From 75c8ffc07a76e7e4d8e9acac1fcf5882b66e1ec3 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Thu, 22 Oct 2026 15:23:07 -0500
Subject: [PATCH] feat(docs): phase 15 - the Rust group, its reference pages
 checked against their sources
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PLAN.md §16 phase 15. A Rust group of fifteen pages after Ultima Online
(D70): the module, installing the bridge (installer, Pterodactyl egg, by
hand), connecting the site, verifying the bridge, linking Steam accounts,
permissions and groups, mod config, who sees who is online, events, zones
and rewards, optional plugins, the live map, troubleshooting, and three
reference pages - rust-link's sidecar.toml, the plugin's
RunicGateway.json, and the event kinds.

checkReference.mjs gains three Rust sections rather than a new check:
sidecar.toml keys and RUSTLINK_* overrides from Rust-Link config.rs,
RunicGateway.json from the plugin's PluginConfig, and the event kinds
in three classes against Module-Rust server/catalogue.js (D71). Every
admin screen was walked on the walk site before it was described (D36).

Core pages now hand off to the Rust group instead of linking out to the
docs repository. Three defects the re-read found here are fixed: the UO
/health sample's hard-coded protocol 4 (both games' samples now render
platform.json through <Code>), Authentication's missing Steam tab, and
two pages saying the site cannot reach EventsEnabled - false on Rust.

Installer v0.8.1 moved checkFacts red mid-phase; platform.json follows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
---
 PLAN.md                                       |  77 ++++++++-
 scripts/checkReference.mjs                    | 126 +++++++++++++-
 src/config/sidebar.mjs                        |  38 +++++
 .../docs/administration/authentication.mdx    |  15 +-
 .../docs/docs/administration/events.mdx       |  13 +-
 .../docs/administration/troubleshooting.mdx   |   2 +-
 .../docs/architecture/events-architecture.mdx |  12 +-
 .../docs/docs/architecture/the-bridge.mdx     |   2 +-
 .../getting-started/connect-a-game-server.mdx |   2 +-
 .../getting-started/install-a-game-module.mdx |   2 +-
 .../docs/getting-started/requirements.mdx     |   3 +-
 .../verify-the-whole-stack.mdx                |   3 +-
 src/content/docs/docs/index.mdx               |   2 +-
 .../docs/docs/reference/installer-cli.mdx     |   4 +-
 .../docs/docs/rust/connect-the-site.mdx       | 108 ++++++++++++
 src/content/docs/docs/rust/event-kinds.mdx    | 106 ++++++++++++
 .../docs/rust/events-zones-and-rewards.mdx    | 104 +++++++++++
 src/content/docs/docs/rust/index.mdx          | 100 +++++++++++
 .../docs/docs/rust/install-the-bridge.mdx     | 161 ++++++++++++++++++
 .../docs/docs/rust/linking-steam-accounts.mdx |  79 +++++++++
 src/content/docs/docs/rust/mod-config.mdx     |  76 +++++++++
 .../docs/docs/rust/optional-plugins.mdx       |  93 ++++++++++
 .../docs/docs/rust/permissions-and-groups.mdx |  90 ++++++++++
 .../docs/docs/rust/runicgateway-json.mdx      |  70 ++++++++
 src/content/docs/docs/rust/sidecar-toml.mdx   |  83 +++++++++
 src/content/docs/docs/rust/the-live-map.mdx   |  65 +++++++
 .../docs/docs/rust/troubleshooting.mdx        |  60 +++++++
 .../docs/docs/rust/verify-the-bridge.mdx      | 101 +++++++++++
 .../docs/docs/rust/who-sees-who-is-online.mdx |  85 +++++++++
 .../docs/ultima-online/verify-the-bridge.mdx  |   7 +-
 src/data/platform.json                        |   2 +-
 src/data/reference.mjs                        | 137 +++++++++++++++
 32 files changed, 1796 insertions(+), 32 deletions(-)
 create mode 100644 src/content/docs/docs/rust/connect-the-site.mdx
 create mode 100644 src/content/docs/docs/rust/event-kinds.mdx
 create mode 100644 src/content/docs/docs/rust/events-zones-and-rewards.mdx
 create mode 100644 src/content/docs/docs/rust/index.mdx
 create mode 100644 src/content/docs/docs/rust/install-the-bridge.mdx
 create mode 100644 src/content/docs/docs/rust/linking-steam-accounts.mdx
 create mode 100644 src/content/docs/docs/rust/mod-config.mdx
 create mode 100644 src/content/docs/docs/rust/optional-plugins.mdx
 create mode 100644 src/content/docs/docs/rust/permissions-and-groups.mdx
 create mode 100644 src/content/docs/docs/rust/runicgateway-json.mdx
 create mode 100644 src/content/docs/docs/rust/sidecar-toml.mdx
 create mode 100644 src/content/docs/docs/rust/the-live-map.mdx
 create mode 100644 src/content/docs/docs/rust/troubleshooting.mdx
 create mode 100644 src/content/docs/docs/rust/verify-the-bridge.mdx
 create mode 100644 src/content/docs/docs/rust/who-sees-who-is-online.mdx

diff --git a/PLAN.md b/PLAN.md
index d051438..0662524 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -237,7 +237,7 @@ Taken by the org lead (Colby Whitlock) on 2026-08-19. Recorded so they are not r
 
 **Decisions after D13 are recorded where they were taken**, in the section describing the phase that
 raised them, rather than appended here — a decision is only re-litigated when its reasoning is
-somewhere other than the thing it decided. The count of record is **sixty-nine**:
+somewhere other than the thing it decided. The count of record is **seventy-one**:
 
 | # | Where | What it settled |
 |---|---|---|
@@ -258,6 +258,7 @@ somewhere other than the thing it decided. The count of record is **sixty-nine**
 | D66 | §16, "How phase 13 built it" | The hero and footer show the Module API only; a protocol and a bundle belong to a game |
 | D67 | §16, "One rule the phases need" | A screenshot belongs to its game: a capture tagged with a game may carry its words, beside the game's name |
 | D68–D69 | §16, "How phase 14 built it" | A game's real example on a core page is a tagged, labelled block; *Verify the whole stack* stays in Getting started, game-neutral (amending D60) |
+| D70–D71 | §16, "How phase 15 built it" | The Rust group is fifteen pages, one per admin screen where it can be; the Rust event kinds are checked against the module's own classification |
 
 ---
 
@@ -2094,6 +2095,80 @@ repositories):
 - **The installer's `--help` says "Which game's shard side"** for `--game`, and `--site-url` names
   "Admin → Shard (uo-link)" for both games.
 
