then says so.',
+    source: 'rust.options.npcs',
+    example: 'npc.scientist',
+  }),
+]
+
+const OPTION_SOURCES = [
+  {
+    // Every server's map, live. A procedural map changes at every wipe, so a
+    // cached list would offer monuments that are not there any more.
+    id: 'rust.options.monuments',
+    label: 'Monuments',
+    description: "Each server's monuments on its current map. A kind that repeats is numbered, #1 first (D93).",
+    searchable: true,
+    async resolve({ q } = {}) {
+      const term = String(q || '').trim().toLowerCase()
+      const answers = await perServer((server) => client.worldMonuments(server))
+      const rows = []
+      for (const { server, result } of answers) {
+        for (const m of (result.data && result.data.monuments) || []) {
+          if (!m || !m.value) continue
+          const label = `${m.label}${m.of > 1 ? ` #${m.instance}` : ''}${m.grid ? ` · ${m.grid}` : ''}`
+          const value = `${server.id}/${m.value}`
+          if (term && !value.toLowerCase().includes(term) && !label.toLowerCase().includes(term)) continue
+          rows.push({ value, label, group: server.name || server.id })
+        }
+      }
+      return bounded(rows, 'rust.options.monuments')
+    },
+  },
+  // From the mirror, so both answer with every server off (the field they fill
+  // must never be taken away by an outage, MODULE_API §2.4). One per verb (D97).
+  ...['crate', 'npc'].map((kind) => ({
+    id: kind === 'npc' ? 'rust.options.npcs' : 'rust.options.crates',
+    label: kind === 'npc' ? 'NPCs' : 'Crates',
+    description: `The ${kind === 'npc' ? 'NPCs' : 'crates'} a Rust server places for events.`,
+    async resolve() {
+      return PLACEABLE.filter((p) => p.kind === kind).map((p) => ({ value: p.key, label: p.label }))
+    },
+  })),
+]
+
+// ── The watch (§11.1) ───────────────────────────────────────────────────────
+//
+// Core asks the module what the world still holds once, at its own boot, and
+// otherwise waits to be told. A game that restarted or wiped under a running
+// event is the moment to tell it: the boot id changes on a restart, the wipe
+// id on a wipe, and neither changes on a sidecar reconnect — which loses
+// nothing and must not provoke a sweep.
+
+const lastSeen = new Map()
+
+/**
+ * Note a server's identity as the refresh saw it, and ask core to reconcile when
+ * it moved — once its world is loaded. The first sighting after this module boots is a baseline, not a
+ * change: core's own boot reconcile already covered it.
+ */
+function observeServer(serverId, { bootId, wipeId, worldReady } = {}) {
+  if (!serverId || (!bootId && !wipeId)) return false
+
+  // **Not until the world is loaded** (§28.6). The plugin connects before the
+  // save loads, so the new boot id arrives while every crate still looks gone;
+  // asked then, reconcile would orphan the lot. The plugin says when it is
+  // ready, and the change is noticed on that hello instead. An older plugin
+  // that never says is taken as ready, as it always was.
+  if (worldReady === false) return false
+
+  const previous = lastSeen.get(serverId)
+  lastSeen.set(serverId, { bootId: bootId || null, wipeId: wipeId || null })
+  if (!previous) return false
+
+  const restarted = Boolean(bootId && previous.bootId && bootId !== previous.bootId)
+  const wiped = Boolean(wipeId && previous.wipeId && wipeId !== previous.wipeId)
+  if (!restarted && !wiped) return false
+
+  log.info('game changed under the events ledger; asking core to reconcile', {
+    server: serverId,
+    ...(restarted ? { restarted: { from: previous.bootId, to: bootId } } : {}),
+    ...(wiped ? { wiped: { from: previous.wipeId, to: wipeId } } : {}),
+  })
+
+  try {
+    Promise.resolve(core.reconcileEvents()).catch((err) => log.warn('reconcile failed', { error: err.message }))
+  } catch (err) {
+    log.warn('reconcile failed', { error: err.message })
+  }
+  return true
+}
+
+/** For tests. */
+function resetWatch() {
+  lastSeen.clear()
+}
+
+module.exports = {
+  BUDGET_MS,
+  MAX_CRATES,
+  MAX_NPCS,
+  ZONE_MAX_MINUTES,
+  PLACEABLE,
+  BUDGETS,
+  ACTIONS,
+  OPTION_SOURCES,
+  location,
+  splitRef,
+  revert,
+  reconcile,
+  observeServer,
+  expired,
+  resetWatch,
+}

server/index.js

@@ -50,7 +50,17 @@ module.exports = function register(ctx, api) {
   const publicRust = require('./router/public/rust.router')
   const playerRust = require('./router/player/rust.router')
   const adminRust = require('./router/admin/rust.router')
+  const usersRust = require('./router/admin/usersRust.router')
+  const teamProvider = require('./model/clans/teamProvider')
+  const { TRIGGERS } = require('./engagement/triggers')
+  const { STREAMS } = require('./engagement/streams')
+  const { AUDIENCES } = require('./engagement/audiences')
+  const seeds = require('./engagement/seeds')
+  const eventLeases = require('./eventLeases')
+  const eventWorld = require('./eventWorld')
+  const eventRewards = require('./eventRewards')
   const boot = require('./boot')
+  const commands = require('./commands')
   /* eslint-enable global-require */
 
   const log = core.logger()
@@ -78,6 +88,57 @@ module.exports = function register(ctx, api) {
     admin: { '/rust': adminRust },
   })
 
+  // R13's first extension slot (§2.4). Core declares `admin.users.detail` on
+  // `/api/v1/admin/users/:id` and we fill it; the router receives the parent's
+  // `req.params.id` through `mergeParams`. Core's own routes on the resource are
+  // declared before the slot is mounted, so core wins any path conflict — it owns
+  // the user, and this module owns what it can say about one.
+  //
+  // **It is declared twice, in two different places, on purpose.** This call is
+  // the SERVER half and `module.json`'s `extensions` array is held against it by
+  // the loader. The CLIENT half is `registry.registerExtension(ID,
+  // 'admin.users.detail', …)` in `entry.jsx` and must NOT appear in that array —
+  // phase 1 found that the hard way with `site.footer.status`, which is a client
+  // slot and fails the load outright when named there.
+  api.registerExtension('admin.users.detail', usersRust)
+
+  // Teams (R5, PLAN.md §24). A first-party Rust clan is a Team, and this module
+  // becomes the deployment's one authoritative source of them. Core asks; the
+  // provider answers from the clan boards (`model/clans`), and refuses rather
+  // than guessing whenever no board is current.
+  //
+  // **One provider per deployment**, so a site running module-uo as well cannot
+  // have both — the second registration is a collision core reports against the
+  // module that made it. That is core's rule and a real constraint on a mixed
+  // UO + Rust site; it is recorded in §24 rather than worked around here.
+  api.registerTeamProvider(teamProvider)
+
+  // Notifications and engagement (R7, PLAN.md §25). Four registrations that are
+  // one decision, because they only mean something together:
+  //
+  //   triggers   what can happen, what a template may say about it, and the
+  //              widest audience a rule on it may EVER have — the security
+  //              boundary; core refuses a rule that widens a ceiling
+  //   streams    which of those may reach a phone. Core pushes an engagement
+  //              rule only to devices subscribed to a stream of the SAME id, so
+  //              a trigger missing here can never buzz anybody (D65)
+  //   audiences  named sets of people over this module's data, for an operator
+  //              to point a rule at; each answers user ids and nothing else
+  //   seeds      the two bodies worth writing, and one disabled rule group per
+  //              family — installing this module mails nobody
+  //
+  // What fires them is `engagement/emit.js`, off the ingest cursor and the
+  // refresh. Registration is a claim, not a call: nothing here touches the
+  // database, and the seeds are written by core after the schema is up.
+  //
+  // The announce leg arrived with phase 13b (D62, D104), when there was a chat
+  // verb to deliver through; it is registered below with the rewards. There is
+  // still no post hook: nothing in game mirrors a post as state.
+  api.registerEventTriggers(TRIGGERS)
+  api.registerNotificationStreams(STREAMS)
+  api.registerAudiences(AUDIENCES)
+  api.registerEngagementSeeds({ templates: seeds.TEMPLATES, ruleGroups: seeds.RULE_GROUPS })
+
   // The lifecycle hooks (§2.5). `onBoot` runs after core's schema, after this
   // module's schema fragment, and BEFORE the HTTP listener binds — so a module
   // that must not serve traffic until it has warmed a cache gets that for free.
@@ -90,16 +151,59 @@ module.exports = function register(ctx, api) {
   api.onBoot(boot.onBoot)
   api.onShutdown(boot.onShutdown)
 
-  // Everything else this module will register — the Team provider, the event
-  // triggers and audiences, the engagement seeds, the four event catalogues, the
-  // notification streams, the slash commands and the two extension slots — is
-  // deliberately absent. Each arrives with the phase that has something real to
-  // put in it. A registration with nothing behind it is worse than a missing one:
-  // a declared trigger nothing emits and a declared slot nothing fills are both
-  // surfaces an operator can configure and then wait on.
+  // The leases (PLAN.md §27, protocol 8): what an event may BORROW on a server
+  // and must give back. Core's `core.lease` is the verb; these are the values it
+  // may name and the four callables each ships. Every lease is targeted and the
+  // target names the server (D73), which is how one value on one server gets
+  // exactly one holder without core learning what a server is.
+  //
+  // The option sources are the three targets' own (D78).
+  api.registerEventLeases(eventLeases.LEASES)
+
+  // The world verbs (PLAN.md §28, protocol 9): what an event MAKES and gives
+  // back — a zone, crates, NPCs — and the budgets that price them, each declared
+  // beside the verb that spends it (D79, D89). A lease spends none of them.
+  //
+  // The rewards (PLAN.md §29, protocol 10) join them: the tally, the kit reward
+  // and the chat line, with the two budgets they spend. Registered in the same
+  // calls' neighbours, not merged into eventWorld's arrays, so each file keeps
+  // its own statement of what it declares.
+  api.registerEventBudgets([...eventWorld.BUDGETS, ...eventRewards.BUDGETS])
+  api.registerEventActions([...eventWorld.ACTIONS, ...eventRewards.ACTIONS])
+
+  // News in game chat (D104). Core enqueues every registered leg for every
+  // published post, so the leg itself sends only to the servers whose switch an
+  // operator turned on — off by default, and a server that is down is skipped.
+  api.registerAnnounceLeg(eventRewards.LEG)
+
+  // ONE call for every option source: core takes a batch once, as this module's
+  // complete statement, and refuses a second.
+  api.registerEventOptionSources([
+    ...eventLeases.OPTION_SOURCES,
+    ...eventWorld.OPTION_SOURCES,
+    ...eventRewards.OPTION_SOURCES,
+  ])
+
+  // The slash commands (phase 16, R11). The handlers run HERE, in the website
+  // process; the bot pulls the definitions and dispatches each call back. Every
+  // command is `access: 'everyone'` and resolves its own audience gate inside the
+  // handler, and every answer narrower than public is sent to the caller alone
+  // (D127) — see `commands/common.js`.
+  api.registerSlashCommands(commands)
 
   log.info('registered', {
     version: require('../module.json').version,
     routes: 'public:/rust player:/rust admin:/rust',
+    extensions: 'admin.users.detail',
+    teams: 'first-party clans',
+    triggers: TRIGGERS.length,
+    streams: STREAMS.length,
+    audiences: AUDIENCES.length,
+    leases: eventLeases.LEASES.length,
+    actions: eventWorld.ACTIONS.length + eventRewards.ACTIONS.length,
+    budgets: eventWorld.BUDGETS.length + eventRewards.BUDGETS.length,
+    announceLeg: eventRewards.LEG.leg,
+    commands: commands.map((cmd) => cmd.name).join(' '),
+    optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length + eventRewards.OPTION_SOURCES.length,
   })
 }

server/ingest.js

@@ -33,7 +33,14 @@
 
 const core = require('./core')
 
+const clans = require('./model/clans/clans.model')
+const configDb = require('./model/config/config.db')
+const configModel = require('./model/config/config.model')
 const db = require('./model/events/events.db')
+const engagement = require('./engagement/emit')
+const eventWorld = require('./eventWorld')
+const links = require('./model/links/links.model')
+const permissionsDb = require('./model/permissions/permissions.db')
 const sidecar = require('./sidecarClient')
 
 const log = core.logger('ingest')
@@ -61,7 +68,7 @@ const MAX_BATCHES_PER_TICK = 10
  * the alternative is losing the one copy of an event the next version will know
  * how to read.
  */
-async function apply(serverId, item) {
+async function apply(serverId, item, server = null) {
   const frame = (item && item.frame) || {}
   const kind = item.kind || frame.kind
   const wipeId = frame.wipeId || null
@@ -79,6 +86,12 @@ async function apply(serverId, item) {
     raw: frame,
   })
 
+  // What core's engagement engine is told (PLAN.md §25). BEFORE the frame is
+  // applied, because applying a disband deletes the roster the notification is
+  // for. Never throws, and does not hold the cursor on core: `onEvent` resolves
+  // who a frame is about and hands it over, and delivery is core's own time.
+  if (server) await engagement.onEvent(server, item)
+
   const at = { serverId, wipeId, steamId: frame.steamId }
 
   switch (kind) {
@@ -144,6 +157,104 @@ async function apply(serverId, item) {
       await db.touchPlayer(frame.steamId, frame.name || null)
       break
 
+    // ── Protocol 3: the one frame that changes something other than a counter ──
+    //
+    // `/unlink` in game severs the site's link, and it is the only way out of a
+    // link on the wrong account: the site REFUSES to move a Steam id another
+    // website account already holds (D23), so without this a player who linked
+    // while signed in as the wrong account would need staff.
+    //
+    // It arrives here rather than through a route because the plugin has nothing
+    // to delete — the site is the author of record and the game holds no link —
+    // so `/unlink` is the game reporting what the player asked for, applied off
+    // the feed like every other frame.
+    //
+    // **The authority is the Steam account itself.** Whoever is connected to the
+    // game as it is who it is, which is a stronger proof of ownership than the
+    // site can obtain any other way, so this is not scoped by website user.
+    case 'account.unlinked':
+      await db.touchPlayer(frame.steamId, frame.name || null)
+      await links.unlinkFromGame(frame.steamId)
+      break
+
+    // Stored and counted as a sighting, nothing more. The code is deliberately
+    // NOT on this frame — it travels through the player — so there is nothing
+    // here to redeem and no pending state for the site to hold. It exists so an
+    // operator can see linking being used at all.
+    case 'account.link.requested':
+      await db.touchPlayer(frame.steamId, frame.name || null)
+      break
+
+    // ── Protocol 4: somebody changed the permission store, and it was not us ──
+    //
+    // The plugin raises this only for writes it did not make itself — its own
+    // sync suppresses the hooks while it applies (PROTOCOL.md §10.4). What
+    // arrives here is therefore a hand edit, a console command, or another
+    // plugin granting something.
+    //
+    // **It is a reason to reconcile, not the reconciliation.** This frame cannot
+    // say whether the change is foreign: only the desired set can, and that
+    // comparison happens in the sync. So the server is marked dirty and the next
+    // tick produces the authoritative answer — which means a hook that stops
+    // firing on a framework upgrade costs latency and nothing else. The audit
+    // interval finds the same drift within fifteen minutes either way.
+    case 'perm.drift':
+      await permissionsDb.markDirty(serverId)
+      break
+
+    // ── Protocol 13: a plugin loaded or unloaded (F8, D184) ─────────────────
+    //
+    // A grant for a plugin that was not loaded stays `unresolved` until that
+    // plugin comes back, and the first walk watched one land thirteen minutes
+    // late, on the fifteen-minute audit. The frame carries the permissions the
+    // plugin added or removed, and only a non-empty list is a reason to sync —
+    // a plugin that registers nothing cannot have changed what a grant resolves
+    // to. `perm.drift`'s posture: a reason, and the next tick (30 s) is the answer.
+    case 'plugin.loaded':
+    case 'plugin.unloaded':
+      if (Array.isArray(frame.permissions) && frame.permissions.length > 0) {
+        await permissionsDb.markDirty(serverId)
+      }
+      break
+
+    // ── Protocol 13: a zone reached its deadline (F13, F14, D170, D183) ──────
+    //
+    // Core records the run's resource row as `expired`. Not awaited: it is
+    // core's bookkeeping, fire-and-forget by contract.
+    case 'world.expired':
+      eventWorld.expired(serverId, frame)
+      break
+
+    // ── Protocol 13: how a configuration save's reload ended (F9, D179) ─────
+    //
+    // The save was answered before the reload finished and recorded as
+    // `reloading`; this is the rest of it. Only a row still `reloading` moves,
+    // so a replayed frame changes nothing, and one that arrives after the page
+    // gave up on it (`lost`) still lands — the audit row ends up true either way.
+    case 'config.outcome': {
+      const outcome = configModel.outcomeOf(frame)
+      if (outcome) await configDb.settleWrite(serverId, outcome)
+      break
+    }
+
+    // ── Protocol 6: first-party clans ──────────────────────────────────────
+    //
+    // Each one is told to core as it happens (`ctx.teams.publish`) and written
+    // to the clan's Team feed as a members-only line (D49). Neither is the
+    // record: the `clans` board the plugin re-sends a few seconds later is what
+    // the store is rebuilt from, so an event this module never saw costs a
+    // feed line and nothing else.
+    //
+    // No `touchPlayer` here, on purpose: it moves `last_seen`, and a kick is
+    // done TO somebody who may be offline. `model/clans` notes names without it.
+    case 'clan.created':
+    case 'clan.disbanded':
+    case 'clan.member.added':
+    case 'clan.member.left':
+    case 'clan.member.kicked':
+      await clans.applyEvent(serverId, frame)
+      break
+
     default:
       // Stored, not counted. Moderation frames, the server lifecycle, and
       // anything a newer protocol sends that this build does not understand.
@@ -191,7 +302,7 @@ async function ingestServer(server) {
 
     for (const item of items) {
       try {
-        await apply(server.id, item)
+        await apply(server.id, item, server)
         applied += 1
       } catch (err) {
         // One malformed event must not wedge a server's cursor for ever. It is
@@ -218,7 +329,11 @@ async function ingestServer(server) {
     if (!res.data.more) break
   }
 
-  if (applied > 0) log.info('ingested', { server: server.id, events: applied, cursor: since })
+  if (applied > 0) {
+    log.info('ingested', { server: server.id, events: applied, cursor: since })
+    // A leader can only change when something was applied. Never throws.
+    await engagement.checkLeader(server)
+  }
 
   return applied
 }
@@ -237,6 +352,22 @@ async function applyBoards(serverId, boards) {
   if (presence && Array.isArray(presence.players)) {
     await db.replacePresence(serverId, presence.players)
   }
+
+  // Clans only once the game has spoken at all. A sidecar that has never heard
+  // from its plugin holds no boards, and recording "no clan board" then would
+  // blame the plugin's protocol for a game server that is simply not up. Left
+  // alone, the stored board ages past fresh on its own, which is the true answer.
+  if (boards && boards['server.hello']) {
+    // Fenced: clans are the one board here that core's Teams depend on, and a
+    // failure applying them must cost the clans rather than the presence board
+    // above or the server state the caller writes next.
+    try {
+      await clans.applyBoard(serverId, boards.clans)
+      await clans.reofferActivity(serverId)
+    } catch (err) {
+      log.warn('could not apply the clan board', { server: serverId, error: err.message })
+    }
+  }
 }
 
 module.exports = { apply, applyBoards, ingestServer, BATCH, MAX_BATCHES_PER_TICK }

server/mapImages.js

@@ -0,0 +1,277 @@
+// ── The map's picture: noticing a new map and fetching it ─────────────────
+//
+// R9's first half, as the rig rewrote it (PLAN.md §30.0). The picture is not
+// extracted from anything: the game's Rust+ service already holds a JPEG of the
+// map in memory, and the plugin hands it over in 512 KiB slices. That changes
+// the one rule R9 carried over from the asset bridge, where a fetch was an
+// expensive extraction:
+//
+// **D110 — the site fetches the picture BY ITSELF the first time it sees a map
+// it does not have**, because reading the cache costs the game nothing. It is
+// triggered off the board poll (`boot.js`): a new boot, wipe, seed or world
+// size, or a server with no row at all, is a reason to ask `map.info`, and a
+// key or hash that differs from the row is a reason to fetch.
+//
+// **D109 — a render is never automatic.** A server with no Rust+ cache has no
+// picture until an admin presses Render now, which stalls that game for seconds
+// and is said so beside the button. The render answers at once and happens on a
+// later frame; this file then polls `map.info` until the picture exists and
+// fetches it like any other.
+//
+// Three rules the fetch keeps:
+//
+//   • **One fetch per server at a time**, held here. A second trigger while one
+//     runs is dropped, and an admin's Fetch again is told one is running.
+//   • **A fetch that straddles a map change is abandoned whole.** The plugin
+//     refuses a slice with `stale` when the key or hash moved, and the bytes are
+//     checked against the hash before anything is written: two maps are never
+//     spliced, and a half-fetched picture is never stored.
+//   • **A failure keeps the old row** and retries on a backoff. The page keeps
+//     drawing the last picture it had, which is still the right map until the
+//     key says otherwise.
+
+const crypto = require('crypto')
+
+const core = require('./core')
+
+const db = require('./model/map/map.db')
+const model = require('./model/map/map.model')
+const sidecar = require('./sidecarClient')
+
+const log = core.logger('map')
+
+/** Backoff after a failed fetch: 30 s doubling to 10 minutes. */
+const BACKOFF_MIN_MS = 30 * 1000
+const BACKOFF_MAX_MS = 10 * 60 * 1000
+
+/** How soon to ask again when the plugin is still hashing, or the world still loading. */
+const SOON_MS = 3000
+
+/** How long a render is watched for before this side gives up on it (a 6000 map stalls ~40 s). */
+const RENDER_WATCH_MS = 5 * 60 * 1000
+const RENDER_POLL_MS = 3000
+
+/** The first protocol whose plugin knows the map verbs. */
+const MAP_PROTOCOL = 11
+
+/** The most slices one picture may have: 16 MiB, MEDIUMBLOB's ceiling. */
+const MAX_CHUNKS = 32
+
+/**
+ * Per server: the observation last acted on, whether a fetch is running, and
+ * when the next try may happen. In memory, deliberately — a restart of the
+ * website forgets it and asks once more, which costs one `map.info`.
+ */
+const state = new Map()
+
+function stateOf(serverId) {
+  if (!state.has(serverId)) {
+    state.set(serverId, { sig: null, running: null, nextTryAt: 0, failures: 0, rendering: null, lastError: null })
+  }
+  return state.get(serverId)
+}
+
+/** What about a server makes its map worth asking about again. */
+const signature = ({ bootId, wipeId, seed, worldSize }) => [bootId, wipeId, seed, worldSize].map((v) => (v == null ? '' : String(v))).join('|')
+
+/**
+ * Called by every board poll for a CONNECTED server whose world is ready. Cheap
+ * when nothing moved: one map lookup and a string compare. When something did,
+ * it starts a fetch in the background and returns — the poll never waits on a
+ * picture.
+ */
+function observe(server, frame, now = Date.now()) {
+  if (!server || !frame || frame.worldReady === false) return
+  // The game link has no version handshake: a plugin older than protocol 11
+  // never answers `map.info`, and asking would cost a full reply timeout a try.
+  if (!(Number(frame.protocol) >= MAP_PROTOCOL)) return
+  const s = stateOf(server.id)
+  const sig = signature(frame)
+
+  if (s.running || now < s.nextTryAt) return
+  if (s.sig === sig) return
+
+  run(server, sig).catch((err) => log.warn('map fetch failed', { server: server.id, error: err.message }))
+}
+
+/**
+ * One fetch cycle. Resolves `{ ok, outcome, detail }`, never rejects in normal
+ * operation; the outcome words are what the admin card shows.
+ *
+ *   fetched    a new picture is stored
+ *   current    the stored picture is already this map's
+ *   none       the game has no picture; geometry stored so layers can be drawn
+ *   busy       another fetch is running (admin only)
+ *   failed     something did not answer; the old row is kept
+ */
+function run(server, sig = null, { force = false } = {}) {
+  const s = stateOf(server.id)
+  if (s.running) return Promise.resolve({ ok: false, outcome: 'busy', detail: 'a fetch is already running for this server' })
+
+  s.running = (async () => {
+    try {
+      const result = await fetchOnce(server, { force })
+      if (result.retrySoon) {
+        s.nextTryAt = Date.now() + SOON_MS
+        return result
+      }
+      if (result.ok) {
+        s.sig = sig
+        s.failures = 0
+        s.nextTryAt = 0
+        s.lastError = null
+      } else {
+        s.failures += 1
+        s.nextTryAt = Date.now() + Math.min(BACKOFF_MAX_MS, BACKOFF_MIN_MS * 2 ** (s.failures - 1))
+        s.lastError = result.detail || result.outcome
+      }
+      return result
+    } finally {
+      s.running = null
+    }
+  })()
+
+  return s.running
+}
+
+/** The plugin's refusal, as a sentence, or null when the answer was not one. */
+function refusal(res) {
+  if (!res.ok) return `the sidecar did not answer (${res.status})`
+  if (res.data && res.data.kind === 'map.error') return res.data.message || res.data.reason || 'refused'
+  return null
+}
+
+async function fetchOnce(server, { force }) {
+  const info = await sidecar.mapInfo(server)
+  const why = refusal(info)
+
+  if (why) {
+    // A world still loading is not a failure worth backing off for.
+    if (info.ok && info.data && info.data.reason === 'not-ready') return { ok: false, retrySoon: true, outcome: 'failed', detail: why }
+    return { ok: false, outcome: 'failed', detail: why }
+  }
+
+  const data = info.data || {}
+  if (data.hashing) return { ok: false, retrySoon: true, outcome: 'failed', detail: 'the plugin is still hashing the picture' }
+
+  const row = model.derive(server.id, data)
+  if (!row.mapKey) return { ok: false, outcome: 'failed', detail: 'map.info named no map' }
+
+  const stored = await db.getMeta(server.id)
+
+  if (row.source === 'none') {
+    // The same map with a picture already stored keeps it: nothing about the map
+    // changed, only where a picture would come from now. A different map, or no
+    // row at all, stores the geometry so the page can draw the layers.
+    if (stored && stored.mapKey === row.mapKey && stored.sha256) {
+      await db.putGeometry({ ...row, source: stored.source, width: Number(stored.width), height: Number(stored.height), background: stored.background })
+      return { ok: true, outcome: 'current', detail: 'the game has no picture now; the stored one is the same map' }
+    }
+    await db.putImage(row)
+    return { ok: true, outcome: 'none', detail: 'the game has no picture of its map; an admin can render one' }
+  }
+
+  if (!force && stored && stored.mapKey === row.mapKey && stored.sha256 === row.sha256) {
+    if (Number(stored.derivation) !== model.DERIVATION_VERSION || stored.source !== row.source) await db.putGeometry(row)
+    return { ok: true, outcome: 'current', detail: 'the stored picture is this map' }
+  }
+
+  const chunks = Number(data.chunks)
+  if (!Number.isInteger(chunks) || chunks < 1 || chunks > MAX_CHUNKS) {
+    return { ok: false, outcome: 'failed', detail: `the plugin described ${data.chunks} slices` }
+  }
+
+  const parts = []
+  for (let n = 0; n < chunks; n += 1) {
+    // eslint-disable-next-line no-await-in-loop
+    const res = await sidecar.mapChunk(server, { mapKey: row.mapKey, sha256: row.sha256, n })
+    const no = refusal(res)
+    if (no) {
+      // `stale` means the map moved under the fetch: start again soon rather
+      // than back off, because the next `map.info` describes the new one.
+      if (res.ok && res.data && res.data.reason === 'stale') return { ok: false, retrySoon: true, outcome: 'failed', detail: no }
+      return { ok: false, outcome: 'failed', detail: `slice ${n}: ${no}` }
+    }
+    if (!res.data || res.data.kind !== 'map.chunk' || Number(res.data.chunk) !== n || typeof res.data.data !== 'string') {
+      return { ok: false, outcome: 'failed', detail: `slice ${n} was not the slice asked for` }
+    }
+    parts.push(Buffer.from(res.data.data, 'base64'))
+  }
+
+  const bytes = Buffer.concat(parts)
+  const hash = crypto.createHash('sha256').update(bytes).digest('hex')
+
+  if (hash !== row.sha256 || (Number(data.bytes) > 0 && bytes.length !== Number(data.bytes))) {
+    return { ok: false, outcome: 'failed', detail: 'the picture did not match its own hash; nothing was stored' }
+  }
+
+  await db.putImage({ ...row, bytes })
+  log.info('map picture stored', { server: server.id, mapKey: row.mapKey, source: row.source, bytes: bytes.length })
+  return { ok: true, outcome: 'fetched', detail: `${bytes.length} bytes from ${row.source}` }
+}
+
+/**
+ * An admin's Render now (D109). Refused here when a render is already being
+ * watched; the plugin refuses the rest (a picture exists, the world is loading).
+ * On `accepted` the render is watched in the background: `map.info` is polled
+ * until its source is `rendered` — through a stall that makes the game answer
+ * nothing at all for its duration — and then fetched like any picture.
+ */
+async function render(server, actor) {
+  const s = stateOf(server.id)
+  if (s.rendering) return { ok: false, status: 409, message: 'A render is already running for this server.' }
+
+  const res = await sidecar.mapRender(server, { actor: actor || null })
+  const no = refusal(res)
+  if (no) {
+    const reason = res.ok && res.data ? res.data.reason : null
+    return { ok: false, status: reason === 'has-picture' || reason === 'busy' ? 409 : 502, message: no, reason }
+  }
+
+  s.rendering = { startedAt: Date.now() }
+  watchRender(server).catch((err) => log.warn('render watch failed', { server: server.id, error: err.message }))
+  return { ok: true, worldSize: res.data && res.data.worldSize, stallSeconds: model.renderStallSeconds(res.data && res.data.worldSize) }
+}
+
+async function watchRender(server) {
+  const s = stateOf(server.id)
+  const until = Date.now() + RENDER_WATCH_MS
+  try {
+    while (Date.now() < until) {
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise((resolve) => {
+        const t = setTimeout(resolve, RENDER_POLL_MS)
+        if (typeof t.unref === 'function') t.unref()
+      })
+      // eslint-disable-next-line no-await-in-loop
+      const info = await sidecar.mapInfo(server)
+      const data = info.ok && info.data ? info.data : null
+      if (!data || data.kind !== 'map.info') continue // the game is mid-stall and answering nothing
+      if (data.rendering) continue
+      if (data.source === 'none') {
+        s.lastError = 'the render finished without a picture — see rg.map on the server console'
+        return
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await run(server, null, { force: false })
+      return
+    }
+    s.lastError = 'the render did not finish within five minutes'
+  } finally {
+    s.rendering = null
+  }
+}
+
+/** For the admin card: what this side is doing about each server's picture. */
+function statusOf(serverId) {
+  const s = state.get(serverId)
+  if (!s) return { fetching: false, rendering: false, lastError: null }
+  return { fetching: Boolean(s.running), rendering: Boolean(s.rendering), lastError: s.lastError }
+}
+
+/** Test seam: forget everything. */
+function _reset() {
+  state.clear()
+}
+
+module.exports = { observe, run, render, statusOf, signature, MAX_CHUNKS, _reset }

server/mapLive.js

@@ -0,0 +1,58 @@
+// ── What moves on the map, asked for while somebody is looking ────────────
+//
+// D111: positions are request/reply, never a board. A board would run with
+// nobody looking and keep where everybody is at rest in the sidecar's database;
+// this asks `map.live` only when a page does, and keeps the answer IN MEMORY for
+// five seconds.
+//
+// **Any number of viewers cost one ask.** Every request inside the window is
+// served from the same answer, and a request that arrives while an ask is in
+// flight waits for that ask rather than starting a second — so the sidecar sees
+// at most one `map.live` per server per window, whoever and however many are
+// watching (§30.4 step 7).
+//
+// The cache holds EVERY layer, unfiltered; each viewer's answer is projected
+// from it by `model/map`. That is why it never leaves this process.
+
+const sidecar = require('./sidecarClient')
+const model = require('./model/map/map.model')
+
+/** serverId → { at, answer } for the last good answer, and { pending } while one is in flight. */
+const cache = new Map()
+
+/**
+ * One server's live answer, from the cache when it is fresh. Resolves `{ ok,
+ * data, status }` like every sidecar call; never rejects.
+ */
+async function live(server, now = Date.now) {
+  const hit = cache.get(server.id)
+  if (hit && hit.answer && now() - hit.at < model.LIVE_CACHE_MS) return hit.answer
+  if (hit && hit.pending) return hit.pending
+
+  const pending = (async () => {
+    const res = await sidecar.mapLive(server)
+    const refused = res.ok && res.data && res.data.kind === 'map.error'
+    const answer = res.ok && !refused
+      ? { ok: true, status: 'ok', data: res.data }
+      : { ok: false, status: refused ? res.data.reason || 'refused' : res.status, data: null }
+    // A failure is cached for the window too: a game that is down must not be
+    // asked once per viewer per poll while it stays down.
+    cache.set(server.id, { at: now(), answer })
+    return answer
+  })()
+
+  cache.set(server.id, { ...(hit || {}), pending })
+  try {
+    return await pending
+  } finally {
+    const entry = cache.get(server.id)
+    if (entry && entry.pending === pending) delete entry.pending
+  }
+}
+
+/** Test seam. */
+function _reset() {
+  cache.clear()
+}
+
+module.exports = { live, _reset }

server/model/clans/clans.db.js

@@ -0,0 +1,298 @@
+// ── SQL for first-party clans ─────────────────────────────────────────────
+//
+// Three tables (see `schema.sql`): the clans a board carried, their members, and
+// what this module knows about each server's board. Raw parameterised SQL, as
+// everywhere in this module; the model decides what any of it means.
+
+const core = require('../../core')
+
+const CLANS = 'rust_clans'
+const MEMBERS = 'rust_clan_members'
+const BOARDS = 'rust_clan_boards'
+const LINKS = 'rust_account_links'
+const PLAYERS = 'rust_players'
+const SERVERS = 'rust_servers'
+
+// ── Boards ─────────────────────────────────────────────────────────────────
+
+/** One server's board record, or null when it has never sent one. */
+async function getBoard(serverId) {
+  const rows = await core.query(
+    `SELECT server_id AS serverId, board_t AS boardT, seen_at AS seenAt, enabled, supported,
+            truncated, backend, reason, umod_clans AS umodClans, clan_count AS clanCount
+       FROM ${BOARDS} WHERE server_id = ?`,
+    [serverId],
+  )
+  return rows[0] || null
+}
+
+/** Every configured server beside its board record, which may be absent. */
+async function listBoards() {
+  return core.query(
+    `SELECT s.id AS serverId, s.name AS serverName, s.enabled AS serverEnabled,
+            b.board_t AS boardT, b.seen_at AS seenAt, b.enabled, b.supported, b.truncated,
+            b.backend, b.reason, b.umod_clans AS umodClans, b.clan_count AS clanCount
+       FROM ${SERVERS} s
+       LEFT JOIN ${BOARDS} b ON b.server_id = s.id
+      ORDER BY s.sort_order ASC, s.id ASC`,
+  )
+}
+
+/**
+ * Records what a board said about itself.
+ *
+ * `seenAt` is passed only when the board's `t` ADVANCED, and is then the
+ * website's own now; otherwise the stored one is kept. That is the whole of the
+ * freshness rule (see `schema.sql`), so it is done in SQL rather than trusted to
+ * every caller to read-then-write.
+ */
+async function putBoard({ serverId, boardT, advanced, enabled, supported, truncated, backend, reason, umodClans, clanCount }) {
+  await core.query(
+    `INSERT INTO ${BOARDS}
+       (server_id, board_t, seen_at, enabled, supported, truncated, backend, reason, umod_clans, clan_count, updated_at)
+     VALUES (?, ?, ${advanced ? 'CURRENT_TIMESTAMP' : 'NULL'}, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE
+       board_t = VALUES(board_t),
+       seen_at = ${advanced ? 'CURRENT_TIMESTAMP' : 'seen_at'},
+       enabled = VALUES(enabled), supported = VALUES(supported), truncated = VALUES(truncated),
+       backend = VALUES(backend), reason = VALUES(reason), umod_clans = VALUES(umod_clans),
+       clan_count = VALUES(clan_count), updated_at = CURRENT_TIMESTAMP`,
+    [
+      serverId,
+      boardT,
+      enabled ? 1 : 0,
+      supported ? 1 : 0,
+      truncated ? 1 : 0,
+      backend || null,
+      reason ? String(reason).slice(0, 255) : null,
+      umodClans ? 1 : 0,
+      clanCount || 0,
+    ],
+  )
+}
+
+// ── Clans ──────────────────────────────────────────────────────────────────
+
+/** Every clan this module holds for one server, gone or not. */
+async function listClansForServer(serverId) {
+  return core.query(
+    `SELECT external_id AS externalId, clan_id AS clanId, created_ms AS createdMs, name,
+            member_count AS memberCount, gone_at AS goneAt
+       FROM ${CLANS} WHERE server_id = ?`,
+    [serverId],
+  )
+}
+
+/**
+ * Every member of one server's current clans, as the board last stated them,
+ * for diffing the next board against. The name is the BOARD's, not the player
+ * table's, because it is compared with the board.
+ */
+async function listMembersForServer(serverId) {
+  return core.query(
+    `SELECT m.external_id AS externalId, m.steam_id AS steamId, m.role_rank AS rank,
+            m.role_name AS role, m.name
+       FROM ${MEMBERS} m
+       JOIN ${CLANS} c ON c.external_id = m.external_id
+      WHERE c.server_id = ? AND c.gone_at IS NULL`,
+    [serverId],
+  )
+}
+
+async function upsertClan({ externalId, serverId, clanId, createdMs, name, color, score, memberCount, maxMembers }) {
+  await core.query(
+    `INSERT INTO ${CLANS}
+       (external_id, server_id, clan_id, created_ms, name, color, score, member_count, max_members,
+        first_seen, updated_at, gone_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, NULL)
+     ON DUPLICATE KEY UPDATE
+       name = VALUES(name), color = VALUES(color), score = VALUES(score),
+       member_count = VALUES(member_count), max_members = VALUES(max_members),
+       updated_at = CURRENT_TIMESTAMP, gone_at = NULL`,
+    [externalId, serverId, clanId, createdMs, name, color, score, memberCount, maxMembers],
+  )
+}
+
+/**
+ * Replaces one clan's members.
+ *
+ * Delete then insert, not wrapped in a transaction — the same trade the presence
+ * board makes (`events.db.replacePresence`): a fraction of a second in which a
+ * roster read might come back short, against holding a lock on a table that core's
+ * reconciler and two public routes read.
+ */
+async function replaceMembers(externalId, members) {
+  await core.query(`DELETE FROM ${MEMBERS} WHERE external_id = ?`, [externalId])
+
+  for (const m of members) {
+    // eslint-disable-next-line no-await-in-loop
+    await core.query(
+      `INSERT INTO ${MEMBERS} (external_id, steam_id, name, role_rank, role_name, joined_ms)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON DUPLICATE KEY UPDATE name = VALUES(name), role_rank = VALUES(role_rank),
+                               role_name = VALUES(role_name), joined_ms = VALUES(joined_ms)`,
+      [externalId, m.steamId, m.name, m.rank, m.role, m.joinedMs],
+    )
+  }
+}
+
+/** Marks clans gone. Their members are removed with them; a gone clan has no roster. */
+async function markGone(externalIds) {
+  if (!externalIds.length) return
+  const marks = externalIds.map(() => '?').join(', ')
+  await core.query(
+    `UPDATE ${CLANS} SET gone_at = CURRENT_TIMESTAMP WHERE external_id IN (${marks}) AND gone_at IS NULL`,
+    externalIds,
+  )
+  await core.query(`DELETE FROM ${MEMBERS} WHERE external_id IN (${marks})`, externalIds)
+}
+
+/** One clan by its Team identity, with its server's name, or null. */
+async function findClan(externalId) {
+  const rows = await core.query(
+    `SELECT c.external_id AS externalId, c.server_id AS serverId, s.name AS serverName,
+            c.clan_id AS clanId, c.created_ms AS createdMs, c.name, c.color, c.score,
+            c.member_count AS memberCount, c.max_members AS maxMembers,
+            c.first_seen AS firstSeen, c.updated_at AS updatedAt, c.gone_at AS goneAt
+       FROM ${CLANS} c
+       JOIN ${SERVERS} s ON s.id = c.server_id
+      WHERE c.external_id = ?`,
+    [externalId],
+  )
+  return rows[0] || null
+}
+
+/**
+ * The newest clan this module holds under a game id on one server, or null.
+ *
+ * The fallback for the one event that can arrive without a creation time
+ * (`clan.member.added`, when the plugin could not read the clan back). Newest,
+ * because an id that the game has re-used belongs to the clan that re-used it.
+ */
+async function findByGameId(serverId, clanId) {
+  const rows = await core.query(
+    `SELECT external_id AS externalId, name
+       FROM ${CLANS} WHERE server_id = ? AND clan_id = ?
+      ORDER BY created_ms DESC LIMIT 1`,
+    [serverId, clanId],
+  )
+  return rows[0] || null
+}
+
+/** Every clan still on a board, for core's `getTeams`. */
+async function listActiveClans() {
+  return core.query(
+    `SELECT c.external_id AS externalId, c.server_id AS serverId, s.name AS serverName,
+            c.name, c.color, c.score, c.member_count AS memberCount
+       FROM ${CLANS} c
+       JOIN ${SERVERS} s ON s.id = c.server_id
+      WHERE c.gone_at IS NULL
+      ORDER BY c.server_id ASC, c.score DESC, c.name ASC`,
+  )
+}
+
+/** One server's clans still on its board, for the public Clans tab. Best first. */
+async function listPublicForServer(serverId) {
+  return core.query(
+    `SELECT external_id AS externalId, name, color, score, member_count AS memberCount,
+            max_members AS maxMembers
+       FROM ${CLANS}
+      WHERE server_id = ? AND gone_at IS NULL
+      ORDER BY score DESC, name ASC`,
+    [serverId],
+  )
+}
+
+/**
+ * One clan's roster, with the website account behind each member when there is
+ * one and whether they are on the clan's server right now.
+ *
+ * Three joins, all of this module's own tables: the link (a Steam id to a user),
+ * the player table (the newest name the game has sent for them) and the presence
+ * board. Presence is joined on the CLAN's server — a member on another server of
+ * the fleet is not online here.
+ */
+async function listMembers(externalId) {
+  return core.query(
+    `SELECT m.steam_id AS steamId, COALESCE(p.name, m.name) AS name, m.role_rank AS rank,
+            m.role_name AS role, m.joined_ms AS joinedMs, l.user_id AS userId,
+            (pr.steam_id IS NOT NULL) AS online
+       FROM ${MEMBERS} m
+       JOIN ${CLANS} c ON c.external_id = m.external_id
+       LEFT JOIN ${LINKS} l ON l.steam_id = m.steam_id
+       LEFT JOIN ${PLAYERS} p ON p.steam_id = m.steam_id
+       LEFT JOIN rust_presence pr ON pr.server_id = c.server_id AND pr.steam_id = m.steam_id
+      WHERE m.external_id = ?
+      ORDER BY (m.role_rank IS NULL) ASC, m.role_rank ASC, name ASC`,
+    [externalId],
+  )
+}
+
+/** Whether a website user holds a linked Steam account that is a member of this clan. */
+async function userIsMember(externalId, userId) {
+  const rows = await core.query(
+    `SELECT 1 AS yes
+       FROM ${MEMBERS} m
+       JOIN ${LINKS} l ON l.steam_id = m.steam_id
+      WHERE m.external_id = ? AND l.user_id = ?
+      LIMIT 1`,
+    [externalId, userId],
+  )
+  return rows.length > 0
+}
+
+/**
+ * Recent clan events for one server, oldest first, for re-offering their feed
+ * items to core until the Team they name exists (see `model/clans`).
+ */
+async function recentClanEvents(serverId, sinceMs) {
+  return core.query(
+    `SELECT id, kind, t, raw
+       FROM rust_events
+      WHERE server_id = ? AND kind LIKE 'clan.%' AND t >= ?
+      ORDER BY t ASC, id ASC
+      LIMIT 200`,
+    [serverId, sinceMs],
+  )
+}
+
+/**
+ * Notes a player's name WITHOUT touching `last_seen`.
+ *
+ * `events.db.touchPlayer` also moves `last_seen`, which is right for a frame that
+ * says a player was on and wrong for a clan frame: a kick is done TO somebody who
+ * may be offline, and a leaderboard's "last seen" would then read as a presence
+ * signal for a player who never connected (PLAN.md §23).
+ *
+ * A player this module has never heard of still gets a  on the new row,
+ * because the column is NOT NULL; what matters is that an existing row's is left
+ * alone, and every surface that reads it is behind the presence gate anyway.
+ */
+async function rememberName(steamId, name) {
+  if (!steamId) return
+  await core.query(
+    `INSERT INTO ${PLAYERS} (steam_id, name, first_seen, last_seen)
+     VALUES (?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE name = COALESCE(VALUES(name), name)`,
+    [steamId, name || null],
+  )
+}
+
+module.exports = {
+  getBoard,
+  listBoards,
+  putBoard,
+  listClansForServer,
+  listMembersForServer,
+  upsertClan,
+  replaceMembers,
+  markGone,
+  findClan,
+  findByGameId,
+  listActiveClans,
+  listPublicForServer,
+  listMembers,
+  userIsMember,
+  recentClanEvents,
+  rememberName,
+}

