docs(rust): phase 11 plan of record — a Rust notification on a phone (PLAN.md §26, M16)

Four org-lead decisions (D69-D72): the linked-account check asks the
site's own module and never gates switching off; a tickle is titled
from the inbox item its ref names; /player/rust and ?tab= open
natively; the relay hop is walked on ntfy.sh, closing M7's open QA item.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

android/PLAN.md

@@ -1528,6 +1528,28 @@ push, and Play (M6–M8) follow the designed app.
     once the fleet was widened to signed-in — the app's bearer session reaching the module's viewer
     check. Branch `fix/rust-presence-visibility`.
 
+17. **M16 — a Rust notification on a phone** (post-v1; planned 2026-09-23). `module-rust` phase
+    11, R10's leg C: the app half of phase 10's notifications. **Design of record:
+    [`../modules/rust/PLAN.md`](../modules/rust/PLAN.md) §26**, with its four decisions (D69–D72).
+
+    The inbox (engagement phase 8) and the preferences screen (engagement phase 3) are drawn from the
+    wire, so every Rust trigger already arrives as a row, with no app change. This milestone covers
+    the three places where the app still assumed it was talking to a UO shard:
+
+    - **The link check** behind the *Your game account* section asked `module-uo`'s
+      `/player/shard/accounts`. On a Rust site that locks the raid alert in every channel. It will
+      ask the site's own module, chosen by capability (`rust` → `/player/rust/links`). Switching a
+      channel **off** is never gated, and only switching push **on** needs a link.
+    - **A push is titled from the item it points at.** A `notification:<id>` ref is pulled over the
+      authenticated inbox API, and the relay still carries nothing. The per-stream title stays as the
+      fallback and as the lock-screen version. §11's "nothing is fetched to show a notification"
+      stops being true, and it gets rewritten when this lands.
+    - **`/player/rust` and `/rust/servers/<id>?tab=<tab>` open natively.** M15 deferred the first
+      of these to exactly this phase.
+
+    It also closes **M7's open QA item**. On-device delivery against a live ntfy has never been
+    walked. It is walked here, on `ntfy.sh` (D72).
+
 ### Deferred (not a milestone)
 
 - **Platform Teams in the app** — **deferred 2026-08-17, no app work scheduled.** The website is