docs(website): Steam sign-in's questions answered (D392-D396)

The org lead answered STEAM_SIGNIN.md's Q1-Q4 on 2026-10-19 and ruled on
the conflict they raise together:

- D392 a Steam account linked on the site is a linked Rust player (Q1)
- D393 unlinking Steam removes only the sign-in identity (Q2)
- D394 Steam needs a Steam Web API key to be enabled (Q3)
- D395 Steam never signs anybody up (Q4)
- D396 a Steam link whose id is another account's Rust link is refused

The build section follows: the key is required, the identity row keeps the
persona name and avatar, and MODULE_API 1.17.0 adds a pre-link check (which
can only refuse) and a linked hook, with no unlink hook. PLAN_REDESIGNS
tables the three decisions Module-Rust builds to and points §15 at them.
The build goes on the website's edge and ships in the cutover in progress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

modules/rust/PLAN_REDESIGNS.md

@@ -11,7 +11,7 @@ chose neither route: Runic Gateway writes its own NPC plugin, RunicNPC, planned
 [`../../runicnpc/PLAN.md`](../../runicnpc/PLAN.md) (D214–D314), and the rest of this plan waits for it.** RunicNPC v1.0.0 shipped on 2026-10-09, and the plan
 resumed with §2 the same day (D331–D334); §2 was built on 2026-10-12, and §11's Economics spike the same day
 raised D335–D336 (§11.2.1). Economics was built on 2026-10-12 too (§11.2.4). The Backpacks spike followed and raised D337–D339 (§11.3.1), and Backpacks was built the same day (D340, D341, §11.3.4). The org lead then added permission rewards (§12,
-D342–D346), planned and built the same day. On 2026-10-14 RaidableBases was deferred until the current paid copy arrives (D347), with both editions to be supported (D348, §11.4.2). The same day the org lead added Rust's own world events to the base module (§13, D349) and six more first-class optional plugins (§14, D350–D352), to be tested together in one phase before their integration plan. Their questions were answered the same day (D353–D359, the end walk now waiting for RaidableBases), and Steam sign-in stays on the website's plan, linked as §15 (D360). **The §14.2 test phase ran the same day on both rigs (§14.2.1)**: the org lead ruled D361–D362 during it and answered its Q19–Q25 the same day (D363–D369). On 2026-10-16 the org lead added console commands as event steps and rewards (§16, D382–D384), to be built before RaidableBases; **they were built the same day (§16.10)**, with D385. The same day the paid RaidableBases copy arrived; **its spike ran on both rigs (§11.4.2)**, with D386 and four questions, Q33–Q36, answered the same day (D387–D390). **§11.4 was built the same day (§11.4.6)**, with D391, core's dry-run advice. **Every item left is built, tested and PR'd first; every walk —
+D342–D346), planned and built the same day. On 2026-10-14 RaidableBases was deferred until the current paid copy arrives (D347), with both editions to be supported (D348, §11.4.2). The same day the org lead added Rust's own world events to the base module (§13, D349) and six more first-class optional plugins (§14, D350–D352), to be tested together in one phase before their integration plan. Their questions were answered the same day (D353–D359, the end walk now waiting for RaidableBases), and Steam sign-in stays on the website's plan, linked as §15 (D360). **The §14.2 test phase ran the same day on both rigs (§14.2.1)**: the org lead ruled D361–D362 during it and answered its Q19–Q25 the same day (D363–D369). On 2026-10-16 the org lead added console commands as event steps and rewards (§16, D382–D384), to be built before RaidableBases; **they were built the same day (§16.10)**, with D385. The same day the paid RaidableBases copy arrived; **its spike ran on both rigs (§11.4.2)**, with D386 and four questions, Q33–Q36, answered the same day (D387–D390). **§11.4 was built the same day (§11.4.6)**, with D391, core's dry-run advice. On 2026-10-19 the org lead answered Steam sign-in's questions (D392–D396, §15), and it is built on the website's `edge` to join the cutover. **Every item left is built, tested and PR'd first; every walk —
 theirs and the ones still owed by §3 and §5 — happens together at the end (D331, §9).** **The end walk's rows
 that need no player ran on 2026-10-16 and 2026-10-19, and all of them are done (§9.1)**: W1–W20 and N1 found, W4
 and W19 the real ones.
@@ -1214,6 +1214,15 @@ The org lead answered §14.3's Q26–Q32 on 2026-10-14:
 | **D390** | **Lockouts are dropped from the feed (Q36).** Neither edition raises a hook for them. On the paid edition the feed gains a line when a player buys a base (`OnRaidableBasePurchased`) and when an admin locks one to a player (`OnRaidableBaseLocked`), naming the player only for the presence audience (D376). This amends D202. | Dropping them with no new lines; reading lockouts out of the plugin's data by reflection. | 11.4.2 |
 | **D391** | **The editor's spot check is advice through core (2026-10-16, asked during the build).** Core's dry run gains a warning channel, MODULE_API 1.16.0: a module answering `verify: true` with `{ ok: true, detail: { warnings } }` has each line shown as a warning finding that never fails the dry run. A raid base's spot refused now, and the rocks and cliffs beside it (D388), show there as advice; the run itself checks again. Steam sign-in moves to 1.17.0. | A blocked spot failing the dry run, with rocks and cliffs only in the run log; no editor check. | 11.4.6 |
 