server/model/clans/clans.model.js

@@ -0,0 +1,574 @@
+// ── First-party clans: the board, the events, and who may see a roster ────
+//
+// Rust's OWN clan system, which this module turns into core's Teams (R5,
+// PLAN.md §24). Three jobs, one file, because all three have to agree on what a
+// clan's identity is:
+//
+//   applyBoard    a `clans` snapshot → the store, plus what changed
+//   applyEvent    a `clan.*` event → core (publish) and the Team feed
+//   canSeeRoster  D48's audience, for core's `projectRoster` and our own page
+//
+// ── The identity (D52) ────────────────────────────────────────────────────
+//
+// `<serverId>:<clanId>:<createdMs>`. The game's clan id alone is not one: its
+// database file carries a hard-coded version, so a game update that bumps it
+// starts a fresh file and ids restart at 1. Keyed on the id, the new clan #1
+// would inherit the old clan #1's Team, forum and history.
+//
+// ── What a board may conclude, and what it may not ───────────────────────
+//
+// A board is authoritative for the clans it CARRIES. It is authoritative about
+// the clans it does NOT carry only when it is complete: a board truncated at the
+// game's 100-clan ceiling (D55), or one with a row this build could not read,
+// proves nothing about a clan it leaves out, and marking that clan gone would
+// hand core an archive on no evidence.
+
+const crypto = require('node:crypto')
+
+const core = require('../../core')
+
+const db = require('./clans.db')
+const visibility = require('../visibility/visibility.model')
+
+const log = core.logger('clans')
+
+/**
+ * How long a board may go without its `t` advancing and still count as current.
+ *
+ * The plugin re-sends it every 60 seconds and this module reads it every 30, so
+ * three minutes tolerates two missed boards before a server stops vouching for
+ * its clans.
+ */
+const FRESH_MS = 3 * 60 * 1000
+
+/**
+ * How far back a clan event's feed item is offered to core again.
+ *
+ * Core writes an item only for a Team it already holds, and a clan founded a
+ * moment ago is not one yet: its Team appears on core's next reconcile, which is
+ * debounced by up to 30 seconds. So the "founded" line — the first line of every
+ * clan's feed — would always be dropped if it were offered once. It is offered
+ * on every board refresh for this long instead, and core's dedupe key makes every
+ * offer after the first that lands a no-op.
+ */
+const REOFFER_MS = 10 * 60 * 1000
+
+/** Team kinds core's `publish` takes, by the clan event that produces them. */
+const PUBLISH = Object.freeze({
+  'clan.created': 'team.created',
+  'clan.disbanded': 'team.disbanded',
+  'clan.member.added': 'team.member.added',
+  'clan.member.left': 'team.member.removed',
+  'clan.member.kicked': 'team.member.removed',
+})
+
+/**
+ * The feed items D49 allows: membership, and nothing else. Every one is
+ * members-only. A disband is not here — it was not one of the four the org lead
+ * chose, and the Team it would be written to is about to be archived anyway.
+ */
+const ACTIVITY = Object.freeze({
+  'clan.created': 'rust.clan.founded',
+  'clan.member.added': 'rust.clan.joined',
+  'clan.member.left': 'rust.clan.left',
+  'clan.member.kicked': 'rust.clan.removed',
+})
+
+const CLAN_KINDS = Object.freeze(Object.keys(PUBLISH))
+
+const STEAM_ID = /^\d{1,32}$/
+const COLOR = /^#[0-9a-f]{6}$/i
+
+/** The Team identity (D52). */
+function externalIdOf(serverId, clanId, createdMs) {
+  return `${serverId}:${clanId}:${createdMs}`
+}
+
+const text = (value, max) => (typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null)
+const int = (value) => (Number.isInteger(Number(value)) && value !== null && value !== '' ? Number(value) : null)
+
+/**
+ * One board row as this module stores it, or null when it cannot be read.
+ *
+ * A member whose Steam id is not a Steam id is dropped rather than failing the
+ * clan: the roster is still true about everybody else. A clan with no id, no
+ * creation time or no name fails as a whole, because it has no identity to
+ * store it under.
+ */
+function normaliseClan(serverId, raw) {
+  if (!raw || typeof raw !== 'object') return null
+
+  const clanId = int(raw.clanId)
+  const createdMs = int(raw.createdMs)
+  const name = text(raw.name, 191)
+  if (clanId == null || createdMs == null || createdMs <= 0 || !name) return null
+
+  const members = []
+  for (const m of Array.isArray(raw.members) ? raw.members : []) {
+    const steamId = m && typeof m.steamId === 'string' && STEAM_ID.test(m.steamId) ? m.steamId : null
+    if (!steamId) continue
+    members.push({
+      steamId,
+      name: text(m.name, 191),
+      rank: int(m.rank),
+      role: text(m.role, 64),
+      joinedMs: int(m.joinedMs),
+    })
+  }
+
+  return {
+    externalId: externalIdOf(serverId, clanId, createdMs),
+    serverId,
+    clanId,
+    createdMs,
+    name,
+    color: typeof raw.color === 'string' && COLOR.test(raw.color) ? raw.color.toLowerCase() : null,
+    score: int(raw.score) || 0,
+    maxMembers: int(raw.maxMembers),
+    memberCount: members.length,
+    members,
+  }
+}
+
+/** A member signature, so an unchanged roster is not rewritten every minute. */
+const signature = (members) =>
+  members
+    .map((m) => `${m.steamId}|${m.rank == null ? '' : m.rank}|${m.role || ''}|${m.name || ''}`)
+    .sort()
+    .join('\n')
+
+const leadersOf = (members) => new Set(members.filter((m) => Number(m.rank) === 1).map((m) => m.steamId))
+
+/**
+ * Tells core something, and never lets core's answer become this module's
+ * problem. Both calls are fire-and-forget by contract; the catch is for a core
+ * that throws synchronously all the same.
+ */
+function publish(event) {
+  try {
+    Promise.resolve(core.teams.publish(event)).catch((err) => {
+      log.warn('teams publish failed', { kind: event.kind, externalId: event.externalId, error: err.message })
+    })
+  } catch (err) {
+    log.warn('teams publish threw', { kind: event.kind, externalId: event.externalId, error: err.message })
+  }
+}
+
+function requestReconcile(reason) {
+  try {
+    core.teams.reconcile({ reason })
+  } catch (err) {
+    log.warn('teams reconcile request threw', { reason, error: err.message })
+  }
+}
+
+function pushActivity(items) {
+  if (!items.length) return
+  try {
+    Promise.resolve(core.teams.pushActivity(items)).catch((err) => {
+      log.warn('teams activity push failed', { items: items.length, error: err.message })
+    })
+  } catch (err) {
+    log.warn('teams activity push threw', { items: items.length, error: err.message })
+  }
+}
+
+// ── The board ──────────────────────────────────────────────────────────────
+
+/**
+ * Applies one server's `clans` board.
+ *
+ * `board` is undefined when the sidecar holds none — a plugin older than
+ * protocol 6, or one that has not connected since it was upgraded. That is
+ * recorded as unsupported, and the clans already stored are left exactly as they
+ * are: a missing board is the absence of an answer, not an answer of absence.
+ *
+ * Returns what happened, for the log and the tests.
+ */
+async function applyBoard(serverId, board) {
+  if (!board || typeof board !== 'object') {
+    await db.putBoard({
+      serverId,
+      boardT: null,
+      advanced: false,
+      enabled: true,
+      supported: false,
+      truncated: false,
+      backend: null,
+      reason: "this server has not sent a clan board; its plugin may predate protocol 6",
+      umodClans: false,
+      clanCount: 0,
+    })
+    return { applied: false, reason: 'no board' }
+  }
+
+  const previous = await db.getBoard(serverId)
+  const boardT = Number(board.t)
+  const known = previous && previous.boardT != null ? Number(previous.boardT) : null
+  const advanced = Number.isFinite(boardT) && (known == null || boardT > known)
+
+  const supported = board.supported === true
+  const raw = supported && Array.isArray(board.clans) ? board.clans : null
+
+  const clans = []
+  let unreadable = 0
+  for (const row of raw || []) {
+    const clan = normaliseClan(serverId, row)
+    if (clan) clans.push(clan)
+    else unreadable += 1
+  }
+
+  // A row this build could not read is treated like the ceiling: the board no
+  // longer vouches for what it leaves out.
+  const truncated = board.truncated === true || unreadable > 0
+
+  await db.putBoard({
+    serverId,
+    boardT: Number.isFinite(boardT) ? boardT : null,
+    advanced,
+    enabled: board.enabled !== false,
+    supported,
+    truncated,
+    backend: text(board.backend, 64),
+    reason: supported ? null : text(board.reason, 255) || 'the plugin could not read this server\'s clans',
+    umodClans: board.umodClans === true,
+    clanCount: clans.length,
+  })
+
+  if (unreadable) log.warn('clan board carried rows this build could not read', { server: serverId, unreadable })
+
+  // A board whose `t` has not moved is the one already applied. Re-applying it
+  // would rewrite every roster every 30 seconds to say what it already says.
+  if (!advanced || !raw) return { applied: false, reason: advanced ? 'unsupported' : 'unchanged' }
+
+  const [before, beforeMembers] = await Promise.all([
+    db.listClansForServer(serverId),
+    db.listMembersForServer(serverId),
+  ])
+
+  const wasActive = new Map(before.filter((c) => !c.goneAt).map((c) => [c.externalId, c]))
+  const rosterBefore = new Map()
+  for (const m of beforeMembers) {
+    if (!rosterBefore.has(m.externalId)) rosterBefore.set(m.externalId, [])
+    rosterBefore.get(m.externalId).push(m)
+  }
+
+  let created = 0
+  let rosterChanged = 0
+  const leaderEvents = []
+
+  for (const clan of clans) {
+    // eslint-disable-next-line no-await-in-loop
+    await db.upsertClan(clan)
+
+    const old = rosterBefore.get(clan.externalId) || []
+    if (!wasActive.has(clan.externalId)) created += 1
+
+    if (signature(old) !== signature(clan.members)) {
+      // eslint-disable-next-line no-await-in-loop
+      await db.replaceMembers(clan.externalId, clan.members)
+      rosterChanged += 1
+    }
+
+    // Leadership is only ever learned here (D54): the game raises no hook when
+    // somebody is promoted. Published only for a clan that was already on the
+    // previous board — a brand-new clan's leaders reach core with the Team.
+    if (wasActive.has(clan.externalId)) {
+      const was = leadersOf(old)
+      const now = leadersOf(clan.members)
+      for (const key of now) if (!was.has(key)) leaderEvents.push({ kind: 'team.leader.added', externalId: clan.externalId, memberKey: key })
+      for (const key of was) if (!now.has(key)) leaderEvents.push({ kind: 'team.leader.removed', externalId: clan.externalId, memberKey: key })
+    }
+  }
+
+  // Only a complete board may say a clan is gone.
+  const onBoard = new Set(clans.map((c) => c.externalId))
+  const gone = truncated ? [] : [...wasActive.keys()].filter((id) => !onBoard.has(id))
+  await db.markGone(gone)
+
+  for (const event of leaderEvents) publish(event)
+
+  if (created || gone.length || rosterChanged) {
+    requestReconcile('rust clans board changed')
+  }
+
+  if (created || gone.length || rosterChanged || leaderEvents.length) {
+    log.info('clan board applied', {
+      server: serverId, clans: clans.length, created, gone: gone.length, rosterChanged,
+      leaderChanges: leaderEvents.length, truncated,
+    })
+  }
+
+  return { applied: true, clans: clans.length, created, gone: gone.length, rosterChanged, leaderChanges: leaderEvents.length }
+}
+
+// ── The events ─────────────────────────────────────────────────────────────
+
+const nameOr = (name) => name || 'A player'
+
+/** The feed line for one clan event, as core stores it verbatim. */
+function summaryOf(kind, frame) {
+  switch (kind) {
+    case 'clan.created':
+      return `${nameOr(frame.name)} founded the clan.`
+    case 'clan.member.added':
+      return `${nameOr(frame.name)} joined the clan.`
+    case 'clan.member.left':
+      return `${nameOr(frame.name)} left the clan.`
+    case 'clan.member.kicked':
+      return frame.byName
+        ? `${nameOr(frame.name)} was removed from the clan by ${frame.byName}.`
+        : `${nameOr(frame.name)} was removed from the clan.`
+    default:
+      return null
+  }
+}
+
+/**
+ * A key core can dedupe on, from the frame's own content.
+ *
+ * Content rather than this module's event row id, so that the same frame read
+ * twice — a cursor replayed after a crash, or the re-offer below — is the same
+ * item. **Hashed, because core clamps a dedupe key to 40 characters**, and a
+ * readable key long enough to be unique (server, clan, creation time, kind,
+ * player, instant) would be cut short into collisions without a word.
+ */
+function dedupeKeyOf(serverId, kind, frame) {
+  const parts = [serverId, frame.clanId, frame.createdMs, kind, frame.steamId || '', frame.t]
+  return crypto.createHash('sha1').update(parts.join('|')).digest('hex')
+}
+
+/** One clan event as a Team feed item, or null when D49 does not allow it. */
+function activityItem(serverId, externalId, kind, frame) {
+  const itemKind = ACTIVITY[kind]
+  const summary = itemKind && summaryOf(kind, frame)
+  if (!summary) return null
+
+  const t = Number(frame.t)
+  return {
+    externalId,
+    kind: itemKind,
+    summary,
+    occurredAt: Number.isFinite(t) ? t : Date.now(),
+    visibility: 'members',
+    actorMemberKey: kind === 'clan.member.kicked' ? frame.bySteamId || null : frame.steamId || null,
+    payload: { serverId, steamId: frame.steamId || null },
+    dedupeKey: dedupeKeyOf(serverId, kind, frame),
+  }
+}
+
+/** The Team identity a clan event names, or null when it cannot be worked out. */
+async function resolveExternalId(serverId, frame) {
+  const clanId = int(frame.clanId)
+  const createdMs = int(frame.createdMs)
+  if (clanId == null) return null
+  if (createdMs != null && createdMs > 0) return externalIdOf(serverId, clanId, createdMs)
+
+  // `clan.member.added` can arrive without a creation time when the plugin could
+  // not read the clan back. Matched on the game id, newest first.
+  const known = await db.findByGameId(serverId, clanId)
+  return known ? known.externalId : null
+}
+
+/**
+ * Applies one `clan.*` event: tells core, and writes the Team feed.
+ *
+ * Called from ingest, after the raw frame is stored. The board that follows
+ * every one of these (the plugin re-sends it a few seconds later) is what the
+ * store is rebuilt from; this only makes the change visible sooner and records
+ * the line for the feed.
+ */
+async function applyEvent(serverId, frame) {
+  const kind = frame && frame.kind
+  if (!PUBLISH[kind]) return { applied: false }
+
+  if (frame.steamId) await db.rememberName(frame.steamId, text(frame.name, 191))
+  if (frame.bySteamId) await db.rememberName(frame.bySteamId, text(frame.byName, 191))
+
+  const externalId = await resolveExternalId(serverId, frame)
+  if (!externalId) {
+    log.info('clan event names a clan this module has never seen', { server: serverId, kind, clanId: frame.clanId })
+    return { applied: false }
+  }
+
+  // The game said it: this clan is gone. Recorded here as well as by the next
+  // board, because a board truncated at the ceiling would never say so.
+  if (kind === 'clan.disbanded') await db.markGone([externalId])
+
+  const event = { kind: PUBLISH[kind], externalId }
+  if (event.kind.startsWith('team.member.')) {
+    if (!frame.steamId) return { applied: false }
+    event.memberKey = String(frame.steamId)
+  }
+  publish(event)
+
+  const item = activityItem(serverId, externalId, kind, frame)
+  if (item) pushActivity([item])
+
+  return { applied: true, externalId }
+}
+
+/**
+ * Offers the last few minutes of one server's clan feed items to core again.
+ *
+ * See `REOFFER_MS`. Called after each board refresh; idempotent by construction.
+ */
+async function reofferActivity(serverId, now = Date.now()) {
+  const rows = await db.recentClanEvents(serverId, now - REOFFER_MS)
+  const items = []
+
+  for (const row of rows) {
+    let frame
+    try {
+      frame = typeof row.raw === 'string' ? JSON.parse(row.raw) : row.raw
+    } catch (err) {
+      continue
+    }
+    if (!frame || !ACTIVITY[frame.kind]) continue
+
+    // eslint-disable-next-line no-await-in-loop
+    const externalId = await resolveExternalId(serverId, frame)
+    const item = externalId && activityItem(serverId, externalId, frame.kind, frame)
+    if (item) items.push(item)
+  }
+
+  pushActivity(items)
+  return items.length
+}
+
+// ── Who may see a roster (D48) ─────────────────────────────────────────────
+
+/**
+ * May this viewer see this clan's roster?
+ *
+ * `viewer` is `{ userId, role }` or null — the shape core hands `projectRoster`,
+ * so core's roster and this module's page decide it with one function.
+ *
+ * The viewer's standing is re-read from the `users` row, never taken from what
+ * the caller says, for the same reason the presence gate does it: a moderator
+ * demoted this morning, or an account banned, must lose the roster on the next
+ * request. Everything that cannot be answered answers no.
+ */
+async function canSeeRoster(viewer, externalId) {
+  const audience = await visibility.clanRosterAudience()
+  if (audience === 'public') return true
+  if (!viewer || viewer.userId == null) return false
+
+  const user = await core.users.getById(viewer.userId)
+  if (!user || (user.status && user.status !== 'active')) return false
+
+  if (audience === 'signed_in') return true
+  if (user.role === 'admin' || user.role === 'moderator') return true
+  return db.userIsMember(externalId, user.id)
+}
+
+// ── The public reads ───────────────────────────────────────────────────────
+
+const shapeBoard = (board, now = Date.now()) => {
+  if (!board || board.supported == null) {
+    return { supported: false, fresh: false, truncated: false, enabled: true, reason: 'this server has not sent a clan board yet' }
+  }
+  const seenAt = board.seenAt ? new Date(board.seenAt).getTime() : null
+  return {
+    supported: Boolean(board.supported),
+    enabled: Boolean(board.enabled),
+    truncated: Boolean(board.truncated),
+    fresh: Boolean(board.supported) && seenAt != null && now - seenAt < FRESH_MS,
+    reason: board.reason || null,
+  }
+}
+
+/** The Clans tab (D58): every clan on one server's board, best first. Public. */
+async function listForServer(serverId, now = Date.now()) {
+  const [clans, board] = await Promise.all([db.listPublicForServer(serverId), db.getBoard(serverId)])
+  return {
+    clans: clans.map((c) => ({
+      externalId: c.externalId,
+      name: c.name,
+      color: c.color || null,
+      score: Number(c.score) || 0,
+      memberCount: Number(c.memberCount) || 0,
+      maxMembers: c.maxMembers == null ? null : Number(c.maxMembers),
+    })),
+    board: shapeBoard(board, now),
+  }
+}
+
+/**
+ * One clan, and its roster if the viewer may see it.
+ *
+ * The roster carries no Steam id and no website account id — the same two fields
+ * core withholds from every public roster. `online` is inside the audience by
+ * construction (D48): a viewer who may not see the roster sees no names at all.
+ */
+async function getForViewer(externalId, viewer) {
+  const clan = await db.findClan(externalId)
+  if (!clan) return null
+
+  const allowed = await canSeeRoster(viewer, externalId)
+  const audience = await visibility.clanRosterAudience()
+
+  const members = allowed && !clan.goneAt ? await db.listMembers(externalId) : []
+
+  return {
+    clan: {
+      externalId: clan.externalId,
+      name: clan.name,
+      color: clan.color || null,
+      score: Number(clan.score) || 0,
+      memberCount: Number(clan.memberCount) || 0,
+      maxMembers: clan.maxMembers == null ? null : Number(clan.maxMembers),
+      serverId: clan.serverId,
+      serverName: clan.serverName,
+      founded: Number(clan.createdMs) || null,
+      gone: Boolean(clan.goneAt),
+    },
+    roster: {
+      visible: allowed,
+      audience,
+      members: members.map((m) => ({
+        name: m.name || null,
+        role: m.role || null,
+        leader: Number(m.rank) === 1,
+        online: Boolean(Number(m.online)),
+        joined: m.joinedMs == null ? null : Number(m.joinedMs),
+      })),
+    },
+  }
+}
+
+/**
+ * Every configured server's clan board as the admin page shows it: whether it is
+ * current, whether it is at the ceiling (D55), why it cannot be read, and
+ * whether the uMod Clans plugin is loaded there (D47) — whose clans are a
+ * separate system and never Teams.
+ */
+async function boardsForAdmin(now = Date.now()) {
+  const rows = await db.listBoards()
+  return rows.map((row) => ({
+    id: row.serverId,
+    name: row.serverName,
+    ...shapeBoard(row.supported == null ? null : row, now),
+    clans: Number(row.clanCount) || 0,
+    umodClans: Boolean(row.umodClans),
+  }))
+}
+
+module.exports = {
+  FRESH_MS,
+  boardsForAdmin,
+  REOFFER_MS,
+  CLAN_KINDS,
+  externalIdOf,
+  normaliseClan,
+  applyBoard,
+  applyEvent,
+  resolveExternalId,
+  reofferActivity,
+  activityItem,
+  dedupeKeyOf,
+  canSeeRoster,
+  shapeBoard,
+  listForServer,
+  getForViewer,
+}

server/model/clans/teamProvider.js

@@ -0,0 +1,202 @@
+// ── module-rust's Team provider ────────────────────────────────────────────
+//
+// The questions core asks this module about Teams (MODULE_API.md
+// `api.registerTeamProvider`, TEAMS.md §2.3). A first-party Rust clan is a Team
+// (R5); this file is the whole of the translation, and `model/clans` is where
+// the clans themselves are kept.
+//
+// ── The envelope is the contract ──────────────────────────────────────────
+//
+// Every method answers `{ ok, ... }` and `{ ok: false, reason }` is an ordinary
+// answer. Core reads it as "keep what you have" — staleness, never emptiness —
+// and there is no shape a failure can take that core reads as "zero Teams". An
+// empty array is the one thing this file must never say while it does not know.
+//
+// ── Many servers, one answer (D53) ─────────────────────────────────────────
+//
+// `module-uo` has one shard and one socket, so "is the board current" has one
+// answer. This module has a fleet, and the answer is per server. `getTeams` is
+// therefore:
+//
+//   • `complete: true`  only when EVERY configured server's board is fresh,
+//                       supported and untruncated — then core may archive a
+//                       Team that is missing;
+//   • `complete: false` when at least one is current and some are not — core
+//                       adds and updates, and removes nothing. One server being
+//                       off for a patch must never archive its clans;
+//   • a refusal         when none is current.
+//
+// A clan is only ever as current as its own server's board, so the roster
+// methods ask about that server alone.
+
+const core = require('../../core')
+
+const db = require('./clans.db')
+const clans = require('./clans.model')
+const servers = require('../servers/servers.model')
+
+const log = core.logger('teams')
+
+const refuse = (reason) => ({ ok: false, reason })
+
+/** Is this board record current? The rule `model/clans` states, applied to one row. */
+function isFresh(board, now = Date.now()) {
+  return clans.shapeBoard(board, now).fresh
+}
+
+/**
+ * `getTeams()` — every clan on every server's board.
+ *
+ * `meta` carries the server and the clan's colour and score, opaquely: core
+ * stores and shows it and never branches on it.
+ */
+async function getTeams(now = Date.now()) {
+  try {
+    const configured = await servers.listForPolling()
+    if (!configured.length) return refuse('no Rust servers are configured')
+
+    const boards = await db.listBoards()
+    const byServer = new Map(boards.map((b) => [b.serverId, b]))
+
+    const fresh = []
+    const behind = []
+    for (const server of configured) {
+      const board = byServer.get(server.id)
+      if (isFresh(board, now)) fresh.push(server.id)
+      else behind.push(server.id)
+    }
+
+    if (!fresh.length) {
+      return refuse(`no server has sent a current clan board (${behind.join(', ')})`)
+    }
+
+    // Complete only when nothing is behind, and nothing is at the ceiling. A
+    // server that is configured but switched off in this module is "behind" by
+    // construction — its board is never read — which is the conservative answer:
+    // switching a server off is not a statement that its clans are gone.
+    const truncated = fresh.filter((id) => byServer.get(id).truncated)
+    const complete = behind.length === 0 && truncated.length === 0
+
+    const rows = await db.listActiveClans()
+    const known = new Set(configured.map((s) => s.id))
+
+    return {
+      ok: true,
+      complete,
+      teams: rows
+        .filter((row) => known.has(row.serverId))
+        .map((row) => ({
+          externalId: row.externalId,
+          name: row.name,
+          abbr: null,
+          meta: {
+            server: row.serverName || row.serverId,
+            serverId: row.serverId,
+            color: row.color || null,
+            score: Number(row.score) || 0,
+          },
+        })),
+    }
+  } catch (err) {
+    log.warn('getTeams failed', { error: err.message })
+    return refuse(`clans unreadable: ${err.message}`)
+  }
+}
+
+/** A clan and whether its server's board vouches for it right now, or a refusal. */
+async function currentClan(externalId, now) {
+  const clan = await db.findClan(externalId)
+  if (!clan) return { refusal: refuse(`clan ${externalId} is not on any board`) }
+  if (clan.goneAt) return { refusal: refuse(`clan ${externalId} has left its server's board`) }
+
+  const board = await db.getBoard(clan.serverId)
+  if (!isFresh(board, now)) {
+    return { refusal: refuse(`server ${clan.serverId} has not sent a current clan board`) }
+  }
+  return { clan }
+}
+
+/**
+ * `getTeamMembers(externalId)` — one clan's roster.
+ *
+ * **A clan with no roster rows is refused, not reported empty**, unless the board
+ * said it has none. A clan always has at least its leader, so an empty roster
+ * beside a non-zero count is a read that happened between two writes, and
+ * reporting it would tell core every member left.
+ */
+async function getTeamMembers(externalId, now = Date.now()) {
+  try {
+    const { clan, refusal } = await currentClan(externalId, now)
+    if (refusal) return refusal
+
+    const rows = await db.listMembers(externalId)
+    if (!rows.length && Number(clan.memberCount) > 0) {
+      return refuse(`roster for clan ${externalId} is not stored yet (board says ${clan.memberCount} members)`)
+    }
+
+    return {
+      ok: true,
+      complete: true,
+      members: rows.map((row) => ({
+        memberKey: row.steamId,
+        displayName: row.name || null,
+        rankLabel: row.role || null,
+        // Rank 1 is leader and several may hold it. A NULL rank — a role id the
+        // board could not match — is not a leader: "not known" must never read
+        // as "leads this clan".
+        leader: Number(row.rank) === 1,
+        online: Boolean(Number(row.online)),
+        userId: Number.isInteger(Number(row.userId)) && Number(row.userId) > 0 ? Number(row.userId) : null,
+      })),
+    }
+  } catch (err) {
+    log.warn('getTeamMembers failed', { externalId, error: err.message })
+    return refuse(`roster unreadable: ${err.message}`)
+  }
+}
+
+/** `getTeamLeaders(externalId)` — everyone at rank 1, which may be several. */
+async function getTeamLeaders(externalId, now = Date.now()) {
+  try {
+    const { refusal } = await currentClan(externalId, now)
+    if (refusal) return refusal
+
+    const rows = await db.listMembers(externalId)
+    return { ok: true, leaders: rows.filter((row) => Number(row.rank) === 1).map((row) => row.steamId) }
+  } catch (err) {
+    log.warn('getTeamLeaders failed', { externalId, error: err.message })
+    return refuse(`leadership unreadable: ${err.message}`)
+  }
+}
+
+/**
+ * Which roster rows a viewer may see (D48, MODULE_API 1.6.0).
+ *
+ * The one provider method core calls on a REQUEST path, and the one that fails
+ * CLOSED: core serves an empty roster when this refuses, because for a
+ * visibility question "keep what you have" would mean publishing the roster to
+ * whoever asked. So every path that cannot reach a confident answer refuses.
+ *
+ * All or nothing, and that is the model rather than a shortcut: the audience is
+ * a property of the ROSTER, not of a member. There is no setting in which some
+ * of a clan's members are visible and others are not.
+ */
+async function projectRoster(externalId, members, viewer) {
+  try {
+    const allowed = await clans.canSeeRoster(viewer, externalId)
+    if (!allowed) return { ok: true, members: [] }
+    return { ok: true, members: (members || []).map((m) => m.member_key).filter(Boolean) }
+  } catch (err) {
+    log.warn('projectRoster could not resolve the audience; withholding the roster', {
+      externalId, error: err.message,
+    })
+    return refuse(`the roster audience could not be resolved: ${err.message}`)
+  }
+}
+
+// Where core should point a link at a clan (MODULE_API 1.6.0, TEAMS.md §6.4).
+// Core substitutes `{externalId}` and nothing else, which is why the page is not
+// nested under its server (D56): the server is inside the id already.
+const pageUrlTemplate = '/rust/clans/{externalId}'
+
+module.exports = { getTeams, getTeamMembers, getTeamLeaders, projectRoster, pageUrlTemplate, isFresh }

server/model/config/config.db.js

@@ -0,0 +1,145 @@
+// ── The SQL half of the configuration audit ───────────────────────────────
+//
+// One table, two questions: record what a save did, and show an operator what
+// has been done to a server lately.
+//
+// Nothing here talks to a game. The game half is `sidecarClient`, and the two
+// are deliberately not mixed: this file is what remains true after the plugin
+// has been reloaded, rolled back, or lost.
+
+const core = require('../../core')
+
+/**
+ * Records one save attempt — including the ones that never reached a file.
+ *
+ * A refusal is written for the same reason a success is: an operator asking why
+ * a setting is not what they set has to be able to see that somebody tried and
+ * was told no, and a table that only holds successes answers that question with
+ * silence.
+ */
+async function recordWrite(row) {
+  const result = await core.query(
+    `INSERT INTO rust_config_writes
+       (server_id, path, plugin, reload_target, tier, user_id, outcome, reloaded,
+        changes, version_before, version_after, detail, write_id, settle_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL ? SECOND))`,
+    [
+      row.serverId,
+      row.path,
+      row.plugin || null,
+      row.reloadTarget || null,
+      row.tier || 'form',
+      row.userId || null,
+      row.outcome,
+      row.reloaded ? 1 : 0,
+      row.changes ? JSON.stringify(row.changes) : null,
+      row.versionBefore || null,
+      row.versionAfter || null,
+      row.detail ? String(row.detail).slice(0, 500) : null,
+      row.writeId || null,
+      // Seconds from now, on the database's clock — the one `lost` is read against.
+      // NULL for a write nothing is waiting on, and DATE_ADD of NULL is NULL.
+      row.settleSeconds != null ? Number(row.settleSeconds) : null,
+    ],
+  )
+
+  return result && result.insertId != null ? Number(result.insertId) : null
+}
+
+/**
+ * Settles a `reloading` write from the plugin's `config.outcome` (protocol 13).
+ *
+ * Found by the plugin's `writeId`, scoped to the server that sent it — a write
+ * id is only unique within one plugin. Only a row still `reloading` moves, so a
+ * replayed frame settles nothing twice. A row whose `settle_by` has passed is
+ * still `reloading` in the table (it reads as `lost`), so a late outcome still
+ * lands. Returns whether a row moved.
+ */
+async function settleWrite(serverId, outcome) {
+  const result = await core.query(
+    `UPDATE rust_config_writes
+        SET outcome = ?, reloaded = ?, restored = ?, version_after = ?, detail = ?,
+            log_tail = ?, settled_at = NOW()
+      WHERE server_id = ? AND write_id = ? AND outcome = 'reloading'`,
+    [
+      outcome.outcome,
+      outcome.reloaded ? 1 : 0,
+      outcome.restored == null ? null : outcome.restored ? 1 : 0,
+      outcome.versionAfter || null,
+      outcome.detail ? String(outcome.detail).slice(0, 500) : null,
+      outcome.log || null,
+      serverId,
+      outcome.writeId,
+    ],
+  )
+
+  return Number((result && result.affectedRows) || 0) > 0
+}
+
+/** One write, by its row id, for the page that is waiting on it. */
+async function getWrite(serverId, id) {
+  const rows = await core.query(
+    `${SELECT_WRITE}
+      WHERE server_id = ? AND id = ?`,
+    [serverId, id],
+  )
+
+  return rows[0] ? shapeWrite(rows[0]) : null
+}
+
+/**
+ * The recent history for one server, newest first.
+ *
+ * `changes` comes back parsed, and a row whose JSON will not parse comes back
+ * with `null` rather than throwing — a corrupt audit row must not be able to
+ * break the page that displays the rest of them.
+ */
+async function recentWrites(serverId, limit = 50) {
+  const rows = await core.query(
+    `${SELECT_WRITE}
+      WHERE server_id = ?
+      ORDER BY id DESC
+      LIMIT ?`,
+    [serverId, Math.max(1, Math.min(Number(limit) || 50, 200))],
+  )
+
+  return rows.map(shapeWrite)
+}
+
+// `lost` is decided by the database's clock, in the same statement that reads
+// the row, so it cannot disagree with `settle_by`, which that clock also wrote.
+const SELECT_WRITE = `SELECT id, server_id AS serverId, path, plugin, reload_target AS reloadTarget, tier,
+            user_id AS userId, outcome, reloaded, restored, changes,
+            version_before AS versionBefore, version_after AS versionAfter, detail,
+            log_tail AS log, write_id AS writeId, settled_at AS settledAt, created_at AS createdAt,
+            (outcome = 'reloading' AND settle_by IS NOT NULL AND settle_by < NOW()) AS lost
+       FROM rust_config_writes`
+
+/**
+ * A row as the page reads it. A write still `reloading` past its `settle_by`
+ * reads as `lost`: the plugin was reloaded or the link dropped before it could
+ * say, and the files are whatever a re-read shows.
+ */
+function shapeWrite(row) {
+  const { lost, ...rest } = row
+
+  return {
+    ...rest,
+    outcome: Number(lost) ? 'lost' : row.outcome,
+    reloaded: Boolean(row.reloaded),
+    restored: row.restored == null ? null : Boolean(row.restored),
+    changes: parseChanges(row.changes),
+  }
+}
+
+function parseChanges(raw) {
+  if (!raw) return null
+
+  try {
+    return JSON.parse(raw)
+  } catch {
+    return null
+  }
+}
+
+module.exports = { recordWrite, settleWrite, getWrite, recentWrites, parseChanges, shapeWrite }