+### How phase 15 built it
+
+Two decisions, taken by the org lead on 2026-10-22 before any page was written. The count of
+record is now **seventy-one**.
+
+**D70 — the Rust group is fifteen pages.** D60 named the topics and not the pages. The group
+follows the Ultima Online group's shape: an overview, then the journey (*Install the bridge*,
+*Connect the site*, *Verify the bridge*), then one page per admin screen where there is one
+(*Permissions and groups*, *Mod config from the site*, *Who sees who is online*, *Events, zones
+and rewards*), then *Linking Steam accounts*, *Optional plugins*, *The live map* and
+*Troubleshooting*, and three reference pages (*sidecar.toml*, *RunicGateway.json*, *Event
+kinds*). *Who sees who is online* and *Optional plugins* got pages of their own rather than
+being folded into the overview and the events page, because each has a screen or a trap of its
+own — RaidableBases must be restarted, never reloaded. The alternative was ten longer pages. The
+question put to the org lead called this option "14 pages" while listing fifteen; the list is
+what was chosen. RunicNPC's subgroup is phase 16's.
+
+**D71 — the Rust event kinds are checked against the module's classification.** The plan said the
+protocol-14 event list would be checked "against its sources". There were two candidates:
+`PROTOCOL.md`, whose kinds are spread across tables from §8.4 to §20.12, and `Module-Rust`
+`server/catalogue.js`, which holds three lists in code — public, staff, and the presence subset
+of public. The second was chosen, for D39's reason: the visibility ladder is checked against the
+module that enforces it, and so is this. The module's own test already holds its lists to
+`PROTOCOL.md`, so the chain reaches the spec without this repo parsing prose tables. The page
+shows three classes, and each is compared separately, so a kind moving from staff to public
+upstream fails here twice.
+
+**`checkReference.mjs` gained three Rust sections**, as the plan said, rather than a new check:
+rust-link's `sidecar.toml` (parsed from its serde structs by the same function as uo-link's, now
+shared) and the six `RUSTLINK_…` variables that override it; the bridge plugin's
+`RunicGateway.json`, read from the public fields of `PluginConfig` in `RunicGateway.cs`; and the
+event kinds (D71). The canonical documents gained `OPERATING.md` and `CARBON.md` under Rust.
+
+**Every admin screen was walked on the walk site first** (D36), signed in as the walk admin:
+Rust servers (Test, Edit, Chat titles, Optional mods), Rust permissions (a player, a group's four
+tabs), Rust mod config (the tree and `RunicGateway.json`'s read-only keys), Rust visibility, Rust
+zone presets, the event editor's action list, a user's Rust section, and the public server page's
+feed, map and leaderboard. Nothing was saved. The NPC screens are phase 16's. Writing from the
+walk and the source corrected three of my own drafts before they shipped: a reward does **not**
+need a linked account (rewards go to Steam ids), the bundle ships **three** helpers, not two, and
+the Test button prints the raw status (`protocol-mismatch`), not a phrase.
+
+**What the re-read found in this repository**, fixed here:
+
+- ***Verify the bridge* (Ultima Online) showed `"protocol":4`** in its `/health` sample, a
+  hard-coded version four protocols stale. Both games' samples now render the protocol from
+  `platform.json` through Starlight's `<Code>`, which is how a version gets into a code block
+  without being typed.
+- ***Authentication* said "four tabs"** and never mentioned Steam, which core shipped with Module
+  API 1.17.0. It now has five, and a *Steam* section the Rust pages link to.
+- ***Scheduled events* and *Events architecture* said the site cannot reach `EventsEnabled`.**
+  True for Ultima Online, false for Rust: an administrator can edit `RunicGateway.json`, that switch
+  included, from Admin → Rust mod config. Both pages now say so, the first as two tagged examples
+  (D68).
+
+**`checkFacts` went red mid-phase, as designed.** Installer v0.8.1 shipped on 2026-10-22 — the
+game-neutral `--help` that phase 14 reported, fixed in `installer` #43 alongside `website` #221 for
+the Teams panel — so `platform.json` moved to it. Its only change is that help text, which no page
+quotes.
+
+**Findings in other repositories**, reported rather than fixed:
+
+- **`Module-Rust` admin copy shows decision numbers.** A group's *Servers* tab reads "unless it is
+  shared (D189)", and the *not imported yet* chip's tooltip ends "(D198)". Neither means anything
+  to an operator.
+- **`Module-Rust`'s servers page reads "Last pushed: 1 player hold one."** — the plural verb is
+  used for one.
+- **`Rust-Plugins`' `PluginConfig.EventsEnabled` comment says it "gates taking a lease only"**.
+  That stopped being true at protocol 9, when it began gating every world write.
+- **`docs` `rust-link/INTEGRATION.md` predates the installer**: it says there is no installer
+  support for Rust and shows protocol-1 samples. **`rust-link/INSTALL.md`'s by-hand step names two
+  helpers**; the bundle ships three. The org lead approved a separate `docs` PR for these:
+  `docs` #370.
+
 ---
 