+The org lead answered [`website/STEAM_SIGNIN.md`](../../website/STEAM_SIGNIN.md)'s Q1–Q4 on 2026-10-19, and ruled on the
+case two of them raised. They are tabled there, in §7; the ones this module builds to are:
+
+| # | Decision | Rejected | § |
+|---|---|---|---|
+| **D392** | **A Steam account linked on the site is a linked Rust player** (Q1), beside the in-game `/link` code (R1). | Steam sign-in as sign-in only. | 15 |
+| **D393** | **Unlinking Steam removes only the sign-in** (Q2). The Rust link it made stays until it is removed on the Rust page. | One link with two ways to make it, gone with either. | 15 |
+| **D396** | **A Steam link whose id is already another website account's Rust link is refused.** Nothing changes; staff remove the old Rust link if the claim is real, and the player links again. | Steam wins and moves the Rust link; a sign-in-only link. | 15 |
+
 Console commands as event steps and rewards, added on 2026-10-16, were decided as D382–D384, and D385 during the build; they are tabled with their section, in §16.7.
 
 ## 11. First-class optional plugins (D199–D202)
@@ -3647,7 +3656,7 @@ RaidableBases (D359).**
 
 ---
 
-## 15. Steam sign-in (D360): on the website's plan
+## 15. Steam sign-in (D360, D392, D393, D396): on the website's plan
 
 The org lead asked on 2026-10-14 for Steam sign-in **in the same manner as the other providers**, and for it to
 stay on the website's plan (D171). It is planned in **[`website/STEAM_SIGNIN.md`](../../website/STEAM_SIGNIN.md)**
@@ -3656,9 +3665,11 @@ it does not hold the end walk (D359).
 
 What this module takes from it:
 
-- **A verified Steam id for a signed-in account**, read through the module contract (MODULE_API 1.16.0 there; 1.15.0 went to §14.3.13).
-- **A Steam identity as a linked Rust player**, beside the in-game `/link` code (R1). Whether it counts as a link
-  is that plan's Q1, and what unlinking removes is its Q2.
+- **A verified Steam id for a signed-in account**, read through the module contract (MODULE_API 1.17.0 there;
+  1.15.0 went to §14.3.13 and 1.16.0 to §11.4.6).
+- **A Steam identity as a linked Rust player** (D392), beside the in-game `/link` code (R1). Linking Steam makes the
+  Rust link; unlinking Steam leaves it (D393); a Steam id that is already another account's Rust link is refused
+  before anything is written (D396), which the module answers through core's pre-link check.
 - When it lands, Module-Rust's account screens and the link flow are updated in their own PR. Rust's grants
   already follow the website user to every linked Steam id (D28), so nothing else changes.