server/model/config/config.model.js

@@ -0,0 +1,279 @@
+// ── The logic half of configuration-from-the-site ─────────────────────────
+//
+// Everything here is about the difference between what a game host reports and
+// what an admin should be shown. Three jobs:
+//
+//  1. **Group a flat file list by plugin**, because one plugin can own several
+//     files and a form that lists 40 paths is not a settings screen.
+//  2. **Say which file is ours, and which keys inside it are locked** (D38). The
+//     plugin names itself in the catalogue rather than us matching a filename,
+//     so renaming the file cannot quietly unlock the three keys that would cut
+//     the link or split a server's history.
+//  3. **Decide nothing about paths.** The only process that can say whether a
+//     path resolves inside a configuration directory is the one holding the
+//     directory. This file checks SHAPE, so an obviously malformed request is
+//     refused before it costs a round trip — never as a substitute for the real
+//     check on the host.
+
+const configEdit = require('../../configEdit')
+
+/**
+ * Keys in the bridge plugin's own config that the website may not change (D38).
+ *
+ * `Host` and `Port` are the link this edit is travelling over, and `ServerId` is
+ * how every row this module has ever stored is keyed — changing it does not
+ * rename a server, it strands its history and starts a new one under a name
+ * nobody chose deliberately. All three are editable on the host, by a person
+ * who is standing on it.
+ */
+const LOCKED_KEYS = ['Host', 'Port', 'ServerId']
+
+/** What a locked field says for itself, on the screen and in a refusal. */
+const LOCKED_REASON = {
+  host: 'the website reaches this server through this address',
+  port: 'the website reaches this server through this port',
+  serverid: 'every row this site holds for this server is keyed to this id',
+}
+
+/**
+ * A path shaped like something the host could plausibly have listed.
+ *
+ * Deliberately narrow and deliberately **not** the security boundary: no `..`,
+ * nothing absolute, no drive letter, forward slashes, and it ends in `.json`.
+ */
+const PATH_SHAPE = /^(?!.*\.\.)(?!\/)[A-Za-z0-9 _.\-()[\]]+(?:\/[A-Za-z0-9 _.\-()[\]]+)*\.json$/
+
+function isPlausiblePath(path) {
+  return typeof path === 'string' && path.length > 0 && path.length <= 255 && PATH_SHAPE.test(path)
+}
+
+/**
+ * Shapes the plugin's catalogue into the screen's shape: plugins, each with its
+ * files, each file saying whether it can be edited and why not.
+ *
+ * A file whose guessed plugin is not loaded is kept and **marked**, not dropped.
+ * An operator whose config for an unloaded plugin vanished from the page would
+ * conclude the bridge cannot see it, which is a different and much more alarming
+ * problem than the true one.
+ */
+function shapeCatalogue(catalogue) {
+  if (!catalogue || typeof catalogue !== 'object') return null
+
+  const loaded = Array.isArray(catalogue.plugins) ? catalogue.plugins : []
+  const byName = new Map(loaded.map((p) => [String(p.name).toLowerCase(), p]))
+  const self = catalogue.self ? String(catalogue.self) : null
+
+  const groups = new Map()
+
+  for (const file of Array.isArray(catalogue.files) ? catalogue.files : []) {
+    const plugin = String(file.plugin || 'unknown')
+    const key = plugin.toLowerCase()
+
+    if (!groups.has(key)) {
+      const match = byName.get(key)
+      groups.set(key, {
+        plugin,
+        loaded: Boolean(match),
+        title: match ? match.title : null,
+        version: match ? match.version : null,
+        // The bridge plugin cannot reload itself — the reload would close the
+        // link carrying the answer — so the screen says so up front rather than
+        // offering a button that always refuses.
+        isBridge: self != null && plugin.toLowerCase() === self.toLowerCase(),
+        files: [],
+      })
+    }
+
+    groups.get(key).files.push({
+      path: String(file.path),
+      bytes: Number(file.bytes) || 0,
+      modified: file.modified ? Number(file.modified) : null,
+      editable: file.editable !== false,
+      ...(file.reason ? { reason: String(file.reason) } : {}),
+    })
+  }
+
+  return {
+    root: catalogue.root ? String(catalogue.root) : null,
+    self,
+    truncated: Boolean(catalogue.truncated),
+    limits: catalogue.limits || null,
+    plugins: [...groups.values()].sort((a, b) => a.plugin.localeCompare(b.plugin)),
+    loaded: loaded
+      .map((p) => ({ name: String(p.name), title: p.title || null, version: p.version || null }))
+      .sort((a, b) => a.name.localeCompare(b.name)),
+  }
+}
+
+/** Whether this file is the bridge's own config, by the name the plugin gave. */
+function isBridgeConfig(path, self) {
+  if (!self) return false
+  const plugin = String(path).includes('/') ? String(path).split('/')[0] : String(path).replace(/\.json$/i, '')
+  return plugin.toLowerCase() === String(self).toLowerCase()
+}
+
+/** The locked keys for a file: three of them in our own config, none anywhere else. */
+function lockedKeysFor(path, self) {
+  return isBridgeConfig(path, self) ? LOCKED_KEYS : []
+}
+
+/**
+ * Turns one file the host sent into what the form renders.
+ *
+ * The text is passed through untouched. What is added is the READING of it: the
+ * field list, which fields are locked, and which hold something a browser should
+ * mask by default.
+ */
+function shapeFile(file, { self = null, maxDepth = 6 } = {}) {
+  if (!file || typeof file.text !== 'string') return null
+
+  const locked = lockedKeysFor(file.path, self)
+  let fields = null
+  let parseError = null
+
+  try {
+    fields = configEdit.describe(configEdit.scan(file.text), { maxDepth, locked })
+  } catch (err) {
+    // A config already broken on disk still opens — in the raw tier, which is
+    // the only thing that can fix it. A page that refused to show a broken file
+    // would send somebody to SSH for the one job this feature exists to do.
+    parseError = err.message
+  }
+
+  return {
+    path: String(file.path),
+    plugin: file.plugin ? String(file.plugin) : null,
+    version: String(file.version),
+    bytes: Number(file.bytes) || 0,
+    modified: file.modified ? Number(file.modified) : null,
+    text: file.text,
+    fields,
+    parseError,
+    locked: locked.map((key) => ({ key, reason: LOCKED_REASON[key.toLowerCase()] || null })),
+    isBridge: isBridgeConfig(file.path, self),
+  }
+}
+
+/**
+ * Which locked keys differ between two versions of a document.
+ *
+ * The form refuses a locked field by pointer, but the **raw tier submits a whole
+ * document**, and a document can change `Port` without anything resembling an
+ * edit to a field. So the raw tier is checked the only way it can be: by
+ * comparing the literals before and after.
+ *
+ * A file that will not parse is not a way around this — an unparseable document
+ * is refused before it gets here.
+ */
+function lockedChanges(before, after, locked) {
+  if (!locked || locked.length === 0) return []
+
+  let a
+  let b
+
+  try {
+    a = configEdit.scan(before)
+    b = configEdit.scan(after)
+  } catch {
+    // Nothing can be compared, so nothing is cleared. The caller refuses.
+    return locked.slice()
+  }
+
+  const literal = (root, key) => {
+    if (root.type !== 'object') return null
+    const node = root.children.find((c) => String(c.key).toLowerCase() === key.toLowerCase())
+    return node ? JSON.stringify(node.value) + ':' + (node.raw || '') : null
+  }
+
+  return locked.filter((key) => literal(a, key) !== literal(b, key))
+}
+
+/** Every change a report says landed, as one line per file. */
+function summariseReport(report) {
+  if (!report || typeof report !== 'object') return null
+
+  const files = Array.isArray(report.files) ? report.files : []
+
+  return {
+    ok: report.ok !== false,
+    reloaded: Boolean(report.reloaded),
+    rolledBack: Boolean(report.rolledBack),
+    // Protocol 13: the files are written and the reload has not finished. The
+    // outcome follows as a `config.outcome` frame naming `writeId`.
+    pending: Boolean(report.pending),
+    writeId: report.writeId ? String(report.writeId) : null,
+    ceilingMs: Number(report.ceilingMs) > 0 ? Number(report.ceilingMs) : null,
+    restored: typeof report.restored === 'boolean' ? report.restored : null,
+    reason: report.reason ? String(report.reason) : null,
+    // The plugin only reads this on the failure path, and it is the difference
+    // between "your change was undone" and "your change was undone BECAUSE line
+    // 14 is not valid for that field".
+    log: report.log ? String(report.log).slice(-4000) : null,
+    files: files.map((f) => ({
+      path: String(f.path),
+      version: f.version ? String(f.version) : null,
+      bytes: f.bytes != null ? Number(f.bytes) : null,
+      // Both frameworks merge missing defaults on load and save the file back,
+      // so the file after a successful reload is regularly not the file we
+      // wrote. Saying so keeps an operator from reading it as our bug.
+      rewritten: Boolean(f.rewritten),
+    })),
+  }
+}
+
+/**
+ * How long a pending write may go unanswered before it is lost, in seconds.
+ *
+ * The plugin waits at most one ceiling for the edit's reload and one more for a
+ * restore's; ingest reads the feed every few seconds on top. Past both, with a
+ * margin, nothing is coming — the plugin was reloaded or the link dropped — and
+ * the page says so instead of spinning. A plugin that sent no ceiling gets the
+ * one protocol 13 shipped with.
+ */
+const SETTLE_SLACK_SECONDS = 20
+const DEFAULT_CEILING_MS = 30 * 1000
+
+function settleSeconds(ceilingMs) {
+  const ceiling = Number(ceilingMs) > 0 ? Number(ceilingMs) : DEFAULT_CEILING_MS
+  return Math.ceil((2 * ceiling) / 1000) + SETTLE_SLACK_SECONDS
+}
+
+/**
+ * A `config.outcome` frame as the row it settles, or null when it names no write.
+ *
+ * `applied` covers every case where the edit is on disk — reloaded, or standing
+ * because the framework never reloaded it (the reason says which). A rollback is
+ * `rolled-back` whether or not the plugin came back on the old file; `restored`
+ * says which, and it is the difference between "try again" and "go and look".
+ */
+function outcomeOf(frame) {
+  if (!frame || typeof frame !== 'object' || !frame.writeId) return null
+
+  const report = summariseReport(frame)
+  const first = report.files[0]
+
+  return {
+    writeId: String(frame.writeId),
+    outcome: report.rolledBack ? 'rolled-back' : 'applied',
+    reloaded: report.reloaded,
+    restored: report.rolledBack ? report.restored : null,
+    versionAfter: first ? first.version : null,
+    detail: report.reason,
+    log: report.log,
+  }
+}
+
+module.exports = {
+  LOCKED_KEYS,
+  LOCKED_REASON,
+  PATH_SHAPE,
+  isPlausiblePath,
+  shapeCatalogue,
+  shapeFile,
+  isBridgeConfig,
+  lockedKeysFor,
+  lockedChanges,
+  summariseReport,
+  outcomeOf,
+  settleSeconds,
+}

server/model/events/events.db.js

@@ -272,6 +272,38 @@ async function presenceFor(serverId) {
   )
 }
 
+/**
+ * Login attempts in `[from, to]` that no approval answered (D64).
+ *
+ * An attempt is answered by a `player.approved` for the same Steam id on the
+ * same server stamped from `slackMs` before it to `windowMs` after it. The
+ * slack is clock grain: both frames come off one game thread, and an approval
+ * stamped a millisecond "early" is still the answer.
+ *
+ * Grouped on (steam id, t) because a cursor replayed after a crash can store the
+ * same attempt twice, and one attempt is one denial however often it was
+ * written down.
+ */
+async function unapprovedLogins({ serverId, from, to, windowMs, slackMs }) {
+  return core.query(
+    `SELECT a.steam_id AS steamId, a.t AS t,
+            MAX(JSON_UNQUOTE(JSON_EXTRACT(a.raw, '$.name'))) AS name
+       FROM ${EVENTS} a
+      WHERE a.server_id = ? AND a.kind = 'player.login.attempt'
+        AND a.steam_id IS NOT NULL AND a.t BETWEEN ? AND ?
+        AND NOT EXISTS (
+          SELECT 1 FROM ${EVENTS} b
+           WHERE b.server_id = a.server_id AND b.kind = 'player.approved'
+             AND b.steam_id = a.steam_id
+             AND b.t BETWEEN a.t - ? AND a.t + ?
+        )
+      GROUP BY a.steam_id, a.t
+      ORDER BY a.t ASC
+      LIMIT 200`,
+    [serverId, from, to, slackMs, windowMs],
+  )
+}
+
 module.exports = {
   getCursor,
   setCursor,
@@ -286,4 +318,5 @@ module.exports = {
   leaderboard,
   listWipes,
   presenceFor,
+  unapprovedLogins,
 }

server/model/events/events.model.js

@@ -51,8 +51,8 @@ function parseKinds(raw) {
  * refused: naming it in an error would confirm the kind exists, which is a small
  * thing to leak and a free one to avoid.
  */
-async function recent({ serverId, admin = false, kind = null, wipeId = null, limit }) {
-  const kinds = catalogue.kindsFor({ admin, requested: parseKinds(kind) })
+async function recent({ serverId, admin = false, presence = false, kind = null, wipeId = null, limit }) {
+  const kinds = catalogue.kindsFor({ admin, presence, requested: parseKinds(kind) })
 
   // Every requested kind was refused. Answering with an empty list is right —
   // the events they asked for are, as far as they are concerned, not there.
@@ -102,7 +102,7 @@ function shape(row) {
  * counters, so the two can never disagree — which is the whole reason R12's
  * "per-wipe detail plus all-time rollups" is one table and not two.
  */
-async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit }) {
+async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit, presence = false }) {
   const rows = await db.leaderboard({
     serverId,
     wipeId,
@@ -118,7 +118,11 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit }) {
     npcKills: Number(r.npcKills) || 0,
     structures: Number(r.structures) || 0,
     playtimeSec: Number(r.playtimeSec) || 0,
-    lastSeen: r.lastSeen || null,
+    // Withheld below the presence audience. A tally refreshes it every minute a
+    // player is on, so a `lastSeen` of forty seconds ago is the Online tab by
+    // another name. The ORDER still uses it as a tie-break — that says who was
+    // on more recently, never whether anybody is on now.
+    ...(presence ? { lastSeen: r.lastSeen || null } : {}),
   }))
 }
 

server/model/links/links.db.js

@@ -0,0 +1,198 @@
+// ── SQL, and nothing else ─────────────────────────────────────────────────
+//
+// The `.db.js` half of the pair (see `servers.db.js` for why the split earns its
+// keep). Raw parameterised SQL through `core.query`, placeholders always.
+
+const core = require('../../core')
+
+const LINKS = 'rust_account_links'
+const PLAYERS = 'rust_players'
+const STATS = 'rust_player_wipe_stats'
+const EVENTS = 'rust_events'
+
+/**
+ * The link for one Steam id, or undefined.
+ *
+ * Joins core's `users` for the username, because every caller that asks "who
+ * owns this?" wants a name rather than an integer — and the one caller that
+ * refuses a re-link has to be able to say *whose* it is.
+ */
+async function getBySteamId(steamId) {
+  const rows = await core.query(
+    `SELECT l.steam_id AS steamId, l.user_id AS userId, l.name, l.server_id AS serverId,
+            l.linked_at AS linkedAt, u.username
+       FROM ${LINKS} l
+       JOIN users u ON u.id = l.user_id
+      WHERE l.steam_id = ?`,
+    [steamId],
+  )
+  return rows[0]
+}
+
+/**
+ * Every Steam account one website user holds, newest first.
+ *
+ * **It joins `rust_players` for the name the game last saw**, and that is not a
+ * convenience. The name on the LINK is what the player was called at the moment
+ * they linked, which is a Rust name and changes on a whim — so a player who has
+ * renamed since sees a name they no longer use, on the one page of the site that
+ * is about who they are. The admin panel already preferred the newer one; this
+ * is the same rule applied where the person themselves is reading.
+ *
+ * A LEFT JOIN, because a player can link an account and never play on it.
+ */
+async function listForUser(userId) {
+  return core.query(
+    `SELECT l.steam_id AS steamId, l.user_id AS userId, l.name, l.server_id AS serverId,
+            l.linked_at AS linkedAt, p.name AS playerName
+       FROM ${LINKS} l
+       LEFT JOIN ${PLAYERS} p ON p.steam_id = l.steam_id
+      WHERE l.user_id = ?
+      ORDER BY l.linked_at DESC`,
+    [userId],
+  )
+}
+
+/**
+ * Record a link.
+ *
+ * **A plain INSERT, never an upsert**, and that is the whole of D23 expressed in
+ * SQL. `ON DUPLICATE KEY UPDATE` here would silently move a Steam id from one
+ * website account to another — which, once phase 7 makes a link a privilege path
+ * and phase 13 makes it an entitlement, is an account takeover performed by
+ * typing a six-character code. The duplicate-key error is the refusal, and the
+ * controller turns it into a sentence.
+ */
+async function insert({ steamId, userId, name, serverId }) {
+  await core.query(
+    `INSERT INTO ${LINKS} (steam_id, user_id, name, server_id)
+     VALUES (?, ?, ?, ?)`,
+    [steamId, userId, name || null, serverId || null],
+  )
+}
+
+/**
+ * Remove a link the caller owns.
+ *
+ * Scoped by `user_id` in the statement rather than checked before it: a delete
+ * that reads, decides, then writes has a gap between the read and the write, and
+ * this way the ownership test and the deletion are the same operation. Answers
+ * how many rows went, so a caller can tell "removed" from "was not yours".
+ */
+async function removeOwned(steamId, userId) {
+  const result = await core.query(
+    `DELETE FROM ${LINKS} WHERE steam_id = ? AND user_id = ?`,
+    [steamId, userId],
+  )
+  return Number(result && result.affectedRows) || 0
+}
+
+/**
+ * Remove a link whoever holds it — the in-game `/unlink` path, and the staff
+ * unlink on the `admin.users.detail` panel (D25).
+ *
+ * Unscoped by user on purpose: neither caller is the link's owner and both have
+ * already established their authority another way. In game the authority is the
+ * Steam account itself — whoever is connected as it is who it is; on the admin
+ * panel it is the tier gate. Which is why the admin caller writes an
+ * `activity.log` entry naming the operator and this does not: it cannot tell the
+ * two apart, and a log line that guessed would be worse than none.
+ */
+async function removeBySteamId(steamId) {
+  const result = await core.query(`DELETE FROM ${LINKS} WHERE steam_id = ?`, [steamId])
+  return Number(result && result.affectedRows) || 0
+}
+
+/**
+ * Every link one user holds, enriched with what this module knows about that
+ * player — for the `admin.users.detail` panel.
+ *
+ * A LEFT JOIN, because a player can link an account and never play on it. An
+ * operator looking at that user should see the link, not an empty panel.
+ */
+async function listForUserWithPlayer(userId) {
+  return core.query(
+    `SELECT l.steam_id AS steamId, l.name, l.server_id AS serverId, l.linked_at AS linkedAt,
+            p.name AS playerName, p.first_seen AS firstSeen, p.last_seen AS lastSeen
+       FROM ${LINKS} l
+       LEFT JOIN ${PLAYERS} p ON p.steam_id = l.steam_id
+      WHERE l.user_id = ?
+      ORDER BY l.linked_at DESC`,
+    [userId],
+  )
+}
+
+/**
+ * Per-server all-time totals for one Steam id.
+ *
+ * The same rows the public leaderboard sums, grouped by server instead of
+ * filtered to one — so an operator sees a player across the fleet in one read.
+ * All-time, deliberately: an admin looking at a user wants their history, not
+ * this week's.
+ */
+async function statsForSteamId(steamId) {
+  return core.query(
+    `SELECT s.server_id AS serverId, srv.name AS serverName,
+            SUM(s.kills)        AS kills,
+            SUM(s.deaths)       AS deaths,
+            SUM(s.npc_kills)    AS npcKills,
+            SUM(s.structures)   AS structures,
+            SUM(s.playtime_sec) AS playtimeSec,
+            MAX(s.last_seen)    AS lastSeen,
+            COUNT(DISTINCT s.wipe_id) AS wipes
+       FROM ${STATS} s
+       LEFT JOIN rust_servers srv ON srv.id = s.server_id
+      WHERE s.steam_id = ?
+      GROUP BY s.server_id, srv.name
+      ORDER BY SUM(s.playtime_sec) DESC`,
+    [steamId],
+  )
+}
+
+/**
+ * Which of these Steam ids are linked, and to whom.
+ *
+ * The one question every notification asks — "who on the website is this
+ * player?" — asked for a set at once, because a raid names a cupboard's whole
+ * authorisation list and a clan event a whole roster. An unlinked id is simply
+ * absent from the answer: there is nobody to tell.
+ */
+async function userIdsForSteamIds(steamIds) {
+  if (!steamIds.length) return []
+  const marks = steamIds.map(() => '?').join(', ')
+  return core.query(
+    `SELECT steam_id AS steamId, user_id AS userId FROM ${LINKS} WHERE steam_id IN (${marks})`,
+    steamIds,
+  )
+}
+
+/**
+ * The servers that handed out a link code in the last `windowSec` (PLAN_FIXES F5).
+ *
+ * Every `/link` in game emits `account.link.requested`, which ingest stores like
+ * any frame — without the code, which travels through the player. So the site
+ * cannot know WHICH server minted a code, but it does know which servers minted
+ * one at all. Read on the database's clock (`created_at`, set at ingest) rather
+ * than the frame's `t`, which is the game host's clock.
+ */
+async function recentLinkIssuers(windowSec) {
+  const rows = await core.query(
+    `SELECT DISTINCT server_id AS serverId FROM ${EVENTS}
+      WHERE kind = 'account.link.requested'
+        AND created_at >= NOW() - INTERVAL ? SECOND`,
+    [Number(windowSec)],
+  )
+  return rows.map((row) => String(row.serverId))
+}
+
+module.exports = {
+  recentLinkIssuers,
+  getBySteamId,
+  listForUser,
+  listForUserWithPlayer,
+  insert,
+  removeOwned,
+  removeBySteamId,
+  statsForSteamId,
+  userIdsForSteamIds,
+}

server/model/links/links.model.js

@@ -0,0 +1,304 @@
+// ── Who owns which Steam account ──────────────────────────────────────────
+//
+// R1's identity link, site-side. The flow it sits in the middle of:
+//
+//   1. In game, a player types `/link`. The plugin mints a one-time code, tells
+//      them privately, and holds it in memory for five minutes.
+//   2. On the website, the player types that code. This module asks the sidecar,
+//      which asks the plugin, which answers with the Steam id the code belongs
+//      to and drops it.
+//   3. This file records the result.
+//
+// **The site is the author of record and the game holds nothing.** That is the
+// one real difference from the UO bridge, which writes a tag onto the game
+// account: there is no equivalent per-account store in Rust that survives a wipe,
+// and phase 7 needs the site to be authoritative anyway — it pushes permissions
+// INTO the game keyed by Steam id. A copy in the game would be a second thing to
+// reconcile every wipe, for no question it could answer better.
+
+const core = require('../../core')
+const db = require('./links.db')
+const engagement = require('../../engagement/emit')
+const servers = require('../servers/servers.model')
+const sidecar = require('../../sidecarClient')
+
+const log = core.logger('links')
+
+/**
+ * How far back a code's mint counts (F5): the plugin's five-minute `CodeTtl`,
+ * plus a minute for a frame that reached this site late — a sidecar that
+ * reconnected, a cursor catching up. Too wide costs nothing but the old
+ * "unsure" answer for a little longer; too narrow would call a live code wrong.
+ */
+const LINK_WINDOW_SEC = 6 * 60
+
+/**
+ * A link changed, so a clan member's website account changed (D57).
+ *
+ * Core resolves a Team member's `userId` from the provider's answer, and that
+ * answer comes from this table. Without asking, a member who links today is not
+ * a member of their clan's Team on the site until core's next scheduled sweep —
+ * fifteen minutes by default — which is exactly when a player tries the clan
+ * forum for the first time. A request, not a wait: it returns at once and never
+ * throws into the link flow.
+ */
+function linksChanged(reason) {
+  try {
+    core.teams.reconcile({ reason })
+  } catch (err) {
+    log.warn('could not ask core to reconcile Teams after a link change', { reason, error: err.message })
+  }
+}
+
+/** What a link looks like to any caller. Never carries a raw code. */
+function shape(row) {
+  if (!row) return null
+  return {
+    steamId: row.steamId,
+    name: row.name || null,
+    serverId: row.serverId || null,
+    linkedAt: row.linkedAt,
+  }
+}
+
+/**
+ * The Steam accounts one website user holds.
+ *
+ * The name is the one the GAME last saw, falling back to the one recorded when
+ * they linked — the rule the admin panel already used, applied on the page the
+ * player themselves reads. A browser walk found the two disagreeing: staff saw
+ * `Wanderer` and the player saw `Wanderer-old`, for the same person on the same
+ * site.
+ */
+async function listForUser(userId) {
+  return (await db.listForUser(userId)).map((row) => ({
+    ...shape(row),
+    name: row.playerName || row.name || null,
+  }))
+}
+
+/** True when this user holds this Steam id. The ownership gate every player read uses. */
+async function owns(steamId, userId) {
+  const row = await db.getBySteamId(steamId)
+  return Boolean(row && Number(row.userId) === Number(userId))
+}
+
+/**
+ * Redeem a code against one server, and record the link.
+ *
+ * Answers a discriminated result rather than throwing, because every outcome
+ * here is a sentence somebody has to read:
+ *
+ *   `{ ok: true, link }`               — linked
+ *   `{ ok: false, reason: 'rejected' }`— the game says that code is not good
+ *   `{ ok: false, reason: 'taken', username }` — someone else holds that Steam id
+ *   `{ ok: false, reason: 'offline' }` — the game or its sidecar did not answer
+ *
+ * **`rejected` deliberately collapses "unknown" and "expired".** The plugin
+ * distinguishes them and an operator reading its log can too; a stranger typing
+ * codes must not learn which of the two they hit, because that is the difference
+ * between "keep guessing" and "guess faster".
+ */
+async function confirmOne({ server, code, userId }) {
+  const result = await sidecar.confirmLink(server, code)
+
+  // The transport failed: the sidecar is unreachable, the game is not connected,
+  // or the reply never came. None of those is a verdict on the code, so the
+  // player is told to try again rather than that their code is wrong.
+  if (!result.ok) {
+    log.warn('link confirm did not reach the game', { server: server.id, status: result.status })
+    return { ok: false, reason: 'offline' }
+  }
+
+  const frame = result.data || {}
+
+  // The plugin's own refusal. `frame.reason` is `unknown`, `expired` or
+  // `malformed`; it is logged and not surfaced (see the doc above).
+  if (frame.kind !== 'link.ok' || !frame.steamId) {
+    log.info('link code refused', { server: server.id, reason: frame.reason || frame.kind || 'unknown' })
+    return { ok: false, reason: 'rejected' }
+  }
+
+  const steamId = String(frame.steamId)
+  const held = await db.getBySteamId(steamId)
+
+  // D23: refuse, and say whose it is. A move would transfer every permission and
+  // entitlement phases 7 and 13 hang off this link, on a code anybody in game
+  // could have run — and the player's way out is `/unlink` in game, which they
+  // can reach from the machine they are sitting at.
+  if (held) {
+    if (Number(held.userId) === Number(userId)) {
+      // Already theirs. Not an error: a player who pressed the button twice, or
+      // one whose code was confirmed on a request that then timed out.
+      return { ok: true, link: shape(held), already: true }
+    }
+    return { ok: false, reason: 'taken', username: held.username }
+  }
+
+  try {
+    await db.insert({
+      steamId,
+      userId,
+      name: frame.name || null,
+      serverId: server.id,
+    })
+  } catch (err) {
+    // The race the PRIMARY KEY exists for: two confirmations of the same Steam
+    // id, interleaved between the check above and this write. The key refuses the
+    // second and it becomes the same refusal, rather than a 500.
+    if (err && (err.code === 'ER_DUP_ENTRY' || err.errno === 1062)) {
+      const now = await db.getBySteamId(steamId)
+      if (now && Number(now.userId) === Number(userId)) {
+        return { ok: true, link: shape(now), already: true }
+      }
+      return { ok: false, reason: 'taken', username: now && now.username }
+    }
+    throw err
+  }
+
+  const link = shape(await db.getBySteamId(steamId))
+  log.info('steam account linked', { steamId, userId, server: server.id })
+  linksChanged('rust account linked')
+  // Only a NEW link is news. The `already` path above is somebody pressing the
+  // button twice, and telling them twice would make the notice meaningless for
+  // the one case it exists for: a link they did not make.
+  engagement.linked({ userId, steamId, name: frame.name })
+  return { ok: true, link }
+}
+
+/**
+ * Redeem a code against the fleet (D24).
+ *
+ * **A code is minted by ONE server and the player types six characters into a
+ * browser**, so the site cannot know which server it came from — nothing in the
+ * code says, and asking the player to pick would make a wrong guess
+ * indistinguishable from a wrong code, which is the one refusal that must not be
+ * ambiguous. So every enabled server is asked in turn and the first `link.ok`
+ * wins. The others answer `unknown` and nothing happens there: a code is only
+ * spent at the server that actually holds it.
+ *
+ * The loop stops early on `taken`, because that is a verdict about the Steam id
+ * rather than about this server — asking the rest of the fleet would produce the
+ * same answer more slowly.
+ *
+ * **"Every reachable server refused" is not the same answer as "a server was
+ * unreachable"**, and collapsing them is how a player who linked on the one
+ * server that is down gets told their code is wrong. `unsure` is that case, and
+ * the sentence it earns says to try again rather than to run `/link` again.
+ */
+async function redeem({ code, userId }) {
+  const fleet = await servers.listForPolling()
+
+  if (fleet.length === 0) return { ok: false, reason: 'no-servers' }
+
+  // **Who could hold this code** (PLAN_FIXES F5). The first walk, with five of
+  // seven servers down, answered a spent code and a made-up `ZZZZZZ` alike with
+  // "one of the servers could not be reached — your code is still good", and
+  // would have for as long as any server stayed down. A code lives five minutes
+  // on the server that minted it, and every mint is an `account.link.requested`
+  // this site has stored — so only a server that minted one recently can hold it,
+  // and only one of THOSE being unreachable is a reason to be unsure.
+  const recent = new Set(await db.recentLinkIssuers(LINK_WINDOW_SEC))
+  const issuers = fleet.filter((server) => recent.has(String(server.id)))
+  const others = fleet.filter((server) => !recent.has(String(server.id)))
+
+  // **In parallel** (F6). One at a time, the walk's redeem waited about four
+  // seconds on each dead server in turn — twenty-one in all, the successful link
+  // included, because the rig sorted last. The issuers first, since the code is
+  // almost always on one of them; the rest only when none of them had it, which
+  // covers a code typed in the few seconds before its frame was ingested. Asking
+  // a server that does not hold the code costs nothing: it answers `unknown`, and
+  // a code is only ever spent where it was minted.
+  const asked = await Promise.all(issuers.map((server) => confirmOne({ server, code, userId })))
+  const settled = asked.find((result) => result.ok || result.reason === 'taken')
+  if (settled) return settled
+
+  const rest = await Promise.all(others.map((server) => confirmOne({ server, code, userId })))
+  const late = rest.find((result) => result.ok || result.reason === 'taken')
+  if (late) return late
+
+  const every = [...asked, ...rest]
+  if (every.every((result) => result.reason === 'offline')) return { ok: false, reason: 'offline' }
+  if (asked.some((result) => result.reason === 'offline')) return { ok: false, reason: 'unsure' }
+
+  return { ok: false, reason: 'rejected' }
+}
+
+/** Remove a link the caller owns. False when they did not hold it. */
+async function unlinkOwned(steamId, userId) {
+  const removed = (await db.removeOwned(steamId, userId)) > 0
+  if (removed) linksChanged('rust account unlinked')
+  return removed
+}
+
+/**
+ * Remove a link whoever holds it.
+ *
+ * Two callers, both of which have already established their authority and
+ * neither of which is the link's owner: ingest applying an in-game `/unlink`
+ * (the authority is the Steam account — whoever is connected as it is who it
+ * is), and a staff unlink from the `admin.users.detail` panel (D25).
+ *
+ * It logs nothing about who asked, because the two callers record that
+ * differently: the admin one writes an `activity.log` entry naming the operator,
+ * and the game one has no operator to name.
+ */
+async function unlinkAnyOwner(steamId) {
+  const removed = (await db.removeBySteamId(steamId)) > 0
+  if (removed) linksChanged('rust account unlinked')
+  return removed
+}
+
+/**
+ * Remove a link because the player asked in game.
+ *
+ * Called from ingest, off an `account.unlinked` event.
+ */
+async function unlinkFromGame(steamId) {
+  const removed = await unlinkAnyOwner(steamId)
+  if (removed) log.info('steam account unlinked in game', { steamId })
+  return removed
+}
+
+/** The admin panel's read: every link this user holds, with per-server totals. */
+async function forAdmin(userId) {
+  const links = await db.listForUserWithPlayer(userId)
+
+  return Promise.all(
+    links.map(async (row) => ({
+      steamId: row.steamId,
+      // The name on the LINK is what they were called when they linked; the one
+      // on `rust_players` is what the game last saw. They differ the moment
+      // somebody renames, and the newer one is the useful one to show.
+      name: row.playerName || row.name || null,
+      linkedName: row.name || null,
+      serverId: row.serverId || null,
+      linkedAt: row.linkedAt,
+      firstSeen: row.firstSeen || null,
+      lastSeen: row.lastSeen || null,
+      servers: (await db.statsForSteamId(row.steamId)).map((s) => ({
+        serverId: s.serverId,
+        serverName: s.serverName || s.serverId,
+        kills: Number(s.kills) || 0,
+        deaths: Number(s.deaths) || 0,
+        npcKills: Number(s.npcKills) || 0,
+        structures: Number(s.structures) || 0,
+        playtimeSec: Number(s.playtimeSec) || 0,
+        wipes: Number(s.wipes) || 0,
+        lastSeen: s.lastSeen || null,
+      })),
+    })),
+  )
+}
+
+module.exports = {
+  shape,
+  listForUser,
+  owns,
+  confirmOne,
+  redeem,
+  unlinkOwned,
+  unlinkAnyOwner,
+  unlinkFromGame,
+  forAdmin,
+}

server/model/map/map.db.js

@@ -0,0 +1,147 @@
+// ── SQL for the map ───────────────────────────────────────────────────────
+//
+// Three things: the picture each server's map is drawn on (`rust_map_images`),
+// the per-server overrides of the map's switches (`rust_map_overrides`), and the
+// two reads the own-and-mates view needs — which Steam accounts a website user
+// holds, and who shares a clan with them on one server.
+//
+// Nothing here stores a POSITION. Where people are is asked for while somebody
+// is looking and kept in memory for seconds (D111, `mapLive.js`).
+
+const core = require('../../core')
+
+const IMAGES = 'rust_map_images'
+const OVERRIDES = 'rust_map_overrides'
+const LINKS = 'rust_account_links'
+const CLANS = 'rust_clans'
+const MEMBERS = 'rust_clan_members'
+
+/** The columns every read but the picture's own wants — everything except the bytes. */
+const META = `server_id AS serverId, map_key AS mapKey, sha256, source, width, height,
+              ocean_margin AS oceanMargin, world_size AS worldSize, grid_cells AS gridCells,
+              grid_cell_size AS gridCellSize, background, derivation, monuments,
+              OCTET_LENGTH(bytes) AS byteCount, fetched_at AS fetchedAt`
+
+/** One server's picture row without the bytes, or undefined. */
+async function getMeta(serverId) {
+  const rows = await core.query(`SELECT ${META} FROM ${IMAGES} WHERE server_id = ?`, [serverId])
+  return rows[0]
+}
+
+/** Every server's picture row without the bytes, for the admin card. */
+async function listMeta() {
+  return core.query(`SELECT ${META} FROM ${IMAGES}`)
+}
+
+/**
+ * The picture itself, but only if it is still the one named. A URL carries the
+ * hash it was minted for, and a picture replaced since must not be served under
+ * it: the response is cached as immutable.
+ */
+async function getBytes(serverId, sha256) {
+  const rows = await core.query(
+    `SELECT bytes FROM ${IMAGES} WHERE server_id = ? AND sha256 = ? AND bytes IS NOT NULL`,
+    [serverId, sha256],
+  )
+  return rows[0] ? rows[0].bytes : null
+}
+
+/**
+ * Replace one server's row whole, in ONE statement. A new map's picture and its
+ * geometry arrive together or not at all; a reader never sees the new bytes
+ * under the old monuments.
+ */
+async function putImage(row) {
+  await core.query(
+    `REPLACE INTO ${IMAGES}
+       (server_id, map_key, sha256, source, width, height, ocean_margin, world_size,
+        grid_cells, grid_cell_size, background, derivation, monuments, bytes, fetched_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)`,
+    [
+      row.serverId, row.mapKey, row.sha256 || null, row.source, row.width, row.height, row.oceanMargin,
+      row.worldSize, row.gridCells, row.gridCellSize, row.background || null, row.derivation,
+      JSON.stringify(row.monuments || []), row.bytes || null,
+    ],
+  )
+}
+
+/**
+ * Re-derive a row's geometry and monuments without touching its picture — the
+ * `DERIVATION_VERSION` path, and a map whose picture is unchanged but whose
+ * source moved (a render replaced by the Rust+ cache of the same bytes).
+ */
+async function putGeometry(row) {
+  await core.query(
+    `UPDATE ${IMAGES}
+        SET source = ?, width = ?, height = ?, ocean_margin = ?, world_size = ?, grid_cells = ?,
+            grid_cell_size = ?, background = ?, derivation = ?, monuments = ?
+      WHERE server_id = ? AND map_key = ?`,
+    [
+      row.source, row.width, row.height, row.oceanMargin, row.worldSize, row.gridCells, row.gridCellSize,
+      row.background || null, row.derivation, JSON.stringify(row.monuments || []), row.serverId, row.mapKey,
+    ],
+  )
+}
+
+/** Every override for one server, as `{ setting: value }` rows. */
+async function getOverrides(serverId) {
+  return core.query(`SELECT setting, value FROM ${OVERRIDES} WHERE server_id = ?`, [serverId])
+}
+
+/** Every override in the fleet, for the admin card. */
+async function listOverrides() {
+  return core.query(`SELECT server_id AS serverId, setting, value FROM ${OVERRIDES}`)
+}
+
+/** Set (a word) or clear (`null`) one server's override of one switch. */
+async function setOverride(serverId, setting, value, userId = null) {
+  if (value === null) {
+    await core.query(`DELETE FROM ${OVERRIDES} WHERE server_id = ? AND setting = ?`, [serverId, setting])
+    return
+  }
+  await core.query(
+    `INSERT INTO ${OVERRIDES} (server_id, setting, value, updated_by, updated_at)
+          VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE value = VALUES(value), updated_by = VALUES(updated_by),
+                             updated_at = CURRENT_TIMESTAMP`,
+    [serverId, setting, value, userId],
+  )
+}
+
+/** Every Steam id one website user has linked. A link reaches every server (D28). */
+async function steamIdsForUser(userId) {
+  const rows = await core.query(`SELECT steam_id AS steamId FROM ${LINKS} WHERE user_id = ?`, [userId])
+  return rows.map((r) => String(r.steamId))
+}
+
+/**
+ * Every Steam id sharing a first-party clan with any of `steamIds` on ONE
+ * server (D115, D117) — the viewer's own accounts included, since they are
+ * members too. A clan the board no longer carries (`gone_at`) is nobody's clan.
+ */
+async function clanMatesOn(serverId, steamIds) {
+  if (!steamIds.length) return []
+  const rows = await core.query(
+    `SELECT DISTINCT m2.steam_id AS steamId
+       FROM ${MEMBERS} m1
+       JOIN ${CLANS} c ON c.external_id = m1.external_id
+       JOIN ${MEMBERS} m2 ON m2.external_id = m1.external_id
+      WHERE c.server_id = ? AND c.gone_at IS NULL
+        AND m1.steam_id IN (${steamIds.map(() => '?').join(', ')})`,
+    [serverId, ...steamIds],
+  )
+  return rows.map((r) => String(r.steamId))
+}
+
+module.exports = {
+  getMeta,
+  listMeta,
+  getBytes,
+  putImage,
+  putGeometry,
+  getOverrides,
+  listOverrides,
+  setOverride,
+  steamIdsForUser,
+  clanMatesOn,
+}