 [api]: https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/MODULE_API.md
diff --git a/scripts/checkReference.mjs b/scripts/checkReference.mjs
index a248646..6e961e9 100644
--- a/scripts/checkReference.mjs
+++ b/scripts/checkReference.mjs
@@ -7,6 +7,10 @@
  * this is the machinery that makes writing the NAMES down safe anyway — the same bargain
  * checkQuickstart.mjs struck for the quickstart, applied to six more sources.
  *
+ * Phase 15 (PLAN.md §16) added the Rust group's three: rust-link's `sidecar.toml` and its
+ * environment overrides, the bridge plugin's `RunicGateway.json`, and the event kinds with the
+ * class each is served under (D71).
+ *
  * Each enumeration in `src/data/reference.mjs` is compared against its authority, read from
  * the repository that owns it over the Gitea API — never from a working tree, per §1's
  * process rule. Every comparison is a SET comparison in both directions:
@@ -39,6 +43,10 @@ import {
   bridgeCfg,
   visibilityLadder,
   canonicalDocs,
+  rustSidecarConfig,
+  rustSidecarEnv,
+  rustPluginConfig,
+  rustEventKinds,
 } from '../src/data/reference.mjs';
 
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
@@ -103,6 +111,45 @@ const cfgKeysOf = (text) =>
     .filter(Boolean)
     .map((m) => m[1]);
 
+/**
+ * A sidecar's TOML keys, parsed from its serde structs rather than from a sample file,
+ * because the sample is GENERATED by the binary on first run and no committed copy is
+ * authoritative. Each `pub name: T` inside a `struct XCfg` is one key, and the struct name
+ * gives the section. Both sidecars are written this way, so one parser serves both.
+ */
+function tomlKeysOf(configRs) {
+  const keys = [];
+  for (const m of configRs.matchAll(/struct\s+(\w+)Cfg\s*\{([\s\S]*?)\n\}/g)) {
+    const section = m[1].toLowerCase();
+    for (const f of m[2].matchAll(/pub\s+(\w+)\s*:/g)) keys.push(`${section}.${f[1]}`);
+  }
+  return keys;
+}
+
+/** The body of a C# class, by brace counting from its opening brace. */
+function classBody(source, name) {
+  const start = source.search(new RegExp(`class\\s+${name}\\b`));
+  if (start < 0) return null;
+  const open = source.indexOf('{', start);
+  let depth = 0;
+  for (let i = open; i < source.length; i++) {
+    if (source[i] === '{') depth++;
+    else if (source[i] === '}' && --depth === 0) return source.slice(open + 1, i);
+  }
+  return null;
+}
+
+/**
+ * The quoted strings inside `const NAME = Object.freeze([ … ])`, comments removed first —
+ * the module's comments are prose, and prose has apostrophes.
+ */
+function frozenListOf(source, name) {
+  const m = source.match(new RegExp(`const\\s+${name}\\s*=\\s*Object\\.freeze\\(\\[([\\s\\S]*?)\\]\\)`));
+  if (!m) return null;
+  const code = m[1].replace(/\/\/.*$/gm, '');
+  return [...code.matchAll(/'([^'\n]+)'/g)].map((x) => x[1]);
+}
+
 async function run() {
   if (!TOKEN) {
     console.error('checkReference: GITEA_TOKEN is not set. This check cannot run anonymously.');
@@ -122,13 +169,12 @@ async function run() {
   // Parsed from the serde structs rather than from a sample file, because the sample is
   // GENERATED by the binary on first run and no committed copy is authoritative. Each
   // `pub name: T` inside a `struct XCfg` is one key, and the struct name gives the section.
-  const configRs = await raw('link', 'sidecar/src/config.rs');
-  const sidecarKeys = [];
-  for (const m of configRs.matchAll(/struct\s+(\w+)Cfg\s*\{([\s\S]*?)\n\}/g)) {
-    const section = m[1].toLowerCase();
-    for (const f of m[2].matchAll(/pub\s+(\w+)\s*:/g)) sidecarKeys.push(`${section}.${f[1]}`);
-  }
-  compareSets('sidecar.toml', Object.keys(sidecarConfig), sidecarKeys, 'link main:sidecar/src/config.rs');
+  compareSets(
+    'sidecar.toml',
+    Object.keys(sidecarConfig),
+    tomlKeysOf(await raw('link', 'sidecar/src/config.rs')),
+    'link main:sidecar/src/config.rs',
+  );
 
   // ── 3. Installer commands ─────────────────────────────────────────────────
   const cliRs = await raw('installer', 'src/cli.rs');
@@ -175,6 +221,72 @@ async function run() {
     else fail(`canonical doc ${docPath}`, `not found in docs main (HTTP ${res.status})`);
   }
 
