docs(rust): the Rust operator guide and bundle schema 2 (phase 18, draft)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

installer/PLAN.md

@@ -1309,6 +1309,36 @@ version anywhere.** It reads what the artifacts declare, and §7.1's gate 1 is w
 mismatched pair from being published as a bundle — which is the mechanism that will matter at the
 *next* protocol bump, not just this one. See `docs/link/v3.md`.
 
+### 7.5 Schema 2: a second game (module-rust phase 18)
+
+Rust reached the installer in module-rust phase 18 (`docs/modules/rust/PLAN.md` §34, D146–D148), and
+schema 1 could not carry it: it names ServUO in its *shape* (`link`, `overlay.servuo`), and every
+shipped installer refuses any schema but 1. So the bundle gained a second schema, **for both games**,
+rather than a separate format for Rust:
+
+- **Schema 2 names one game.** A `game` discriminant (`servuo` or `rust`), a `sidecar`, and a
+  `payload` whose `kind` is `overlay` or `plugin`. One document per game, because the games release
+  on their own schedules and a document naming both would hand a ServUO host a new bundle every time
+  a Rust plugin shipped. The shape is in `installer/bundles/README.md`.
+- **Three streams on the `bundles` branch:** schema 1 at the root (ServUO), `v2/servuo/`, and
+  `v2/rust/`. `bundle.yml` composes all three in `.gitea/scripts/compose-bundles.sh`, each game
+  independently — a Rust failure still lets a ServUO bundle publish, and the run goes red after. A
+  game none of whose repos has released composes nothing, and that is not a failure.
+- **One matrix, one tag.** A ServUO pair carries the same tag at both schemas, so the first
+  `v2/servuo` bundle is `2026.09.15` — the tag schema 1 had already given that pair.
+- **Schema 1 is kept alive until 2027-01-01** (D147), composed exactly as before so every installer
+  in the field keeps updating. After that date it is **frozen, never deleted**: an old installer still
+  resolves its last bundle and every `bundle-<tag>.json` stays pinnable.
+- **The installer from phase 18 reads both.** ServUO resolves `v2/servuo/` first and is *lowered*
+  into the schema-1 model, so `install.json` and every ServUO code path are unchanged; a pin that
+  exists only at schema 1 falls back to the root. Rust resolves `v2/rust/`.
+- **v2 is read through Gitea's contents API**, not `/raw/`: the web raw route answers
+  `Cache-Control: public, max-age=21600`, so a bundle read through it can be hours behind the
+  branch. The contents API is `private, must-revalidate`. (Schema 1's fallback still uses `/raw/`,
+  as every shipped installer does.)
+
+What `--game rust` installs from a Rust bundle, and where, is `docs/rust-link/INSTALL.md`.
+
 ---
 
 ## 8. Open questions