server/model/map/map.model.js

@@ -0,0 +1,414 @@
+// ── The map: who may see which layer, and what a viewer is sent ───────────
+//
+// R9's security boundary, and the reason this file exists apart from the
+// picture machinery in `mapImages.js`: **public player positions in Rust locate
+// players, and base positions are where they sleep.** So every layer has its own
+// audience (D112), a fleet default with a per-server override (D114), and a
+// viewer is SENT only the layers they may see — a hidden layer is absent from the
+// answer, never present and hidden by the page (§30.2).
+//
+// ── The four layers ───────────────────────────────────────────────────────
+//
+//   world     monuments, and the world's own events: cargo, the patrol
+//             helicopter, the Chinook, Bradley, supply drops, locked crates
+//   events    what this site's events placed: zones, crates, NPCs (phase 13a)
+//   players   who is on the server and where, and the sleepers
+//   bases     tool cupboards and player vending machines, as positions only
+//
+// Defaults: the first two public, the last two staff. The audiences are the
+// presence rungs (`staff` · `signed_in` · `public`) and follow its asymmetric
+// fallbacks: an unknown stored word narrows to staff, an unknown viewer is
+// public (`model/visibility`).
+//
+// ── Two rules that make the players layer safe to widen ───────────────────
+//
+// **D113 — it can never show more than presence does.** Its effective audience
+// is the NARROWER of the layer's switch and the server's presence audience. An
+// operator who opens the map to the public while the roll call stays staff has
+// opened nothing: a name on a map says who is online as surely as a list does.
+//
+// **D115/D117 — own dot and clan mates.** A linked viewer sees their own
+// position (their sleeper too, §30.5) and their ONLINE first-party clan mates on
+// that server, whatever the players layer says — and only a linked member of the
+// same clan sees them. It is gated by its own switch (D118, default on) and by
+// nothing else: widening the roster widens who sees the member LIST, never where
+// the members are.
+
+const core = require('../../core')
+
+const db = require('./map.db')
+const visibility = require('../visibility/visibility.model')
+const visibilityDb = require('../visibility/visibility.db')
+
+const log = core.logger('map')
+
+const LAYERS = Object.freeze(['world', 'events', 'players', 'bases'])
+
+const DEFAULTS = Object.freeze({ world: 'public', events: 'public', players: 'staff', bases: 'staff' })
+
+/** D118: on, because it shows a member nothing the game does not already show them. */
+const DEFAULT_MATES = true
+
+const MATES_KEY = 'map.mates'
+
+const layerKey = (layer) => `map.layer.${layer}.audience`
+
+/** Every override setting name a server may carry. */
+const SETTINGS = Object.freeze([...LAYERS.map(layerKey), MATES_KEY])
+
+/**
+ * `DERIVATION_VERSION` (R9): how a row's geometry is worked out from what the
+ * plugin said. A stored row with an older number is re-derived from a fresh
+ * `map.info`, without fetching the picture again.
+ *
+ *   1  — width/height from the picture itself (or, with no picture, the Rust+
+ *        cache's geometry: half scale plus the ocean margin); the grid from the
+ *        game's own `MapHelper` (D119); the margin in PIXELS, unscaled.
+ */
+const DERIVATION_VERSION = 1
+
+/** The Rust+ cache's scale, used only to size a map that has no picture yet. */
+const CACHE_SCALE = 0.5
+
+/** How often the page asks for positions while visible, and how long the module keeps an answer. */
+const POLL_MS = 10000
+const LIVE_CACHE_MS = 5000
+
+/**
+ * What a render costs, measured on the rig (§30.0): 8.5 s for a 3000 map at
+ * half scale, a 2500 × 2500 picture. The work is per pixel, so the estimate for
+ * another size scales with its area.
+ */
+const RENDER_MEASURED = Object.freeze({ worldSize: 3000, seconds: 8.5 })
+
+function renderStallSeconds(worldSize, margin = 500) {
+  const side = (ws) => ws * CACHE_SCALE + 2 * margin
+  const size = Number(worldSize) > 0 ? Number(worldSize) : RENDER_MEASURED.worldSize
+  const ratio = (side(size) * side(size)) / (side(RENDER_MEASURED.worldSize) ** 2)
+  return Math.max(1, Math.round(RENDER_MEASURED.seconds * ratio))
+}
+
+/** A stored mates word as a boolean. Anything but `on` is off: an unknown word narrows. */
+const matesOn = (value) => value === 'on'
+
+/** The narrower of two audiences: the one fewer people satisfy. */
+function narrower(a, b) {
+  const ra = visibility.AUDIENCES.indexOf(visibility.normalise(a))
+  const rb = visibility.AUDIENCES.indexOf(visibility.normalise(b))
+  return visibility.AUDIENCES[Math.max(ra, rb)]
+}
+
+/** The fleet defaults, as stored, with the built-in defaults where nothing is. */
+async function fleet() {
+  const stored = await Promise.all([...LAYERS.map((l) => visibilityDb.getSetting(layerKey(l))), visibilityDb.getSetting(MATES_KEY)])
+  const out = {}
+  LAYERS.forEach((layer, i) => {
+    out[layer] = stored[i] == null ? DEFAULTS[layer] : visibility.normalise(stored[i])
+  })
+  const mates = stored[LAYERS.length]
+  out.mates = mates == null ? DEFAULT_MATES : matesOn(mates)
+  return out
+}
+
+/** Overrides rows as `{ world: 'staff', mates: false, … }`, only for what is set. */
+function overridesFrom(rows) {
+  const out = {}
+  for (const { setting, value } of rows) {
+    if (setting === MATES_KEY) out.mates = matesOn(value)
+    else {
+      const layer = LAYERS.find((l) => layerKey(l) === setting)
+      if (layer) out[layer] = visibility.normalise(value)
+    }
+  }
+  return out
+}
+
+/** What applies to one server: its overrides over the fleet. */
+async function forServer(serverId) {
+  const [base, rows] = await Promise.all([fleet(), db.getOverrides(serverId)])
+  return { ...base, ...overridesFrom(rows) }
+}
+
+/**
+ * Everything the public routes need to decide what one viewer gets on one
+ * server's map. Throws nothing: a setting that cannot be read hides every layer
+ * but the picture, which is the direction a map must fail in.
+ */
+async function access(req, serverId) {
+  try {
+    const [viewer, settings, presence] = await Promise.all([
+      visibility.viewer(req),
+      forServer(serverId),
+      visibility.presenceFor(serverId),
+    ])
+
+    const layers = {}
+    for (const layer of LAYERS) {
+      const audience = layer === 'players' ? narrower(settings.players, presence) : settings[layer]
+      layers[layer] = { visible: visibility.meets(viewer.level, audience), audience }
+    }
+    // Why the players layer is narrower than its own switch, when it is (D113):
+    // the page says "limited by who may see who is online" rather than nothing.
+    if (layers.players.audience !== visibility.normalise(settings.players)) layers.players.cappedByPresence = true
+
+    let steamIds = []
+    if (settings.mates && viewer.userId != null) steamIds = await db.steamIdsForUser(viewer.userId)
+
+    const mates = {
+      on: settings.mates,
+      linked: steamIds.length > 0,
+      visible: settings.mates && steamIds.length > 0,
+    }
+
+    return { level: viewer.level, userId: viewer.userId, layers, mates, steamIds }
+  } catch (err) {
+    log.warn('could not resolve map visibility; showing the picture only', { server: serverId, error: err.message })
+    const layers = {}
+    for (const layer of LAYERS) layers[layer] = { visible: false, audience: 'staff' }
+    return { level: 'public', userId: null, layers, mates: { on: false, linked: false, visible: false }, steamIds: [] }
+  }
+}
+
+/**
+ * The positions a viewer who is entitled to own-and-mates may see: their own
+ * accounts (online or asleep) and their ONLINE clan mates on this server. Empty
+ * for anybody else. Asked only when there is a live answer to filter.
+ */
+async function mateIdsFor(serverId, acc) {
+  if (!acc.mates.visible || !acc.steamIds.length) return { own: new Set(), mates: new Set() }
+  const own = new Set(acc.steamIds)
+  const clan = await db.clanMatesOn(serverId, acc.steamIds)
+  return { own, mates: new Set(clan.filter((id) => !own.has(id))) }
+}
+
+/**
+ * One live answer, cut down to what one viewer may see. **Pure**, and the
+ * security boundary in one function: a layer the viewer may not see is not in
+ * the result at all — not an empty array, not a flag — so there is nothing on
+ * the wire for a page to forget to hide.
+ *
+ * `mates` is the viewer's own dots and their online clan mates' (D115). It is
+ * the ONLY place a player position can appear below the players layer, and it
+ * never carries anybody outside the viewer's clan.
+ */
+function project(live, acc, ids = { own: new Set(), mates: new Set() }) {
+  const out = { mapKey: live.mapKey || null, t: live.t || null }
+
+  if (acc.layers.world.visible) out.world = Array.isArray(live.world) ? live.world : []
+  if (acc.layers.events.visible) out.events = Array.isArray(live.events) ? live.events : []
+  if (acc.layers.players.visible) {
+    out.players = Array.isArray(live.players) ? live.players : []
+    if (live.playersTruncated) out.playersTruncated = true
+  }
+  if (acc.layers.bases.visible) {
+    out.bases = Array.isArray(live.bases) ? live.bases : []
+    if (live.basesTruncated) out.basesTruncated = true
+  }
+
+  if (acc.mates.visible) {
+    const players = Array.isArray(live.players) ? live.players : []
+    out.mates = players
+      .filter((p) => ids.own.has(String(p.steamId)) || (ids.mates.has(String(p.steamId)) && p.online === true))
+      .map((p) => ({
+        steamId: String(p.steamId),
+        name: p.name,
+        x: p.x,
+        z: p.z,
+        sleeping: Boolean(p.sleeping),
+        online: p.online === true,
+        self: ids.own.has(String(p.steamId)),
+      }))
+  }
+
+  return out
+}
+
+/**
+ * A stored row as the geometry the page draws with. The picture's own size is
+ * the truth when there is one; without one the Rust+ cache's geometry stands in,
+ * so a server that has no picture yet draws its layers in the same frame a
+ * picture would later fill.
+ */
+function geometryOf(row) {
+  if (!row) return null
+  return {
+    worldSize: Number(row.worldSize),
+    oceanMargin: Number(row.oceanMargin),
+    width: Number(row.width),
+    height: Number(row.height),
+    gridCells: Number(row.gridCells),
+    gridCellSize: Number(row.gridCellSize),
+    background: row.background || null,
+  }
+}
+
+/**
+ * `map.info` as the row it becomes (without bytes). **Pure** — the one place
+ * `DERIVATION_VERSION` is applied.
+ */
+function derive(serverId, info) {
+  const worldSize = Number(info.worldSize) || 0
+  const oceanMargin = Number(info.oceanMargin) || 0
+  const hasPicture = info.source !== 'none' && Number(info.width) > 0 && Number(info.height) > 0
+  const side = Math.round(worldSize * CACHE_SCALE + 2 * oceanMargin)
+
+  return {
+    serverId,
+    mapKey: String(info.mapKey || ''),
+    sha256: hasPicture && info.sha256 ? String(info.sha256).toLowerCase() : null,
+    source: hasPicture ? String(info.source) : 'none',
+    width: hasPicture ? Number(info.width) : side,
+    height: hasPicture ? Number(info.height) : side,
+    oceanMargin,
+    worldSize,
+    gridCells: Number(info.gridCells) || 1,
+    gridCellSize: Number(info.gridCellSize) || worldSize,
+    background: typeof info.background === 'string' && /^#[0-9a-f]{6}$/i.test(info.background) ? info.background : null,
+    derivation: DERIVATION_VERSION,
+    monuments: Array.isArray(info.monuments)
+      ? info.monuments
+          .filter((m) => m && Number.isFinite(Number(m.x)) && Number.isFinite(Number(m.z)))
+          .map((m) => ({
+            value: String(m.value || ''),
+            kind: String(m.kind || ''),
+            label: String(m.label || m.kind || ''),
+            grid: m.grid ? String(m.grid) : null,
+            x: Number(m.x),
+            z: Number(m.z),
+          }))
+      : [],
+  }
+}
+
+/** Parse the stored monuments, never throwing: a row that will not parse draws none. */
+function monumentsOf(row) {
+  if (!row || !row.monuments) return []
+  try {
+    const parsed = typeof row.monuments === 'string' ? JSON.parse(row.monuments) : row.monuments
+    return Array.isArray(parsed) ? parsed : []
+  } catch (err) {
+    return []
+  }
+}
+
+// ── Admin ────────────────────────────────────────────────────────────────
+
+/** The Map card's switches: the fleet, and each server's overrides and effective values. */
+async function describeSwitches(servers) {
+  const [base, rows] = await Promise.all([fleet(), db.listOverrides()])
+  const byServer = new Map()
+  for (const row of rows) {
+    if (!byServer.has(row.serverId)) byServer.set(row.serverId, [])
+    byServer.get(row.serverId).push(row)
+  }
+
+  return {
+    layers: [...LAYERS],
+    defaults: { ...DEFAULTS, mates: DEFAULT_MATES },
+    fleet: base,
+    servers: servers.map((s) => {
+      const overrides = overridesFrom(byServer.get(s.id) || [])
+      const full = {}
+      for (const key of [...LAYERS, 'mates']) full[key] = key in overrides ? overrides[key] : null
+      return { id: s.id, overrides: full, effective: { ...base, ...overrides } }
+    }),
+  }
+}
+
+/**
+ * The Map card's write, validated whole before anything is written, like the
+ * rest of the visibility page.
+ *
+ *   { fleet: { world: 'public', …, mates: true },
+ *     servers: { <id>: { players: 'signed_in', mates: null, … } } }
+ *
+ * `null` clears an override. Resolves `{ ok, changed }` or `{ ok: false,
+ * status, message }`. `dryRun` validates and writes nothing, so a caller saving
+ * several things in one request can refuse the whole request up front.
+ */
+async function update({ fleet: fleetIn, servers } = {}, actor = null, serverExists = async () => true, { dryRun = false } = {}) {
+  const fleetChanges = []
+  const serverChanges = []
+
+  const check = (key, value, where, allowNull) => {
+    if (value === null && allowNull) return null
+    if (key === 'mates') {
+      if (typeof value !== 'boolean') return `The own-and-mates view is on or off${where}, not "${value}".`
+      return null
+    }
+    if (!LAYERS.includes(key)) return `"${key}" is not a map layer. The layers are: ${LAYERS.join(', ')}, and mates.`
+    if (!visibility.isAudience(value)) {
+      return `"${value}" is not an audience for the ${key} layer${where}. Choose one of: ${visibility.AUDIENCES.join(', ')}.`
+    }
+    return null
+  }
+
+  for (const [key, value] of Object.entries(fleetIn || {})) {
+    const problem = check(key, value, '', false)
+    if (problem) return { ok: false, status: 400, message: problem }
+    fleetChanges.push([key, value])
+  }
+
+  for (const [id, settings] of Object.entries(servers || {})) {
+    if (!settings || typeof settings !== 'object') {
+      return { ok: false, status: 400, message: `Server ${id}'s map switches must be an object.` }
+    }
+    // eslint-disable-next-line no-await-in-loop
+    if (!(await serverExists(id))) return { ok: false, status: 404, message: `There is no server called ${id}.` }
+    for (const [key, value] of Object.entries(settings)) {
+      const problem = check(key, value, ` on server ${id}`, true)
+      if (problem) return { ok: false, status: 400, message: problem }
+      serverChanges.push([id, key, value])
+    }
+  }
+
+  if (dryRun) return { ok: true, changed: {} }
+
+  const userId = actor && actor.id != null ? actor.id : null
+  const settingOf = (key) => (key === 'mates' ? MATES_KEY : layerKey(key))
+  const wordOf = (key, value) => (key === 'mates' ? (value ? 'on' : 'off') : value)
+
+  for (const [key, value] of fleetChanges) {
+    // eslint-disable-next-line no-await-in-loop
+    await visibilityDb.setSetting(settingOf(key), wordOf(key, value), userId)
+  }
+  for (const [id, key, value] of serverChanges) {
+    // eslint-disable-next-line no-await-in-loop
+    await db.setOverride(id, settingOf(key), value === null ? null : wordOf(key, value), userId)
+  }
+
+  const changed = {}
+  if (fleetChanges.length) changed.fleet = Object.fromEntries(fleetChanges)
+  if (serverChanges.length) {
+    changed.servers = {}
+    for (const [id, key, value] of serverChanges) {
+      changed.servers[id] = { ...(changed.servers[id] || {}), [key]: value === null ? 'inherit' : value }
+    }
+  }
+  return { ok: true, changed }
+}
+
+module.exports = {
+  LAYERS,
+  DEFAULTS,
+  DEFAULT_MATES,
+  MATES_KEY,
+  SETTINGS,
+  DERIVATION_VERSION,
+  POLL_MS,
+  LIVE_CACHE_MS,
+  RENDER_MEASURED,
+  layerKey,
+  renderStallSeconds,
+  narrower,
+  fleet,
+  forServer,
+  access,
+  mateIdsFor,
+  project,
+  geometryOf,
+  derive,
+  monumentsOf,
+  describeSwitches,
+  update,
+}

server/model/permissions/chatStyle.js

@@ -0,0 +1,175 @@
+// ── A group's BetterChat style, and the voice made from one (phase 17) ─────
+//
+// D138 puts all twelve of BetterChat's group fields on a site-authored group,
+// and D140 lets one styled group be the VOICE the module's own lines are said
+// in. Both are pure text work, so they live here, without a database or a game:
+//
+//   validateStyle  what an operator typed → the twelve values BetterChat's own
+//                  `chat group set` accepts, or one sentence per problem
+//   voiceFormat    a style → the format string `chat.say` carries: BetterChat's
+//                  markup with exactly one `{message}` in it
+//
+// Every value is TEXT, in the form BetterChat's setter parses — `true`/`false`,
+// a decimal integer, a colour — because text is what the plugin compares the
+// game's value against when it decides whether somebody edited a field by hand
+// (§33.2). Two spellings of one value would be drift that never happened.
+
+/** The longest a format may be (§33.4 reading 7). */
+const FORMAT_MAX = 128
+
+/** The longest a group's title may be. BetterChat has no limit; a chat line does. */
+const TITLE_MAX = 64
+
+/**
+ * The twelve fields, by the name BetterChat's API takes, each with its type and
+ * BetterChat 5.2.15's default. `Title`'s default is the group's own name in
+ * brackets, so it is worked out in `defaults`.
+ */
+const FIELDS = [
+  { name: 'Priority', type: 'int', min: -9999, max: 9999, default: '0' },
+  { name: 'Title', type: 'title', default: null },
+  { name: 'TitleColor', type: 'color', default: '#55aaff' },
+  { name: 'TitleSize', type: 'size', default: '15' },
+  { name: 'TitleHidden', type: 'bool', default: 'false' },
+  { name: 'TitleHiddenIfNotPrimary', type: 'bool', default: 'false' },
+  { name: 'UsernameColor', type: 'color', default: '#55aaff' },
+  { name: 'UsernameSize', type: 'size', default: '15' },
+  { name: 'MessageColor', type: 'color', default: 'white' },
+  { name: 'MessageSize', type: 'size', default: '15' },
+  { name: 'ChatFormat', type: 'format', default: '{Title} {Username}: {Message}' },
+  { name: 'ConsoleFormat', type: 'format', default: '{Title} {Username}: {Message}' },
+]
+
+const FIELD_NAMES = FIELDS.map((f) => f.name)
+
+/** BetterChat's defaults for a new group of this name — what the form starts from. */
+function defaults(group) {
+  const out = {}
+  for (const f of FIELDS) out[f.name] = f.default
+  out.Title = group === 'default' ? '[Player]' : `[${group}]`
+  return out
+}
+
+function occurrences(text, needle) {
+  return text.split(needle).length - 1
+}
+
+/**
+ * One field's value as BetterChat's setter takes it, or a sentence.
+ *
+ * Colours are `#rrggbb` or a plain colour word (BetterChat's own default for a
+ * message is `white`). A format holds `{Message}` EXACTLY once: without it every
+ * line a member types is swallowed, and twice cannot be made into a voice,
+ * whose line has one message.
+ */
+function checkField(field, raw) {
+  const text = typeof raw === 'boolean' || typeof raw === 'number' ? String(raw) : typeof raw === 'string' ? raw.trim() : null
+  if (text === null || /[\r\n]/.test(text)) return { error: `${field.name} must be text on one line` }
+
+  switch (field.type) {
+    case 'int': {
+      if (!/^-?\d{1,4}$/.test(text)) return { error: `${field.name} must be a whole number from ${field.min} to ${field.max}` }
+      return { value: String(Number(text)) }
+    }
+    case 'size': {
+      if (!/^\d{1,2}$/.test(text) || Number(text) < 6 || Number(text) > 64) return { error: `${field.name} must be a size from 6 to 64` }
+      return { value: String(Number(text)) }
+    }
+    case 'bool': {
+      const lowered = text.toLowerCase()
+      if (lowered !== 'true' && lowered !== 'false') return { error: `${field.name} must be true or false` }
+      return { value: lowered }
+    }
+    case 'color': {
+      if (/^#[0-9a-fA-F]{6}$/.test(text)) return { value: text.toLowerCase() }
+      if (/^[a-z]{3,20}$/.test(text)) return { value: text }
+      return { error: `${field.name} must be a colour like #ffaa55, or a colour word like white` }
+    }
+    case 'title': {
+      if (!text.length || text.length > TITLE_MAX) return { error: `Title must be 1 to ${TITLE_MAX} characters` }
+      // A brace would be read as a placeholder when the title is put into a line.
+      if (/[{}]/.test(text)) return { error: 'Title cannot contain { or }' }
+      return { value: text }
+    }
+    case 'format': {
+      if (text.length > FORMAT_MAX) return { error: `${field.name} must be at most ${FORMAT_MAX} characters` }
+      if (occurrences(text, '{Message}') !== 1) return { error: `${field.name} must contain {Message} exactly once` }
+      return { value: text }
+    }
+    default:
+      return { error: `${field.name} is not a field this site knows` }
+  }
+}
+
+/**
+ * An operator's style, checked whole. All twelve fields are required — a style
+ * is the whole of a BetterChat group or nothing (D138), which is what keeps a
+ * half-authored group from being a set of values nobody chose.
+ *
+ * Resolves `{ ok: true, fields }` with every value normalised, or
+ * `{ ok: false, errors }`, one sentence per problem.
+ */
+function validateStyle(style) {
+  if (!style || typeof style !== 'object' || Array.isArray(style)) {
+    return { ok: false, errors: ['a chat style is an object of the twelve BetterChat fields'] }
+  }
+
+  const errors = []
+  const fields = {}
+
+  for (const key of Object.keys(style)) {
+    if (!FIELD_NAMES.includes(key)) errors.push(`${key} is not a BetterChat group field`)
+  }
+
+  for (const field of FIELDS) {
+    if (style[field.name] === undefined || style[field.name] === null) {
+      errors.push(`${field.name} is missing`)
+      continue
+    }
+    const checked = checkField(field, style[field.name])
+    if (checked.error) errors.push(checked.error)
+    else fields[field.name] = checked.value
+  }
+
+  return errors.length ? { ok: false, errors } : { ok: true, fields }
+}
+
+/** A colour as BetterChat's markup writes it: the hex without its `#`, or the word. */
+function markupColor(color) {
+  return String(color || 'white').replace(/^#/, '')
+}
+
+/**
+ * The format a styled group's voice says a line in (D140), or null.
+ *
+ * Built from six of the twelve fields (§33.4 reading 5): the title, its colour
+ * and size, the message's colour and size, and `ChatFormat`. The line has no
+ * sender, so `{Username}` renders as nothing — and so does the `:` BetterChat's
+ * own default puts after it, or every announcement would read `[Title] : …`.
+ * `{Group}`, `{ID}`, `{Time}` and `{Date}` render as nothing for the same
+ * reason. The plugin puts the words in for `{message}` and turns the markup into
+ * the game's rich text.
+ */
+function voiceFormat(fields) {
+  if (!fields || !fields.ChatFormat || occurrences(fields.ChatFormat, '{Message}') !== 1) return null
+
+  const title =
+    fields.TitleHidden === 'true'
+      ? ''
+      : `[#${markupColor(fields.TitleColor)}][+${fields.TitleSize || 15}]${fields.Title || ''}[/+][/#]`
+  const message = `[#${markupColor(fields.MessageColor)}][+${fields.MessageSize || 15}]{message}[/+][/#]`
+
+  // split/join rather than `replace`, whose replacement string treats `$&` and
+  // friends as patterns — and a title is operator text.
+  const format = fields.ChatFormat
+    .replace(/\{Username\}\s*:?/g, '')
+    .replace(/\{(Group|ID|Time|Date)\}/g, '')
+    .split('{Title}').join(title)
+    .split('{Message}').join(message)
+    .replace(/\s{2,}/g, ' ')
+    .trim()
+
+  return occurrences(format, '{message}') === 1 ? format : null
+}
+
+module.exports = { FIELDS, FIELD_NAMES, FORMAT_MAX, TITLE_MAX, defaults, validateStyle, voiceFormat, checkField }

server/model/permissions/permissions.db.js

@@ -0,0 +1,638 @@
+// ── SQL for the permission mirror, and nothing else ───────────────────────
+//
+// The tables this file reads are described at length in `db/schema.sql`; what
+// matters here is which of them is authoritative for what, because four of the
+// eight look similar and answer completely different questions:
+//
+//   AUTHORED   `rust_perm_groups`, `..._group_permissions`, `..._group_members`,
+//              `rust_perm_grants` — what an operator (and later an event) says
+//              should be true. Keyed by WEBSITE USER (D28).
+//   PUSHED     `rust_perm_pushed` — what this site has confirmed into one game's
+//              store. Keyed by STEAM ID, because it records what is in the game
+//              and the game has never heard of a website account.
+//   FOUND      `rust_perm_drift` — what a sync found that the site did not
+//              author. Replaced whole by each report: it is the current
+//              difference, not a history of differences.
+//   INSTRUCTED `rust_perm_revocations` — remove this, even though we never put
+//              it there. The only way to act on drift, since a foreign grant
+//              often names a Steam id no website account holds.
+//
+// Raw parameterised SQL through `core.query`, no ORM, like every other `.db.js`
+// here. Bulk writes are batched into one statement with a generated placeholder
+// list rather than looped, because a fleet-wide sync writes hundreds of rows and
+// a round trip each is how a boot tick becomes a second long.
+
+const core = require('../../core')
+
+const GROUPS = 'rust_perm_groups'
+const GROUP_PERMISSIONS = 'rust_perm_group_permissions'
+const GROUP_MEMBERS = 'rust_perm_group_members'
+const GROUP_CHAT = 'rust_perm_group_chat'
+const GRANTS = 'rust_perm_grants'
+const RUN_GRANTS = 'rust_perm_run_grants'
+const PUSHED = 'rust_perm_pushed'
+const DRIFT = 'rust_perm_drift'
+const REVOCATIONS = 'rust_perm_revocations'
+const SYNC = 'rust_perm_sync'
+const CATALOGUE = 'rust_perm_catalogue'
+const LINKS = 'rust_account_links'
+const SERVERS = 'rust_servers'
+
+/** `(?,?,?),(?,?,?)` for `rows.length` rows of `width` columns. */
+function placeholders(rows, width) {
+  return rows.map(() => `(${new Array(width).fill('?').join(',')})`).join(',')
+}
+
+// ---- the authored set ----
+
+async function listGroups() {
+  return core.query(
+    `SELECT name, title, \`rank\`, scope, created_at AS createdAt, updated_at AS updatedAt
+       FROM ${GROUPS}
+      ORDER BY \`rank\` DESC, name ASC`,
+  )
+}
+
+async function getGroup(name) {
+  const rows = await core.query(
+    `SELECT name, title, \`rank\`, scope FROM ${GROUPS} WHERE name = ?`,
+    [name],
+  )
+
+  return rows[0] || null
+}
+
+/**
+ * Create or update one group.
+ *
+ * `ON DUPLICATE KEY UPDATE` rather than a check-then-write: two admins on the
+ * same screen is not a race worth losing a title over, and the row's identity is
+ * its name either way.
+ */
+async function upsertGroup({ name, title, rank, scope }) {
+  await core.query(
+    `INSERT INTO ${GROUPS} (name, title, \`rank\`, scope)
+          VALUES (?, ?, ?, ?)
+     ON DUPLICATE KEY UPDATE title = VALUES(title), \`rank\` = VALUES(\`rank\`),
+                             scope = VALUES(scope), updated_at = CURRENT_TIMESTAMP`,
+    [name, title, rank, scope],
+  )
+}
+
+async function deleteGroup(name) {
+  const result = await core.query(`DELETE FROM ${GROUPS} WHERE name = ?`, [name])
+  return Number(result.affectedRows || 0) > 0
+}
+
+async function listGroupPermissions() {
+  return core.query(
+    `SELECT group_name AS groupName, permission FROM ${GROUP_PERMISSIONS} ORDER BY permission ASC`,
+  )
+}
+
+/** Replace a group's permission list whole. The form edits a list, so the write is a list. */
+async function setGroupPermissions(name, permissions) {
+  await core.query(`DELETE FROM ${GROUP_PERMISSIONS} WHERE group_name = ?`, [name])
+
+  if (!permissions.length) return
+
+  await core.query(
+    `INSERT INTO ${GROUP_PERMISSIONS} (group_name, permission)
+          VALUES ${placeholders(permissions, 2)}`,
+    permissions.flatMap((permission) => [name, permission]),
+  )
+}
+
+/** Every group's BetterChat style, one row per field (phase 17, D138). */
+async function listGroupChat() {
+  return core.query(
+    `SELECT group_name AS groupName, field, value FROM ${GROUP_CHAT} ORDER BY group_name ASC, field ASC`,
+  )
+}
+
+/**
+ * Replace a group's style whole, or remove it with `null`. A style is all twelve
+ * fields or none, and the form edits it as one thing.
+ */
+async function setGroupChat(name, fields) {
+  await core.query(`DELETE FROM ${GROUP_CHAT} WHERE group_name = ?`, [name])
+
+  const entries = fields ? Object.entries(fields) : []
+  if (!entries.length) return
+
+  await core.query(
+    `INSERT INTO ${GROUP_CHAT} (group_name, field, value) VALUES ${placeholders(entries, 3)}`,
+    entries.flatMap(([field, value]) => [name, field, value]),
+  )
+}
+
+/** One field of a style, for adopting a hand edit. Returns whether the group has that field. */
+async function setGroupChatField(name, field, value) {
+  const result = await core.query(
+    `UPDATE ${GROUP_CHAT} SET value = ? WHERE group_name = ? AND field = ?`,
+    [value, name, field],
+  )
+  return Number(result.affectedRows || 0) > 0
+}
+
+async function getGroupChat(name) {
+  const rows = await core.query(`SELECT field, value FROM ${GROUP_CHAT} WHERE group_name = ?`, [name])
+  return rows.length ? Object.fromEntries(rows.map((r) => [r.field, r.value])) : null
+}
+
+/**
+ * Every membership, with the member's Steam accounts joined on.
+ *
+ * One query rather than a membership read plus a link read per member: the admin
+ * screen renders both together and the push needs both together, and a fleet's
+ * worth of members is one round trip either way.
+ */
+async function listGroupMembers() {
+  return core.query(
+    `SELECT m.group_name AS groupName, m.user_id AS userId, m.added_at AS addedAt,
+            u.username, l.steam_id AS steamId, p.name AS playerName
+       FROM ${GROUP_MEMBERS} m
+       JOIN users u ON u.id = m.user_id
+       LEFT JOIN ${LINKS} l ON l.user_id = m.user_id
+       LEFT JOIN rust_players p ON p.steam_id = l.steam_id
+      ORDER BY m.group_name ASC, u.username ASC`,
+  )
+}
+
+async function addGroupMember(groupName, userId, addedBy) {
+  await core.query(
+    `INSERT IGNORE INTO ${GROUP_MEMBERS} (group_name, user_id, added_by) VALUES (?, ?, ?)`,
+    [groupName, userId, addedBy],
+  )
+}
+
+async function removeGroupMember(groupName, userId) {
+  const result = await core.query(
+    `DELETE FROM ${GROUP_MEMBERS} WHERE group_name = ? AND user_id = ?`,
+    [groupName, userId],
+  )
+
+  return Number(result.affectedRows || 0) > 0
+}
+
+/**
+ * Every direct grant, with the holder's accounts joined on.
+ *
+ * `username` is on the row because a grant with no linked Steam account still
+ * has to be listable and nameable — that state is the one the admin screen most
+ * needs to show, since it looks exactly like a working grant from every other
+ * angle and reaches nobody.
+ */
+async function listGrants({ userId = null } = {}) {
+  return core.query(
+    `SELECT g.id, g.user_id AS userId, g.permission, g.scope, g.source, g.note,
+            g.granted_at AS grantedAt, u.username,
+            l.steam_id AS steamId, p.name AS playerName
+       FROM ${GRANTS} g
+       JOIN users u ON u.id = g.user_id
+       LEFT JOIN ${LINKS} l ON l.user_id = g.user_id
+       LEFT JOIN rust_players p ON p.steam_id = l.steam_id
+      ${userId === null ? '' : 'WHERE g.user_id = ?'}
+      ORDER BY u.username ASC, g.permission ASC`,
+    userId === null ? [] : [userId],
+  )
+}
+
+async function getGrant(id) {
+  const rows = await core.query(
+    `SELECT id, user_id AS userId, permission, scope, source FROM ${GRANTS} WHERE id = ?`,
+    [id],
+  )
+
+  return rows[0] || null
+}
+
+/**
+ * Add a grant, or leave the one that is already there alone.
+ *
+ * `INSERT IGNORE` against the unique key, and the return says which happened —
+ * the controller needs to tell "granted" from "they already had it" to write an
+ * honest activity row.
+ */
+async function insertGrant({ userId, permission, scope, source, note, grantedBy }) {
+  const result = await core.query(
+    `INSERT IGNORE INTO ${GRANTS} (user_id, permission, scope, source, note, granted_by)
+          VALUES (?, ?, ?, ?, ?, ?)`,
+    [userId, permission, scope, source, note, grantedBy],
+  )
+
+  return { inserted: Number(result.affectedRows || 0) > 0, id: result.insertId }
+}
+
+async function deleteGrant(id) {
+  const result = await core.query(`DELETE FROM ${GRANTS} WHERE id = ?`, [id])
+  return Number(result.affectedRows || 0) > 0
+}
+
+// ---- what events granted (phase 13b) ----
+//
+// `rust_perm_run_grants` is authored by `rust.kit.entitle`, never by a person,
+// and it is read beside `rust_perm_grants` rather than merged into it (D84): the
+// push unions the two, and a revert deletes exactly one step's rows.
+
+/** Every event grant, for the push. Small: one row per recipient per reward step still standing. */
+async function listRunGrants() {
+  return core.query(
+    `SELECT run_id AS runId, step_id AS stepId, user_id AS userId, server_id AS serverId,
+            steam_id AS steamId, permission, kit, credit
+       FROM ${RUN_GRANTS}`,
+  )
+}
+
+/** One step's rows. A repeated key finds them here and writes nothing new. */
+async function listRunGrantsForStep(runId, stepId) {
+  return core.query(
+    `SELECT user_id AS userId, server_id AS serverId, steam_id AS steamId, permission, kit, credit
+       FROM ${RUN_GRANTS}
+      WHERE run_id = ? AND step_id = ?`,
+    [String(runId), String(stepId)],
+  )
+}
+
+/**
+ * One step's recipients, in one statement. `INSERT IGNORE` against the unique
+ * key, so a retry that races the first attempt writes each row once.
+ */
+async function insertRunGrants(rows) {
+  if (!rows.length) return 0
+
+  const result = await core.query(
+    `INSERT IGNORE INTO ${RUN_GRANTS} (run_id, step_id, idem_key, user_id, server_id, steam_id, permission, kit, credit)
+          VALUES ${placeholders(rows, 9)}`,
+    rows.flatMap((r) => [
+      String(r.runId),
+      String(r.stepId),
+      String(r.idemKey || ''),
+      r.userId,
+      r.serverId,
+      r.steamId,
+      r.permission || '',
+      r.kit,
+      r.credit ? 1 : 0,
+    ]),
+  )
+
+  return Number(result.affectedRows || 0)
+}
+
+/** Withdraw one step's rows. Returns the servers they were on; none is a success. */
+async function deleteRunGrantsForStep(runId, stepId) {
+  return deleteRunGrantsWhere('run_id = ? AND step_id = ?', [String(runId), String(stepId)])
+}
+
+/** The same, found by core's idempotency key — the revert of an answer core lost. */
+async function deleteRunGrantsForKey(runId, idemKey) {
+  if (!idemKey) return []
+  return deleteRunGrantsWhere('run_id = ? AND idem_key = ?', [String(runId), String(idemKey)])
+}
+
+async function deleteRunGrantsWhere(where, params) {
+  const found = await core.query(`SELECT DISTINCT server_id AS serverId FROM ${RUN_GRANTS} WHERE ${where}`, params)
+  if (!found.length) return []
+
+  await core.query(`DELETE FROM ${RUN_GRANTS} WHERE ${where}`, params)
+  return found.map((row) => row.serverId)
+}
+
+/**
+ * One website account by name, for the authoring form.
+ *
+ * A form that made an operator type a numeric user id would be a form nobody
+ * could use, and the alternative — calling core's own admin user search from the
+ * client — would bind this module to the shape of a response the contract does
+ * not cover. Reading the `users` table is already what every join in this file
+ * does.
+ *
+ * Case-insensitive because the column's collation is: core stores usernames in a
+ * `_ci` collation and an exact-case lookup would refuse a name the site itself
+ * considers the same one.
+ */
+async function findUserByUsername(username) {
+  const rows = await core.query(`SELECT id, username FROM users WHERE username = ? LIMIT 1`, [username])
+  return rows[0] || null
+}
+
+/** Which website user holds which Steam account. The join that turns an authored row into a push. */
+async function listLinks() {
+  return core.query(`SELECT user_id AS userId, steam_id AS steamId FROM ${LINKS}`)
+}
+
+// ---- one person's own half of all of it (the player tier) ----
+//
+// Every read below is scoped inside the statement rather than filtered after it.
+// The admin reads above answer "who holds what"; these answer "what do I hold",
+// and the difference between the two is a `WHERE` that must not be somebody
+// else's job to remember.
+
+/** The groups one website user belongs to. Ordered the way the admin list is. */
+async function listGroupsForUser(userId) {
+  return core.query(
+    `SELECT g.name, g.title, g.\`rank\`, g.scope, m.added_at AS addedAt
+       FROM ${GROUP_MEMBERS} m
+       JOIN ${GROUPS} g ON g.name = m.group_name
+      WHERE m.user_id = ?
+      ORDER BY g.\`rank\` DESC, g.name ASC`,
+    [userId],
+  )
+}
+
+/**
+ * Every pushed row naming one of these Steam ids, across every server.
+ *
+ * The pushed ledger is keyed by Steam id because it records what is in a GAME
+ * (D28's other half), so this is the one read in the file that starts from an
+ * account rather than from a user. `kind` is carried through: a direct grant and
+ * a group membership are different rows about the same person and only the
+ * caller can say which of them it was looking for.
+ */
+async function listPushedForSteamIds(steamIds) {
+  if (!steamIds.length) return []
+
+  return core.query(
+    `SELECT server_id AS serverId, kind, subject, object
+       FROM ${PUSHED}
+      WHERE subject IN (${steamIds.map(() => '?').join(',')})
+        AND kind IN ('grant', 'member')`,
+    steamIds,
+  )
+}
+
+// ---- what is actually out there ----
+
+async function listPushed(serverId) {
+  return core.query(
+    `SELECT kind, subject, object, value FROM ${PUSHED} WHERE server_id = ?`,
+    [serverId],
+  )
+}
+
+/**
+ * Record rows as landed. A `chat-field` row carries the VALUE that landed, and a
+ * second landing of the same field moves it: the value is what the next sync
+ * tells a hand edit from this site's own write by (§33.2). Every other kind has
+ * no value and is written once.
+ */
+async function addPushed(serverId, rows) {
+  if (!rows.length) return
+
+  await core.query(
+    `INSERT INTO ${PUSHED} (server_id, kind, subject, object, value)
+          VALUES ${placeholders(rows, 5)}
+     ON DUPLICATE KEY UPDATE value = VALUES(value)`,
+    rows.flatMap((row) => [serverId, row.kind, row.subject, row.object, row.value === undefined ? null : row.value]),
+  )
+}
+
+/**
+ * Say that a style field holds `value` in one game as far as this site is
+ * concerned. It is how a person revokes a hand edit to a style: the next sync
+ * sends the site's value with this as what it expects to find, which is the
+ * game's own value — so the plugin writes over it, on purpose (§33.2).
+ */
+async function setPushedValue(serverId, { kind, subject, object, value }) {
+  await addPushed(serverId, [{ kind, subject, object, value }])
+}
+
+async function removePushed(serverId, rows) {
+  for (const row of rows) {
+    // eslint-disable-next-line no-await-in-loop
+    await core.query(
+      `DELETE FROM ${PUSHED} WHERE server_id = ? AND kind = ? AND subject = ? AND object = ?`,
+      [serverId, row.kind, row.subject, row.object],
+    )
+  }
+}
+
+/**
+ * Replace one server's drift list with what the latest report found.
+ *
+ * Whole, rather than merged, and `first_seen` survives through the
+ * `ON DUPLICATE KEY UPDATE` — so "this has been here since Tuesday" is still
+ * answerable while "somebody has since undone it" removes the row.
+ */
+async function replaceDrift(serverId, rows) {
+  if (!rows.length) {
+    await core.query(`DELETE FROM ${DRIFT} WHERE server_id = ?`, [serverId])
+    return
+  }
+
+  await core.query(
+    `INSERT INTO ${DRIFT} (server_id, kind, subject, object, detail)
+          VALUES ${placeholders(rows, 5)}
+     ON DUPLICATE KEY UPDATE last_seen = CURRENT_TIMESTAMP, detail = VALUES(detail)`,
+    rows.flatMap((row) => [serverId, row.kind, row.subject, row.object, row.detail === undefined ? null : row.detail]),
+  )
+
+  // Anything this report did NOT name is gone from the game, so it goes from
+  // here. Named explicitly rather than swept by timestamp: two syncs a second
+  // apart would make a timestamp window either delete live rows or keep dead
+  // ones, depending on the clock.
+  await core.query(
+    `DELETE FROM ${DRIFT}
+      WHERE server_id = ?
+        AND (kind, subject, object) NOT IN (${placeholders(rows, 3)})`,
+    [serverId, ...rows.flatMap((row) => [row.kind, row.subject, row.object])],
+  )
+}
+
+async function listDrift() {
+  return core.query(
+    `SELECT d.id, d.server_id AS serverId, d.kind, d.subject, d.object, d.detail,
+            d.first_seen AS firstSeen, d.last_seen AS lastSeen,
+            l.user_id AS userId, u.username, p.name AS playerName
+       FROM ${DRIFT} d
+       LEFT JOIN ${LINKS} l ON l.steam_id = d.subject
+       LEFT JOIN users u ON u.id = l.user_id
+       LEFT JOIN rust_players p ON p.steam_id = d.subject
+      ORDER BY d.server_id ASC, d.kind ASC, d.subject ASC`,
+  )
+}
+
+async function getDrift(id) {
+  const rows = await core.query(
+    `SELECT id, server_id AS serverId, kind, subject, object, detail FROM ${DRIFT} WHERE id = ?`,
+    [id],
+  )
+
+  return rows[0] || null
+}
+
+async function deleteDrift(id) {
+  await core.query(`DELETE FROM ${DRIFT} WHERE id = ?`, [id])
+}
+
+async function queueRevocation({ serverId, kind, subject, object, requestedBy }) {
+  await core.query(
+    `INSERT IGNORE INTO ${REVOCATIONS} (server_id, kind, subject, object, requested_by)
+          VALUES (?, ?, ?, ?, ?)`,
+    [serverId, kind, subject, object, requestedBy],
+  )
+}
+
+async function listRevocations(serverId) {
+  return core.query(
+    `SELECT id, kind, subject, object FROM ${REVOCATIONS} WHERE server_id = ?`,
+    [serverId],
+  )
+}
+
+async function deleteRevocations(ids) {
+  if (!ids.length) return
+
+  await core.query(
+    `DELETE FROM ${REVOCATIONS} WHERE id IN (${ids.map(() => '?').join(',')})`,
+    ids,
+  )
+}
+
+// ---- the state of the mirror ----
+
+/**
+ * One sync row per configured server, created on demand.
+ *
+ * A server added today has no row and must not therefore be skipped for ever, so
+ * the read inserts what is missing rather than the writer remembering to.
+ */
+async function ensureSyncRows() {
+  await core.query(
+    `INSERT IGNORE INTO ${SYNC} (server_id) SELECT id FROM ${SERVERS}`,
+  )
+}
+
+async function listSync() {
+  return core.query(
+    `SELECT s.server_id AS serverId, s.state, s.dirty, s.desired_hash AS desiredHash,
+            s.synced_hash AS syncedHash, s.boot_id AS bootId, s.wipe_id AS wipeId,
+            s.last_attempt_at AS lastAttemptAt, s.last_ok_at AS lastOkAt,
+            s.report, s.error
+       FROM ${SYNC} s
+      ORDER BY s.server_id ASC`,
+  )
+}
+
+/**
+ * Mark servers as needing a sync.
+ *
+ * `scope` is a server id or `*`; a fleet-wide change dirties every row, which is
+ * right: the set each server should hold has changed even if only one of them
+ * will notice a difference.
+ */
+async function markDirty(scope) {
+  if (!scope || scope === '*') {
+    await core.query(`UPDATE ${SYNC} SET dirty = 1, updated_at = CURRENT_TIMESTAMP`)
+    return
+  }
+
+  await core.query(
+    `UPDATE ${SYNC} SET dirty = 1, updated_at = CURRENT_TIMESTAMP WHERE server_id = ?`,
+    [scope],
+  )
+}
+
+/**
+ * Record the outcome of one attempt.
+ *
+ * **`dirty` is cleared unconditionally, and that is safe because it is an
+ * optimisation rather than the truth.** Something may well have changed the
+ * authored set while this sync was in flight, and clearing the flag would then
+ * lose that change — except that the loop's real condition is
+ * `desired_hash != synced_hash`, recomputed from the tables on every tick. The
+ * flag only saves a hash comparison; the hash is what cannot be wrong.
+ *
+ * `last_ok_at` moves only on success, and it is passed rather than composed into
+ * the SQL so the statement is the same string every time.
+ */
+async function putSyncResult(serverId, { state, syncedHash, desiredHash, bootId, wipeId, report, error }) {
+  const okAt = state === 'ok' ? new Date() : null
+
+  await core.query(
+    `INSERT INTO ${SYNC} (server_id, state, dirty, desired_hash, synced_hash, boot_id, wipe_id,
+                          last_attempt_at, last_ok_at, report, error, updated_at)
+          VALUES (?, ?, 0, ?, ?, ?, ?, NOW(), ?, ?, ?, NOW())
+     ON DUPLICATE KEY UPDATE state = VALUES(state), dirty = 0,
+                             desired_hash = VALUES(desired_hash),
+                             synced_hash = VALUES(synced_hash),
+                             boot_id = VALUES(boot_id), wipe_id = VALUES(wipe_id),
+                             last_attempt_at = NOW(),
+                             last_ok_at = COALESCE(VALUES(last_ok_at), last_ok_at),
+                             report = VALUES(report), error = VALUES(error),
+                             updated_at = NOW()`,
+    [serverId, state, desiredHash, syncedHash, bootId, wipeId, okAt, report, error],
+  )
+}
+
+// ---- the option source ----
+
+async function putCatalogue(serverId, permissions) {
+  await core.query(`DELETE FROM ${CATALOGUE} WHERE server_id = ?`, [serverId])
+
+  if (!permissions.length) return
+
+  await core.query(
+    `INSERT IGNORE INTO ${CATALOGUE} (server_id, permission)
+          VALUES ${placeholders(permissions, 2)}`,
+    permissions.flatMap((permission) => [serverId, permission]),
+  )
+}
+
+async function listCatalogue() {
+  return core.query(
+    `SELECT server_id AS serverId, permission FROM ${CATALOGUE} ORDER BY permission ASC`,
+  )
+}
+
+module.exports = {
+  GROUPS,
+  GRANTS,
+  RUN_GRANTS,
+  PUSHED,
+  DRIFT,
+  listGroups,
+  getGroup,
+  upsertGroup,
+  deleteGroup,
+  listGroupPermissions,
+  setGroupPermissions,
+  listGroupChat,
+  setGroupChat,
+  setGroupChatField,
+  getGroupChat,
+  listGroupMembers,
+  addGroupMember,
+  removeGroupMember,
+  listGrants,
+  getGrant,
+  insertGrant,
+  deleteGrant,
+  listRunGrants,
+  listRunGrantsForStep,
+  insertRunGrants,
+  deleteRunGrantsForStep,
+  deleteRunGrantsForKey,
+  findUserByUsername,
+  listLinks,
+  listGroupsForUser,
+  listPushedForSteamIds,
+  listPushed,
+  addPushed,
+  setPushedValue,
+  removePushed,
+  replaceDrift,
+  listDrift,
+  getDrift,
+  deleteDrift,
+  queueRevocation,
+  listRevocations,
+  deleteRevocations,
+  ensureSyncRows,
+  listSync,
+  markDirty,
+  putSyncResult,
+  putCatalogue,
+  listCatalogue,
+}