+  // ── 7. Rust: rust-link's sidecar.toml, and the variables that override it ──
+  //
+  // PLAN.md §16, phase 15. The same parser as uo-link's — both sidecars declare their file
+  // as serde structs — plus the environment overrides, which a Pterodactyl egg sets and an
+  // operator meets on the panel before they ever see the file.
+  const rustConfigRs = await raw('Rust-Link', 'sidecar/src/config.rs');
+  compareSets(
+    'rust-link sidecar.toml',
+    Object.keys(rustSidecarConfig),
+    tomlKeysOf(rustConfigRs),
+    'Rust-Link main:sidecar/src/config.rs',
+  );
+  compareSets(
+    'rust-link environment variable',
+    Object.keys(rustSidecarEnv),
+    [...rustConfigRs.matchAll(/get\("(RUSTLINK_[A-Z_]+)"\)/g)].map((m) => m[1]),
+    'Rust-Link main:sidecar/src/config.rs',
+  );
+  for (const [envName, key] of Object.entries(rustSidecarEnv)) {
+    if (!(key in rustSidecarConfig)) fail(`rust-link environment variable ${envName}`, `says it overrides "${key}", which is not a key listed here`);
+  }
+
+  // ── 8. Rust: the bridge plugin's RunicGateway.json ────────────────────────
+  //
+  // The public fields of `PluginConfig`, which the framework serialises as the file.
+  const pluginCs = await raw('Rust-Plugins', 'overlay/oxide/plugins/RunicGateway.cs');
+  const pluginBody = classBody(pluginCs, 'PluginConfig');
+  if (!pluginBody) {
+    fail('RunicGateway.json', 'could not find class PluginConfig in Rust-Plugins main:overlay/oxide/plugins/RunicGateway.cs');
+  } else {
+    compareSets(
+      'RunicGateway.json',
+      Object.values(rustPluginConfig).flatMap((group) => Object.keys(group)),
+      [...pluginBody.matchAll(/public\s+[\w<>[\],]+\s+(\w+)\s*=/g)].map((m) => m[1]),
+      'Rust-Plugins main:overlay/oxide/plugins/RunicGateway.cs PluginConfig',
+    );
+  }
+
+  // ── 9. Rust: the event kinds, and who may see each ────────────────────────
+  //
+  // D71: checked against the module's own catalogue, because the module is what enforces
+  // the boundary (the same reasoning as check 5). Three comparisons, each a security
+  // statement: a kind listed public here must be public there, a presence kind must be one
+  // of the module's presence kinds, and a staff kind must be staff there. A kind moved from
+  // staff to public upstream fails this check twice over, which is the point.
+  const catalogue = await raw('Module-Rust', 'server/catalogue.js');
+  const upPublic = frozenListOf(catalogue, 'PUBLIC_KINDS');
+  const upStaff = frozenListOf(catalogue, 'STAFF_KINDS');
+  const upPresence = frozenListOf(catalogue, 'PRESENCE_KINDS');
+  if (!upPublic || !upStaff || !upPresence) {
+    fail('Rust event kinds', 'could not find PUBLIC_KINDS, STAFF_KINDS and PRESENCE_KINDS in Module-Rust main:server/catalogue.js');
+  } else {
+    const hint = 'Module-Rust main:server/catalogue.js';
+    compareSets('Rust presence kind', Object.keys(rustEventKinds.presence), upPresence, `${hint} PRESENCE_KINDS`);
+    compareSets(
+      'Rust public kind',
+      Object.keys(rustEventKinds.public),
+      upPublic.filter((k) => !upPresence.includes(k)),
+      `${hint} PUBLIC_KINDS (less its presence kinds)`,
+    );
+    compareSets('Rust staff kind', Object.keys(rustEventKinds.staff), upStaff, `${hint} STAFF_KINDS`);
+    for (const k of upPresence) {
+      if (!upPublic.includes(k)) fail(`Rust presence kind ${k}`, 'is a presence kind upstream but not a public one — the page explains presence as a narrowing of public, so re-read it');
+    }
+  }
+
   // ── Report ────────────────────────────────────────────────────────────────
   if (failures.length === 0) {
     console.log(`checkReference: ${checked.length} enumeration check(s) passed against their sources.`);
diff --git a/src/config/sidebar.mjs b/src/config/sidebar.mjs
index 0fe21c5..1eeaca6 100644
--- a/src/config/sidebar.mjs
+++ b/src/config/sidebar.mjs
@@ -98,6 +98,26 @@ export const docsSidebar = [
       { label: 'Shard event catalog', slug: 'docs/ultima-online/event-catalog' },
     ],
   },
+  {
+    label: 'Rust',
+    items: [
+      { label: 'The Rust module', slug: 'docs/rust' },
+      { label: 'Install the bridge', slug: 'docs/rust/install-the-bridge' },
+      { label: 'Connect the site', slug: 'docs/rust/connect-the-site' },
+      { label: 'Verify the bridge', slug: 'docs/rust/verify-the-bridge' },
+      { label: 'Linking Steam accounts', slug: 'docs/rust/linking-steam-accounts' },
+      { label: 'Permissions and groups', slug: 'docs/rust/permissions-and-groups' },
+      { label: 'Mod config from the site', slug: 'docs/rust/mod-config' },
+      { label: 'Who sees who is online', slug: 'docs/rust/who-sees-who-is-online' },
+      { label: 'Events, zones and rewards', slug: 'docs/rust/events-zones-and-rewards' },
+      { label: 'Optional plugins', slug: 'docs/rust/optional-plugins' },
+      { label: 'The live map', slug: 'docs/rust/the-live-map' },
+      { label: 'Troubleshooting', slug: 'docs/rust/troubleshooting' },
+      { label: 'sidecar.toml', slug: 'docs/rust/sidecar-toml' },
+      { label: 'RunicGateway.json', slug: 'docs/rust/runicgateway-json' },
+      { label: 'Event kinds', slug: 'docs/rust/event-kinds' },
+    ],
+  },
 ];
 
 /**
@@ -174,4 +194,22 @@ export const plannedSidebar = {
     'sidecar.toml',
     'Shard event catalog',
   ],
+  // PLAN.md §16, D70 (phase 15). RunicNPC's subgroup lands in phase 16 (D61).
+  Rust: [
+    'The Rust module',
+    'Install the bridge',
+    'Connect the site',
+    'Verify the bridge',
+    'Linking Steam accounts',
+    'Permissions and groups',
+    'Mod config from the site',
+    'Who sees who is online',
+    'Events, zones and rewards',
+    'Optional plugins',
+    'The live map',
+    'Troubleshooting',
+    'sidecar.toml',
+    'RunicGateway.json',
+    'Event kinds',
+  ],
 };
diff --git a/src/content/docs/docs/administration/authentication.mdx b/src/content/docs/docs/administration/authentication.mdx
index 1df190d..3be12c2 100644
--- a/src/content/docs/docs/administration/authentication.mdx
+++ b/src/content/docs/docs/administration/authentication.mdx
@@ -5,7 +5,7 @@ description: Local accounts and two-factor, SSO providers and the link-only poli
 
 import { Aside } from '@astrojs/starlight/components';
 
-**Admin → Authentication** has four tabs: Local Accounts, Google, Discord and Custom
+**Admin → Authentication** has five tabs: Local Accounts, Google, Discord, Steam and Custom
 Providers. One session model sits behind all of them — a web cookie, a mobile bearer token
 and an SSO sign-in all produce the same session.
 
@@ -35,6 +35,19 @@ account is still a stranger.
 Configuring Google here also unlocks **email delivery**, which reuses the same OAuth client
 — see [Notifications and email](/docs/administration/notifications-and-email/).
 
