docs(rust): stage 6 built — Guarded Crate (PROTOCOL §20.9, PLAN_REDESIGNS §14.3.19, D380)

- rust-link/PROTOCOL.md §20.9: hello's guardedCrate with npcSpawn and events,
  gc.started/ended/failed, gc.place and gc.error's reasons, guardedWon, map.live's
  guarded rows and how they are kept, POST /gc/place, and the website side.
  §17.3's world row gains guarded.
- modules/rust/PLAN_REDESIGNS.md: D380 (the kept crate's run-log note at
  placement), §14.3.19 the stage record, pointers from §9 and §14.3.5.
- modules/rust/OPERATING.md: Runic Gateway's own section on Guarded Crate and
  NpcSpawn (install, images, what it contacts at load), after the uMod mirror.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

modules/rust/OPERATING.md

@@ -5,6 +5,8 @@ configure and permission plugins. This is the surface our own deployment story h
 of, the way [`installer/INSTALL.md`](../../installer/INSTALL.md) sits on top of ServUO.
 
 > **Mirrored verbatim from uMod on 2026-09-15** — 6 pages. uMod is upstream and normative.
+> The last section, [Guarded Crate and NpcSpawn](#guarded-crate-and-npcspawn), is Runic Gateway's own and
+> is not part of the mirror.
 
 ---
 
@@ -16,6 +18,7 @@ of, the way [`installer/INSTALL.md`](../../installer/INSTALL.md) sits on top of
 - [Plugin configuration](#plugin-configuration-plugins-configuration) — Editing a plugin's config file
 - [Data Files](#data-files-plugins-data-files) — Where plugin data lives on disk
 - [Permissions](#permissions-plugins-permissions) — Granting permissions and managing groups in-game
+- [Guarded Crate and NpcSpawn](#guarded-crate-and-npcspawn) — Runic Gateway's note on an optional plugin that needs a Codefling extension
 
 ---
 
@@ -369,3 +372,41 @@ That's the basics to permissions for Oxide. Permissions give you a fantastic way
 ---
 
 <sub>Mirrored from uMod, 2026-09-15.</sub>
+
+---
+
+<a id="guarded-crate-and-npcspawn"></a>
+
+## Guarded Crate and NpcSpawn
+
+<sub>Runic Gateway's own section, not mirrored. Design: [PLAN_REDESIGNS.md](PLAN_REDESIGNS.md) §14.3.5 (D361,
+D364); wire: [PROTOCOL.md](../../rust-link/PROTOCOL.md) §20.9.</sub>
+
+Bazz3l's **Guarded Crate** (uMod) is one of the optional plugins Runic Gateway reports and drives: a guarded
+crate landing and being cleared reach the site's feed, map and *Warden* title, and an event can place one. It
+**needs NpcSpawn** for its guards, and NpcSpawn is not on uMod. Runic Gateway never ships or modifies either
+(D351, D361); an operator who wants guarded crates installs both.
+
+**Installing NpcSpawn.**
+
+1. Download NpcSpawn from Codefling (<https://codefling.com/extensions/npc-spawn>), a free download.
+2. Put `NpcSpawn.cs` in the plugins directory (`oxide/plugins`, or `carbon/plugins` on Carbon).
+3. Put the archive's `data/Images/` files in the data directory's `Images` folder (`oxide/data/Images`, or
+   `carbon/data/Images`). **Without them NpcSpawn unloads itself.**
+4. Leave `data/NpcSpawn/` for NpcSpawn to create. On Carbon, a folder made by a panel's file manager may not be
+   writable by the game, and NpcSpawn then fails until that folder is deleted and left to it.
+5. Install Guarded Crate from uMod as any other plugin.
+
+**What NpcSpawn does at load: it contacts its author's server.** It calls a version server at a bare IP
+address (seen as `37.153.157.216:5000` in the §14.2 test) and downloads clothing images. An operator whose
+server may not reach the internet, or who does not want it to, should know this before installing it.
+
+**Without NpcSpawn,** Guarded Crate unloads itself the next time its own schedule starts an event, and Runic
+Gateway's *Place a guarded crate* step is refused with *"Guarded Crate is loaded but NpcSpawn is missing: its
+events cannot start"*. The bridge refuses that placement itself, because Guarded Crate's `position` command does
+not check and would drop a crate with no guards. Admin → Rust servers shows NpcSpawn beside Guarded Crate.
+
+**Its events** are rows in Guarded Crate's **data** file, `data/GuardedCrate.json` (Easy, Medium, Hard and Elite
+as it ships), not its config. The site offers whatever names that file holds. A crate placed by an event is
+**kept when the event ends** (D373): Guarded Crate has no way to end one event, and `gcrate stop all` ends every
+one on the server.