server/model/permissions/permissions.model.js

@@ -0,0 +1,552 @@
+// ── The authored set, and what it means for one server ────────────────────
+//
+// This file turns "what an operator wrote on the website" into "what one game
+// server's store should contain", which is where four of phase 7's decisions
+// actually live:
+//
+//   D28  a grant is authored against a WEBSITE USER and resolved to every Steam
+//        id they have linked, here, at the moment of the push.
+//   D29  every authored row carries a scope — one server, or `*` for the fleet —
+//        and a server sees only what names it.
+//   D30  groups travel as groups. Membership is a separate wire fact from the
+//        permissions the group carries, because the game stores them separately
+//        and one of the two can fail on its own (§12.2 rule 4).
+//   D31  the difference between the desired set and what this site has already
+//        pushed is what gets retired. Anything else in the store is drift, and
+//        drift is reported rather than undone.
+//
+// Nothing here talks to a sidecar — `permSync.js` does that. The split is the
+// usual one and earns its keep twice over here: the whole of the interesting
+// logic is a pure function of four tables, so it is tested without a game, a
+// sidecar, or a database.
+
+const crypto = require('node:crypto')
+
+const db = require('./permissions.db')
+
+/** A scope that means every server. Stored, rather than null, so the column never needs a coalesce. */
+const FLEET = '*'
+
+/**
+ * Permission and group names, as both frameworks store them.
+ *
+ * Lowercased on the way in, because the store lowers them and a site that did
+ * not would author `Kits.VIP`, push it, read back `kits.vip`, and report its own
+ * grant as drift for ever.
+ */
+function normaliseName(value) {
+  return String(value || '').trim().toLowerCase()
+}
+
+/** Whether a scope reaches a server. */
+function inScope(scope, serverId) {
+  return scope === FLEET || scope === serverId
+}
+
+/**
+ * Everything the authoring screen renders, in one read.
+ *
+ * Assembled here rather than in SQL because the shape is a tree — a group with
+ * its permissions and its members — and the alternative is either four round
+ * trips per group or one join that repeats every group row once per member.
+ */
+async function overview() {
+  const [groups, groupPermissions, members, grants, sync, drift, catalogue, groupChat] = await Promise.all([
+    db.listGroups(),
+    db.listGroupPermissions(),
+    db.listGroupMembers(),
+    db.listGrants(),
+    db.listSync(),
+    db.listDrift(),
+    db.listCatalogue(),
+    db.listGroupChat(),
+  ])
+
+  const byGroup = new Map(groups.map((group) => [group.name, { ...group, permissions: [], members: [], chat: null }]))
+
+  // Phase 17: a group's BetterChat style, or null for a group without one.
+  for (const [name, fields] of chatByGroup(groupChat)) {
+    const group = byGroup.get(name)
+    if (group) group.chat = fields
+  }
+
+  for (const row of groupPermissions) {
+    const group = byGroup.get(row.groupName)
+    if (group) group.permissions.push(row.permission)
+  }
+
+  // A member with two linked Steam accounts arrives as two rows from the join,
+  // and is one person on the screen — holding BOTH accounts, not the first one
+  // the join happened to return. The screen needs all of them: a membership is
+  // pushed per account, and it can be waiting on one while it landed on another.
+  const memberByKey = new Map()
+
+  for (const row of members) {
+    const group = byGroup.get(row.groupName)
+    if (!group) continue
+
+    const key = `${row.groupName}:${row.userId}`
+    let member = memberByKey.get(key)
+
+    if (!member) {
+      member = {
+        userId: row.userId,
+        username: row.username,
+        accounts: [],
+        addedAt: row.addedAt,
+      }
+      memberByKey.set(key, member)
+      group.members.push(member)
+    }
+
+    if (row.steamId) member.accounts.push({ steamId: row.steamId, name: row.playerName || null })
+  }
+
+  return {
+    groups: [...byGroup.values()],
+    grants: collapseGrants(grants),
+    servers: sync.map(shapeSync),
+    drift: drift.map((row) => ({ ...row, detail: row.detail === undefined ? null : row.detail })),
+    catalogue: catalogueByPermission(catalogue),
+  }
+}
+
+/** Style rows folded into one object per group: `name → { Field: value }`. */
+function chatByGroup(rows) {
+  const out = new Map()
+
+  for (const row of rows || []) {
+    if (!out.has(row.groupName)) out.set(row.groupName, {})
+    out.get(row.groupName)[row.field] = row.value
+  }
+
+  return out
+}
+
+/**
+ * One row per grant, not one per linked account.
+ *
+ * The join in `listGrants` multiplies a grant by the holder's accounts, which is
+ * what the push wants and the opposite of what a screen wants.
+ */
+function collapseGrants(rows) {
+  const byId = new Map()
+
+  for (const row of rows) {
+    const existing = byId.get(row.id)
+
+    if (!existing) {
+      byId.set(row.id, {
+        id: row.id,
+        userId: row.userId,
+        username: row.username,
+        permission: row.permission,
+        scope: row.scope,
+        source: row.source,
+        note: row.note,
+        grantedAt: row.grantedAt,
+        accounts: row.steamId ? [{ steamId: row.steamId, name: row.playerName || null }] : [],
+      })
+
+      continue
+    }
+
+    if (row.steamId) existing.accounts.push({ steamId: row.steamId, name: row.playerName || null })
+  }
+
+  return [...byId.values()]
+}
+
+/**
+ * The sync row as a client reads it.
+ *
+ * `report` is stored as the JSON the game sent and parsed here rather than on the
+ * way in, so a report this build cannot read is a rendering problem on one
+ * screen instead of a write that failed.
+ */
+function shapeSync(row) {
+  let report = null
+
+  if (row.report) {
+    try {
+      report = JSON.parse(row.report)
+    } catch {
+      report = null
+    }
+  }
+
+  return {
+    serverId: row.serverId,
+    state: row.state,
+    dirty: Boolean(row.dirty),
+    inSync: Boolean(row.desiredHash) && row.desiredHash === row.syncedHash && row.state === 'ok',
+    lastAttemptAt: row.lastAttemptAt,
+    lastOkAt: row.lastOkAt,
+    error: row.error || null,
+    report,
+  }
+}
+
+/** Which servers know each permission name — the form's option source, and its warning label. */
+function catalogueByPermission(rows) {
+  const byPermission = new Map()
+
+  for (const row of rows) {
+    if (!byPermission.has(row.permission)) byPermission.set(row.permission, [])
+    byPermission.get(row.permission).push(row.serverId)
+  }
+
+  return [...byPermission.entries()]
+    .map(([permission, servers]) => ({ permission, servers }))
+    .sort((a, b) => a.permission.localeCompare(b.permission))
+}
+
+/**
+ * ── What one person holds, as that person reads it ────────────────────────
+ *
+ * The admin overview answers *who holds what*; this answers *what do I hold*,
+ * and it is a different shape rather than a filtered one. Three things make it
+ * different:
+ *
+ *  1. **The scope arithmetic is answered here, not sent.** A client handed
+ *     `scope: '*'` would have to know what the fleet is and re-implement
+ *     `inScope` to say anything useful, and then there would be two of it. Each
+ *     entry carries the servers it actually reaches, already resolved.
+ *  2. **`live` is per server and it is the pushed ledger, not the authored
+ *     row.** A grant made on the website is not a privilege in a game until a
+ *     sync confirmed it, and phase 7 is careful never to record a push that
+ *     silently did nothing (an unregistered permission, a store that has never
+ *     seen the player). So "waiting" here means waiting, and saying otherwise
+ *     would be the site claiming to have given something it has not.
+ *  3. **Nothing says WHY it is waiting.** Which permission names a server's
+ *     loaded plugins registered is an operator's diagnosis and an inventory of
+ *     what is installed; a player gets the honest state, not the reason.
+ *
+ * Every read is scoped to the caller in SQL, and the pushed rows are looked up
+ * by the caller's OWN Steam ids — so a person with no linked account correctly
+ * sees entitlements that reach nobody yet, rather than nothing at all (the
+ * mistake phase 7 shipped on the admin user page, §20.5).
+ */
+async function forPlayer(userId, steamIds, serverRows) {
+  const [groups, groupPermissions, grants, pushed] = await Promise.all([
+    db.listGroupsForUser(userId),
+    db.listGroupPermissions(),
+    db.listGrants({ userId }),
+    db.listPushedForSteamIds(steamIds),
+  ])
+
+  const servers = serverRows.map((row) => ({ id: row.id, name: row.name || row.id }))
+
+  // `kind:object` -> the servers a row of ours landed on. The subject is one of
+  // this caller's own Steam ids by construction, so it does not enter the key:
+  // an entitlement is live for the person if it is live for any account they
+  // hold, which is the same thing the game sees.
+  const live = new Map()
+
+  for (const row of pushed) {
+    const key = `${row.kind}:${normaliseName(row.object)}`
+    if (!live.has(key)) live.set(key, new Set())
+    live.get(key).add(row.serverId)
+  }
+
+  /** The servers a scope reaches, each marked with whether it is there yet. */
+  function reach(scope, key) {
+    const landed = live.get(key) || new Set()
+
+    return servers
+      .filter((server) => inScope(scope, server.id))
+      .map((server) => ({ ...server, live: landed.has(server.id) }))
+  }
+
+  const permissionsByGroup = new Map()
+
+  for (const row of groupPermissions) {
+    if (!permissionsByGroup.has(row.groupName)) permissionsByGroup.set(row.groupName, [])
+    permissionsByGroup.get(row.groupName).push(normaliseName(row.permission))
+  }
+
+  return {
+    groups: groups.map((group) => ({
+      name: group.name,
+      title: group.title || group.name,
+      scope: group.scope,
+      since: group.addedAt,
+      permissions: (permissionsByGroup.get(group.name) || []).sort(),
+      reach: reach(group.scope, `member:${normaliseName(group.name)}`),
+    })),
+    // `collapseGrants` first: the join multiplies a grant by the accounts its
+    // holder has linked, and this caller may hold two.
+    grants: collapseGrants(grants)
+      .map((grant) => ({
+        permission: grant.permission,
+        scope: grant.scope,
+        source: grant.source,
+        note: grant.note,
+        since: grant.grantedAt,
+        reach: reach(grant.scope, `grant:${normaliseName(grant.permission)}`),
+      }))
+      .sort((a, b) => a.permission.localeCompare(b.permission)),
+  }
+}
+
+/**
+ * The whole authored set, read once, in the shape the per-server build wants.
+ *
+ * Read once per sync tick rather than once per server: six servers is six
+ * different answers derived from one set of tables, and re-reading them per
+ * server is six times the queries for the same rows.
+ */
+async function readAuthored() {
+  const [groups, groupPermissions, members, grants, links, runGrants, groupChat] = await Promise.all([
+    db.listGroups(),
+    db.listGroupPermissions(),
+    db.listGroupMembers(),
+    db.listGrants(),
+    db.listLinks(),
+    db.listRunGrants(),
+    db.listGroupChat(),
+  ])
+
+  const steamIdsByUser = new Map()
+
+  for (const link of links) {
+    if (!steamIdsByUser.has(link.userId)) steamIdsByUser.set(link.userId, [])
+    steamIdsByUser.get(link.userId).push(link.steamId)
+  }
+
+  return { groups, groupPermissions, members, grants, runGrants, steamIdsByUser, groupChat }
+}
+
+/**
+ * What one server's store should contain, and the rows that say so.
+ *
+ * Returns three things the caller needs together and must not compute twice:
+ *
+ *   `payload`  what goes on the wire
+ *   `rows`     the same set in `rust_perm_pushed`'s shape, for the diff
+ *   `hash`     a stable digest of `rows`, which is how the loop knows nothing
+ *              has changed without asking a game server
+ *
+ * **A user with no linked Steam account contributes nothing and is not an
+ * error.** They are authored against perfectly well and reach nobody until they
+ * link — which the admin screen says out loud, because a grant that reaches
+ * nothing looks exactly like one that worked.
+ */
+function buildDesired(serverId, authored) {
+  const { groups, groupPermissions, members, grants, steamIdsByUser } = authored
+  const runGrants = authored.runGrants || []
+
+  const scopedGroups = groups.filter((group) => inScope(group.scope, serverId))
+  const groupNames = new Set(scopedGroups.map((group) => group.name))
+
+  const permissionsByGroup = new Map(scopedGroups.map((group) => [group.name, []]))
+  const membersByGroup = new Map(scopedGroups.map((group) => [group.name, []]))
+  const managed = new Set()
+  const rows = []
+
+  for (const group of scopedGroups)
+    rows.push({ kind: 'group', subject: group.name, object: '' })
+
+  for (const row of groupPermissions) {
+    if (!groupNames.has(row.groupName)) continue
+
+    const permission = normaliseName(row.permission)
+    permissionsByGroup.get(row.groupName).push(permission)
+    managed.add(permission)
+    rows.push({ kind: 'group-permission', subject: row.groupName, object: permission })
+  }
+
+  const seenMember = new Set()
+
+  for (const row of members) {
+    if (!groupNames.has(row.groupName)) continue
+
+    for (const steamId of steamIdsByUser.get(row.userId) || []) {
+      const key = `${row.groupName}:${steamId}`
+      if (seenMember.has(key)) continue
+      seenMember.add(key)
+
+      membersByGroup.get(row.groupName).push(steamId)
+      rows.push({ kind: 'member', subject: steamId, object: row.groupName })
+    }
+  }
+
+  const permissionsBySteamId = new Map()
+  const seenGrant = new Set()
+
+  for (const row of grants) {
+    if (!inScope(row.scope, serverId)) continue
+
+    const permission = normaliseName(row.permission)
+
+    // Managed whether or not it reaches anybody: the namespace is what makes a
+    // hand grant of this permission to somebody else show up as drift, and a
+    // grant whose holder has linked nothing would otherwise silently narrow it.
+    managed.add(permission)
+
+    // **Resolved from the link map, not from the row.** `listGrants` joins the
+    // links and therefore repeats a grant once per linked account, which would
+    // give the right answer here by accident — until somebody changes that query
+    // and one of a person's two accounts quietly stops being granted. The map is
+    // the same source the members above use, and it says what it means.
+    for (const steamId of steamIdsByUser.get(row.userId) || []) {
+      const key = `${steamId}:${permission}`
+      if (seenGrant.has(key)) continue
+      seenGrant.add(key)
+
+      if (!permissionsBySteamId.has(steamId)) permissionsBySteamId.set(steamId, [])
+      permissionsBySteamId.get(steamId).push(permission)
+      rows.push({ kind: 'grant', subject: steamId, object: permission })
+    }
+  }
+
+  // ── What events granted (phase 13b, D84) ──────────────────────────────
+  //
+  // Unioned with the admin grants above through the same `seenGrant`, so a
+  // permission held both ways is ONE row in the game — and withdrawing either
+  // leaves the other standing, because the next build still finds it.
+  //
+  // An event grant reaches only the kit's server (D102), and like any grant it
+  // reaches every account the user has linked (D28).
+  //
+  // The CREDIT is different: one win is one extra use, on the account that took
+  // part, and only while that account is still linked to the user who won it.
+  const credits = new Map()
+
+  for (const row of runGrants) {
+    if (row.serverId !== serverId) continue
+
+    const linked = steamIdsByUser.get(row.userId) || []
+    const permission = normaliseName(row.permission)
+
+    if (permission) {
+      managed.add(permission)
+
+      for (const steamId of linked) {
+        const key = `${steamId}:${permission}`
+        if (seenGrant.has(key)) continue
+        seenGrant.add(key)
+
+        if (!permissionsBySteamId.has(steamId)) permissionsBySteamId.set(steamId, [])
+        permissionsBySteamId.get(steamId).push(permission)
+        rows.push({ kind: 'grant', subject: steamId, object: permission })
+      }
+    }
+
+    if (Number(row.credit) && linked.includes(row.steamId)) {
+      // A Steam id is digits, so the first bar is always the split; a kit name
+      // may contain one.
+      const key = `${row.steamId}|${row.kit}`
+      credits.set(key, (credits.get(key) || 0) + 1)
+    }
+  }
+
+  // ── A group's BetterChat style (phase 17, D138) ───────────────────────
+  //
+  // One ledger row per FIELD (`chat-field`, subject the group, object the
+  // field), carrying its value: the diff that retires a style is the same
+  // `pushed − desired` as everything else, and the value is what the next sync
+  // sends as `expect`. The value is not in the row's identity — a changed value
+  // is the same field pushed again, not a retirement.
+  const chat = chatByGroup(authored.groupChat)
+
+  for (const group of scopedGroups) {
+    const fields = chat.get(group.name)
+    if (!fields) continue
+
+    for (const field of Object.keys(fields).sort()) {
+      rows.push({ kind: 'chat-field', subject: group.name, object: field, value: fields[field] })
+    }
+  }
+
+  const creditRows = [...credits.entries()]
+    .map(([key, count]) => {
+      const bar = key.indexOf('|')
+      return { steamId: key.slice(0, bar), kit: key.slice(bar + 1), count }
+    })
+    .sort((a, b) => (a.steamId + a.kit).localeCompare(b.steamId + b.kit))
+
+  const payload = {
+    groups: scopedGroups.map((group) => ({
+      name: group.name,
+      title: group.title || group.name,
+      rank: group.rank,
+      permissions: permissionsByGroup.get(group.name),
+      members: membersByGroup.get(group.name),
+      // The values only; `permSync` adds what each one expects to find, which
+      // is per server and comes from the ledger.
+      ...(chat.has(group.name) ? { chat: chat.get(group.name) } : {}),
+    })),
+    grants: [...permissionsBySteamId.entries()].map(([steamId, permissions]) => ({
+      steamId,
+      permissions,
+    })),
+    managed: [...managed].sort(),
+    // Always sent, even empty: to the plugin an absent field means "this site
+    // says nothing about credits", and an empty one means "nobody has any" —
+    // which is what a revert of the last reward must be able to say (D103).
+    credits: creditRows,
+  }
+
+  // Credits are in the digest, so a new reward or a revert pushes, but they are
+  // NOT in `rows`: those are the pushed ledger's, and a use of a kit is not
+  // something in the permission store to retire.
+  //
+  // A style field's VALUE goes into the digest the same way, since it is not in
+  // the row's identity: a colour changed on the site must push.
+  const hashed = [
+    ...rows.map((row) => (row.kind === 'chat-field' ? { ...row, object: `${row.object}=${row.value}` } : row)),
+    ...creditRows.map((c) => ({ kind: 'credit', subject: c.steamId, object: `${c.kit}#${c.count}` })),
+  ]
+
+  return { payload, rows, hash: hashRows(hashed) }
+}
+
+/**
+ * A digest of the desired set.
+ *
+ * Sorted before hashing, because the rows come out of several queries in an
+ * order nothing guarantees — an unsorted digest would differ between two reads
+ * of an unchanged set and push to every game server on every tick.
+ */
+function hashRows(rows) {
+  const canonical = rows
+    .map((row) => `${row.kind}${row.subject}${row.object}`)
+    .sort()
+    .join('\n')
+
+  return crypto.createHash('sha256').update(canonical).digest('hex')
+}
+
+/** A row's identity, for set arithmetic against what was pushed. */
+const rowKey = (row) => `${row.kind}${row.subject}${row.object}`
+
+/**
+ * What this site put in a server and has since withdrawn.
+ *
+ * `pushed − desired`, and it is the one calculation that cannot be replaced by
+ * asking the game: a name in the store that is not in the desired set is either
+ * something the site retired or something a human granted, and those have
+ * opposite correct answers (D31). Only the pushed ledger tells them apart.
+ */
+function retirements(pushed, desiredRows) {
+  const desired = new Set(desiredRows.map(rowKey))
+
+  return pushed.filter((row) => !desired.has(rowKey(row)))
+}
+
+module.exports = {
+  FLEET,
+  normaliseName,
+  inScope,
+  overview,
+  forPlayer,
+  readAuthored,
+  buildDesired,
+  retirements,
+  hashRows,
+  rowKey,
+  collapseGrants,
+  shapeSync,
+  chatByGroup,
+}

server/model/permissions/voice.js

@@ -0,0 +1,70 @@
+// ── The voice the module's own lines are said in (phase 17, D140) ──────────
+//
+// One fleet setting (§33.4 reading 5): the name of a permission group that has
+// a BetterChat style, or nothing for plain chat. News lines and `rust.announce`
+// lines are then said in that group's title and colours — composed here, said by
+// our plugin with no player as the sender, so they look right whether or not
+// BetterChat is loaded.
+//
+// The style is read at the moment a line is said, never copied into the
+// setting: an operator who recolours the group changes the voice with it, and a
+// group whose style is taken away stops being a voice rather than leaving a
+// stale one behind.
+
+const settingsDb = require('../visibility/visibility.db')
+const chatStyle = require('./chatStyle')
+const db = require('./permissions.db')
+const model = require('./permissions.model')
+
+const VOICE_KEY = 'announce.voice'
+
+/** The chosen group's name, or '' for plain chat. */
+async function chosen() {
+  return (await settingsDb.getSetting(VOICE_KEY)) || ''
+}
+
+/**
+ * The format a line is said in right now, or null for plain chat — which is
+ * also the answer when the chosen group has since lost its style or gone.
+ */
+async function currentFormat() {
+  const group = await chosen()
+  if (!group) return null
+
+  const fields = await db.getGroupChat(group)
+  return fields ? chatStyle.voiceFormat(fields) : null
+}
+
+/** The setting, and every group that could be a voice, for the admin page. */
+async function describe() {
+  const [voice, rows] = await Promise.all([chosen(), db.listGroupChat()])
+  const options = []
+
+  for (const [group, fields] of model.chatByGroup(rows)) {
+    const format = chatStyle.voiceFormat(fields)
+    if (format) options.push({ group, title: fields.Title || group, format })
+  }
+
+  return { voice, options: options.sort((a, b) => a.group.localeCompare(b.group)) }
+}
+
+/**
+ * Choose the voice. A group is accepted only when it has a style a voice can be
+ * made from; '' goes back to plain chat. Resolves `{ ok }` or
+ * `{ ok: false, message }`.
+ */
+async function choose(group, userId = null) {
+  const name = model.normaliseName(group)
+
+  if (name) {
+    const fields = await db.getGroupChat(name)
+    if (!fields || !chatStyle.voiceFormat(fields)) {
+      return { ok: false, message: `The group "${name}" has no chat style, so it cannot be a voice. Give it one under Permissions first.` }
+    }
+  }
+
+  await settingsDb.setSetting(VOICE_KEY, name, userId)
+  return { ok: true, voice: name }
+}
+
+module.exports = { VOICE_KEY, chosen, currentFormat, describe, choose }

server/model/servers/nextWipe.js

@@ -0,0 +1,281 @@
+// ── When a server wipes next (phase 16, D128 · D130) ────────────────────────
+//
+// The module knows every PAST wipe — each one is a fact a frame carried — and
+// nothing about the next. D128 made the next one something an operator states,
+// and D130 made the statement a RULE plus an optional one-off date, so it never
+// goes stale: a rule computes the next wipe from the clock, and once a wipe has
+// happened the rule simply names the one after it.
+//
+// **Computed on every read, never stored** (PLAN.md §32.4 reading 7). Nothing has
+// to roll it forward after a wipe, and nothing can disagree with it.
+//
+// ── The rules ─────────────────────────────────────────────────────────────
+//
+//   none      no forecast. The operator has not said the server follows any
+//             calendar, so the game's forced wipe is NOT assumed either.
+//   forced    Facepunch's forced wipe and nothing else.
+//   weekly    every `wipe_day` at `wipe_time` in `wipe_tz`, AND the forced wipe.
+//   biweekly  every other `wipe_day`, on the weeks `wipe_anchor` falls in, AND
+//             the forced wipe.
+//
+// Every rule includes the forced wipe because Facepunch forces it on every server
+// whatever its own schedule (reading 3): a weekly server's next wipe is the
+// earlier of its own next day and the first Thursday of the month.
+//
+// A one-off date, while it is in the future, IS the next wipe, and any computed
+// wipe before it is skipped (reading 5). That one reading covers both of D130's
+// cases — a date after the computed wipe delays it, a date before it adds one —
+// and it applies under `none` too: an operator who states a date has stated a
+// forecast. Once the date has passed it is ignored rather than cleared.
+//
+// ── The zone arithmetic ───────────────────────────────────────────────────
+//
+// Core offers modules none (`events/recurrence.js` is core's own, and §2.7 forbids
+// importing it), so it is done here through `Intl`, which Node ships with full
+// ICU. Calendar dates are counted as whole days since the epoch — a local date is
+// a date, not an instant — and turned into an instant only at the end, in the
+// server's own zone.
+//
+// A wall-clock time that does not exist (the hour skipped in spring) moves
+// FORWARD by the gap, and one that happens twice (the hour repeated in autumn)
+// takes the FIRST occurrence (reading 6). That is Temporal's `compatible`
+// disambiguation, and the tests pin both edges in both zones the walk uses.
+
+/** Facepunch's forced wipe: the first Thursday of the month, 19:00 UK time (reading 4). */
+const FORCED = Object.freeze({ weekday: 4, time: '19:00', tz: 'Europe/London' })
+
+const RULES = Object.freeze(['none', 'forced', 'weekly', 'biweekly'])
+
+const DAY_MS = 86_400_000
+
+const formatters = new Map()
+
+/** One cached formatter per zone; building one costs far more than using it. */
+function formatterFor(tz) {
+  let fmt = formatters.get(tz)
+  if (!fmt) {
+    fmt = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      hourCycle: 'h23',
+      year: 'numeric',
+      month: 'numeric',
+      day: 'numeric',
+      hour: 'numeric',
+      minute: 'numeric',
+      second: 'numeric',
+    })
+    formatters.set(tz, fmt)
+  }
+  return fmt
+}
+
+/** Is `tz` a zone this process can compute in? `Intl` throws a RangeError on one it cannot. */
+function isZone(tz) {
+  if (typeof tz !== 'string' || !tz) return false
+  try {
+    formatterFor(tz)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** The wall clock in `tz` at instant `ms`, as `{ y, m, d, hh, mm, ss }`. */
+function wallClock(ms, tz) {
+  const parts = {}
+  for (const p of formatterFor(tz).formatToParts(new Date(ms))) parts[p.type] = p.value
+  return {
+    y: Number(parts.year),
+    m: Number(parts.month),
+    d: Number(parts.day),
+    hh: Number(parts.hour),
+    mm: Number(parts.minute),
+    ss: Number(parts.second),
+  }
+}
+
+/** How far `tz` is ahead of UTC at instant `ms`, in milliseconds. */
+function offsetAt(ms, tz) {
+  const w = wallClock(ms, tz)
+  const asUtc = Date.UTC(w.y, w.m - 1, w.d, w.hh, w.mm, w.ss)
+  return asUtc - Math.floor(ms / 1000) * 1000
+}
+
+/**
+ * The instant at which `tz`'s wall clock reads `day` (days since the epoch) at
+ * `hh:mm`, disambiguated as the header says.
+ *
+ * Offsets change at most once a day, so the offsets a day either side are the
+ * only two a wall time can have. Each gives a candidate; a candidate is real if
+ * the zone's offset AT it is the one that produced it.
+ */
+function instantOf(day, hh, mm, tz) {
+  const naive = day * DAY_MS + (hh * 60 + mm) * 60_000
+  const before = offsetAt(naive - DAY_MS, tz)
+  const after = offsetAt(naive + DAY_MS, tz)
+  const candidates = [naive - before, naive - after].filter((t, i) => offsetAt(t, tz) === (i === 0 ? before : after))
+
+  // A skipped hour: neither candidate reads back as that wall time. Using the
+  // offset from BEFORE the gap lands the same distance past it — 01:30 in a
+  // spring-forward from 01:00 to 02:00 becomes 02:30.
+  if (!candidates.length) return naive - before
+  return Math.min(...candidates)
+}
+
+/** Today's date in `tz`, as days since the epoch. */
+function localDay(ms, tz) {
+  const w = wallClock(ms, tz)
+  return Math.floor(Date.UTC(w.y, w.m - 1, w.d) / DAY_MS)
+}
+
+/** 0 = Sunday … 6 = Saturday, for a day count. 1970-01-01 was a Thursday. */
+const weekdayOf = (day) => (((day + 4) % 7) + 7) % 7
+
+/** `HH:MM` → `[hh, mm]`, or null. */
+function parseTime(value) {
+  const match = /^([01]\d|2[0-3]):([0-5]\d)$/.exec(String(value || ''))
+  return match ? [Number(match[1]), Number(match[2])] : null
+}
+
+/** `YYYY-MM-DD` (or a Date) → days since the epoch, or null. */
+function parseDay(value) {
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) return null
+    return Math.floor(Date.UTC(value.getFullYear(), value.getMonth(), value.getDate()) / DAY_MS)
+  }
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(value || ''))
+  if (!match) return null
+  const ms = Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]))
+  const back = new Date(ms)
+  // Reject a date that rolled over (2026-02-30 is not 2026-03-02).
+  if (back.getUTCDate() !== Number(match[3])) return null
+  return Math.floor(ms / DAY_MS)
+}
+
+/** The first forced wipe strictly after `now`. */
+function nextForced(now) {
+  const [hh, mm] = parseTime(FORCED.time)
+  const today = wallClock(now, FORCED.tz)
+
+  // This month's first Thursday, then next month's. Two are always enough: a
+  // month's forced wipe that has passed is followed by next month's.
+  for (let step = 0; step < 2; step += 1) {
+    const first = Math.floor(Date.UTC(today.y, today.m - 1 + step, 1) / DAY_MS)
+    const thursday = first + ((FORCED.weekday - weekdayOf(first) + 7) % 7)
+    const at = instantOf(thursday, hh, mm, FORCED.tz)
+    if (at > now) return at
+  }
+  return null
+}
+
+/** The first wipe a weekly or biweekly rule names strictly after `now`, or null. */
+function nextByRule(row, now) {
+  const time = parseTime(row.wipeTime)
+  const day = Number(row.wipeDay)
+  if (!time || !Number.isInteger(day) || day < 0 || day > 6 || !isZone(row.wipeTz)) return null
+
+  const anchor = row.wipeRule === 'biweekly' ? parseDay(row.wipeAnchor) : null
+  if (row.wipeRule === 'biweekly' && anchor == null) return null
+
+  // Start a day early: "today" is judged in the server's zone and `now` may be a
+  // few hours either side of it in another. Three weeks covers a biweekly rule
+  // whose on-week has just passed.
+  const start = localDay(now, row.wipeTz) - 1
+  for (let d = start; d < start + 22; d += 1) {
+    if (weekdayOf(d) !== day) continue
+    // eslint-disable-next-line no-continue
+    if (anchor != null && (((d - anchor) % 14) + 14) % 14 >= 7) continue
+    const at = instantOf(d, time[0], time[1], row.wipeTz)
+    if (at > now) return at
+  }
+  return null
+}
+
+/** A one-off date as an instant, or null. */
+function onceOf(value) {
+  if (value == null || value === '') return null
+  const ms = value instanceof Date ? value.getTime() : Date.parse(value)
+  return Number.isNaN(ms) ? null : ms
+}
+
+/**
+ * When `row` wipes next, and what decided it.
+ *
+ * `row` carries the six schedule fields in their camelCase names (`wipeRule`,
+ * `wipeDay`, `wipeTime`, `wipeTz`, `wipeAnchor`, `wipeOnceAt`). Answers
+ * `{ at, source }` — `at` an ISO instant, `source` one of `once`, `forced` or
+ * `rule` — or `null` when no forecast can honestly be made.
+ *
+ * Throws nothing: a row with a zone this process does not know, or a time that
+ * does not parse, answers what the rest of it can (the forced wipe still stands)
+ * rather than failing the page that asked.
+ */
+function nextWipe(row, now = Date.now()) {
+  if (!row) return null
+
+  const once = onceOf(row.wipeOnceAt)
+  if (once != null && once > now) return { at: new Date(once).toISOString(), source: 'once' }
+
+  const rule = RULES.includes(row.wipeRule) ? row.wipeRule : 'none'
+  if (rule === 'none') return null
+
+  const forced = nextForced(now)
+  const own = rule === 'forced' ? null : nextByRule(row, now)
+
+  // On a tie the forced wipe is the reason: it happens whatever the rule says.
+  if (own != null && (forced == null || own < forced)) return { at: new Date(own).toISOString(), source: 'rule' }
+  if (forced != null) return { at: new Date(forced).toISOString(), source: 'forced' }
+  return null
+}
+
+/**
+ * Check an operator's schedule before it is saved. Answers a list of sentences,
+ * empty when the schedule is sound — the admin form shows them as they are.
+ *
+ * The rule's own fields are required only by the rules that read them, and the
+ * one-off date must be in the future on save: a date in the past says nothing
+ * about the next wipe, and accepting one would be storing a mistake.
+ */
+function validateSchedule(schedule, now = Date.now()) {
+  const errors = []
+  const rule = schedule.wipeRule == null ? 'none' : schedule.wipeRule
+  if (!RULES.includes(rule)) errors.push(`The wipe rule is one of ${RULES.join(', ')}, not "${rule}".`)
+
+  if (rule === 'weekly' || rule === 'biweekly') {
+    const day = Number(schedule.wipeDay)
+    if (schedule.wipeDay == null || schedule.wipeDay === '' || !Number.isInteger(day) || day < 0 || day > 6) {
+      errors.push('A weekly or biweekly rule needs a day of the week.')
+    }
+    if (!parseTime(schedule.wipeTime)) errors.push('The wipe time is HH:MM, on a 24-hour clock.')
+    if (!isZone(schedule.wipeTz)) errors.push(`"${schedule.wipeTz || ''}" is not a time zone this site knows (use an IANA name such as Europe/London).`)
+  }
+
+  if (rule === 'biweekly') {
+    const anchor = parseDay(schedule.wipeAnchor)
+    if (anchor == null) {
+      errors.push('A biweekly rule needs the date of one wipe on it, as YYYY-MM-DD.')
+    } else if (Number.isInteger(Number(schedule.wipeDay)) && weekdayOf(anchor) !== Number(schedule.wipeDay)) {
+      errors.push('The biweekly rule’s date must fall on its day of the week.')
+    }
+  }
+
+  if (schedule.wipeOnceAt != null && schedule.wipeOnceAt !== '') {
+    const once = onceOf(schedule.wipeOnceAt)
+    if (once == null) errors.push('The one-off wipe is not a date and time.')
+    else if (once <= now) errors.push('The one-off wipe must be in the future.')
+  }
+
+  return errors
+}
+
+module.exports = {
+  FORCED,
+  RULES,
+  nextWipe,
+  validateSchedule,
+  isZone,
+  // Exposed for the tests, which pin the arithmetic directly.
+  instantOf,
+  parseDay,
+  weekdayOf,
+}

server/model/servers/servers.db.js

@@ -23,7 +23,11 @@ const STATE = 'rust_server_state'
 async function listServers({ enabledOnly = false } = {}) {
   return core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
-            protocol, enabled, sort_order AS sortOrder, created_at AS createdAt, updated_at AS updatedAt
+            protocol, enabled, sort_order AS sortOrder, announce_news AS announceNews,
+            news_delivery AS newsDelivery,
+            wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
+            DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
+            created_at AS createdAt, updated_at AS updatedAt
        FROM ${SERVERS}
       ${enabledOnly ? 'WHERE enabled = 1' : ''}
       ORDER BY sort_order ASC, id ASC`,
@@ -33,7 +37,10 @@ async function listServers({ enabledOnly = false } = {}) {
 async function getServer(id) {
   const rows = await core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
-            protocol, enabled, sort_order AS sortOrder, created_at AS createdAt, updated_at AS updatedAt
+            protocol, enabled, sort_order AS sortOrder,
+            wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
+            DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
+            created_at AS createdAt, updated_at AS updatedAt
        FROM ${SERVERS}
       WHERE id = ?`,
     [id],
@@ -70,19 +77,78 @@ async function upsertServer({ id, name, sidecarBaseUrl, sidecarTokenEnc, protoco
   )
 }
 
+/**
+ * Write one server's wipe schedule (phase 16, D130), all six columns at once.
+ *
+ * Its own statement rather than six more columns on `upsertServer`, because the
+ * schedule is written only when a save CARRIES one: a client that predates the
+ * schedule and posts the rest of the row must not reset it to `none`.
+ *
+ * `wipeOnceAt` is a Date or null. The pool negotiates the session's zone
+ * (`timezone: 'auto'` in core), so a Date written here reads back as the same
+ * instant.
+ */
+async function setSchedule(id, { wipeRule, wipeDay, wipeTime, wipeTz, wipeAnchor, wipeOnceAt }) {
+  await core.query(
+    `UPDATE ${SERVERS}
+        SET wipe_rule = ?, wipe_day = ?, wipe_time = ?, wipe_tz = ?, wipe_anchor = ?, wipe_once_at = ?
+      WHERE id = ?`,
+    [wipeRule, wipeDay, wipeTime, wipeTz, wipeAnchor, wipeOnceAt, id],
+  )
+}
+
 async function deleteServer(id) {
   await core.query(`DELETE FROM ${SERVERS} WHERE id = ?`, [id])
 }
 
+/**
+ * `worldReady` from the hello the row keeps whole (`raw`): true, false, or null for
+ * a plugin that never says — which PLAN.md §28.6 reads as ready. The permission and
+ * title pushes hold while it is false (PLAN_FIXES F7): the plugin connects before the
+ * save loads, and a sync sent then waits on a main thread that is busy loading, times
+ * out, and the restart it was for is never shown as restored.
+ */
+function withWorldReady(row) {
+  if (!row) return row
+  const value = row.worldReady
+  const ready = value === null || value === undefined ? null : value === true || value === 1 || String(value) === 'true'
+  return { ...row, worldReady: ready, zoneHelper: helperOf(row.zoneHelper) }
+}
+
+/**
+ * The ZoneManager helper's state from the same hello (PLAN_FIXES D182): `{ state,
+ * version?, reason? }`, or null when the plugin reported none — no ZoneManager, or
+ * a plugin older than protocol 13. The driver hands JSON_EXTRACT back as text.
+ */
+function helperOf(value) {
+  if (value === null || value === undefined) return null
+  let parsed = value
+  if (typeof value === 'string') {
+    try {
+      parsed = JSON.parse(value)
+    } catch {
+      return null
+    }
+  }
+  if (!parsed || typeof parsed !== 'object' || typeof parsed.state !== 'string') return null
+  return {
+    state: parsed.state,
+    ...(typeof parsed.version === 'string' ? { version: parsed.version } : {}),
+    ...(typeof parsed.reason === 'string' ? { reason: parsed.reason } : {}),
+  }
+}
+
 /** The last thing each server said about itself, keyed by server id. */
 async function listState() {
-  return core.query(
+  return (await core.query(
     `SELECT server_id AS serverId, reachable, online, players, max_players AS maxPlayers,
             hostname, level, seed, world_size AS worldSize, boot_id AS bootId,
             save_created_at AS saveCreatedAt, wipe_id AS wipeId, protocol,
-            last_seen_at AS lastSeenAt, updated_at AS updatedAt
+            last_seen_at AS lastSeenAt, updated_at AS updatedAt,
+            JSON_EXTRACT(raw, '$.worldReady') AS worldReady,
+            JSON_EXTRACT(raw, '$.zoneHelper') AS zoneHelper
        FROM ${STATE}`,
-  )
+  )).map(withWorldReady)
 }
 
 /** One server's observed state, or `null`. The single-row twin of `listState`. */
@@ -91,12 +157,14 @@ async function getState(serverId) {
     `SELECT server_id AS serverId, reachable, online, players, max_players AS maxPlayers,
             hostname, level, seed, world_size AS worldSize, boot_id AS bootId,
             save_created_at AS saveCreatedAt, wipe_id AS wipeId, protocol,
-            last_seen_at AS lastSeenAt, updated_at AS updatedAt
+            last_seen_at AS lastSeenAt, updated_at AS updatedAt,
+            JSON_EXTRACT(raw, '$.worldReady') AS worldReady,
+            JSON_EXTRACT(raw, '$.zoneHelper') AS zoneHelper
        FROM ${STATE}
       WHERE server_id = ?`,
     [serverId],
   )
-  return rows[0] || null
+  return withWorldReady(rows[0] || null)
 }
 
 /**
@@ -146,7 +214,7 @@ async function putState(state) {
     `INSERT INTO ${STATE}
        (server_id, reachable, online, players, max_players, hostname, level, seed,
         world_size, boot_id, save_created_at, wipe_id, protocol, raw, last_seen_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, IF(?, CURRENT_TIMESTAMP, NULL), CURRENT_TIMESTAMP)
      ON DUPLICATE KEY UPDATE
        reachable = VALUES(reachable), online = VALUES(online), players = VALUES(players),
        max_players = VALUES(max_players), hostname = VALUES(hostname), level = VALUES(level),
@@ -154,10 +222,11 @@ async function putState(state) {
        save_created_at = VALUES(save_created_at), wipe_id = VALUES(wipe_id),
        protocol = VALUES(protocol),
        raw = VALUES(raw),
-       -- Only a frame moves this; an unreachable write leaves it alone, which is
-       -- what lets a page say how long a server has been down rather than how
-       -- recently we failed to reach it.
-       last_seen_at = CURRENT_TIMESTAMP,
+       -- Only a CONNECTED game moves this; an unreachable write leaves it alone,
+       -- and so does a board the sidecar kept after the game went away (D68).
+       -- That is what lets a page say how long a server has been down rather
+       -- than how recently we failed to reach it.
+       last_seen_at = IF(?, CURRENT_TIMESTAMP, last_seen_at),
        updated_at = CURRENT_TIMESTAMP`,
     [
       state.serverId,
@@ -174,6 +243,8 @@ async function putState(state) {
       state.wipeId || null,
       state.protocol === undefined ? null : state.protocol,
       state.raw ? JSON.stringify(state.raw) : null,
+      state.seen === false ? 0 : 1,
+      state.seen === false ? 0 : 1,
     ],
   )
 }
@@ -184,6 +255,7 @@ module.exports = {
   listServers,
   getServer,
   upsertServer,
+  setSchedule,
   deleteServer,
   listState,
   getState,

server/model/servers/servers.model.js

@@ -16,6 +16,7 @@
 
 const core = require('../../core')
 const db = require('./servers.db')
+const { nextWipe } = require('./nextWipe')
 
 const log = core.logger('servers')
 
@@ -48,15 +49,50 @@ function withToken(row) {
     }
   }
 
-  return { id: row.id, name: row.name, baseUrl: row.sidecarBaseUrl, token, protocol: row.protocol }
+  return {
+    id: row.id,
+    name: row.name,
+    baseUrl: row.sidecarBaseUrl,
+    token,
+    protocol: row.protocol,
+    // D104: whether a published news post is said in this server's chat.
+    announceNews: Boolean(Number(row.announceNews)),
+    // D142: where that post goes — chat, or a popup.
+    newsDelivery: row.newsDelivery === 'popup' ? 'popup' : 'chat',
+  }
+}
+
+/**
+ * How many servers were enabled when this process last looked. An action's
+ * `cost()` is synchronous and cannot ask the database, so `rust.announce` to
+ * every server is priced at this — refreshed by every poll, which runs
+ * continuously. One until the first poll, which is the least a fleet can be.
+ */
+let enabledCount = 1
+
+function lastEnabledCount() {
+  return enabledCount
 }
 