+### Steam
+
+Steam signs people in with OpenID rather than OAuth, so it needs no client ID or secret — but
+it does need a **Steam Web API key**, for the name and avatar Steam's sign-in does not carry,
+and saving Steam as enabled without one is refused. It follows the same link-only policy, more
+strictly: **Steam never creates an account**, whatever registration allows. A person may link
+several Steam accounts, and each is listed on their account screen with its name, avatar and
+Steam ID.
+
+A game module can also be told which Steam accounts a signed-in person has proved are theirs,
+which is how a game that knows its players by Steam account can recognise a member. The Rust
+module uses it — see [Linking Steam accounts](/docs/rust/linking-steam-accounts/).
+
 ## Trusted devices
 
 A second factor that asks on every sign-in on the same laptop trains people to click
diff --git a/src/content/docs/docs/administration/events.mdx b/src/content/docs/docs/administration/events.mdx
index 89ecb36..7cc5327 100644
--- a/src/content/docs/docs/administration/events.mdx
+++ b/src/content/docs/docs/administration/events.mdx
@@ -141,8 +141,8 @@ restart puts every borrowed value back too.
 
 ## The game server has its own switches
 
-They live in the bridge plugin's config on the game server's host, outside the site's reach,
-and the site cannot turn them on.
+They live in the bridge plugin's config on the game server's host, not in the site's
+database, and no event can turn them on.
 
 **`EventsEnabled` is off by default**, in both games. Turning it on is consenting to the site
 changing and watching your world unattended.
@@ -151,7 +151,14 @@ changing and watching your world unattended.
 `EventsEnabled` is a different switch from `AdminWriteEnabled`. Turning the admin plane on is
 consenting to staff moderation driven from a screen somebody is looking at; turning events on
 is consenting to unattended changes. One switch could not honestly express both. Every key
-is in [`Bridge.cfg`](/docs/ultima-online/bridge-cfg/).
+is in [`Bridge.cfg`](/docs/ultima-online/bridge-cfg/), which only the shard host can edit.
+</GameExample>
+
+<GameExample game="rust">
+`EventsEnabled` is in each server's [`RunicGateway.json`](/docs/rust/runicgateway-json/). An
+administrator can edit it on the host, or from the site's
+[Mod config](/docs/rust/mod-config/) screen, which reaches the game host's config files
+through the bridge.
 </GameExample>
 
 Beside it sit the game's own ceilings — how much one call may place, how long something it
diff --git a/src/content/docs/docs/administration/troubleshooting.mdx b/src/content/docs/docs/administration/troubleshooting.mdx
index e2414b0..34a20a4 100644
--- a/src/content/docs/docs/administration/troubleshooting.mdx
+++ b/src/content/docs/docs/administration/troubleshooting.mdx
@@ -82,7 +82,7 @@ Two responses from a sidecar mean the same thing for every game: **`409`** is a
 mismatch (the sidecar refuses rather than mis-parsing), and **`401`** is the auth token.
 
 Each game's group in the sidebar has its own troubleshooting page with the exact commands:
-[Ultima Online](/docs/ultima-online/troubleshooting/) today.
+[Ultima Online](/docs/ultima-online/troubleshooting/) and [Rust](/docs/rust/troubleshooting/).
 
 ## Teams are missing
 
diff --git a/src/content/docs/docs/architecture/events-architecture.mdx b/src/content/docs/docs/architecture/events-architecture.mdx
index 2c32f05..d9eaf75 100644
--- a/src/content/docs/docs/architecture/events-architecture.mdx
+++ b/src/content/docs/docs/architecture/events-architecture.mdx
@@ -114,11 +114,13 @@ something must not take that path.
    are re-validated against the database on every request, so a demotion takes effect on the
    next click.
 
-The game's switches are the layer the site cannot reach: they live in the bridge plugin's
-own config on the game server's host — `EventsEnabled`, in both games — and are off out of
-the box, and the
-game's own ceilings **refuse rather than clamp** — because a silently shortened request leaves
-the two halves disagreeing about what happened.
+The game's switches are the layer outside the site's own database: they live in the bridge
+plugin's own config on the game server's host — `EventsEnabled`, in both games — and are off
+out of the box. No event and no role check can turn one on. On Rust an administrator can
+still edit that file from the game module's config screen, which reaches the host's config
+files through the bridge, so there it is a separate deliberate act rather than an unreachable
+one. The game's own ceilings **refuse rather than clamp** — because a silently shortened
+request leaves the two halves disagreeing about what happened.
 
 <Aside type="note" title="Stated plainly">
 The module boundary is **not** a security boundary — a module runs in the same process with
diff --git a/src/content/docs/docs/architecture/the-bridge.mdx b/src/content/docs/docs/architecture/the-bridge.mdx
index eae066f..3458813 100644
--- a/src/content/docs/docs/architecture/the-bridge.mdx
+++ b/src/content/docs/docs/architecture/the-bridge.mdx
@@ -105,7 +105,7 @@ website about. Every catalog has the same structure, though: kinds the module de
 each one either safe for the public stream or kept to the admin one.
 
 - **Ultima Online:** [its event catalog](/docs/ultima-online/event-catalog/), in the Ultima Online group
-- **Rust:** [the Rust bridge protocol](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md) in the `docs` repository
+- **Rust:** [its event kinds](/docs/rust/event-kinds/), in the Rust group
 
 ## Two design details worth stealing
 
diff --git a/src/content/docs/docs/getting-started/connect-a-game-server.mdx b/src/content/docs/docs/getting-started/connect-a-game-server.mdx
index 690a870..83c7220 100644
--- a/src/content/docs/docs/getting-started/connect-a-game-server.mdx
+++ b/src/content/docs/docs/getting-started/connect-a-game-server.mdx
@@ -34,7 +34,7 @@ protocol-checked pair of sidecar and bridge plugin — never "the latest of each
 | Game | Its steps |
 |---|---|
 | **{platform.games.uo.name}** | [Connecting the server](/docs/ultima-online/connect-a-servuo-shard/), then [verifying its bridge](/docs/ultima-online/verify-the-bridge/), in the Ultima Online group |
-| **{platform.games.rust.name}** | [The Rust bridge install guide](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md) in the `docs` repository: the installer, a Pterodactyl egg, or by hand |
+| **{platform.games.rust.name}** | [Installing the bridge](/docs/rust/install-the-bridge/) — the installer, a Pterodactyl egg, or by hand — then [connecting the site](/docs/rust/connect-the-site/), in the Rust group |
 
