docs(rust): stage 3 built — TruePVE in the zone step (PROTOCOL §20.6, PLAN_REDESIGNS §14.3.16)

- rust-link/PROTOCOL.md §20.6: hello's integrations.truePve, world.zone's
  truePve (exactly one of exclude and ruleset, all or nothing, the
  refusals), the unmapping on every erase path with truepve.json for
  while TruePVE is away, rg.world's two fields, and the website's two
  params. The §15 command table points at it.
- modules/rust/PLAN_REDESIGNS.md §14.3.16: the stage-3 record, ten points
  settled in code (all overrulable), TruePVE's one-second save, the tests
  and the rig compile. Pointers from §9's summary and §14.3.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

modules/rust/PLAN_REDESIGNS.md

@@ -930,7 +930,7 @@ pulls) is research, not a walk, so it still comes first:
    answered before code: **written on 2026-10-14 as §14.3**, from D361–D369, and answered as D370–D376. Then the
    build, in §14.3.11's nine stages (two of them core), §13 first. **Stage 1, §13, was built on 2026-10-15
    (§14.3.14)**, with D378 and D379. **Stage 2, core's `retryAfterMs` (MODULE_API 1.15.0), was built on
-   2026-10-15 (§14.3.15).**
+   2026-10-15 (§14.3.15).** **Stage 3, TruePVE in the zone step, was built on 2026-10-15 (§14.3.16).**
 
 **Then one walk, on Oxide and Carbon, of everything still owed (D331):** §2.7; §11's rows; §12.9; §13's and
 §14's rows; the in-game rows
@@ -2501,6 +2501,8 @@ helicopter from a run, then cancel the run and see both stay; a Guarded Crate cr
 
 #### 14.3.2 TruePVE in the zone step (D362, D368)
 
+> **Built on 2026-10-15** (§14.3.16), specified in PROTOCOL.md §20.6.
+
 **Hello.** `integrations.truePve`: `{ loaded, version }`.
 
 **The wire.** `world.zone` gains an optional **`truePve`**: `{ "exclude": true }` or `{ "ruleset": "pvp-arena" }`
@@ -2933,6 +2935,47 @@ machine's installed `modules/`; client 422/422 and the build.
 **No walk rows of its own.** Stage 5's Dangerous Treasures rows exercise it: a step answering *"not ready"*
 shows *"retrying at …"* and runs then.
 
+#### 14.3.16 Stage 3, built: TruePVE in the zone step (2026-10-15)
+
+Built in Rust-Plugins and Module-Rust as §14.3.2 planned it, specified in
+[PROTOCOL.md](../../rust-link/PROTOCOL.md) §20.6. **No Rust-Link change**: the sidecar forwards `world.zone`
+whole. `PROTOCOL_VERSION` stays 14. Builds: Rust 25902425, Oxide 2.0.7830, Carbon 2.0.262, TruePVE 2.4.6 on both
+rigs.
+
+**Settled in the code, and overrulable:**
+
+1. **A ruleset name is trimmed and 1–64 characters**, checked by the site and the plugin alike; past that it
+   is passed as written, because TruePVE compares names case-sensitively (`r.name == ruleset` in 2.4.6).
+2. **A server whose hello has not said whether it has TruePVE is left to the plugin** (a plugin before
+   protocol 14, or never reached), as a dome is, and the plugin answers `truepve-missing`. Only a hello that
+   says `loaded: false` is refused at verify.
+3. **`exclude` refused by TruePVE answers `refused`, not `truepve-ruleset`.** It happens only when TruePVE has
+   not read its config or data yet; the zone is erased all the same.
+4. **The mapping comes after the dome**, so a refusal erases both, as a failed dome erases its zone.
+5. **Re-creation maps nothing again.** TruePVE keeps the mapping in its own data file, keyed by the zone id,
+   which re-creation keeps.
+6. **Two erase paths beyond the plan's three are covered:** a zone `world.owned` finds ZoneManager no longer
+   holds, and a new wipe dropping the old map's entries. TruePVE's table outlives a wipe.
+7. **Leftovers are also flushed at the bridge's own load**, not only at `OnPluginLoaded(TruePVE)`, so a bridge
+   reloaded after TruePVE came back does not wait for TruePVE's next reload. `truepve.json` is deleted when empty.
+8. **Hello is sent again when TruePVE loads or unloads**, so the site's verify reads the current answer.
+9. **`truepve-missing` and `truepve-ruleset` are permanent failures**, as `no-zone` is.
+10. **Server settings' plugin line names TruePVE**: *"TruePVE 2.4.6 is loaded — a zone step may turn off PvP
+    protection or name a ruleset."*
+
+**One thing TruePVE does that we cannot change:** it saves its data file one second after a change, on its
+own timer. A restart inside that second loses the change. For a removal that leaves a mapping for an `rg-…` id
+no zone will have again, which changes nothing in game; D362's cleanup is otherwise complete.
+
+**Tests.** Module-Rust: five new in `test/zones.test.js` (exclude, `"true"` and a trimmed ruleset on the wire;
+unset, off and blank send nothing; both, a long name and no TruePVE refused for good at verify and perform; a
+hello that has not said is left to the plugin; `truepve-ruleset` and `truepve-missing` fail for good with the
+plugin's words). Full suites: server 603/603 and every check (imports, bundle, swagger, engagement); client
+84/84, the build and externals. The plugin compiled and loaded on both rigs, and `rg.world` read
+`truePve=True truePveLeftover=0` on each; both rigs were put back on the protocol-13 bridge after.
+
+**Walk rows** are §14.3.2's, at the end walk (D331, D359).
+
 ### 14.4 Questions for the org lead
 
 **Answered on 2026-10-14:** Q17 as proposed, out (D358). **Q18 against the proposal: the end walk waits for