 /** Every enabled server, with tokens, for the poller. */
 async function listForPolling() {
   const rows = await db.listServers({ enabledOnly: true })
+  enabledCount = rows.length
   return rows.map(withToken)
 }
 
+/**
+ * One ENABLED server with its token, for a call to its sidecar made on a page's
+ * behalf (the map's live layers), or `null`. The same rule as `getPublic`: a
+ * disabled server is not there.
+ */
+async function getForCalling(id) {
+  if (!id) return null
+  const row = await db.getServer(id)
+  if (!row || !row.enabled) return null
+  return withToken(row)
+}
+
 /**
  * The public view: every enabled server and what it last said.
  *
@@ -103,6 +139,27 @@ function shapePublic(row, state, now) {
     lastSeenAt: lastSeenAt ? lastSeenAt.toISOString() : null,
     updatedAt: updatedAt ? updatedAt.toISOString() : null,
     stale,
+    // Phase 16 (D130): `{ at, source }` or null, computed from the operator's
+    // schedule on every read — never stored, so it cannot go stale after a wipe.
+    // Public: a wipe date is announced to bring players back, not kept secret.
+    nextWipe: nextWipe(row, now),
+  }
+}
+
+/**
+ * The schedule as stored, for the admin form: what the operator typed, not what
+ * it computes to. A one-off date that has passed is still returned, and the form
+ * shows it as past (§32.4 reading 5) rather than silently dropping it.
+ */
+function scheduleOf(row) {
+  const once = row.wipeOnceAt ? new Date(row.wipeOnceAt) : null
+  return {
+    rule: row.wipeRule || 'none',
+    day: row.wipeDay == null ? null : Number(row.wipeDay),
+    time: row.wipeTime || null,
+    tz: row.wipeTz || null,
+    anchor: row.wipeAnchor || null,
+    onceAt: once && !Number.isNaN(once.getTime()) ? once.toISOString() : null,
   }
 }
 
@@ -151,6 +208,10 @@ async function listForAdmin(now = Date.now()) {
       reachable: Boolean(state && state.reachable),
       bootId: (state && state.bootId) || null,
       sidecarProtocol: state && state.protocol != null ? Number(state.protocol) : null,
+      // D182: whether ZoneManager counts somebody already standing in a zone the
+      // bridge makes. Anything but `patched` is said on the servers page.
+      zoneHelper: (state && state.zoneHelper) || null,
+      schedule: scheduleOf(row),
     }
   })
 }
@@ -165,9 +226,12 @@ module.exports = {
   STALE_AFTER_MS,
   withToken,
   listForPolling,
+  getForCalling,
+  lastEnabledCount,
   listPublic,
   getPublic,
   listForAdmin,
   shapePublic,
+  scheduleOf,
   encryptToken,
 }

server/model/titles/titles.db.js

@@ -0,0 +1,61 @@
+// ── SQL for chat titles (phase 17) ────────────────────────────────────────
+//
+// The rules an operator writes, per server, and the two columns on
+// `rust_servers` that say how many titles a player shows. The titles themselves
+// are never stored — see `schema.sql` and `titles.js`.
+
+const core = require('../../core')
+
+const RULES = 'rust_title_rules'
+const SERVERS = 'rust_servers'
+
+/** One server's rules, in precedence order. */
+async function listRules(serverId) {
+  return core.query(
+    `SELECT id, stat, top_n AS topN, text, color
+       FROM ${RULES}
+      WHERE server_id = ?
+      ORDER BY position ASC, id ASC`,
+    [serverId],
+  )
+}
+
+/** Every server's rules, for the admin list — one read rather than one per server. */
+async function listAllRules() {
+  return core.query(
+    `SELECT server_id AS serverId, stat, top_n AS topN, text, color
+       FROM ${RULES}
+      ORDER BY server_id ASC, position ASC, id ASC`,
+  )
+}
+
+async function getMode(serverId) {
+  const rows = await core.query(
+    `SELECT title_mode AS mode, title_max AS max FROM ${SERVERS} WHERE id = ?`,
+    [serverId],
+  )
+  return rows[0] || null
+}
+
+async function listModes() {
+  return core.query(`SELECT id AS serverId, title_mode AS mode, title_max AS max FROM ${SERVERS}`)
+}
+
+/**
+ * Replace one server's rules and mode whole. The form edits a list, so the
+ * write is a list — and a rule's position is its place in that list.
+ */
+async function saveSettings(serverId, { mode, max, rules }) {
+  await core.query(`UPDATE ${SERVERS} SET title_mode = ?, title_max = ? WHERE id = ?`, [mode, max, serverId])
+  await core.query(`DELETE FROM ${RULES} WHERE server_id = ?`, [serverId])
+
+  if (!rules.length) return
+
+  await core.query(
+    `INSERT INTO ${RULES} (server_id, position, stat, top_n, text, color)
+          VALUES ${rules.map(() => '(?, ?, ?, ?, ?, ?)').join(',')}`,
+    rules.flatMap((r, i) => [serverId, i, r.stat, r.topN, r.text, r.color]),
+  )
+}
+
+module.exports = { RULES, listRules, listAllRules, getMode, listModes, saveSettings }

server/model/titles/titles.js

@@ -0,0 +1,165 @@
+// ── Chat titles, as rules and as a set (phase 17, D135–D137) ───────────────
+//
+// An operator writes rules per server — "#1 kills", "top 3 playtime" — and the
+// site works out who holds each title from the CURRENT wipe's standings. The
+// same answer goes to three places: BetterChat in the game (`titles.set`), the
+// web leaderboard and the app's. So it is worked out here, once, as pure
+// functions of the rules and the standings, and every consumer reads it.
+//
+// Four readings shape it (§33.4):
+//
+//   1. a rule counts only a stat above zero — a fresh wipe gives no titles,
+//      rather than #1 kills to somebody with none
+//   2. ties follow the leaderboard's own order, so a rule's top N is the first
+//      N rows the web shows for that stat
+//   3. a title's text is at most 24 characters, with markup characters taken
+//      out, and its colour is `#rrggbb`
+//   4. the rule order is precedence: `first` shows the first rule a player meets
+
+const crypto = require('node:crypto')
+
+/** The stats a rule may rank, and the leaderboard sort and column each means. */
+const STATS = {
+  kills: { sort: 'kills', value: (row) => row.kills, label: 'kills' },
+  npckills: { sort: 'npcKills', value: (row) => row.npcKills, label: 'NPC kills' },
+  playtime: { sort: 'playtime', value: (row) => row.playtimeSec, label: 'playtime' },
+}
+
+const MODES = ['first', 'all', 'upto']
+
+const MAX_RULES = 10
+const MAX_TOP_N = 10
+const TEXT_MAX = 24
+const MAX_UPTO = 5
+
+/**
+ * An operator's title text, made safe to put in a chat line: the characters
+ * BetterChat's markup and its placeholders are built from are taken out, then
+ * the whitespace is collapsed. `{` and `}` go too, beyond reading 3's four: a
+ * title is substituted into `{Title}` before `{Message}` is, so a title reading
+ * `{Message}` would print the player's words twice.
+ */
+function cleanText(raw) {
+  return String(raw === undefined || raw === null ? '' : raw)
+    .replace(/[[\]<>{}]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+/** A mode word, or `first` — the fewest — for one this build does not know. */
+function normaliseMode(mode) {
+  return MODES.includes(mode) ? mode : 'first'
+}
+
+/**
+ * A server's title settings as the admin form sends them, checked whole.
+ *
+ * Resolves `{ ok: true, value: { mode, max, rules } }` with every rule cleaned,
+ * or `{ ok: false, errors }`, one sentence per problem. A text that is empty
+ * AFTER cleaning is refused rather than saved blank, so a title made entirely of
+ * brackets is a sentence on the form and not an empty chip in the game.
+ */
+function validateSettings(body) {
+  const errors = []
+  const input = body || {}
+  const mode = input.mode === undefined ? 'first' : input.mode
+
+  if (!MODES.includes(mode)) errors.push(`mode must be one of ${MODES.join(', ')}`)
+
+  const max = input.max === undefined || input.max === null || input.max === '' ? 2 : Number(input.max)
+  if (!Number.isInteger(max) || max < 1 || max > MAX_UPTO) errors.push(`max must be a whole number from 1 to ${MAX_UPTO}`)
+
+  const rules = Array.isArray(input.rules) ? input.rules : null
+  if (!rules) errors.push('rules must be a list')
+  else if (rules.length > MAX_RULES) errors.push(`a server has at most ${MAX_RULES} title rules`)
+
+  const clean = []
+
+  for (const [i, rule] of (rules || []).entries()) {
+    const n = i + 1
+    const r = rule || {}
+    if (!STATS[r.stat]) errors.push(`rule ${n}: stat must be one of ${Object.keys(STATS).join(', ')}`)
+
+    const topN = Number(r.topN)
+    if (!Number.isInteger(topN) || topN < 1 || topN > MAX_TOP_N) errors.push(`rule ${n}: top must be from 1 to ${MAX_TOP_N}`)
+
+    const text = cleanText(r.text)
+    if (!text) errors.push(`rule ${n}: the title needs some text`)
+    else if (text.length > TEXT_MAX) errors.push(`rule ${n}: a title is at most ${TEXT_MAX} characters`)
+
+    const color = String(r.color || '').trim().toLowerCase()
+    if (!/^#[0-9a-f]{6}$/.test(color)) errors.push(`rule ${n}: colour must look like #ffaa55`)
+
+    clean.push({ stat: r.stat, topN, text, color })
+  }
+
+  return errors.length ? { ok: false, errors } : { ok: true, value: { mode, max, rules: clean } }
+}
+
+/**
+ * Who holds which title.
+ *
+ * @param {Array} rules              in precedence order: `{ stat, topN, text, color }`
+ * @param {object} standings         stat → leaderboard rows for the current wipe,
+ *                                   in the leaderboard's order, at least `topN` long
+ * @param {object} options
+ * @param {string} options.mode      `first` · `all` · `upto`
+ * @param {number} options.max       how many `upto` shows
+ * @returns {Map<string, Array<{text, color}>>}  Steam id → titles, in rule order
+ */
+function evaluate(rules, standings, { mode = 'first', max = 2 } = {}) {
+  const held = new Map()
+
+  for (const rule of rules || []) {
+    const stat = STATS[rule.stat]
+    if (!stat) continue
+
+    const rows = (standings[rule.stat] || []).filter((row) => Number(stat.value(row)) > 0).slice(0, rule.topN)
+
+    for (const row of rows) {
+      if (!held.has(row.steamId)) held.set(row.steamId, [])
+      held.get(row.steamId).push({ text: rule.text, color: rule.color })
+    }
+  }
+
+  const keep = { first: 1, upto: max, all: Infinity }[normaliseMode(mode)]
+
+  for (const [steamId, list] of held) held.set(steamId, list.slice(0, keep))
+
+  return held
+}
+
+/** One player's titles as BetterChat markup: `[#hex]text[/#]`, space-separated. */
+function markup(list) {
+  return list.map((t) => `[#${t.color.replace(/^#/, '')}]${t.text}[/#]`).join(' ')
+}
+
+/** The wire set, sorted so an unchanged set digests the same on every tick. */
+function wireSet(held) {
+  return [...held.entries()]
+    .map(([steamId, list]) => ({ steamId, text: markup(list) }))
+    .sort((a, b) => a.steamId.localeCompare(b.steamId))
+}
+
+function digest(set) {
+  return crypto
+    .createHash('sha256')
+    .update(set.map((t) => `${t.steamId} ${t.text}`).join('\n'))
+    .digest('hex')
+}
+
+module.exports = {
+  STATS,
+  MODES,
+  MAX_RULES,
+  MAX_TOP_N,
+  MAX_UPTO,
+  TEXT_MAX,
+  cleanText,
+  normaliseMode,
+  validateSettings,
+  evaluate,
+  markup,
+  wireSet,
+  digest,
+}

server/model/titles/titles.model.js

@@ -0,0 +1,106 @@
+// ── Chat titles, read against the live standings (phase 17) ────────────────
+//
+// `titles.js` decides; this file fetches what it decides from. One answer per
+// server serves three readers — the push to the game, the web leaderboard and
+// the app's — so it is remembered briefly: the leaderboard is polled by every
+// open page, and each rule is a leaderboard query of its own.
+
+const eventsDb = require('../events/events.db')
+const serversDb = require('../servers/servers.db')
+const db = require('./titles.db')
+const titles = require('./titles')
+
+/** How long one server's answer is reused. The same as the push loop's tick. */
+const MEMO_MS = 30 * 1000
+
+const memo = new Map()
+
+/** A server's settings as the admin form reads them. */
+async function settingsFor(serverId) {
+  const [mode, rules] = await Promise.all([db.getMode(serverId), db.listRules(serverId)])
+  return shapeSettings(mode, rules)
+}
+
+function shapeSettings(mode, rules) {
+  return {
+    mode: titles.normaliseMode(mode && mode.mode),
+    max: mode && Number(mode.max) ? Number(mode.max) : 2,
+    rules: rules.map((r) => ({ stat: r.stat, topN: Number(r.topN), text: r.text, color: r.color })),
+  }
+}
+
+/** Every server's settings, keyed by id, for the admin server list. */
+async function settingsByServer() {
+  const [modes, rules] = await Promise.all([db.listModes(), db.listAllRules()])
+  const out = new Map(modes.map((m) => [m.serverId, shapeSettings(m, [])]))
+
+  for (const r of rules) {
+    const s = out.get(r.serverId)
+    if (s) s.rules.push({ stat: r.stat, topN: Number(r.topN), text: r.text, color: r.color })
+  }
+
+  return out
+}
+
+async function saveSettings(serverId, value) {
+  await db.saveSettings(serverId, value)
+  forget(serverId)
+}
+
+function forget(serverId) {
+  for (const key of memo.keys()) if (key.startsWith(`${serverId} `)) memo.delete(key)
+}
+
+/**
+ * Who holds which title on one server right now: a Map of Steam id to
+ * `[{ text, color }]`, after the server's mode. Empty with no rules, and empty
+ * with no current wipe — a title ranks the current wipe (D135), and a server that
+ * has never said which wipe it is on has none to rank.
+ */
+async function heldFor(serverId, { wipeId, now = Date.now() } = {}) {
+  if (!wipeId) return new Map()
+
+  const key = `${serverId} ${wipeId}`
+  const hit = memo.get(key)
+  if (hit && now - hit.at < MEMO_MS) return hit.held
+
+  const settings = await settingsFor(serverId)
+  const standings = {}
+
+  // One query per STAT, at the deepest top N any rule on it asks for, rather
+  // than one per rule: two rules on kills read the same rows.
+  const depth = new Map()
+  for (const r of settings.rules) depth.set(r.stat, Math.max(depth.get(r.stat) || 0, r.topN))
+
+  await Promise.all(
+    [...depth.entries()].map(async ([stat, limit]) => {
+      standings[stat] = await eventsDb.leaderboard({ serverId, wipeId, sort: titles.STATS[stat].sort, limit })
+    }),
+  )
+
+  const held = titles.evaluate(settings.rules, normalise(standings), settings)
+  memo.set(key, { at: now, held })
+  return held
+}
+
+/** The leaderboard's rows carry numbers as strings from SUM(); the rules compare numbers. */
+function normalise(standings) {
+  const out = {}
+  for (const [stat, rows] of Object.entries(standings)) {
+    out[stat] = rows.map((r) => ({
+      steamId: r.steamId,
+      kills: Number(r.kills) || 0,
+      npcKills: Number(r.npcKills) || 0,
+      playtimeSec: Number(r.playtimeSec) || 0,
+    }))
+  }
+  return out
+}
+
+/** The same, for a server by id, reading its current wipe from its last report. */
+async function currentFor(serverId) {
+  const state = await serversDb.getState(serverId)
+  return heldFor(serverId, { wipeId: state && state.wipeId ? state.wipeId : null })
+}
+
+module.exports = { MEMO_MS, settingsFor, settingsByServer, saveSettings, heldFor, currentFor, forget }

server/model/visibility/visibility.db.js

@@ -0,0 +1,77 @@
+// ── SQL for the visibility settings ───────────────────────────────────────
+//
+// Two stores for one decision: the fleet default in `rust_settings`, and an
+// optional per-server override on `rust_servers`. See `schema.sql` for why each
+// lives where it does.
+
+const core = require('../../core')
+
+const SETTINGS = 'rust_settings'
+const SERVERS = 'rust_servers'
+
+/** One setting's stored value, or `null` when nobody has ever set it. */
+async function getSetting(key) {
+  const rows = await core.query(`SELECT value FROM ${SETTINGS} WHERE setting_key = ?`, [key])
+  return rows[0] ? rows[0].value : null
+}
+
+async function setSetting(key, value, userId = null) {
+  await core.query(
+    `INSERT INTO ${SETTINGS} (setting_key, value, updated_by, updated_at)
+          VALUES (?, ?, ?, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE value = VALUES(value), updated_by = VALUES(updated_by),
+                             updated_at = CURRENT_TIMESTAMP`,
+    [key, value, userId],
+  )
+}
+
+/** One server's override, `null` for "inherit", or `undefined` when there is no such server. */
+async function getServerPresence(serverId) {
+  const rows = await core.query(`SELECT presence_audience AS presence FROM ${SERVERS} WHERE id = ?`, [serverId])
+  return rows[0] ? rows[0].presence : undefined
+}
+
+/** Every configured server with its override, in the operator's own order. */
+async function listServerPresence() {
+  return core.query(
+    `SELECT id, name, enabled, presence_audience AS presence, announce_news AS announceNews,
+            news_delivery AS newsDelivery
+       FROM ${SERVERS}
+      ORDER BY sort_order ASC, id ASC`,
+  )
+}
+
+/**
+ * Sets or clears (`null`) one server's override.
+ *
+ * Returns nothing, deliberately. `affectedRows` would look like a way to tell
+ * "no such server" from success, and it is not one: without `foundRows` an
+ * UPDATE writing the value already there reports 0, and whether core's pool sets
+ * that flag is core's business. The model checks existence with a read first.
+ */
+async function setServerPresence(serverId, value) {
+  await core.query(`UPDATE ${SERVERS} SET presence_audience = ? WHERE id = ?`, [value, serverId])
+}
+
+/**
+ * Turns one server's news switch on or off (D104). Existence is the model's
+ * question, asked with a read first, for the reason given above.
+ */
+async function setServerNews(serverId, on) {
+  await core.query(`UPDATE ${SERVERS} SET announce_news = ? WHERE id = ?`, [on ? 1 : 0, serverId])
+}
+
+/** Where one server's news goes when its switch is on: `chat` or `popup` (D142). */
+async function setServerNewsDelivery(serverId, delivery) {
+  await core.query(`UPDATE ${SERVERS} SET news_delivery = ? WHERE id = ?`, [delivery, serverId])
+}
+
+module.exports = {
+  getSetting,
+  setSetting,
+  getServerPresence,
+  listServerPresence,
+  setServerPresence,
+  setServerNews,
+  setServerNewsDelivery,
+}

server/model/visibility/visibility.model.js

@@ -0,0 +1,322 @@
+// ── Who may see who is online ─────────────────────────────────────────────
+//
+// The org lead's rule, settled 2026-09-22: **nothing tells who is online by
+// default.** It is always the lowest blast radius — staff — unless an operator
+// deliberately widens it, and a COUNT of players is fine where a list of names
+// is not.
+//
+// "Who is online" is wider than the Online tab. Every frame that says a named
+// player was on the server at a given moment says it: a connect, a respawn, a
+// death, a chat line, a gather tally (`catalogue.PRESENCE_KINDS`), and a
+// leaderboard row's `lastSeen`, which a tally refreshes every minute while
+// somebody plays. All of them sit behind this one setting.
+//
+// ── The audiences ─────────────────────────────────────────────────────────
+//
+//   staff       an admin or a moderator — the two roles every Team surface in
+//               core also means by "staff"
+//   signed_in   any active website account
+//   public      anybody, signed in or not
+//
+// Ordered, each rung implying the ones below it. The names line up with phase
+// 14's map-layer switches (public / players / admin) so that one layer can take
+// this over rather than sit beside it.
+//
+// ── Two fallbacks, deliberately asymmetric ────────────────────────────────
+//
+// An unrecognised VIEWER reads as the bottom rung and an unrecognised
+// REQUIREMENT reads as the top one, so a value nobody expected always loses.
+// One shared fallback cannot do that: whichever way it points, it fails open on
+// one side. module-uo's shard visibility learned this the hard way; the rule is
+// copied here rather than rediscovered.
+
+const core = require('../../core')
+
+const db = require('./visibility.db')
+
+const log = core.logger('visibility')
+
+const AUDIENCES = Object.freeze(['public', 'signed_in', 'staff'])
+const RANK = new Map(AUDIENCES.map((a, i) => [a, i]))
+
+/** The narrowest rung, and the default wherever nothing has been chosen. */
+const DEFAULT_PRESENCE = 'staff'
+
+/** The `rust_settings` key the fleet default lives under. */
+const PRESENCE_KEY = 'presence.audience'
+
+const isAudience = (value) => RANK.has(value)
+
+// ── Who may see a clan's roster (phase 9, D48) ────────────────────────────
+//
+// The same rule applied to a roster: a roster says who is in a clan and, inside
+// its audience, which of them is on. So it defaults to the clan's OWN members
+// plus staff, and an operator widens it deliberately.
+//
+//   members     staff, and a website account linked to one of the clan's members
+//   signed_in   any active website account
+//   public      anybody
+//
+// One fleet-wide setting (D48), deliberately without a per-server override: the
+// presence override exists because a PvE server may publish a roll call a PvP one
+// must not, and a roster is the same answer on every server of the fleet.
+//
+// **Widening it widens online status too.** Core's `projectRoster` can withhold a
+// roster's rows but not its fields, so there is no rung that shows who is in a
+// clan and hides which of them is on. The admin page says so beside the switch.
+const CLAN_AUDIENCES = Object.freeze(['public', 'signed_in', 'members'])
+
+/** The narrowest rung, and the default until an operator chooses. */
+const DEFAULT_CLAN_ROSTER = 'members'
+
+/** The `rust_settings` key the roster audience lives under. */
+const CLAN_ROSTER_KEY = 'clans.roster.audience'
+
+const isClanAudience = (value) => CLAN_AUDIENCES.includes(value)
+
+const viewerRank = (level) => RANK.get(level) ?? 0
+const requiredRank = (level) => RANK.get(level) ?? RANK.get('staff')
+
+/** Does a viewer at `viewer` satisfy a requirement of `required`? */
+const meets = (viewer, required) => viewerRank(viewer) >= requiredRank(required)
+
+/**
+ * The viewer's rung, re-read from the database.
+ *
+ * `getUserFromRequest` decodes a token and nothing more — the role in it is the
+ * role the account had when it signed in. For a gate on who may see who is
+ * online, that is not good enough: a moderator demoted this morning would keep
+ * the roll call until their token expired, and a banned account would keep
+ * reading it too. So the token only says WHO; the row says what they are now.
+ *
+ * Any failure resolves to `public` — the bottom rung — because an unanswerable
+ * question about somebody's standing must grant nothing.
+ */
+async function viewerLevel(req) {
+  return (await viewer(req)).level
+}
+
+/**
+ * The viewer's rung AND who they are, from the same re-read row — `{ level,
+ * userId }`, with `userId` null for anybody who resolves to `public`. The map's
+ * own-and-mates view (D115) needs the id, and it must come from the row that
+ * decided the rung: a banned account is nobody, whatever its token names.
+ */
+async function viewer(req) {
+  const nobody = { level: 'public', userId: null }
+  try {
+    const claimed = req.user || core.auth.getUserFromRequest(req)
+    if (!claimed || claimed.id == null) return nobody
+
+    const user = await core.users.getById(claimed.id)
+    if (!user) return nobody
+    if (user.status && user.status !== 'active') return nobody
+
+    const level = user.role === 'admin' || user.role === 'moderator' ? 'staff' : 'signed_in'
+    return { level, userId: user.id != null ? user.id : claimed.id }
+  } catch (err) {
+    log.warn('could not resolve the viewer; treating them as anonymous', { error: err.message })
+    return nobody
+  }
+}
+
+/** A stored value as an audience, narrowing anything this build does not recognise. */
+function normalise(value) {
+  return isAudience(value) ? value : DEFAULT_PRESENCE
+}
+
+/** The fleet default. */
+async function fleetPresence() {
+  const stored = await db.getSetting(PRESENCE_KEY)
+  return stored == null ? DEFAULT_PRESENCE : normalise(stored)
+}
+
+/**
+ * The audience that applies to one server: its override if it has one, the
+ * fleet default otherwise.
+ *
+ * A server that does not exist gets the fleet default, which is the right answer
+ * for the routes that call this: they answer an empty list for an unknown id,
+ * and an empty list is empty at every rung.
+ */
+async function presenceFor(serverId) {
+  const override = await db.getServerPresence(serverId)
+  if (override != null) return normalise(override)
+  return fleetPresence()
+}
+
+/**
+ * Everything a public route needs in one call: may this viewer see who is on
+ * this server?
+ *
+ * Throws nothing. A setting that cannot be read resolves to "no" — the routes
+ * that ask would otherwise have to choose between a 500 and publishing names.
+ */
+async function canSeePresence(req, serverId) {
+  try {
+    const [level, required] = await Promise.all([viewerLevel(req), presenceFor(serverId)])
+    return { visible: meets(level, required), level, required }
+  } catch (err) {
+    log.warn('could not resolve presence visibility; withholding it', { server: serverId, error: err.message })
+    return { visible: false, level: 'public', required: DEFAULT_PRESENCE }
+  }
+}
+
+/**
+ * The clan roster audience. An unrecognised stored word narrows to `members`,
+ * and a read that fails throws — every caller answers "no" on a throw, which is
+ * the direction a roster must fail in.
+ */
+async function clanRosterAudience() {
+  const stored = await db.getSetting(CLAN_ROSTER_KEY)
+  return isClanAudience(stored) ? stored : DEFAULT_CLAN_ROSTER
+}
+
+/** The admin screen's read: the fleet default and every server beside it. */
+async function describe() {
+  const [fleet, servers, clanRoster] = await Promise.all([
+    fleetPresence(),
+    db.listServerPresence(),
+    clanRosterAudience(),
+  ])
+  return {
+    audiences: [...AUDIENCES],
+    clans: { audiences: [...CLAN_AUDIENCES], roster: clanRoster },
+    presence: {
+      fleet,
+      servers: servers.map((s) => {
+        const override = s.presence == null ? null : normalise(s.presence)
+        return {
+          id: s.id,
+          name: s.name,
+          enabled: Boolean(s.enabled),
+          override,
+          effective: override || fleet,
+        }
+      }),
+    },
+    // D104/D106: whether a published news post is said in each server's chat.
+    // On this page because it is the one that lists every server with a setting
+    // of its own, and it answers the same kind of question — what a server shows.
+    news: {
+      servers: servers.map((s) => ({
+        id: s.id,
+        name: s.name,
+        enabled: Boolean(s.enabled),
+        on: Boolean(Number(s.announceNews)),
+        // D142: where the post goes when the switch is on. A word this build
+        // does not know reads as chat, which every server can do.
+        delivery: s.newsDelivery === 'popup' ? 'popup' : 'chat',
+      })),
+    },
+  }
+}
+
+/**
+ * The admin screen's write.
+ *
+ * `fleet` is optional; `servers` maps an id to an audience, or to `null` to
+ * clear its override. Validated whole before anything is written, so a request
+ * naming one unknown server changes nothing rather than half of what it asked.
+ *
+ * Resolves `{ ok, changed }`, or `{ ok: false, status, message }` — a refusal is a
+ * sentence the page can show.
+ */
+async function update({ fleet, servers, clanRoster, news, newsDelivery } = {}, actor = null) {
+  if (fleet !== undefined && !isAudience(fleet)) {
+    return { ok: false, status: 400, message: `"${fleet}" is not an audience. Choose one of: ${AUDIENCES.join(', ')}.` }
+  }
+
+  if (clanRoster !== undefined && !isClanAudience(clanRoster)) {
+    return {
+      ok: false,
+      status: 400,
+      message: `"${clanRoster}" is not a clan roster audience. Choose one of: ${CLAN_AUDIENCES.join(', ')}.`,
+    }
+  }
+
+  const changes = Object.entries(servers || {})
+  for (const [id, value] of changes) {
+    if (value !== null && !isAudience(value)) {
+      return { ok: false, status: 400, message: `"${value}" is not an audience for server ${id}.` }
+    }
+    // eslint-disable-next-line no-await-in-loop
+    if ((await db.getServerPresence(id)) === undefined) {
+      return { ok: false, status: 404, message: `There is no server called ${id}.` }
+    }
+  }
+
+  const newsChanges = Object.entries(news || {})
+  for (const [id, value] of newsChanges) {
+    if (typeof value !== 'boolean') {
+      return { ok: false, status: 400, message: `News in game chat is on or off for server ${id}, not "${value}".` }
+    }
+    // eslint-disable-next-line no-await-in-loop
+    if ((await db.getServerPresence(id)) === undefined) {
+      return { ok: false, status: 404, message: `There is no server called ${id}.` }
+    }
+  }
+
+  const deliveryChanges = Object.entries(newsDelivery || {})
+  for (const [id, value] of deliveryChanges) {
+    if (value !== 'chat' && value !== 'popup') {
+      return { ok: false, status: 400, message: `News goes to chat or to a popup on server ${id}, not "${value}".` }
+    }
+    // eslint-disable-next-line no-await-in-loop
+    if ((await db.getServerPresence(id)) === undefined) {
+      return { ok: false, status: 404, message: `There is no server called ${id}.` }
+    }
+  }
+
+  const userId = actor && actor.id != null ? actor.id : null
+
+  if (fleet !== undefined) await db.setSetting(PRESENCE_KEY, fleet, userId)
+  if (clanRoster !== undefined) await db.setSetting(CLAN_ROSTER_KEY, clanRoster, userId)
+  for (const [id, value] of changes) {
+    // eslint-disable-next-line no-await-in-loop
+    await db.setServerPresence(id, value)
+  }
+  for (const [id, on] of newsChanges) {
+    // eslint-disable-next-line no-await-in-loop
+    await db.setServerNews(id, on)
+  }
+  for (const [id, delivery] of deliveryChanges) {
+    // eslint-disable-next-line no-await-in-loop
+    await db.setServerNewsDelivery(id, delivery)
+  }
+
+  // What was written, for the controller's audit row. Recorded there rather than
+  // here because the activity log takes the REQUEST (who, from where), and a
+  // model that took a request would be a model that could only be called by one.
+  return {
+    ok: true,
+    changed: {
+      ...(fleet !== undefined ? { fleet } : {}),
+      ...(clanRoster !== undefined ? { clanRoster } : {}),
+      servers: Object.fromEntries(changes.map(([id, value]) => [id, value === null ? 'inherit' : value])),
+      ...(newsChanges.length ? { news: Object.fromEntries(newsChanges) } : {}),
+      ...(deliveryChanges.length ? { newsDelivery: Object.fromEntries(deliveryChanges) } : {}),
+    },
+  }
+}
+
+module.exports = {
+  AUDIENCES,
+  DEFAULT_PRESENCE,
+  PRESENCE_KEY,
+  isAudience,
+  CLAN_AUDIENCES,
+  DEFAULT_CLAN_ROSTER,
+  CLAN_ROSTER_KEY,
+  isClanAudience,
+  clanRosterAudience,
+  meets,
+  normalise,
+  viewerLevel,
+  viewer,
+  fleetPresence,
+  presenceFor,
+  canSeePresence,
+  describe,
+  update,
+}

server/package.json

@@ -10,7 +10,9 @@
     "check:imports": "node scripts/checkImports.js",
     "check:bundle": "node scripts/checkBundle.js",
     "swagger": "node scripts/swaggerFragment.js",
-    "check:swagger": "node scripts/swaggerFragment.js --check"
+    "check:swagger": "node scripts/swaggerFragment.js --check",
+    "engagement:manifest": "node scripts/engagementManifest.js",
+    "check:engagement": "node scripts/engagementManifest.js --check"
   },
   "engines": {
     "node": ">=20"

server/permSync.js

@@ -0,0 +1,456 @@
+// ── Keeping a game's permission store equal to what the site authored ─────
+//
+// R2's whole mechanism, and it is chapter 4's board pointed the other way: the
+// site is the single producer of a set, it re-sends the whole thing rather than
+// a stream of edits, and the receiver reconciles. What is new is the direction —
+// the module telling the game what the site knows, where every earlier phase
+// asked the game what it knew.
+//
+// ── One verb (D32) ────────────────────────────────────────────────────────
+//
+// A sync sends the whole desired set and the plugin diffs it against the live
+// store. The website never holds a copy of the game's permissions, which is the
+// point: a second source of truth is stale the moment it lands, and the store is
+// the bigger of the two sets.
+//
+// The delta the site DOES compute is the one the game cannot: what this site put
+// there and has since withdrawn (`retirements`). A name in the store that is not
+// in the desired set is either that, or a hand edit — and only the pushed ledger
+// can tell them apart (D31).
+//
+// ── When it runs ──────────────────────────────────────────────────────────
+//
+// Every tick asks a cheap question — does the digest of the desired set still
+// equal what this server last confirmed — and does nothing when the answer is
+// yes. A sync therefore happens when:
+//
+//   • an operator changed something (the dirty flag, and the digest behind it)
+//   • the game restarted or wiped (a new boot id or wipe id: the store may have
+//     been emptied, and R2's promise is that a wipe is not a data-loss event)
+//   • a permission hook fired in the game that we did not cause (`ingest.js`
+//     marks the server dirty; the authoritative answer is this sync's report)
+//   • the audit interval elapsed — the backstop that finds drift on a quiet
+//     server nobody has touched
+//   • the last attempt failed, after a backoff
+//
+// ── What it never does ────────────────────────────────────────────────────
+//
+// It does not remove a grant it did not make (D31), it does not invent a
+// permission the server has not registered (D33), and it does not treat a
+// silent sidecar as a reason to forget anything. A server that is unreachable
+// keeps its retirements and its revocations until it comes back.
+
+const core = require('./core')
+
+const db = require('./model/permissions/permissions.db')
+const model = require('./model/permissions/permissions.model')
+const servers = require('./model/servers/servers.model')
+const serversDb = require('./model/servers/servers.db')
+const sidecar = require('./sidecarClient')
+
+const log = core.logger('permissions')
+
+/** How often the loop asks whether anything needs pushing. */
+const TICK_MS = 30 * 1000
+
+/**
+ * How long a server may go without a full reconciliation, however quiet it is.
+ *
+ * The digest comparison is what keeps the loop cheap, and on its own it would
+ * also mean a server whose store somebody edited by hand is never asked about
+ * again. This is the interval at which the question gets asked anyway.
+ */
+const AUDIT_MS = 15 * 60 * 1000
+
+/** How long to leave a failing server alone before trying again. */
+const FAIL_BACKOFF_MS = 2 * 60 * 1000
+
+/**
+ * The most rows one sync may carry.
+ *
+ * Below the sidecar's line cap and below the plugin's operation ceiling, so the
+ * refusal happens here — where it can name the server and reach an operator —
+ * rather than as a `413` or a `too-large` from two processes away.
+ */
+const MAX_ROWS = 15000
+
+let timer = null
+
+function start() {
+  if (timer) return
+
+  timer = setInterval(() => {
+    tick().catch((err) => log.error('permission sync tick failed', { error: err.message }))
+  }, TICK_MS)
+
+  if (timer.unref) timer.unref()
+}
+
+function stop() {
+  if (!timer) return
+
+  clearInterval(timer)
+  timer = null
+}
+
+/**
+ * One pass over every enabled server.
+ *
+ * The authored set is read ONCE and handed to each server's build: six servers
+ * are six different answers derived from the same four tables, and re-reading
+ * them per server is six times the queries for identical rows.
+ */
+async function tick({ force = null } = {}) {
+  await db.ensureSyncRows()
+
+  const [rows, state, sync, authored] = await Promise.all([
+    servers.listForPolling(),
+    serversDb.listState(),
+    db.listSync(),
+    model.readAuthored(),
+  ])
+
+  const syncById = new Map(sync.map((row) => [row.serverId, row]))
+  const stateById = new Map(state.map((row) => [row.serverId, row]))
+
+  // `allSettled`, for the same reason the board poll uses it: one unreachable
+  // host must not stop the other five being reconciled.
+  await Promise.allSettled(
+    rows
+      .filter((server) => force === null || force === server.id)
+      .map((server) =>
+        syncOne(server, {
+          authored,
+          sync: syncById.get(server.id) || null,
+          state: stateById.get(server.id) || null,
+          force: force !== null,
+        }),
+      ),
+  )
+}
+
+/**
+ * Whether this server needs a push right now.
+ *
+ * Returns a reason rather than a boolean, because the reason is worth logging:
+ * "why did the website just write to my game server" is a question an operator
+ * asks, and `wipe` and `drift` are very different answers.
+ */
+function reasonToSync({ desiredHash, sync, state, force }) {
+  if (force) return 'requested'
+  // Not while the world is loading (PLAN_FIXES F7). The plugin connects before
+  // the save loads, and the first walk's restart sync went 35 s before "Server
+  // startup complete", timed out behind the busy main thread, and was retried
+  // 2.5 minutes later as "0 applied" — so nothing said what the restart had
+  // restored. The plugin says `worldReady: true` in the hello it sends the moment
+  // the world is up, and the sync goes on the next tick. A human's "sync now" is
+  // not held: they asked, and a failure then is theirs to read.
+  if (state && state.worldReady === false) return null
+  if (!sync) return 'first'
+  if (sync.state !== 'ok' && sync.lastAttemptAt && age(sync.lastAttemptAt) < FAIL_BACKOFF_MS && !sync.dirty) {
+    return null
+  }
+  if (sync.state !== 'ok') return 'retry'
+  if (desiredHash !== sync.syncedHash) return 'changed'
+  if (sync.dirty) return 'dirty'
+
+  const bootId = state && state.bootId ? state.bootId : null
+  const wipeId = state && state.wipeId ? state.wipeId : null
+
+  // A restart or a wipe is the case R2 exists for: the game may have forgotten
+  // everything, and the site has not.
+  if (bootId && bootId !== sync.bootId) return 'restart'
+  if (wipeId && wipeId !== sync.wipeId) return 'wipe'
+
+  if (!sync.lastAttemptAt || age(sync.lastAttemptAt) >= AUDIT_MS) return 'audit'
+
+  return null
+}
+
+function age(value) {
+  const at = value instanceof Date ? value.getTime() : new Date(value).getTime()
+  return Number.isFinite(at) ? Date.now() - at : Number.MAX_SAFE_INTEGER
+}
+
+async function syncOne(server, { authored, sync, state, force }) {
+  const desired = model.buildDesired(server.id, authored)
+  const reason = reasonToSync({ desiredHash: desired.hash, sync, state, force })
+
+  if (!reason) return null
+
+  const [pushed, revocations] = await Promise.all([
+    db.listPushed(server.id),
+    db.listRevocations(server.id),
+  ])
+
+  const retirements = model.retirements(pushed, desired.rows)
+  const { styleRetired, sent: styleRetire } = styleRetirements(retirements)
+  const retire = [
+    ...retirements
+      .filter((row) => row.kind !== 'chat-field')
+      .map((row) => ({ kind: row.kind, subject: row.subject, object: row.object })),
+    ...styleRetire,
+    ...revocations.map((row) => ({ kind: row.kind, subject: row.subject, object: row.object })),
+  ]
+
+  const bootId = state && state.bootId ? state.bootId : null
+  const wipeId = state && state.wipeId ? state.wipeId : null
+
+  if (desired.rows.length + retire.length > MAX_ROWS) {
+    // Refused here rather than sent: the sidecar would answer `413` and the
+    // plugin would answer `too-large`, and neither of those messages reaches the
+    // person who has to make the set smaller.
+    const error = `the permission set is too large to push (${desired.rows.length + retire.length} rows, limit ${MAX_ROWS})`
+    log.error('permission sync refused', { server: server.id, rows: desired.rows.length })
+    await db.putSyncResult(server.id, {
+      state: 'failed',
+      desiredHash: desired.hash,
+      syncedHash: sync ? sync.syncedHash : null,
+      bootId,
+      wipeId,
+      report: null,
+      error,
+    })
+
+    return 'too-large'
+  }
+
+  log.info('syncing permissions', {
+    server: server.id,
+    reason,
+    rows: desired.rows.length,
+    retire: retire.length,
+  })
+
+  const result = await sidecar.permSync(server, {
+    setId: desired.hash,
+    groups: withExpect(desired.payload.groups, pushed),
+    grants: desired.payload.grants,
+    managed: desired.payload.managed,
+    credits: desired.payload.credits,
+    retire,
+  })
+
+  if (!result.ok) {
+    // Said in the log as well as on the row (F7): the first walk's restart sync
+    // timed out with nothing in the log at all, while the titles push that failed
+    // beside it did log.
+    log.warn('permission sync failed', { server: server.id, reason, status: result.status })
+    await db.putSyncResult(server.id, {
+      state: 'failed',
+      desiredHash: desired.hash,
+      syncedHash: sync ? sync.syncedHash : null,
+      bootId,
+      wipeId,
+      report: null,
+      error: result.status,
+    })
+
+    return result.status
+  }
+
+  const report = result.data || {}
+
+  // The plugin refuses a whole sync with `perm.error` — `busy` while an earlier
+  // one is still draining, `too-large` past its own ceiling. Both are answers
+  // rather than transport failures, exactly like a refused link code, so they
+  // arrive as a 200 and are told apart by `kind`.
+  if (report.kind === 'perm.error') {
+    log.warn('permission sync refused by the game', { server: server.id, reason, refused: report.reason || 'unknown' })
+    await db.putSyncResult(server.id, {
+      state: 'failed',
+      desiredHash: desired.hash,
+      syncedHash: sync ? sync.syncedHash : null,
+      bootId,
+      wipeId,
+      report: null,
+      error: `the game refused the sync: ${report.reason || 'unknown'}`,
+    })
+
+    return report.reason || 'refused'
+  }
+
+  await applyReport(server, { desired, retire, styleRetired, report, bootId, wipeId })
+
+  return 'ok'
+}
+
+/**
+ * The groups as the wire carries them: each style field with the value this
+ * site last pushed to THIS server (`expect`), or null for one it never has.
+ * The plugin writes a field only when the game still holds that, so a field
+ * somebody changed by hand is reported instead of overwritten (D138).
+ */
+function withExpect(groups, pushed) {
+  const expect = new Map(
+    pushed.filter((row) => row.kind === 'chat-field').map((row) => [`${row.subject} ${row.object}`, row.value]),
+  )
+
+  return groups.map((group) => {
+    if (!group.chat) return group
+
+    const chat = {}
+    for (const [field, value] of Object.entries(group.chat)) {
+      const last = expect.get(`${group.name} ${field}`)
+      chat[field] = { value, expect: last === undefined ? null : last }
+    }
+
+    return { ...group, chat }
+  })
+}
+
+/**
+ * Style fields the site pushed and no longer wants, as the wire says it: ONE
+ * `chat-group` retirement per group, because a style is all twelve fields or
+ * none, and the only way to take one out of BetterChat is to remove its group
+ * (D139).
+ *
+ * **`default` is never removed.** It is BetterChat's fallback, which it warns
+ * about on every line when it is missing; a style withdrawn from the site's
+ * `default` group stops being pushed and is left as it stands (§33.5).
+ */
+function styleRetirements(retirements) {
+  const styleRetired = retirements.filter((row) => row.kind === 'chat-field')
+  const groups = [...new Set(styleRetired.map((row) => row.subject))].filter((name) => name !== 'default')
+
+  return { styleRetired, sent: groups.map((name) => ({ kind: 'chat-group', subject: name, object: '' })) }
+}
+
+/**
+ * Record what the game said it did.
+ *
+ * Three writes, and the order matters only in that all three are safe to repeat:
+ * a sync that crashes here is re-run next tick and reaches the same place, which
+ * is the property that lets this loop be the only writer.
+ */
+async function applyReport(server, { desired, retire, styleRetired = [], report, bootId, wipeId }) {
+  const unresolved = new Set((report.unresolved || []).map(model.normaliseName))
+  const pending = new Set(report.pending || [])
+  // Grants the plugin made and then did not find in the store when it read it
+  // back (D85). Before protocol 9 there was no such read-back, and on Oxide every
+  // grant of another plugin's permission landed nowhere while this site recorded
+  // it as pushed (PLAN.md §27.6).
+  const notLanded = new Set((report.notLanded || []).map((entry) => String(entry).toLowerCase()))
+
+  // A grant naming a permission this server has not registered did NOT land —
+  // `GrantUserPermission` no-ops silently for an unregistered name, which is
+  // why the plugin pre-checks and says so. Recording it as pushed would make the
+  // site believe it had given a privilege it had not.
+  //
+  // The same for a member the store could not place: the membership is waiting
+  // on their first connection, and it is not in the game yet.
+  // Protocol 12. A style field landed when BetterChat was there to take it and
+  // the report names it neither drift nor failed. With BetterChat absent none
+  // did, and each is sent again with the same `expect` next time (§33.2).
+  const chat = report.chat && typeof report.chat === 'object' ? report.chat : null
+  const chatLoaded = Boolean(chat && chat.loaded === true)
+  const fieldKey = (group, field) => `${group} ${String(field || '').toLowerCase()}`
+  const chatHeld = new Set([
+    ...((chatLoaded && chat.drift) || []).map((row) => fieldKey(row.group, row.field)),
+    ...((chatLoaded && chat.failed) || []).filter((row) => row.field).map((row) => fieldKey(row.group, row.field)),
+  ])
+  const chatGroupFailed = new Set(((chatLoaded && chat.failed) || []).filter((row) => !row.field).map((row) => row.group))
+
+  const landed = desired.rows.filter((row) => {
+    if (row.kind === 'chat-field') {
+      return chatLoaded && !chatGroupFailed.has(row.subject) && !chatHeld.has(fieldKey(row.subject, row.object))
+    }
+    if (row.kind === 'grant' || row.kind === 'group-permission') {
+      return !unresolved.has(row.object) && !notLanded.has(`${row.subject}:${row.object}`.toLowerCase())
+    }
+    if (row.kind === 'member') return !pending.has(`${row.subject}:${row.object}`)
+    return true
+  })
+
+  await db.addPushed(server.id, landed)
+
+  // Everything retired is gone from the game whether the plugin removed it or
+  // found it already absent, so it stops being something this site put there.
+  // A `chat-group` is not a ledger row; its fields are, below.
+  await db.removePushed(server.id, retire.filter((row) => row.kind !== 'chat-group'))
+
+  // A style's fields leave the ledger only once BetterChat has removed the group
+  // — or for `default`, which is never removed — so a style withdrawn while
+  // BetterChat was absent is retired by the first sync that can (D139).
+  const removed = new Set((chatLoaded && chat.removed) || [])
+  await db.removePushed(
+    server.id,
+    styleRetired.filter((row) => row.subject === 'default' || removed.has(row.subject)),
+  )
+
+  const revocations = await db.listRevocations(server.id)
+  await db.deleteRevocations(revocations.map((row) => row.id))
+
+  await db.replaceDrift(server.id, [
+    ...(report.foreign || []).map((row) => ({
+      kind: String(row.kind || ''),
+      subject: String(row.subject || ''),
+      object: String(row.object || ''),
+    })),
+    // A style field somebody changed by hand, with what it holds now (D138).
+    ...((chatLoaded && chat.drift) || []).map((row) => ({
+      kind: 'chat-field',
+      subject: String(row.group || ''),
+      object: String(row.field || ''),
+      detail: row.game === undefined || row.game === null ? null : String(row.game).slice(0, 255),
+    })),
+  ])
+
+  await db.putSyncResult(server.id, {
+    state: 'ok',
+    desiredHash: desired.hash,
+    syncedHash: desired.hash,
+    bootId,
+    wipeId,
+    report: JSON.stringify(report),
+    error: null,
+  })
+
+  // The option source, refreshed from the same server that just answered. It is
+  // a second round trip and it is worth it: the form must not offer a name that
+  // stopped being registered when somebody uninstalled a plugin, because a grant
+  // against one is a privilege nobody ever gets and nothing ever reports.
+  const catalogue = await sidecar.permCatalogue(server)
+
+  if (catalogue.ok && catalogue.data && Array.isArray(catalogue.data.permissions)) {
+    await db.putCatalogue(
+      server.id,
+      catalogue.data.permissions.map(model.normaliseName).filter(Boolean),
+    )
+  }
+
+  log.info('permissions synced', {
+    server: server.id,
+    applied: report.applied,
+    unresolved: (report.unresolved || []).length,
+    foreign: (report.foreign || []).length,
+    pending: (report.pending || []).length,
+    notLanded: (report.notLanded || []).length,
+    ...(chat
+      ? {
+          betterChat: chatLoaded,
+          ...(chatLoaded
+            ? { styleApplied: chat.applied, styleSaved: chat.saved, styleDrift: (chat.drift || []).length, styleFailed: (chat.failed || []).length }
+            : {}),
+        }
+      : {}),
+    ...(report.creditsApplied !== undefined
+      ? { creditsApplied: report.creditsApplied, creditsWithdrawn: report.creditsWithdrawn }
+      : {}),
+  })
+}
+
+module.exports = {
+  TICK_MS,
+  AUDIT_MS,
+  FAIL_BACKOFF_MS,
+  MAX_ROWS,
+  start,
+  stop,
+  tick,
+  syncOne,
+  reasonToSync,
+  applyReport,
+  withExpect,
+  styleRetirements,
+}