 ## If the website is on a different machine
 
diff --git a/src/content/docs/docs/getting-started/install-a-game-module.mdx b/src/content/docs/docs/getting-started/install-a-game-module.mdx
index 1184367..9592f80 100644
--- a/src/content/docs/docs/getting-started/install-a-game-module.mdx
+++ b/src/content/docs/docs/getting-started/install-a-game-module.mdx
@@ -18,7 +18,7 @@ There are two, both built inside this project, and a site runs **one** of them:
 | **{platform.games.rust.name}** | [releases](https://gitea.whitlocktech.com/RunicGateway/Module-Rust/releases) | {platform.releases['Module-Rust']} |
 
 What each one adds is in its own group in the sidebar:
-[Ultima Online](/docs/ultima-online/) today.
+[Ultima Online](/docs/ultima-online/) and [Rust](/docs/rust/).
 
 ## Install it
 
diff --git a/src/content/docs/docs/getting-started/requirements.mdx b/src/content/docs/docs/getting-started/requirements.mdx
index 172d84c..d26b8f1 100644
--- a/src/content/docs/docs/getting-started/requirements.mdx
+++ b/src/content/docs/docs/getting-started/requirements.mdx
@@ -40,8 +40,7 @@ game:
 | **The sidecar on the same host as the game server** | The bridge plugin dials the sidecar over loopback. That loopback socket *is* the trust boundary for inbound commands to the game, so the two are never split across machines. |
 
 Then the game's own list: [Ultima Online](/docs/ultima-online/connect-a-servuo-shard/#what-the-shard-host-needs),
-or the *Before you begin* section of
-[the Rust bridge install guide](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md#before-you-begin).
+or [Rust](/docs/rust/install-the-bridge/#before-you-begin).
 
 ## What you do not need
 
diff --git a/src/content/docs/docs/getting-started/verify-the-whole-stack.mdx b/src/content/docs/docs/getting-started/verify-the-whole-stack.mdx
index fa9038c..6d4c470 100644
--- a/src/content/docs/docs/getting-started/verify-the-whole-stack.mdx
+++ b/src/content/docs/docs/getting-started/verify-the-whole-stack.mdx
@@ -23,8 +23,7 @@ The order is the same for every game. The commands and the screen names are not,
 game has its own page with the exact steps:
 
 - **Ultima Online:** [Verify the bridge](/docs/ultima-online/verify-the-bridge/)
-- **Rust:** the *Connect the website* and *Day two* sections of
-  [the Rust bridge install guide](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md)
+- **Rust:** [Verify the bridge](/docs/rust/verify-the-bridge/)
 
 ## Two responses that mean the same for every game
 
diff --git a/src/content/docs/docs/index.mdx b/src/content/docs/docs/index.mdx
index e2f54cc..d4f4fcb 100644
--- a/src/content/docs/docs/index.mdx
+++ b/src/content/docs/docs/index.mdx
@@ -77,7 +77,7 @@ authentication, Teams, scheduled events, moderation, notifications, modules, upg
 what to do when something is wrong.
 
 Everything that belongs to one game has its own group at the end of the sidebar, after
-**Reference**: [Ultima Online](/docs/ultima-online/) today.
+**Reference**: [Ultima Online](/docs/ultima-online/) and [Rust](/docs/rust/).
 
