docs(events,rust): MODULE_API 1.14.0's multiple param; permission rewards built (PLAN_REDESIGNS §12.10)

- website/MODULE_API.md: 1.14.0 in §1.1 and the changelog — `multiple: true`
  with `max` on a string/int action param, the JSON-array value, a bare value
  as a list of one, refused on a duration, a template input and a list
  example; the catalog serves both keys; the editor's multi-select;
  Module-uo unaffected. §2.4's registerEventActions line names it.
- website/EVENTS.md §F: the param that holds several values and its control.
- modules/rust/PLAN_REDESIGNS.md §12.10: built in website#213 and
  Module-Rust#42, with the eight points settled in code, overrulable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

modules/rust/PLAN_REDESIGNS.md

@@ -1814,3 +1814,31 @@ On both rigs, with a plugin that registers a perk (NightVision or similar):
 - run a *Permissions for good* step; see it stay after the run ends, show in the permission manager with its
   note, and go when staff delete it;
 - unload the plugin and see the step refuse the permission by name.
+
+### 12.10 Built (2026-10-12)
+
+Built to §12.2–§12.5 in two PRs, core first: website#213 (MODULE_API 1.14.0, the `multiple` flag and the
+editor's multi-select, with Module-uo's frozen-manifest proof in its body) and Module-Rust#42 (the source, the two
+steps and the two budgets, in a new `server/eventPermRewards.js`, with `ci/core-ref.json` pinned to #213 until it
+merges). A core at #213 with the module installed registered it, and its own spec path validated and priced both
+steps. These points the design left open were settled in the code, and are named here so they can be overruled:
+
+- **The two steps share one param list** (§12.5's "the same params"), each with its own message example: *"You
+  can use /nv until the event ends"* and *"…from now on"*. `confirm` is the last param, and a new step starts with
+  it off, so it must be ticked on purpose.
+- **Only a real `true` ticks it.** A step written by hand with `"confirm": "true"` is refused like an unticked
+  one. A string is not the author's tick.
+- **A server that has reported no catalogue yet is a wait, not a refusal.** It has not had a permission sync since
+  it was added, so the step is retried rather than refused for every permission by name.
+- **The picker uses the first owner any server reports** for a permission. Two servers that disagree about which
+  plugin registered a name would be a renamed plugin, and the name is one row either way.
+- **A permission is matched without case and stored lower case**, which is how Oxide and Carbon store one. The
+  picker shows the catalogue's own spelling.
+- **Give tells a retry from a staff member's grant by its note.** A grant already there that carries this step's
+  note is counted as *given*, not *already held*, so a retry after a lost answer reports what the first attempt
+  did. Lend finds its rows by step, as a kit reward does.
+- **Give's message goes to every recipient**, including one who already held every permission: the sentence
+  is still true for them.
+- **The permission manager marks a for-good grant** with a chip, *given by event run N, step M*, from the
+  grant's note. It is turned off like any staff grant. A lent permission keeps its *from an event* chip and its
+  locked toggle, because the run's teardown takes it back.