server/router/admin/config.controller.js

@@ -0,0 +1,383 @@
+// ── Admin · Rust · Mod configuration ──────────────────────────────────────
+//
+// R18. Five routes: list the tree, read a file, write a file, read what has
+// been written lately, and read one write while its reload settles. The first
+// three are live round trips to a game host — nothing here is cached, because a
+// cached config is an edit somebody made over SSH that this website then
+// silently overwrote. The last two read this module's own audit table.
+//
+// ── The write is three steps and the order is the whole design ────────────
+//
+//  1. **Re-read the file from the host.** Form edits are spliced into the text
+//     that is on disk *now*, not into the text a browser was holding. The
+//     version the browser presents is checked against the fresh one, and a
+//     mismatch is a conflict rather than an overwrite.
+//  2. **Compose the new bytes here** (D35). The browser sends pointers and
+//     literals; `configEdit` splices them. It never parses and re-serialises,
+//     because that is how every untouched `1.0` becomes `1` and how a plugin
+//     fails to come back from its reload.
+//  3. **Hand the whole file to the plugin**, which version-checks it again,
+//     backs the old one up, writes, reloads, and rolls the write back if the
+//     plugin fails to load. That last part is the feature; this file reports it.
+//     Since protocol 13 the plugin answers as soon as the files are written and
+//     reports the reload later as a `config.outcome` frame (F9), so a save that
+//     reloads is recorded `reloading` and settled by ingest (D179).
+//
+// ── What the outcome means ────────────────────────────────────────────────
+//
+// A `config.report` with `rolledBack: true` is a SUCCESSFUL round trip carrying
+// bad news: the edit was undone, the plugin is back on its old config, and the
+// admin needs to see the log line that says why. It is not a 5xx, and treating
+// it as one would lose the only diagnosis available.
+
+const core = require('../../core')
+
+const configEdit = require('../../configEdit')
+const db = require('../../model/config/config.db')
+const model = require('../../model/config/config.model')
+const servers = require('../../model/servers/servers.model')
+const serversDb = require('../../model/servers/servers.db')
+const sidecar = require('../../sidecarClient')
+
+const log = core.logger('admin:config')
+
+/** Reads the server row with its token, or answers 404 once, here. */
+async function serverOr404(req, res) {
+  const row = servers.withToken(await serversDb.getServer(req.params.serverId))
+
+  if (!row) {
+    res.status(404).json({ message: 'No such server' })
+    return null
+  }
+
+  return row
+}
+
+/**
+ * Turns a sidecar failure into a sentence an operator can act on.
+ *
+ * The statuses are the ones `sidecarClient` produces, and each names a different
+ * fix: nothing configured, no credential, the wrong protocol, a game that is
+ * down, a game that is up and silent.
+ */
+function unreachable(res, reply, what) {
+  const messages = {
+    'not-configured': 'That server has no sidecar URL configured',
+    'no-token': 'That server has no sidecar token configured',
+    'protocol-mismatch': 'That server’s sidecar speaks a different protocol version',
+    unauthorized: 'That server’s sidecar rejected the stored token',
+    timeout: 'That server’s sidecar did not answer in time',
+    'http-503': 'The game is not connected to that server’s sidecar',
+    'http-504': 'The game did not answer in time',
+  }
+
+  const message = messages[reply.status] || `Could not ${what}`
+  return res.status(503).json({ message, status: reply.status })
+}
+
+/** Every settings file on one host, grouped by the plugin that probably owns it. */
+async function listFiles(req, res) {
+  const server = await serverOr404(req, res)
+  if (!server) return undefined
+
+  const reply = await sidecar.configFiles(server)
+  if (!reply.ok) return unreachable(res, reply, 'read that server’s configuration')
+
+  if (reply.data && reply.data.kind === 'config.error') {
+    return res.status(502).json({ message: refusalMessage(reply.data) })
+  }
+
+  return res.json(model.shapeCatalogue(reply.data))
+}
+
+/** One file: its text, and the reading of it the form is drawn from. */
+async function readFile(req, res) {
+  const path = String(req.query.path || '')
+
+  if (!model.isPlausiblePath(path)) {
+    return res.status(400).json({ message: 'That is not a configuration path' })
+  }
+
+  const server = await serverOr404(req, res)
+  if (!server) return undefined
+
+  const [fileReply, catalogueReply] = await Promise.all([
+    sidecar.configFile(server, path),
+    // Asked alongside, because whether this file is OURS decides whether three
+    // of its keys are locked (D38) — and the answer is the plugin's own name,
+    // never a filename this module matched on.
+    sidecar.configFiles(server),
+  ])
+
+  if (!fileReply.ok) return unreachable(res, fileReply, 'read that file')
+
+  if (fileReply.data && fileReply.data.kind === 'config.error') {
+    return res.status(refusalStatus(fileReply.data)).json({ message: refusalMessage(fileReply.data) })
+  }
+
+  const self = catalogueReply.ok && catalogueReply.data ? catalogueReply.data.self : null
+  return res.json(model.shapeFile(fileReply.data, { self }))
+}
+
+/**
+ * Save one file, and reload whatever owns it.
+ *
+ * Two tiers in one route, because they are one action with two ways of saying
+ * what changed: `edits` is the generated form, `text` is the raw editor.
+ */
+async function writeFile(req, res) {
+  const path = String(req.body.path || '')
+  const tier = Array.isArray(req.body.edits) ? 'form' : 'raw'
+  const reload = req.body.reload ? String(req.body.reload) : null
+  const serverId = req.params.serverId
+
+  if (!model.isPlausiblePath(path)) {
+    return res.status(400).json({ message: 'That is not a configuration path' })
+  }
+
+  const server = await serverOr404(req, res)
+  if (!server) return undefined
+
+  const [current, catalogue] = await Promise.all([
+    sidecar.configFile(server, path),
+    sidecar.configFiles(server),
+  ])
+
+  if (!current.ok) return unreachable(res, current, 'read that file')
+
+  if (current.data && current.data.kind === 'config.error') {
+    return res.status(refusalStatus(current.data)).json({ message: refusalMessage(current.data) })
+  }
+
+  const onDisk = current.data
+  const self = catalogue.ok && catalogue.data ? catalogue.data.self : null
+  const locked = model.lockedKeysFor(path, self)
+
+  // The browser's version against what is on the host right now. The plugin
+  // checks this again before it writes — this check exists so that a conflict
+  // is reported with the current file in hand, which is what a person needs to
+  // merge their change rather than retype it.
+  if (String(req.body.version || '') !== String(onDisk.version)) {
+    return res.status(409).json({
+      message: 'That file changed on the server since you opened it',
+      current: model.shapeFile(onDisk, { self }),
+    })
+  }
+
+  let text
+  let changes
+
+  if (tier === 'form') {
+    const applied = configEdit.applyEdits(onDisk.text, req.body.edits, { locked })
+    if (applied.error) return res.status(400).json({ message: applied.error })
+
+    text = applied.text
+    changes = applied.changes
+  } else {
+    text = String(req.body.text || '')
+
+    try {
+      configEdit.scan(text)
+    } catch (err) {
+      return res.status(400).json({ message: `That is not valid JSON: ${err.message}` })
+    }
+
+    const broken = model.lockedChanges(onDisk.text, text, locked)
+
+    if (broken.length > 0) {
+      return res.status(400).json({
+        message: `${broken.join(', ')} cannot be changed from the website`,
+        locked: broken.map((key) => ({ key, reason: model.LOCKED_REASON[key.toLowerCase()] || null })),
+      })
+    }
+
+    // A raw save records that the document was replaced rather than a field
+    // list, because that is what happened. Pretending to know which keys moved
+    // would mean diffing two documents and reporting a guess as an audit fact.
+    changes = text === onDisk.text ? [] : [{ path: '(whole file)', from: null, to: null }]
+  }
+
+  if (changes.length === 0) {
+    return res.json({ changed: false, version: onDisk.version })
+  }
+
+  const reply = await sidecar.configWrite(server, {
+    files: [{ path, version: onDisk.version, text }],
+    ...(reload ? { reload } : {}),
+  })
+
+  if (!reply.ok) {
+    await record(req, {
+      serverId,
+      path,
+      self,
+      reload,
+      tier,
+      outcome: 'unreachable',
+      changes,
+      versionBefore: onDisk.version,
+      detail: reply.status,
+    })
+
+    return unreachable(res, reply, 'write that file')
+  }
+
+  if (reply.data && reply.data.kind === 'config.error') {
+    await record(req, {
+      serverId,
+      path,
+      self,
+      reload,
+      tier,
+      outcome: 'refused',
+      changes,
+      versionBefore: onDisk.version,
+      detail: refusalMessage(reply.data),
+    })
+
+    return res.status(refusalStatus(reply.data)).json({ message: refusalMessage(reply.data) })
+  }
+
+  const report = model.summariseReport(reply.data)
+  const after = report && report.files[0] ? report.files[0].version : null
+
+  // Protocol 13 (F9, D179): the files are on disk and the reload is still
+  // running — behind a cold compile it can take longer than any request should.
+  // The row is `reloading` until ingest settles it from the plugin's
+  // `config.outcome`; the page polls it by the id returned here.
+  if (report && report.pending) {
+    const id = await record(req, {
+      serverId,
+      path,
+      self,
+      reload,
+      tier,
+      outcome: 'reloading',
+      reloaded: false,
+      changes,
+      versionBefore: onDisk.version,
+      versionAfter: after,
+      writeId: report.writeId,
+      settleSeconds: model.settleSeconds(report.ceilingMs),
+    })
+
+    return res.json({ changed: true, pending: true, write: { id, writeId: report.writeId }, report })
+  }
+
+  await record(req, {
+    serverId,
+    path,
+    self,
+    reload,
+    tier,
+    outcome: report && report.rolledBack ? 'rolled-back' : 'applied',
+    reloaded: Boolean(report && report.reloaded),
+    changes,
+    versionBefore: onDisk.version,
+    versionAfter: after,
+    detail: report ? report.reason : null,
+  })
+
+  // 200 either way. A rollback is a round trip that worked and an edit that did
+  // not, and the body says which — collapsing it into a 5xx would throw away
+  // the log line that explains it.
+  return res.json({ changed: true, report })
+}
+
+/** What has been written to this server's configuration lately, and by whom. */
+async function history(req, res) {
+  try {
+    return res.json({ writes: await db.recentWrites(req.params.serverId, req.query.limit) })
+  } catch (err) {
+    log.error('failed to read the configuration history', { error: err.message })
+    return res.status(500).json({ message: 'Failed to read the configuration history' })
+  }
+}
+
+/**
+ * One write, for the page waiting on a reload (D179).
+ *
+ * `reloading` until ingest settles it, then `applied` or `rolled-back` with the
+ * reason and the server's log; `lost` once it has gone unanswered past twice the
+ * plugin's ceiling, which means re-read the file rather than keep waiting.
+ */
+async function writeStatus(req, res) {
+  try {
+    const write = await db.getWrite(req.params.serverId, Number(req.params.writeId))
+    if (!write) return res.status(404).json({ message: 'No such configuration write' })
+
+    return res.json({ write })
+  } catch (err) {
+    log.error('failed to read a configuration write', { error: err.message })
+    return res.status(500).json({ message: 'Failed to read that configuration write' })
+  }
+}
+
+/**
+ * One audit row, plus the activity entry core owns. Never lets a logging failure
+ * fail a save. Returns the row's id, or null when it could not be written.
+ */
+async function record(req, row) {
+  let id = null
+
+  try {
+    id = await db.recordWrite({
+      ...row,
+      plugin: model.isBridgeConfig(row.path, row.self) ? row.self : pluginOf(row.path),
+      reloadTarget: row.reload,
+      userId: req.user ? req.user.id : null,
+    })
+
+    await core.activity.log({
+      req,
+      action: 'rust.config.write',
+      detail: {
+        server: row.serverId,
+        path: row.path,
+        tier: row.tier,
+        outcome: row.outcome,
+        reload: row.reload || null,
+        fields: Array.isArray(row.changes) ? row.changes.length : 0,
+      },
+    })
+  } catch (err) {
+    log.error('failed to record a configuration write', { path: row.path, error: err.message })
+  }
+
+  return id
+}
+
+function pluginOf(path) {
+  return String(path).includes('/') ? String(path).split('/')[0] : String(path).replace(/\.json$/i, '')
+}
+
+/** A `config.error` frame as a sentence. */
+function refusalMessage(frame) {
+  const reasons = {
+    busy: 'Another configuration write on that server is still finishing',
+    conflict: 'That file changed on the server since you opened it',
+    invalid: 'The game refused that file: it is not valid JSON',
+    missing: 'That file is not on that server',
+    path: 'That path is not inside the server’s configuration directory',
+    'too-large': 'That file is larger than the bridge will carry',
+    'too-many': 'That save touches too many files',
+    'reload-self': 'The bridge plugin cannot be reloaded from the website',
+    'reload-failed': 'The game could not reload that plugin',
+    unwritable: 'The game could not write that file',
+    unreadable: 'The game could not read that file',
+    'no-root': 'That framework reports no configuration directory',
+  }
+
+  const base = reasons[frame.reason] || 'The game refused that configuration change'
+  return frame.detail ? `${base} (${frame.detail})` : base
+}
+
+/** A refusal's status: the caller's fault where it is, the far end's where it is not. */
+function refusalStatus(frame) {
+  if (frame.reason === 'conflict') return 409
+  if (frame.reason === 'busy') return 409
+  if (['path', 'missing', 'invalid', 'too-large', 'too-many', 'reload-self'].includes(frame.reason)) return 400
+  return 502
+}
+
+module.exports = { listFiles, readFile, writeFile, writeStatus, history, refusalMessage, refusalStatus }

server/router/admin/config.router.js

@@ -0,0 +1,122 @@
+// ── Admin · Rust · Mod configuration ──────────────────────────────────────
+//
+// Mounted under the admin tier's `/rust` prefix, so every path here is
+// `/api/v1/admin/rust/config…`. A **nested** `use()` rather than a second mount,
+// because a mount prefix is one path segment — core's own check is
+// `/^\/[a-z0-9][a-z0-9-]*$/`, so `/rust/config` could never be declared in
+// `module.json`. (The OpenAPI generator follows the require and prefixes these
+// correctly regardless, which phase 7 established the hard way.)
+//
+// **Every route is `requireRole('admin')`**, on top of the tier's own gate. This
+// is a website form writing files onto a game host and reloading its plugins,
+// which is the most powerful thing this module can do to somebody's server.
+// There is still no module-declared site permission at MODULE_API 1.10.0 — R18
+// asked for one and hits the same wall phase 7 did — so role is the whole of the
+// available vocabulary, and `admin` is the honest choice within it.
+
+const core = require('../../core')
+
+const express = core.express
+const config = require('./config.controller')
+const { requireRole, validate } = core.middleware
+const { body, param, query } = core.validator
+
+const configRouter = express.Router()
+
+/** A server id, as every other route in this module spells it. */
+const SERVER_ID = /^[a-z0-9][a-z0-9-]{0,63}$/
+
+/**
+ * A plugin name to reload.
+ *
+ * Shape only. Whether the name is loaded — and whether it is the bridge itself,
+ * which cannot reload itself without closing the link carrying the answer — is
+ * the plugin's decision, because it is the only process that knows.
+ */
+const PLUGIN_NAME = /^[A-Za-z0-9_.-]{1,128}$/
+
+configRouter.get(
+  '/:serverId/files',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Every plugin configuration file on one server'
+  // #swagger.description = 'A live recursive walk of the game host’s configuration directory, grouped by the plugin each file probably belongs to, plus every plugin currently loaded. The root comes from the mod framework, so it is `oxide/config` on Oxide and `carbon/configs` on Carbon. Files past the size limit are listed and marked un-editable rather than hidden. The game’s data directory is never walked.'
+  /* #swagger.responses[200] = { description: 'The configuration tree and the loaded plugins' } */
+  /* #swagger.responses[503] = { description: 'The sidecar or the game is unreachable' } */
+  requireRole('admin'),
+  param('serverId').matches(SERVER_ID),
+  validate,
+  config.listFiles,
+)
+
+configRouter.get(
+  '/:serverId/file',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'One configuration file'
+  // #swagger.description = 'The file’s text, the version a save must present back, and the field list the generated form is drawn from — types, keys, and which values are credentials. A file that is already broken on disk still opens, with the parse error, because the raw tier is the only thing that can fix it.'
+  /* #swagger.responses[200] = { description: 'The file and the reading of it' } */
+  /* #swagger.responses[400] = { description: 'Not a configuration path' } */
+  /* #swagger.responses[503] = { description: 'The sidecar or the game is unreachable' } */
+  requireRole('admin'),
+  param('serverId').matches(SERVER_ID),
+  query('path').isString().isLength({ min: 1, max: 255 }),
+  validate,
+  config.readFile,
+)
+
+configRouter.post(
+  '/:serverId/file',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Save a configuration file and reload its plugin'
+  // #swagger.description = 'Send `edits` (the generated form: pointers and literals, type-preserving) or `text` (the raw tier: the whole document). `version` must match what the host holds or the save is refused 409 with the current file. The game backs the file up, writes it, reloads the named plugin, and **restores the old file automatically** if the plugin fails to load. With a plugin to reload, the answer comes as soon as the file is written — `pending: true` and `write.id` — and the outcome is read from `GET …/writes/{writeId}` once the reload settles. Without one, the answer is final.'
+  /* #swagger.responses[200] = { description: 'Written and reloading (`pending`, with the write’s id), or the final outcome when nothing was reloaded' } */
+  /* #swagger.responses[400] = { description: 'Invalid body, an edit the form may not make, or a locked key' } */
+  /* #swagger.responses[409] = { description: 'The file changed on the host since it was read' } */
+  /* #swagger.responses[503] = { description: 'The sidecar or the game is unreachable' } */
+  requireRole('admin'),
+  param('serverId').matches(SERVER_ID),
+  body('path').isString().isLength({ min: 1, max: 255 }),
+  body('version').isString().isLength({ min: 1, max: 64 }),
+  body('reload').optional({ values: 'falsy' }).matches(PLUGIN_NAME),
+  // One tier or the other, never both and never neither. `edits` carries the
+  // form's pointers and literals; `text` is the whole document.
+  body('edits').optional().isArray({ max: 500 }),
+  body('text').optional().isString().isLength({ max: 262144 }),
+  body().custom((value) => {
+    const hasEdits = Array.isArray(value.edits)
+    const hasText = typeof value.text === 'string'
+
+    if (hasEdits === hasText) throw new Error('send either edits or text')
+    return true
+  }),
+  validate,
+  config.writeFile,
+)
+
+configRouter.get(
+  '/:serverId/writes',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Recent configuration writes'
+  // #swagger.description = 'The audit trail for one server: who changed which field, from what to what, whether the plugin reloaded, and whether the change was rolled back. Refused and unreachable attempts are recorded too — an operator asking why a setting is not what they set needs to see that somebody tried. Values of credential-shaped fields are never stored.'
+  /* #swagger.responses[200] = { description: 'The recent writes, newest first' } */
+  requireRole('admin'),
+  param('serverId').matches(SERVER_ID),
+  query('limit').optional().isInt({ min: 1, max: 200 }),
+  validate,
+  config.history,
+)
+
+configRouter.get(
+  '/:serverId/writes/:writeId',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'One configuration write, while its reload settles'
+  // #swagger.description = 'A save that reloads a plugin answers as soon as the file is written, with `pending: true` and this write’s id; the reload can take longer than a request should, behind a cold compile. Poll this until `outcome` leaves `reloading`: `applied`, or `rolled-back` with the reason, the server’s log, and `restored` (whether the plugin came back on its old file). `lost` means the plugin never reported — it was reloaded, or the link dropped — so re-read the file.'
+  /* #swagger.responses[200] = { description: 'The write and how far it has got' } */
+  /* #swagger.responses[404] = { description: 'No such write on that server' } */
+  requireRole('admin'),
+  param('serverId').matches(SERVER_ID),
+  param('writeId').isInt({ min: 1 }),
+  validate,
+  config.writeStatus,
+)
+
+module.exports = configRouter

server/router/admin/permissions.controller.js

@@ -0,0 +1,508 @@
+// ── Admin · Rust · Permissions ────────────────────────────────────────────
+//
+// The authoring surface for R2. Everything here writes to the site's own tables
+// and marks the affected servers dirty; nothing here talks to a game. The push
+// is `permSync.js`'s loop, which is deliberate — a form that wrote to six game
+// hosts inside the request would fail differently for each of them and have no
+// honest status code to answer with.
+//
+// **The one exception is "sync now"**, which runs the loop's pass for one server
+// and waits for it. It exists because an operator who has just changed something
+// wants to see it land, and because waiting thirty seconds to find out that a
+// server is unreachable is a bad way to learn it.
+//
+// Every write logs an activity row. These rows decide who may do what inside
+// somebody's game server, which is the one thing on this module's admin tier
+// more consequential than the sidecar credential.
+
+const core = require('../../core')
+
+const chatStyle = require('../../model/permissions/chatStyle')
+const db = require('../../model/permissions/permissions.db')
+const model = require('../../model/permissions/permissions.model')
+const permSync = require('../../permSync')
+const servers = require('../../model/servers/servers.model')
+
+const log = core.logger('admin:permissions')
+
+/** Everything the screen renders: groups, grants, drift, the catalogue, per-server state. */
+async function overview(req, res) {
+  try {
+    // The twelve BetterChat fields travel with the model, so the form's editor
+    // is built from the same list the server validates against (D138).
+    res.json({ ...(await model.overview()), chatFields: chatStyle.FIELDS })
+  } catch (err) {
+    log.error('failed to read the permission model', { error: err.message })
+    res.status(500).json({ message: 'Failed to read the permission model' })
+  }
+}
+
+/**
+ * Create or update a group.
+ *
+ * The permission list is part of the same write, because that is how the form
+ * edits it: a group and what it carries are one idea on the screen, and two
+ * requests would leave a group briefly carrying the wrong set.
+ */
+async function putGroup(req, res) {
+  const name = model.normaliseName(req.params.name)
+  const scope = String(req.body.scope || model.FLEET)
+
+  try {
+    if (scope !== model.FLEET && !(await knownServer(scope))) {
+      return res.status(400).json({ message: 'That scope names no configured server' })
+    }
+
+    // Phase 17: `chat` is the group's BetterChat style — all twelve fields, or
+    // null to take the style away. Absent leaves it as it is, so a client that
+    // predates styles cannot erase one by saving a group.
+    let style
+    if (req.body.chat !== undefined && req.body.chat !== null) {
+      const checked = chatStyle.validateStyle(req.body.chat)
+      if (!checked.ok) return res.status(400).json({ message: checked.errors.join(' '), errors: checked.errors })
+      style = checked.fields
+    } else if (req.body.chat === null) {
+      style = null
+    }
+
+    const previous = await db.getGroup(name)
+
+    await db.upsertGroup({
+      name,
+      title: String(req.body.title || name),
+      rank: Number(req.body.rank) || 0,
+      scope,
+    })
+
+    const permissions = [...new Set((req.body.permissions || []).map(model.normaliseName))].filter(Boolean)
+    await db.setGroupPermissions(name, permissions)
+    if (style !== undefined) await db.setGroupChat(name, style)
+
+    // Both scopes: a group that moved from one server to another has to be
+    // retired from where it was as well as applied where it now is, and only the
+    // old scope knows the first half.
+    await db.markDirty(scope)
+    if (previous && previous.scope !== scope) await db.markDirty(previous.scope)
+
+    await core.activity.log({
+      req,
+      action: previous ? 'rust.perm.group.update' : 'rust.perm.group.create',
+      detail: {
+        group: name,
+        scope,
+        permissions: permissions.length,
+        ...(style !== undefined ? { chatStyle: style ? 'set' : 'removed' } : {}),
+      },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to save a group', { group: name, error: err.message })
+    return res.status(500).json({ message: 'Failed to save that group' })
+  }
+}
+
+async function deleteGroup(req, res) {
+  const name = model.normaliseName(req.params.name)
+
+  try {
+    const existing = await db.getGroup(name)
+    if (!existing) return res.status(404).json({ message: 'No such group' })
+
+    await db.deleteGroup(name)
+    await db.markDirty(existing.scope)
+
+    await core.activity.log({ req, action: 'rust.perm.group.delete', detail: { group: name } })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to delete a group', { group: name, error: err.message })
+    return res.status(500).json({ message: 'Failed to delete that group' })
+  }
+}
+
+async function addMember(req, res) {
+  const name = model.normaliseName(req.params.name)
+
+  try {
+    const group = await db.getGroup(name)
+    if (!group) return res.status(404).json({ message: 'No such group' })
+
+    const userId = await resolveUser(req.body)
+    if (!userId) return res.status(404).json({ message: 'No account on this site has that name' })
+
+    await db.addGroupMember(name, userId, req.user ? req.user.id : null)
+    await db.markDirty(group.scope)
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.member.add',
+      detail: { group: name, userId },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    // A user id that names nobody fails on the foreign key rather than on a
+    // check of our own: the row is the constraint, and one round trip is
+    // cheaper than two.
+    log.error('failed to add a member', { group: name, userId, error: err.message })
+    return res.status(400).json({ message: 'That account could not be added to the group' })
+  }
+}
+
+async function removeMember(req, res) {
+  const name = model.normaliseName(req.params.name)
+  const userId = Number(req.params.userId)
+
+  try {
+    const group = await db.getGroup(name)
+    if (!group) return res.status(404).json({ message: 'No such group' })
+
+    const removed = await db.removeGroupMember(name, userId)
+    if (!removed) return res.status(404).json({ message: 'That account is not in the group' })
+
+    await db.markDirty(group.scope)
+    await core.activity.log({
+      req,
+      action: 'rust.perm.member.remove',
+      detail: { group: name, userId },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to remove a member', { group: name, userId, error: err.message })
+    return res.status(500).json({ message: 'Failed to remove that account from the group' })
+  }
+}
+
+/**
+ * Grant one permission to one person.
+ *
+ * `source` is fixed at `admin` here and is not accepted from the body: the
+ * column exists so phase 13's event actions can write their own rows through the
+ * same table, and a route that let a caller choose would make "who gave this"
+ * unanswerable the first time somebody passed the wrong string.
+ */
+async function addGrant(req, res) {
+  const permission = model.normaliseName(req.body.permission)
+  const scope = String(req.body.scope || model.FLEET)
+  let userId = null
+
+  try {
+    if (scope !== model.FLEET && !(await knownServer(scope))) {
+      return res.status(400).json({ message: 'That scope names no configured server' })
+    }
+
+    userId = await resolveUser(req.body)
+    if (!userId) return res.status(404).json({ message: 'No account on this site has that name' })
+
+    const { inserted } = await db.insertGrant({
+      userId,
+      permission,
+      scope,
+      source: 'admin',
+      note: req.body.note ? String(req.body.note).slice(0, 255) : null,
+      grantedBy: req.user ? req.user.id : null,
+    })
+
+    if (inserted) {
+      await db.markDirty(scope)
+      await core.activity.log({
+        req,
+        action: 'rust.perm.grant',
+        detail: { userId, permission, scope },
+      })
+    }
+
+    return res.status(inserted ? 201 : 200).json({ granted: inserted })
+  } catch (err) {
+    log.error('failed to grant', { userId, permission, error: err.message })
+    return res.status(400).json({ message: 'That permission could not be granted' })
+  }
+}
+
+async function removeGrant(req, res) {
+  const id = Number(req.params.id)
+
+  try {
+    const grant = await db.getGrant(id)
+    if (!grant) return res.status(404).json({ message: 'No such grant' })
+
+    await db.deleteGrant(id)
+    await db.markDirty(grant.scope)
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.revoke',
+      detail: { userId: grant.userId, permission: grant.permission, scope: grant.scope },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to revoke a grant', { grant: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to remove that grant' })
+  }
+}
+
+/**
+ * Adopt a hand edit: the site records it as its own.
+ *
+ * It is only possible for a `grant` whose Steam id belongs to a website account,
+ * and the refusal says so — because the alternative is authoring privilege
+ * against a game account no person on this site holds, which is precisely the
+ * thing D28 decided not to do.
+ */
+async function adoptDrift(req, res) {
+  const id = Number(req.params.id)
+
+  try {
+    const row = await db.getDrift(id)
+    if (!row) return res.status(404).json({ message: 'No such drift' })
+
+    if (row.kind === 'chat-field') return adoptStyleField(req, res, row)
+
+    if (row.kind !== 'grant' && row.kind !== 'member') {
+      return res.status(400).json({
+        message: 'Only a grant or a membership can be adopted. A permission on a group is edited on the group itself.',
+      })
+    }
+
+    const holder = await holderOf(row.subject)
+
+    if (!holder) {
+      return res.status(409).json({
+        message:
+          'That Steam account is not linked to any account on this site, so there is nobody to author this against. Revoke it instead, or ask the player to link.',
+      })
+    }
+
+    if (row.kind === 'grant') {
+      await db.insertGrant({
+        userId: holder.userId,
+        permission: row.object,
+        scope: row.serverId,
+        source: 'adopted',
+        note: 'Adopted from a hand edit',
+        grantedBy: req.user ? req.user.id : null,
+      })
+    } else {
+      const group = await db.getGroup(row.object)
+      if (!group) return res.status(409).json({ message: 'That group is not authored on this site' })
+
+      await db.addGroupMember(row.object, holder.userId, req.user ? req.user.id : null)
+    }
+
+    // Already in the game, so it is already pushed — recorded as such rather
+    // than left for the next sync to "apply". Without this the row would be
+    // desired-but-not-pushed, which is a state the loop would happily write
+    // again and the game would report as already correct: harmless, and a lie in
+    // the one table that exists to say what this site put there.
+    await db.addPushed(row.serverId, [{ kind: row.kind, subject: row.subject, object: row.object }])
+    await db.deleteDrift(id)
+    await db.markDirty(row.serverId)
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.drift.adopt',
+      detail: { server: row.serverId, kind: row.kind, subject: row.subject, object: row.object },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to adopt drift', { drift: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to adopt that change' })
+  }
+}
+
+/**
+ * Revoke a hand edit.
+ *
+ * Queued rather than sent: the server may be down, and an instruction that is
+ * dropped because a game host was restarting is exactly the behaviour a site
+ * claiming to be the author of record must not have. The next successful sync
+ * carries it and the queue row goes.
+ */
+async function revokeDrift(req, res) {
+  const id = Number(req.params.id)
+
+  try {
+    const row = await db.getDrift(id)
+    if (!row) return res.status(404).json({ message: 'No such drift' })
+
+    if (row.kind === 'chat-field') return revokeStyleField(req, res, row)
+
+    await db.queueRevocation({
+      serverId: row.serverId,
+      kind: row.kind,
+      subject: row.subject,
+      object: row.object,
+      requestedBy: req.user ? req.user.id : null,
+    })
+
+    await db.deleteDrift(id)
+    await db.markDirty(row.serverId)
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.drift.revoke',
+      detail: { server: row.serverId, kind: row.kind, subject: row.subject, object: row.object },
+    })
+
+    return res.status(202).json({ queued: true })
+  } catch (err) {
+    log.error('failed to queue a revocation', { drift: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to queue that revocation' })
+  }
+}
+
+/**
+ * Adopt a hand edit to a style field: the game's value becomes the site's.
+ *
+ * The style belongs to the GROUP, and a group may reach every server — so the
+ * value adopted from one server is the value every server in its scope is
+ * pushed next. That is what adopting means for a fleet-wide group, and the
+ * activity row names the server it came from.
+ */
+async function adoptStyleField(req, res, row) {
+  const style = await db.getGroupChat(row.subject)
+  if (!style || style[row.object] === undefined) {
+    return res.status(409).json({ message: 'That group has no chat style on this site to adopt the change into' })
+  }
+
+  const field = chatStyle.FIELDS.find((f) => f.name === row.object)
+  const checked = field ? chatStyle.checkField(field, row.detail === null ? '' : row.detail) : { error: 'unknown field' }
+  if (checked.error) {
+    return res.status(409).json({
+      message: `The game's value cannot be adopted: ${checked.error}. Revoke it instead, or edit the style.`,
+    })
+  }
+
+  await db.setGroupChatField(row.subject, row.object, checked.value)
+  // Already in that game, so already pushed there — the same reasoning as a grant.
+  await db.setPushedValue(row.serverId, { kind: 'chat-field', subject: row.subject, object: row.object, value: row.detail })
+  await db.deleteDrift(row.id)
+  await db.markDirty(model.FLEET)
+
+  await core.activity.log({
+    req,
+    action: 'rust.perm.drift.adopt',
+    detail: { server: row.serverId, kind: row.kind, group: row.subject, field: row.object, value: checked.value },
+  })
+
+  return res.status(204).end()
+}
+
+/**
+ * Revoke a hand edit to a style field: put the site's value back.
+ *
+ * Not a queued revocation — there is nothing to remove, only a value to
+ * overwrite. The ledger is told the game's value is this site's own, so the
+ * next sync expects to find it and writes over it. That is a person choosing to
+ * overwrite, which R2 allows (§33.2).
+ */
+async function revokeStyleField(req, res, row) {
+  await db.setPushedValue(row.serverId, { kind: 'chat-field', subject: row.subject, object: row.object, value: row.detail })
+  await db.deleteDrift(row.id)
+  await db.markDirty(row.serverId)
+
+  await core.activity.log({
+    req,
+    action: 'rust.perm.drift.revoke',
+    detail: { server: row.serverId, kind: row.kind, group: row.subject, field: row.object },
+  })
+
+  return res.status(202).json({ queued: true })
+}
+
+/** Run the loop's pass now, for one server or for all of them, and report what happened. */
+async function syncNow(req, res) {
+  const serverId = req.body && req.body.serverId ? String(req.body.serverId) : null
+
+  try {
+    if (serverId && !(await knownServer(serverId))) {
+      return res.status(404).json({ message: 'No such server' })
+    }
+
+    await db.markDirty(serverId || model.FLEET)
+    await permSync.tick({ force: serverId })
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.sync',
+      detail: { server: serverId || 'all' },
+    })
+
+    const state = await model.overview()
+    return res.json({ servers: state.servers, drift: state.drift })
+  } catch (err) {
+    log.error('a forced sync failed', { server: serverId, error: err.message })
+    return res.status(500).json({ message: 'Failed to run the sync' })
+  }
+}
+
+/** Every permission name any configured server has registered, with which ones know it. */
+async function catalogue(req, res) {
+  try {
+    const rows = await db.listCatalogue()
+    res.json({ permissions: groupCatalogue(rows) })
+  } catch (err) {
+    log.error('failed to read the catalogue', { error: err.message })
+    res.status(500).json({ message: 'Failed to read the permission catalogue' })
+  }
+}
+
+function groupCatalogue(rows) {
+  const byPermission = new Map()
+
+  for (const row of rows) {
+    if (!byPermission.has(row.permission)) byPermission.set(row.permission, [])
+    byPermission.get(row.permission).push(row.serverId)
+  }
+
+  return [...byPermission.entries()]
+    .map(([permission, serverIds]) => ({ permission, servers: serverIds }))
+    .sort((a, b) => a.permission.localeCompare(b.permission))
+}
+
+/**
+ * The user id a write is about, from either an id or a username.
+ *
+ * The form sends a name, because a form that made an operator type a numeric id
+ * would be a form nobody could use. The id form stays accepted because the
+ * client already holds one on the panel inside core's user page, and looking a
+ * name back up from it would be a round trip to answer a question it has
+ * already answered.
+ */
+async function resolveUser(body) {
+  if (body.userId) return Number(body.userId)
+  if (!body.username) return null
+
+  const user = await db.findUserByUsername(String(body.username).trim())
+  return user ? user.id : null
+}
+
+/** Whether a scope names a server row. A disabled server still counts — it exists. */
+async function knownServer(id) {
+  const rows = await servers.listForAdmin()
+  return rows.some((row) => row.id === id)
+}
+
+/** The website account that holds a Steam id, or null. */
+async function holderOf(steamId) {
+  const links = await db.listLinks()
+  return links.find((link) => link.steamId === steamId) || null
+}
+
+module.exports = {
+  overview,
+  putGroup,
+  deleteGroup,
+  addMember,
+  removeMember,
+  addGrant,
+  removeGrant,
+  adoptDrift,
+  revokeDrift,
+  syncNow,
+  catalogue,
+}