 ## Where the truth lives
 
diff --git a/src/content/docs/docs/reference/installer-cli.mdx b/src/content/docs/docs/reference/installer-cli.mdx
index 600a679..3152373 100644
--- a/src/content/docs/docs/reference/installer-cli.mdx
+++ b/src/content/docs/docs/reference/installer-cli.mdx
@@ -45,7 +45,9 @@ runicgateway-installer install --game rust --rust /srv/rust --server-id main
 ```
 
 One sidecar serves one Rust server, so `--server-id` is required on install. The Rust flags
-are refused on a run that is not `--game rust`, rather than silently ignored.
+are refused on a run that is not `--game rust`, rather than silently ignored. The whole Rust
+install, including a Pterodactyl egg for hosts the installer cannot run on, is in
+[its group](/docs/rust/install-the-bridge/).
 </GameExample>
 
 ## Rehearsing a run
diff --git a/src/content/docs/docs/rust/connect-the-site.mdx b/src/content/docs/docs/rust/connect-the-site.mdx
new file mode 100644
index 0000000..71fe507
--- /dev/null
+++ b/src/content/docs/docs/rust/connect-the-site.mdx
@@ -0,0 +1,108 @@
+---
+title: Connect the site
+description: Adding a Rust server to the site on Admin → Rust servers, what the Test button's answers mean, and the rest of a server's settings — its wipe schedule, world-event credit and chat titles.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+Every Rust server the site follows is one row on **Admin → Rust servers**
+(`/admin/rust/servers`). A row tells the site where that server's sidecar is; the sidecar
+itself lives on the game host, put there by [Install the bridge](/docs/rust/install-the-bridge/).
+
+## Add a server
+
+Press **Add a server** and fill in four values:
+
+| Field | Value |
+|---|---|
+| **Id** | The server id — the installer's `--server-id`, or the egg's variable. It must equal `ServerId` in the plugin's config |
+| **Name** | Anything. Players see it |
+| **Sidecar address** | The sidecar URL the installer or the console printed, such as `http://10.0.0.5:8090` |
+| **Sidecar token** | The token, from the sidecar's own config |
+
+**The id is permanent.** It is in every link to the server and the site will not change it
+later. It is deliberately not the hostname: you will rename a server for a season, and its
+history must not go with the name. Changing the plugin's `ServerId` after the site has seen it
+strands everything recorded under the old one.
+
+**The token is write-only.** It is stored encrypted and never shown again once saved; the row
+says only *token stored*. Saving the form with the field blank keeps the stored token, so
+renaming a server does not mean re-pasting a credential.
+
+## Test it
+
+**Test the sidecar** asks the sidecar for its health and reports what came back. A working
+server answers *The sidecar answered (protocol N)*, and its row reads online, with its
+player count, the protocol and *last seen just now*. *The sidecar answered, but the game's
+plugin is not connected to it* means the site's half works and the game's does not — go to
+[Verify the bridge](/docs/rust/verify-the-bridge/).
+
+A wrong address, a wrong token and a mismatched protocol all look the same from the public
+site — *the server is offline* — so the Test button is what tells them apart. A failure reads
+*The sidecar did not answer:* followed by one of these:
+
+| Status | What is wrong | Where to look |
+|---|---|---|
+| `no-token` | The form was saved without one | This screen |
+| `unauthorized` | The token does not match | The sidecar's config on the game host |
+| `protocol-mismatch` | The sidecar and the module speak different protocols | Update whichever is behind |
+| `timeout` | The sidecar answered too slowly, or not at all | The sidecar's own log |
+| `transport-error` | Nothing is listening at that address | The address, the firewall, whether the sidecar runs |
+| `http-<code>` | Something answered, and it was not a sidecar | Usually a reverse proxy in front of the wrong thing |
+
+Within a poll interval the server appears at `/rust`.
+
+## If the site is on another machine
+
+The installer's sidecar listens on `127.0.0.1`, reachable only from the game host. Put a TLS
+reverse proxy or a VPN link in front of it and give the site that URL — the token is a plain
+bearer token, and the sidecar speaks HTTP. The egg's sidecar listens on its allocation, which
+the network can reach, so firewall it to your site's address.
+
+<Aside type="caution" title="Leave the game bind on loopback">
+The sidecar's other socket, the one the bridge plugin dials, takes commands for the game
+server and has no token. Being loopback-only is what makes that safe. Only the web bind ever
+moves.
+</Aside>
+
+## The rest of a server's settings
+
+**Edit** on a row opens the same form, plus:
+
+- **Enabled** and **Order** — whether the site follows the server, and where it sits in the
+  list.
+- **Wipe schedule.** *No schedule*, *Forced wipe only* (Facepunch's monthly forced wipe, the
+  first Thursday of the month at 19:00 UK time), *Weekly* or *Every other week*, on a day,
+  time and time zone you choose. A **one-off wipe** covers a delayed or extra one. It is a
+  forecast: the next wipe shows on the server's public page. The wipe itself is whatever the
+  game reports, which is what splits the leaderboard and the history.
+- **Who downs a helicopter or a Bradley.** *Killing blow* (the default), *Last hit*, *Most
+  damage*, or *Everyone who hurt it*. It decides whose name the feed shows and who it counts
+  for, from the moment you save.
+
+**Optional mods** on a row lists what the bridge found on that server — BetterChat,
+PopupNotifications, Economics, Backpacks, TruePVE, Dynamic PVP, Dangerous Treasures, Guarded
+Crate, ZLevels, RaidableBases — with each one's version and what it lets the site do there.
+[Optional plugins](/docs/rust/optional-plugins/) explains each.
+
+### Chat titles
+
+**Chat titles** on a row gives titles to the top players of the current wipe, one rule per
+stat: *the top 1 by guarded crates cleared earns "Warden"*. Up to ten rules a server; a stat
+of zero earns nothing, so a fresh wipe has no titles until somebody plays. Titles show beside
+the name on the leaderboard, and in game chat where BetterChat is installed.
+
+Below the servers, **Category titles** sets each stat's default title once for every server,
+and **Announcement voice** lets news posts and event announcements said in game chat wear the
+title and colours of one permission group that has a chat style. That style is set on the
+group, in [Permissions and groups](/docs/rust/permissions-and-groups/#chat-styles).
+
+Next: [Verify the bridge](/docs/rust/verify-the-bridge/).
+
+## Canonical documents
+
+[`rust-link/INSTALL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md#connect-the-website)
+and [`rust-link/INTEGRATION.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INTEGRATION.md)
+§3 hold the connection and the Test button's answers;
+[`modules/rust/PLAN.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/PLAN.md)
+is the module's design of record.
diff --git a/src/content/docs/docs/rust/event-kinds.mdx b/src/content/docs/docs/rust/event-kinds.mdx
new file mode 100644
index 0000000..2033908
--- /dev/null
+++ b/src/content/docs/docs/rust/event-kinds.mdx
@@ -0,0 +1,106 @@
+---
+title: Event kinds
+description: Every kind of event a Rust server can tell the site, in three classes — public, presence and staff — and why the module, not the game, decides which is which.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+import platform from '../../../../data/platform.json';
