docs(rust): console commands built — command.run (PROTOCOL §20.11, PLAN_REDESIGNS §16.10, D385)

- rust-link/PROTOCOL.md §20.11: command.run in its three shapes (once with a
  stored teardown, per online recipient with {steamid}/{name}, teardownOf),
  the at-most-once key file, the frame budget, command.ran / command.error
  and their reasons, how unknown-command is told (the game's log line, not
  Run's return), POST /commands/run, and the website side.
- modules/rust/PLAN_REDESIGNS.md: D385 (the bridge keeps a step's teardown
  with its key, asked during the build), §16.10 the build record (three
  spike findings, the rig run, twelve settled-in-code points), a D385 walk
  row in §16.9, pointers from the status paragraph, §9 and §10.
- website/EVENTS.md: an action can be text the module cannot read: what
  core already bounds, and the two things a module copying it needs (a
  failed step's revert has only the key; `multiple` drops duplicates).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/EVENTS.md

@@ -1164,6 +1164,21 @@ exactly the reason the rest of this document is careful about. It is deleted.
   outcome against a participant and answer "who received what, from which step, in which run". One
   optional field on a shape that already exists — not a registry.
 
+**An action can be text the module cannot read.** Module-Rust's *Run console commands* and *Reward by
+console command* (`rust.command.run`, `rust.command.reward`; Rust PLAN_REDESIGNS §16, D382–D385) run console
+commands an admin typed into a `multiple` string param. That is a free text box with no allowlist, and it
+needs nothing new from core. The module cannot know what a command does, so **it rates both `irreversible`**.
+Everything core already does for that class bounds them: they arrive off in the switchboard, only an admin
+authors them, the per-run caps apply, and a failure aborts the run. A required `confirm` param is the author's
+own "I am sure". The command step keeps **teardown commands on its ledger row**, and core's revert at the end of
+the run runs them. Two details any module copying this needs:
+
+- **A step that failed, or whose answer was lost, has no ledger row.** Core records nothing from a failure, so
+  `revert()` gets only the idempotency key. A teardown that must run then, after a first command started
+  something and a second was misspelled, has to be findable by that key. Rust keeps it on the game side with
+  the key (D385).
+- **`multiple` drops duplicates.** A command listed twice runs once.
+
 ### Param option sources
 
 A `source` names a module-served option endpoint, so an authoring field is a dropdown of *real*