server/router/admin/permissions.router.js

@@ -0,0 +1,187 @@
+// ── Admin · Rust · Permissions ────────────────────────────────────────────
+//
+// Mounted under the admin tier's `/rust` prefix, so every path here is
+// `/api/v1/admin/rust/permissions…`. It is a second router rather than more
+// routes on `rust.router.js` because it is a second subject: that one configures
+// the bridge, this one authors privilege inside somebody's game.
+//
+// **Every route is `requireRole('admin')`.** The admin tier's own gate admits
+// editors and moderators, and a moderator being able to grant themselves
+// `kits.admin` on six servers is the whole of R1's "a weak link is now a
+// privilege-escalation path" arriving through the front door instead. The tier
+// gate is not re-implemented; this is one gate on top of it, exactly as the
+// server-configuration routes do it.
+//
+// There is no module-declared site permission to gate these more finely with —
+// `MODULE_API.md` has no such member at 1.10.0 — so role is the whole of the
+// available vocabulary, and `admin` is the honest choice within it.
+
+const core = require('../../core')
+
+const express = core.express
+const permissions = require('./permissions.controller')
+const { requireRole, validate } = core.middleware
+const { body, param } = core.validator
+
+const permissionsRouter = express.Router()
+
+/** A permission or group name, as both mod frameworks store them. */
+const NAME = /^[a-z0-9][a-z0-9._-]{0,127}$/i
+
+permissionsRouter.get(
+  '/',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'The whole permission model'
+  // #swagger.description = 'Groups with their permissions, members and BetterChat style (`chat`, or null), direct grants, the drift each server reported, the option source of registered permission names, and the sync state of every configured server. A drift row of kind `chat-field` is a style field somebody changed in game: `subject` is the group, `object` the field and `detail` what the game holds. `chatFields` lists the twelve BetterChat fields with their types and defaults, for the style editor.'
+  /* #swagger.responses[200] = { description: 'The authored model and what each game reported', content: { "application/json": { schema: { $ref: "#/components/schemas/RustPermissionModel" } } } } */
+  requireRole('admin'),
+  permissions.overview,
+)
+
+permissionsRouter.get(
+  '/catalogue',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Permission names the servers have registered'
+  // #swagger.description = 'What the loaded plugins on each configured server have registered, cached from the last sync. It is the option source for the authoring form: a permission no server knows cannot be granted, because `GrantUserPermission` silently does nothing for an unregistered name.'
+  /* #swagger.responses[200] = { description: 'Every registered name, and which servers know it', content: { "application/json": { schema: { $ref: "#/components/schemas/RustPermissionCatalogue" } } } } */
+  requireRole('admin'),
+  permissions.catalogue,
+)
+
+permissionsRouter.put(
+  '/groups/:name',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Create or update a permission group'
+  // #swagger.description = 'Writes the group and the permissions it carries in one request, because they are one idea on the form. `scope` is a server id or `*` for the whole fleet. The group is mirrored into each in-scope game as a real group, so third-party plugins that read group membership see it. `chat` is the group’s BetterChat style: all twelve fields (`Priority`, `Title`, `TitleColor`, `TitleSize`, `TitleHidden`, `TitleHiddenIfNotPrimary`, `UsernameColor`, `UsernameSize`, `MessageColor`, `MessageSize`, `ChatFormat`, `ConsoleFormat`), each as text; `null` removes the style, which removes the group from BetterChat on the next sync; absent leaves it alone. A format must hold `{Message}` exactly once. A 400 carries one sentence per problem in `errors`.'
+  /* #swagger.responses[204] = { description: 'Saved' } */
+  /* #swagger.responses[400] = { description: 'Invalid body, or a scope naming no configured server' } */
+  requireRole('admin'),
+  param('name').matches(NAME).withMessage('a group name is letters, digits, dots, dashes and underscores'),
+  body('title').optional().isString().trim().isLength({ max: 120 }),
+  body('rank').optional().isInt({ min: -1000, max: 1000 }).toInt(),
+  body('scope').optional().isString().isLength({ min: 1, max: 64 }),
+  body('permissions').optional().isArray({ max: 500 }),
+  body('permissions.*').isString().matches(NAME),
+  // Shape only; the twelve fields and their rules are `chatStyle.validateStyle`'s,
+  // in the controller, so the form gets one sentence per problem.
+  body('chat').optional({ values: 'null' }).isObject().withMessage('chat is an object of BetterChat fields, or null'),
+  validate,
+  permissions.putGroup,
+)
+
+permissionsRouter.delete(
+  '/groups/:name',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Delete a permission group'
+  // #swagger.description = 'Removes the group, its permission list and its membership from the site. The next sync retires the group from every server it had been pushed to — a group the site authored and has withdrawn is removed from the game, unlike one somebody created by hand.'
+  /* #swagger.responses[204] = { description: 'Deleted' } */
+  /* #swagger.responses[404] = { description: 'No such group' } */
+  requireRole('admin'),
+  param('name').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  permissions.deleteGroup,
+)
+
+permissionsRouter.post(
+  '/groups/:name/members',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Put an account in a group'
+  // #swagger.description = 'Membership is authored against a website user and reaches every Steam account they have linked. A member who has never connected to a server cannot be placed in its store yet — the sync reports them as pending and the membership lands on their first connection.'
+  /* #swagger.responses[204] = { description: 'Added' } */
+  /* #swagger.responses[404] = { description: 'No such group' } */
+  requireRole('admin'),
+  param('name').isString().isLength({ min: 1, max: 64 }),
+  // Either identifier: the screen sends a name, the panel inside core's own user
+  // page already holds an id.
+  body('userId').optional().isInt({ min: 1 }).toInt(),
+  body('username').optional().isString().trim().isLength({ min: 1, max: 64 }),
+  validate,
+  permissions.addMember,
+)
+
+permissionsRouter.delete(
+  '/groups/:name/members/:userId',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Take an account out of a group'
+  /* #swagger.responses[204] = { description: 'Removed' } */
+  /* #swagger.responses[404] = { description: 'No such group, or that account is not in it' } */
+  requireRole('admin'),
+  param('name').isString().isLength({ min: 1, max: 64 }),
+  param('userId').isInt({ min: 1 }).toInt(),
+  validate,
+  permissions.removeMember,
+)
+
+permissionsRouter.post(
+  '/grants',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Grant one permission to one person'
+  // #swagger.description = 'A direct grant, authored against a website user and pushed to every Steam account they have linked. Unlike group membership it reaches a player who has never connected to the server, which is what an entitlement earned on the website has to do.'
+  /* #swagger.responses[201] = { description: 'Granted' } */
+  /* #swagger.responses[200] = { description: 'They already held it; nothing changed' } */
+  /* #swagger.responses[400] = { description: 'Invalid body, or a scope naming no configured server' } */
+  /* #swagger.responses[404] = { description: 'No account on this site has that name' } */
+  requireRole('admin'),
+  body('userId').optional().isInt({ min: 1 }).toInt(),
+  body('username').optional().isString().trim().isLength({ min: 1, max: 64 }),
+  body('permission').isString().matches(NAME),
+  body('scope').optional().isString().isLength({ min: 1, max: 64 }),
+  body('note').optional().isString().isLength({ max: 255 }),
+  validate,
+  permissions.addGrant,
+)
+
+permissionsRouter.delete(
+  '/grants/:id',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Remove a grant'
+  // #swagger.description = 'The next sync revokes it in every in-scope game. A player who has already used what it allowed keeps what they did with it — the grant is the entitlement, not the consumption.'
+  /* #swagger.responses[204] = { description: 'Removed' } */
+  /* #swagger.responses[404] = { description: 'No such grant' } */
+  requireRole('admin'),
+  param('id').isInt({ min: 1 }).toInt(),
+  validate,
+  permissions.removeGrant,
+)
+
+permissionsRouter.post(
+  '/drift/:id/adopt',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Adopt a hand edit'
+  // #swagger.description = 'Records a grant or membership somebody made in game as one the site authors, so it stops being reported and starts being maintained. It needs a website account holding that Steam id; without one there is nobody to author it against, and the answer is to revoke it or to ask the player to link. For a `chat-field` row it copies the game’s value into the group’s style — which every server in the group’s scope is then pushed — and answers 409 when the group has no style or the value is not one the site accepts.'
+  /* #swagger.responses[204] = { description: 'Adopted' } */
+  /* #swagger.responses[400] = { description: 'That kind of drift cannot be adopted' } */
+  /* #swagger.responses[409] = { description: 'That Steam account is linked to nobody on this site' } */
+  requireRole('admin'),
+  param('id').isInt({ min: 1 }).toInt(),
+  validate,
+  permissions.adoptDrift,
+)
+
+permissionsRouter.post(
+  '/drift/:id/revoke',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Revoke a hand edit'
+  // #swagger.description = 'Queues the removal rather than performing it: a server that is down keeps the instruction until it comes back. This is the only way the site removes something it did not put there — a sync never does it on its own. For a `chat-field` row it puts the site’s value back over the hand edit on the next sync.'
+  /* #swagger.responses[202] = { description: 'Queued for the next sync' } */
+  /* #swagger.responses[404] = { description: 'No such drift' } */
+  requireRole('admin'),
+  param('id').isInt({ min: 1 }).toInt(),
+  validate,
+  permissions.revokeDrift,
+)
+
+permissionsRouter.post(
+  '/sync',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Push the permission set now'
+  // #swagger.description = 'Runs the reconciliation loop’s pass immediately, for one server or for all of them, and answers with what each one reported. The loop does this on its own; the button exists so an operator who has just changed something can see it land, and finds out at once when a server is unreachable.'
+  /* #swagger.responses[200] = { description: 'The state of every server after the pass', content: { "application/json": { schema: { $ref: "#/components/schemas/RustPermissionSyncResult" } } } } */
+  /* #swagger.responses[404] = { description: 'No such server' } */
+  requireRole('admin'),
+  body('serverId').optional().isString().isLength({ min: 1, max: 64 }),
+  validate,
+  permissions.syncNow,
+)
+
+module.exports = permissionsRouter

server/router/admin/rust.controller.js

@@ -13,17 +13,55 @@
 const core = require('../../core')
 
 const db = require('../../model/servers/servers.db')
+const mapImages = require('../../mapImages')
+const nextWipe = require('../../model/servers/nextWipe')
 const servers = require('../../model/servers/servers.model')
 const sidecar = require('../../sidecarClient')
+const titleSync = require('../../titleSync')
+const titles = require('../../model/titles/titles')
+const titlesModel = require('../../model/titles/titles.model')
+const voice = require('../../model/permissions/voice')
 
 const log = core.logger('admin')
 
 async function listServers(req, res) {
   try {
-    res.json({ servers: await servers.listForAdmin() })
+    const [rows, settings] = await Promise.all([servers.listForAdmin(), titlesModel.settingsByServer()])
+
+    // Phase 17: each server's chat titles, and what the last push of them found.
+    res.json({
+      servers: rows.map((row) => ({
+        ...row,
+        titles: settings.get(row.id) || { mode: 'first', max: 2, rules: [] },
+        titlePush: titleSync.lastPush(row.id),
+      })),
+    })
   } catch (err) {
     log.error('failed to read the server list', { error: err.message })
-    res.status(500).json({ error: 'Failed to read the server list' })
+    res.status(500).json({ message: 'Failed to read the server list' })
+  }
+}
+
+/**
+ * The wipe schedule a save carries (phase 16, D130), normalised for storage — or
+ * `null` when the body carries none, which leaves the stored one alone.
+ *
+ * Only the fields the rule reads are kept: a weekly rule's day left behind after
+ * the operator switched to `forced` would be a value nothing reads and the form
+ * would show back to them as if it meant something.
+ */
+function scheduleFrom(body) {
+  if (body.wipeRule === undefined) return null
+  const rule = body.wipeRule
+  const weekly = rule === 'weekly' || rule === 'biweekly'
+  const blank = (v) => v === undefined || v === null || v === ''
+  return {
+    wipeRule: rule,
+    wipeDay: weekly ? Number(body.wipeDay) : null,
+    wipeTime: weekly ? body.wipeTime : null,
+    wipeTz: weekly ? body.wipeTz : null,
+    wipeAnchor: rule === 'biweekly' ? body.wipeAnchor : null,
+    wipeOnceAt: blank(body.wipeOnceAt) ? null : new Date(body.wipeOnceAt),
   }
 }
 
@@ -39,9 +77,16 @@ async function putServer(req, res) {
     // Refusing it up front costs one round trip and saves that hunt. An EXISTING
     // row is a different case: omitting the token is how you say "leave it".
     if (!existing && !sidecarToken) {
-      return res.status(400).json({ error: 'A new server needs its sidecar token' })
+      return res.status(400).json({ message: 'A new server needs its sidecar token' })
     }
 
+    // Checked whole before anything is written, so a bad schedule saves nothing
+    // rather than half a row. The sentences go back as they are: the form shows
+    // them beside the fields.
+    const schedule = scheduleFrom(req.body)
+    const problems = schedule ? nextWipe.validateSchedule(req.body) : []
+    if (problems.length) return res.status(400).json({ message: problems.join(' '), errors: problems })
+
     await db.upsertServer({
       id,
       name,
@@ -55,6 +100,7 @@ async function putServer(req, res) {
       enabled: enabled === undefined ? true : enabled,
       sortOrder: sortOrder === undefined ? 0 : sortOrder,
     })
+    if (schedule) await db.setSchedule(id, schedule)
 
     await core.activity.log({
       req,
@@ -65,13 +111,16 @@ async function putServer(req, res) {
         sidecarBaseUrl,
         // Whether the credential was rotated, never the credential.
         tokenChanged: Boolean(sidecarToken),
+        // The schedule as written, when the save carried one. Nothing in it is a
+        // secret, and "who moved the wipe" is a question players will ask.
+        ...(schedule ? { schedule: { ...schedule, wipeOnceAt: schedule.wipeOnceAt ? schedule.wipeOnceAt.toISOString() : null } } : {}),
       },
     })
 
     return res.status(204).end()
   } catch (err) {
     log.error('failed to save a server', { server: id, error: err.message })
-    return res.status(500).json({ error: 'Failed to save the server' })
+    return res.status(500).json({ message: 'Failed to save the server' })
   }
 }
 
@@ -80,7 +129,7 @@ async function deleteServer(req, res) {
 
   try {
     const existing = await db.getServer(id)
-    if (!existing) return res.status(404).json({ error: 'No such server' })
+    if (!existing) return res.status(404).json({ message: 'No such server' })
 
     await db.deleteServer(id)
     await core.activity.log({ req, action: 'rust.server.delete', detail: { server: id } })
@@ -88,7 +137,7 @@ async function deleteServer(req, res) {
     return res.status(204).end()
   } catch (err) {
     log.error('failed to delete a server', { server: id, error: err.message })
-    return res.status(500).json({ error: 'Failed to delete the server' })
+    return res.status(500).json({ message: 'Failed to delete the server' })
   }
 }
 
@@ -106,7 +155,7 @@ async function testServer(req, res) {
 
   try {
     const row = await db.getServer(id)
-    if (!row) return res.status(404).json({ error: 'No such server' })
+    if (!row) return res.status(404).json({ message: 'No such server' })
 
     const result = await sidecar.health(servers.withToken(row))
 
@@ -125,8 +174,153 @@ async function testServer(req, res) {
     })
   } catch (err) {
     log.error('failed to probe a sidecar', { server: id, error: err.message })
-    return res.status(500).json({ error: 'Failed to probe the sidecar' })
+    return res.status(500).json({ message: 'Failed to probe the sidecar' })
   }
 }
 
-module.exports = { listServers, putServer, deleteServer, testServer }
+/**
+ * Fetch one server's map picture again (D110's admin button). Runs the same
+ * fetch the board poll triggers, forced — the stored hash is not trusted to be
+ * current — and answers what it did, because an operator pressing this is
+ * asking a question: is the picture this server has the right one?
+ */
+async function fetchMap(req, res) {
+  const { id } = req.params
+
+  try {
+    const server = await servers.getForCalling(id)
+    if (!server) return res.status(404).json({ message: 'No such server, or it is disabled' })
+
+    const result = await mapImages.run(server, null, { force: true })
+    await core.activity.log({ req, action: 'rust.map.fetch', detail: { server: id, outcome: result.outcome } })
+
+    if (result.outcome === 'busy') return res.status(409).json({ message: 'A fetch is already running for this server.' })
+    return res.status(result.ok ? 200 : 502).json({ ok: result.ok, outcome: result.outcome, message: result.detail || null })
+  } catch (err) {
+    log.error('failed to fetch a map', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to fetch the map' })
+  }
+}
+
+/**
+ * Ask a server with no picture to draw one (D109). **This stalls that game**
+ * for seconds — the card says how many before the button is pressed — and it is
+ * refused by the plugin when a picture already exists. Answered as soon as the
+ * game accepts; the picture is fetched when the render finishes.
+ */
+async function renderMap(req, res) {
+  const { id } = req.params
+
+  try {
+    const server = await servers.getForCalling(id)
+    if (!server) return res.status(404).json({ message: 'No such server, or it is disabled' })
+
+    const actor = req.user && (req.user.username || req.user.id)
+    const result = await mapImages.render(server, actor != null ? String(actor) : null)
+    await core.activity.log({
+      req,
+      action: 'rust.map.render',
+      detail: { server: id, accepted: result.ok, ...(result.ok ? {} : { reason: result.reason || null }) },
+    })
+
+    if (!result.ok) return res.status(result.status || 502).json({ message: result.message })
+    return res.status(202).json({ accepted: true, stallSeconds: result.stallSeconds })
+  } catch (err) {
+    log.error('failed to ask for a render', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to ask the server to draw its map' })
+  }
+}
+
+// ── The optional mods (phase 17) ─────────────────────────────────────────────
+
+/**
+ * Replace one server's chat titles: the rules, the mode and N (D135, D136).
+ * Validated whole, so a bad rule saves nothing. The titles reach the game on
+ * the push loop's next tick, and the web the next time it reads.
+ */
+async function putTitles(req, res) {
+  const { id } = req.params
+
+  try {
+    const existing = await db.getServer(id)
+    if (!existing) return res.status(404).json({ message: 'No such server' })
+
+    const checked = titles.validateSettings(req.body)
+    if (!checked.ok) return res.status(400).json({ message: checked.errors.join(' '), errors: checked.errors })
+
+    await titlesModel.saveSettings(id, checked.value)
+    await core.activity.log({
+      req,
+      action: 'rust.titles.save',
+      detail: { server: id, mode: checked.value.mode, max: checked.value.max, rules: checked.value.rules },
+    })
+
+    return res.json({ titles: await titlesModel.settingsFor(id) })
+  } catch (err) {
+    log.error('failed to save chat titles', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to save the chat titles' })
+  }
+}
+
+/**
+ * Which optional mods one server has loaded right now, read live from the game
+ * (`integrations` on `server.status`). Live, because an operator installs
+ * BetterChat and then looks here, and the board the site keeps is from the last
+ * time the plugin connected.
+ */
+async function integrations(req, res) {
+  const { id } = req.params
+
+  try {
+    const server = await servers.getForCalling(id)
+    if (!server) return res.status(404).json({ message: 'No such server, or it is disabled' })
+
+    const result = await sidecar.liveStatus(server)
+    const data = result.ok && result.data ? result.data : null
+
+    return res.json({
+      ok: Boolean(data),
+      status: result.status,
+      integrations: data && data.integrations ? data.integrations : null,
+    })
+  } catch (err) {
+    log.error('failed to read integrations', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to ask the server what it has loaded' })
+  }
+}
+
+async function getVoice(req, res) {
+  try {
+    res.json(await voice.describe())
+  } catch (err) {
+    log.error('failed to read the voice', { error: err.message })
+    res.status(500).json({ message: 'Failed to read the announcement voice' })
+  }
+}
+
+async function putVoice(req, res) {
+  try {
+    const result = await voice.choose(req.body.group || '', req.user ? req.user.id : null)
+    if (!result.ok) return res.status(400).json({ message: result.message })
+
+    await core.activity.log({ req, action: 'rust.voice.save', detail: { group: result.voice || null } })
+    return res.json(await voice.describe())
+  } catch (err) {
+    log.error('failed to save the voice', { error: err.message })
+    return res.status(500).json({ message: 'Failed to save the announcement voice' })
+  }
+}
+
+module.exports = {
+  scheduleFrom,
+  listServers,
+  putServer,
+  deleteServer,
+  testServer,
+  fetchMap,
+  renderMap,
+  putTitles,
+  integrations,
+  getVoice,
+  putVoice,
+}

server/router/admin/rust.router.js

@@ -27,6 +27,21 @@ const { body, param } = core.validator
 
 const adminRustRouter = express.Router()
 
+// R2's authoring surface, under `/rust/permissions`. Its own file because it is
+// its own subject — this router configures the bridge, that one decides who may
+// do what inside the game the bridge reaches.
+adminRustRouter.use('/permissions', require('./permissions.router'))
+
+// R18's editor, under `/rust/config`. A third subject again: this router
+// configures the BRIDGE, `permissions` decides who may do what inside the game,
+// and this one edits the game host's own plugin settings.
+adminRustRouter.use('/config', require('./config.router'))
+
+// Who may see who is online, under `/rust/visibility`. The org lead's rule is
+// that nothing names who is online by default; this is where an operator
+// deliberately widens it, fleet-wide or for one server.
+adminRustRouter.use('/visibility', require('./visibility.router'))
+
 adminRustRouter.get(
   '/servers',
   // #swagger.tags = ['Admin · Rust']
@@ -40,7 +55,8 @@ adminRustRouter.put(
   '/servers/:id',
   // #swagger.tags = ['Admin · Rust']
   // #swagger.summary = 'Create or update a Rust server'
-  // #swagger.description = 'Writes one server row. `sidecarToken` is write-only — send it to set or rotate the credential, and omit it or send an empty string to leave the stored one untouched. The id is the slug every URL under the module carries.'
+  // #swagger.description = 'Writes one server row. `sidecarToken` is write-only — send it to set or rotate the credential, and omit it or send an empty string to leave the stored one untouched. The id is the slug every URL under the module carries. The wipe schedule (`wipeRule`, `wipeDay`, `wipeTime`, `wipeTz`, `wipeAnchor`, `wipeOnceAt`) is written only when `wipeRule` is present, so a body without it leaves the stored schedule alone. `wipeRule` is `none`, `forced`, `weekly` or `biweekly`; a weekly or biweekly rule needs `wipeDay` (0 = Sunday), `wipeTime` (`HH:MM`) and an IANA `wipeTz`, and a biweekly rule a `wipeAnchor` date on that day. `wipeOnceAt` is a one-off wipe in the future. A 400 carries one sentence per problem in `errors`.'
+  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/RustServerSave" } } } } */
   /* #swagger.responses[204] = { description: 'Saved' } */
   /* #swagger.responses[400] = { description: 'Invalid body' } */
   requireRole('admin'),
@@ -57,6 +73,16 @@ adminRustRouter.put(
   body('protocol').optional().isInt({ min: 1, max: 1000 }).toInt(),
   body('enabled').optional().isBoolean().toBoolean(),
   body('sortOrder').optional().isInt({ min: -1000, max: 1000 }).toInt(),
+  // The wipe schedule (phase 16, D130). Shape only here; the rules that span
+  // fields — a day for a weekly rule, an anchor on that day, a known zone, a
+  // one-off date in the future — are `nextWipe.validateSchedule`'s, in the
+  // controller, so the form gets one sentence per problem.
+  body('wipeRule').optional().isIn(['none', 'forced', 'weekly', 'biweekly']),
+  body('wipeDay').optional({ values: 'null' }).isInt({ min: 0, max: 6 }),
+  body('wipeTime').optional({ values: 'null' }).isString().isLength({ max: 5 }),
+  body('wipeTz').optional({ values: 'null' }).isString().isLength({ max: 64 }),
+  body('wipeAnchor').optional({ values: 'falsy' }).isISO8601({ strict: true }).isLength({ max: 10 }),
+  body('wipeOnceAt').optional({ values: 'falsy' }).isISO8601({ strict: true }),
   validate,
   admin.putServer,
 )
@@ -86,4 +112,97 @@ adminRustRouter.post(
   admin.testServer,
 )
 
+// ── The map's picture (phase 14) ──────────────────────────────────────────
+
+adminRustRouter.post(
+  '/servers/:id/map/fetch',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Fetch a server’s map picture again'
+  // #swagger.description = 'Asks the game what its map is and fetches the picture again, whatever this site already holds. The site does this by itself the first time it sees a new map when the game has a picture to give; this is the button for when that did not happen. `outcome` is `fetched`, `current` (the stored picture is this map’s), `none` (the game has no picture, and Render now is the way to get one) or `failed`, with a sentence in `message`. One fetch per server at a time: a second answers 409.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[200] = { description: 'What the fetch did' } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  /* #swagger.responses[409] = { description: 'A fetch is already running for this server' } */
+  /* #swagger.responses[502] = { description: 'The game or its sidecar did not give a picture; the stored one is kept' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  admin.fetchMap,
+)
+
+adminRustRouter.post(
+  '/servers/:id/map/render',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Ask a server to draw its own map'
+  // #swagger.description = '**This stalls the game server** while it draws — about 8.5 seconds on a 3000 map, longer on a larger one — and nothing on it moves for that time. It exists for a server without Rust+ (`app.port`), whose game keeps no picture of its map, and is refused when a picture already exists. Answers 202 as soon as the game accepts; the picture is fetched when the render finishes, and kept by the game so a restart on the same map does not need another.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[202] = { description: 'The game accepted and will draw on its next frame' } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  /* #swagger.responses[409] = { description: 'A picture already exists, or a render is already running' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  admin.renderMap,
+)
+
+// ── The optional mods (phase 17) ──────────────────────────────────────────
+
+adminRustRouter.put(
+  '/servers/:id/titles',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Set a server’s chat titles'
+  // #swagger.description = 'Replaces the server’s title rules and how many titles a player shows. A rule ranks the CURRENT wipe by `kills`, `npckills` or `playtime` and gives its top N (1–10) a title; only a stat above zero counts, so a fresh wipe gives no titles. Rules are in precedence order, at most ten. `mode` is `first` (the first rule a player meets), `all`, or `upto` `max` (1–5). The titles are shown in game by BetterChat when it is loaded — they are pushed whether or not it is, and it shows them as soon as it is — and on the web and app leaderboards. A 400 carries one sentence per problem in `errors`.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/RustTitleSettings" } } } } */
+  /* #swagger.responses[200] = { description: 'Saved; answers the server’s settings as stored' } */
+  /* #swagger.responses[400] = { description: 'A rule, the mode or N is not valid' } */
+  /* #swagger.responses[404] = { description: 'No such server' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  // Shape only. The words, the bounds and the per-rule sentences are
+  // `titles.validateSettings`'s, in the controller, so a bad mode reaches the
+  // form as a sentence rather than as "Invalid value".
+  body('rules').isArray().withMessage('rules is a list'),
+  validate,
+  admin.putTitles,
+)
+
+adminRustRouter.get(
+  '/servers/:id/integrations',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Which optional mods a server has loaded'
+  // #swagger.description = 'Asks the game, live, whether BetterChat and PopupNotifications are loaded, and which versions. Both are optional: without BetterChat titles and group styles wait for it, and without PopupNotifications a popup is refused with a reason. `integrations` is null when the game could not be asked or its plugin is older than protocol 12, and `status` then says why.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[200] = { description: 'What the server has loaded', content: { "application/json": { schema: { $ref: "#/components/schemas/RustIntegrations" } } } } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  admin.integrations,
+)
+
+adminRustRouter.get(
+  '/voice',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'The voice announcements are said in'
+  // #swagger.description = 'The permission group whose BetterChat style news and `rust.announce` lines are said in, or empty for plain chat, and every group that could be one. The line is composed on the site and said by the bridge plugin with no player as its sender, so it works whether or not BetterChat is loaded.'
+  /* #swagger.responses[200] = { description: 'The voice and the groups that could be one', content: { "application/json": { schema: { $ref: "#/components/schemas/RustVoice" } } } } */
+  requireRole('admin'),
+  admin.getVoice,
+)
+
+adminRustRouter.put(
+  '/voice',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Choose the voice announcements are said in'
+  // #swagger.description = '`group` is a permission group with a chat style, or empty for plain chat. A group without a style is refused.'
+  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: 'object', properties: { group: { type: 'string', example: 'staff' } } } } } } */
+  /* #swagger.responses[200] = { description: 'Saved; answers the new state', content: { "application/json": { schema: { $ref: "#/components/schemas/RustVoice" } } } } */
+  /* #swagger.responses[400] = { description: 'That group has no chat style' } */
+  requireRole('admin'),
+  body('group').optional({ values: 'null' }).isString().isLength({ max: 64 }),
+  validate,
+  admin.putVoice,
+)
+
 module.exports = adminRustRouter

server/router/admin/usersRust.controller.js

@@ -0,0 +1,202 @@
+// ── The `admin.users.detail` slot's handlers ──────────────────────────────
+//
+// What an operator can see and do about one website user's Rust identity. The
+// user id is the PARENT's — `req.params.id` off core's `/admin/users/:id` — and
+// every statement here is scoped by it, so a panel opened on one user cannot
+// read or write another's rows by editing a path segment.
+
+const core = require('../../core')
+
+const links = require('../../model/links/links.model')
+const permissionsDb = require('../../model/permissions/permissions.db')
+const permissions = require('../../model/permissions/permissions.model')
+const servers = require('../../model/servers/servers.model')
+
+const log = core.logger('admin')
+
+/**
+ * GET /admin/users/:id/rust/links
+ *
+ * The linked Steam accounts and, per server, what this module knows about the
+ * player behind them — all-time rather than this wipe's, because an operator
+ * looking at a user wants their history and the public leaderboard already
+ * answers the other question.
+ *
+ * **An empty array is an answer.** Most users have no Rust link at all, and the
+ * panel renders nothing rather than an error for them.
+ */
+async function listLinks(req, res) {
+  try {
+    res.json({ links: await links.forAdmin(req.params.id) })
+  } catch (err) {
+    log.error('failed to read a user’s Rust links', { error: err.message })
+    res.status(500).json({ message: 'Failed to read this user’s Rust accounts' })
+  }
+}
+
+/**
+ * DELETE /admin/users/:id/rust/links/:steamId — staff sever a link (D25).
+ *
+ * **This is the counterweight to D23.** The site refuses to move a Steam id that
+ * another website account already holds, and the player's own way out is
+ * `/unlink` in game — which is no way out at all for somebody who has lost access
+ * to that Steam account, or to the site account holding it. Staff are that route.
+ *
+ * Scoped by the parent user id in the statement rather than checked first: the
+ * ownership test and the deletion are one operation, and a link that belongs to a
+ * different user answers 404 from the page it was not on.
+ */
+async function removeLink(req, res) {
+  const { steamId } = req.params
+  const userId = req.params.id
+
+  try {
+    const removed = await links.unlinkOwned(steamId, userId)
+
+    if (!removed) return res.status(404).json({ message: 'That account is not linked to this user' })
+
+    // The one write this panel has, so it is the one thing here worth an audit
+    // row: after phase 7 a link is what permissions are granted against, and
+    // "who severed it" stops being a curiosity.
+    await core.activity.log({
+      req,
+      action: 'rust.account.unlink.staff',
+      detail: { steamId, userId: Number(userId) },
+    })
+
+    return res.json({ unlinked: true })
+  } catch (err) {
+    log.error('failed to unlink a Steam account', { error: err.message })
+    return res.status(500).json({ message: 'Failed to unlink that account' })
+  }
+}
+
+/**
+ * GET /admin/users/:id/rust/permissions
+ *
+ * What this person may do in game, and — the part that is easy to leave out —
+ * whether any of it reaches anybody. A grant against an account with no linked
+ * Steam id is authored, stored, pushed nowhere and looks identical to a working
+ * one on every screen that does not say so.
+ */
+async function listPermissions(req, res) {
+  const userId = Number(req.params.id)
+
+  try {
+    const [groups, groupPermissions, members, grants, allLinks] = await Promise.all([
+      permissionsDb.listGroups(),
+      permissionsDb.listGroupPermissions(),
+      permissionsDb.listGroupMembers(),
+      permissionsDb.listGrants({ userId }),
+      permissionsDb.listLinks(),
+    ])
+
+    const theirs = new Set(
+      members.filter((row) => row.userId === userId).map((row) => row.groupName),
+    )
+
+    const carried = new Map()
+    for (const row of groupPermissions) {
+      if (!carried.has(row.groupName)) carried.set(row.groupName, [])
+      carried.get(row.groupName).push(row.permission)
+    }
+
+    res.json({
+      groups: groups
+        .filter((group) => theirs.has(group.name))
+        .map((group) => ({
+          name: group.name,
+          title: group.title,
+          scope: group.scope,
+          permissions: carried.get(group.name) || [],
+        })),
+      grants: permissions.collapseGrants(grants).map((grant) => ({
+        id: grant.id,
+        permission: grant.permission,
+        scope: grant.scope,
+        source: grant.source,
+        note: grant.note,
+        grantedAt: grant.grantedAt,
+      })),
+      reaches: allLinks.filter((link) => link.userId === userId).map((link) => link.steamId),
+    })
+  } catch (err) {
+    log.error('failed to read a user’s Rust permissions', { error: err.message })
+    res.status(500).json({ message: 'Failed to read this user’s Rust permissions' })
+  }
+}
+
+/** POST /admin/users/:id/rust/permissions/grants */
+async function addGrant(req, res) {
+  const userId = Number(req.params.id)
+  const permission = permissions.normaliseName(req.body.permission)
+  const scope = String(req.body.scope || permissions.FLEET)
+
+  try {
+    if (scope !== permissions.FLEET) {
+      const known = await servers.listForAdmin()
+      if (!known.some((row) => row.id === scope)) {
+        return res.status(400).json({ message: 'That scope names no configured server' })
+      }
+    }
+
+    const { inserted } = await permissionsDb.insertGrant({
+      userId,
+      permission,
+      scope,
+      source: 'admin',
+      note: null,
+      grantedBy: req.user ? req.user.id : null,
+    })
+
+    if (inserted) {
+      await permissionsDb.markDirty(scope)
+      await core.activity.log({
+        req,
+        action: 'rust.perm.grant',
+        detail: { userId, permission, scope },
+      })
+    }
+
+    return res.status(inserted ? 201 : 200).json({ granted: inserted })
+  } catch (err) {
+    log.error('failed to grant a permission', { userId, permission, error: err.message })
+    return res.status(400).json({ message: 'That permission could not be granted' })
+  }
+}
+
+/**
+ * DELETE /admin/users/:id/rust/permissions/grants/:grantId
+ *
+ * **Scoped by the user as well as by the grant**, like every other write in this
+ * panel: a grant id belonging to somebody else answers `404` rather than
+ * removing a privilege from a person whose page nobody was looking at.
+ */
+async function removeGrant(req, res) {
+  const userId = Number(req.params.id)
+  const grantId = Number(req.params.grantId)
+
+  try {
+    const grant = await permissionsDb.getGrant(grantId)
+
+    if (!grant || grant.userId !== userId) {
+      return res.status(404).json({ message: 'That grant does not belong to this user' })
+    }
+
+    await permissionsDb.deleteGrant(grantId)
+    await permissionsDb.markDirty(grant.scope)
+
+    await core.activity.log({
+      req,
+      action: 'rust.perm.revoke',
+      detail: { userId, permission: grant.permission, scope: grant.scope },
+    })
+
+    return res.status(204).end()
+  } catch (err) {
+    log.error('failed to remove a grant', { userId, grant: grantId, error: err.message })
+    return res.status(500).json({ message: 'Failed to remove that permission' })
+  }
+}
+
+module.exports = { listLinks, removeLink, listPermissions, addGrant, removeGrant }

server/router/admin/usersRust.router.js

@@ -0,0 +1,131 @@
+// ── The `admin.users.detail` extension slot ───────────────────────────────
+//
+// R13's first slot, and the phase criterion in one file: *an operator sees the
+// Steam id inside core's own user page*.
+//
+// MODULE_API.md §2.4's fourth mount shape — module routes hanging off a CORE
+// resource. `/admin/users/:id` is a URL core owns and this module has something
+// to say about it, so the routes cannot move behind a `/rust` prefix and cannot
+// be registered anywhere else either. Core declares the slot; a module fills it,
+// and only one module may.
+//
+// Three things about this router that are not true of the other three:
+//
+//   • **`mergeParams: true`**, because the user id belongs to the parent. Without
+//     it `req.params.id` is undefined and every statement here silently scopes to
+//     nothing.
+//   • **The paths keep the module's own segment** (`/rust/links`, not `/links`).
+//     Core owns the resource and other modules may fill their own slots on other
+//     resources; a bare `/links` would be this module claiming a word on a URL it
+//     does not own.
+//   • **The gate is stricter than the admin tier's.** Core's users router is
+//     `requireRole('admin')` and the slot is mounted inside it, so editors and
+//     moderators never reach here — which is right for a surface that can sever
+//     what phases 7 and 13 grant against.
+//
+// The client half is registered under the SAME name (`registry.registerExtension`
+// in `entry.jsx`) and builds its own client for these two routes; a slot passes a
+// component `userId` and nothing else.
+
+const core = require('../../core')
+
+const express = core.express
+const { body, param } = core.validator
+
+const usersRust = require('./usersRust.controller')
+const { validate } = core.middleware
+
+// Same bound the player tier states, for the same reason: nothing but digits
+// reaches a `WHERE steam_id = ?`.
+const STEAM_ID_RE = /^[0-9]{5,32}$/
+
+const usersRustRouter = express.Router({ mergeParams: true })
+
+usersRustRouter.get(
+  '/rust/links',
+  // #swagger.tags = ['Admin · Users']
+  // #swagger.summary = 'A user’s linked Steam accounts and their Rust record (admin only)'
+  // #swagger.description = 'Every Steam account linked to this website user, with the display name the game last saw and, per server, all-time kills / deaths / playtime across every wipe. Fills the admin.users.detail extension slot.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'User id.' }
+  /* #swagger.responses[200] = { description: 'Linked accounts', content: { "application/json": { schema: { $ref: "#/components/schemas/RustAdminLinkList" } } } } */
+  param('id').isInt(),
+  validate,
+  usersRust.listLinks,
+)
+
+usersRustRouter.delete(
+  '/rust/links/:steamId',
+  // #swagger.tags = ['Admin · Users']
+  // #swagger.summary = 'Sever a user’s Steam link (admin only)'
+  // #swagger.description = 'Staff release a link on this user’s behalf. It is the counterweight to the site refusing to move a Steam id another account holds: a player who cannot reach that Steam account in game has no other way back. Recorded in the activity log.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'User id.' }
+  // #swagger.parameters['steamId'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'The Steam id to release.' }
+  /* #swagger.responses[200] = { description: 'Unlinked', content: { "application/json": { schema: { type: "object", properties: { unlinked: { type: "boolean", example: true } } } } } } */
+  /* #swagger.responses[404] = { description: 'Not linked to this user', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt(),
+  param('steamId').matches(STEAM_ID_RE),
+  validate,
+  usersRust.removeLink,
+)
+
+// ── Phase 7: what this person may do in game ─────────────────────────────
+//
+// The same panel, one section lower. It is here rather than only on the
+// permissions screen because the question an operator actually has is about a
+// PERSON — "why can this player spawn a kit" is asked on their page, not on a
+// list of groups — and because the slot is already the place this module says
+// everything else it knows about one user.
+//
+// Both writes go through the ordinary authored tables and the ordinary loop. A
+// grant made here reaches the game when the mirror next reconciles, which is
+// seconds, and never inside this request.
+
+usersRustRouter.get(
+  '/rust/permissions',
+  // #swagger.tags = ['Admin · Users']
+  // #swagger.summary = 'A user’s Rust privileges (admin only)'
+  // #swagger.description = 'The groups this person is in, the permissions granted to them directly, and the Steam accounts those privileges actually reach. An empty `reaches` means they have linked nothing and hold them on paper only.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'User id.' }
+  /* #swagger.responses[200] = { description: 'Their groups and grants', content: { "application/json": { schema: { $ref: "#/components/schemas/RustUserPermissions" } } } } */
+  param('id').isInt(),
+  validate,
+  usersRust.listPermissions,
+)
+
+usersRustRouter.post(
+  '/rust/permissions/grants',
+  // #swagger.tags = ['Admin · Users']
+  // #swagger.summary = 'Grant a Rust permission to this user (admin only)'
+  // #swagger.description = 'Authored against the website account, so it reaches every Steam id they have linked — now and later. `scope` is a server id or `*` for the fleet. The push happens on the mirror’s next pass.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'User id.' }
+  /* #swagger.responses[201] = { description: 'Granted' } */
+  /* #swagger.responses[200] = { description: 'They already held it' } */
+  /* #swagger.responses[400] = { description: 'Invalid body, or a scope naming no configured server', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt(),
+  body('permission').isString().matches(/^[a-z0-9][a-z0-9._-]{0,127}$/i),
+  body('scope').optional().isString().isLength({ min: 1, max: 64 }),
+  validate,
+  usersRust.addGrant,
+)
+
+usersRustRouter.delete(
+  '/rust/permissions/grants/:grantId',
+  // #swagger.tags = ['Admin · Users']
+  // #swagger.summary = 'Remove a Rust permission from this user (admin only)'
+  // #swagger.description = 'Scoped to this user as well as to the grant, so a wrong id on the URL removes nothing rather than somebody else’s privilege. The revoke reaches the game on the mirror’s next pass.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'User id.' }
+  // #swagger.parameters['grantId'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'The grant to remove.' }
+  /* #swagger.responses[204] = { description: 'Removed' } */
+  /* #swagger.responses[404] = { description: 'No such grant for this user', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt(),
+  param('grantId').isInt({ min: 1 }).toInt(),
+  validate,
+  usersRust.removeGrant,
+)
+
+module.exports = usersRustRouter