+import { rustEventKinds } from '../../../../data/reference.mjs';
+
+What a Rust server tells the site, unprompted, as things happen in the world — every kind the
+bridge sends through protocol {platform.games.rust.protocol}, and who may see each.
+
+**Not to be confused with a scheduled event.** That is a thing you put on the calendar and run —
+see [Events, zones and rewards](/docs/rust/events-zones-and-rewards/). The two meet: what happens
+here is what a phase can wait for.
+
+The exact wire shapes are in the protocol specification and are **not** restated here. This page
+is the map and the security model.
+
+## The module decides, not the game
+
+The wire carries no visibility field. **A boundary is enforced by the side that serves, never
+declared by the side that sends**: a field the game stamped on each frame would be a boundary that
+a compromised — or merely out-of-date — game host could widen. So the Rust module holds the lists
+below, and they are **default-deny**: a kind it has never heard of, from a newer bridge, is not
+public until somebody classifies it.
+
+These three lists are checked against the module's own on every build. A kind moved between
+classes upstream turns this page red.
+
+## Public
+
+Anybody may see these. Some are filtered field by field for each viewer — a world event's player
+name only for the presence audience, a Steam id and a position only for staff — but the kind
+itself is public.
+
+<table>
+  <thead><tr><th>Kind</th><th>What it says</th></tr></thead>
+  <tbody>
+    {Object.entries(rustEventKinds.public).map(([kind, what]) => (
+      <tr key={kind}><td><code>{kind}</code></td><td>{what}</td></tr>
+    ))}
+  </tbody>
+</table>
+
+## Presence
+
+Public kinds that say a **named** player was on the server at a given moment. Their audience is an
+operator's choice on [Who sees who is online](/docs/rust/who-sees-who-is-online/), and it is **staff
+only** until somebody widens it.
+
+<table>
+  <thead><tr><th>Kind</th><th>What it says</th></tr></thead>
+  <tbody>
+    {Object.entries(rustEventKinds.presence).map(([kind, what]) => (
+      <tr key={kind}><td><code>{kind}</code></td><td>{what}</td></tr>
+    ))}
+  </tbody>
+</table>
+
+`player.death` and `player.chat` are here on purpose. They are the kill feed and the chat — the
+content a feed exists for — and each says *this person was on at 12:03* as plainly as a connect
+does.
+
+<Aside type="note" title="Gathering is counted, not sent">
+A tree is hit hundreds of times a minute. One frame per swing would make the bridge the most
+expensive thing on the server, so the plugin keeps a per-player tally and sends `player.tally`
+once a minute, on disconnect and at shutdown. The leaderboard is exact and the wire is quiet. The
+rule behind it: if a hook can fire more than once a second per player, it is a counter, not an
+event.
+</Aside>
+
+## Staff
+
+Admins and moderators, and nobody else, at any setting.
+
+<table>
+  <thead><tr><th>Kind</th><th>What it says</th></tr></thead>
+  <tbody>
+    {Object.entries(rustEventKinds.staff).map(([kind, what]) => (
+      <tr key={kind}><td><code>{kind}</code></td><td>{what}</td></tr>
+    ))}
+  </tbody>
+</table>
+
+Bans, unbans, login attempts and approvals carry **IP addresses**, and `player.reported` carries the text of one player's
+complaint about another. They are stored because an operator chasing ban evasion needs them; they
+reach no page below admin, and the sidecar's raw history that holds them is bounded by
+`retain_days` in [`sidecar.toml`](/docs/rust/sidecar-toml/).
+
+Clan membership changes are staff kinds on the server's feed, but not hidden from the clan: they
+reach a clan's own members through its [Team](/docs/administration/teams/) feed, where core decides
+who is a member.
+
+## Every frame says when and where
+
+Every frame carries the server's id and the **wipe** it happened in — derived by the plugin from
+the save's creation time, absent on a server that has never saved. A wipe splits a server's history
+rather than ending it, which is how the leaderboard is per wipe while a player's totals survive.
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§8 defines the catalogue and every later section adds to it;
+[`server/catalogue.js`](https://gitea.whitlocktech.com/RunicGateway/Module-Rust/src/branch/main/server/catalogue.js)
+in the module is the classification this page is checked against.
diff --git a/src/content/docs/docs/rust/events-zones-and-rewards.mdx b/src/content/docs/docs/rust/events-zones-and-rewards.mdx
new file mode 100644
index 0000000..f1cf864
--- /dev/null
+++ b/src/content/docs/docs/rust/events-zones-and-rewards.mdx
@@ -0,0 +1,104 @@
+---
+title: Events, zones and rewards
+description: What the Rust module adds to core's scheduled events — its steps, the values an event may borrow, zone presets, and the switch on each server that has to be on first.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+An event is core's: phases, steps, a schedule, a dry run, and a record of what happened — see
+[Scheduled events](/docs/administration/events/). This page is what the Rust module puts into
+that editor, and what a Rust server needs before any of it can run.
+
+## First, switch it on
+
+Each server's bridge plugin has **`EventsEnabled`**, and it is **off** until you turn it on —
+in [`RunicGateway.json`](/docs/rust/runicgateway-json/), from
+[Mod config](/docs/rust/mod-config/) or on the host. It gates everything an event writes: a
+borrowed value, a zone, a crate, an NPC, a tally, a line in chat.
+
+Letting staff moderate from a screen they are looking at and letting a schedule change the world
+at four in the morning are different consents, so this is its own switch. Turning it off never
+strands anything: giving back what an event took, and cleaning up what it placed, always work.
+
+<Aside type="note" title="A server's own ceilings">
+The same file holds how much one step may do on that server — crates, NPCs, people rewarded,
+tallies at once, the length of a chat line, world events called. **A step over a bound is
+refused, never trimmed to fit.** An operator may lower each bound; none can be raised past the
+plugin's own ceiling.
+</Aside>
+
+## The steps
+
+Picked from the step's **Action** list, beside core's own:
+
+| Group | Step | What it does |
+|---|---|---|
+| **The world** | Open a zone | A ZoneManager zone, at a monument or coordinates, with flags from a [preset](#zone-presets), messages on entering and leaving, and optionally a dome |
+| | Place crates | Crates, barrels and supply drops |
+| | Place NPCs | Rust's scientists and guards, or RunicNPC profiles — placed through RunicNPC |
+| | Call a world event | Rust's own: a patrol helicopter, an airdrop, the cargo ship, a Bradley, the Travelling Vendor and the rest |
+| **Counting** | Start counting participants | A tally of who is present in a zone or on the server, by seconds present, kills, or both |
+| | Record participants | Reads the tally into the run, so later steps can reward from it |
+| **Rewards** | Reward a kit | A Kits kit, as a credit the player redeems |
+| | Pay coins | Economics coins |
+| | Bigger backpack | Lends a larger Backpacks size until the event ends |
+| | Permissions until the event ends | Lent, and taken back at the end |
+| | Permissions for good | Given, and kept. Needs a tick saying you are sure |
+| | Reward by console command | Commands run once per recipient, with `{steamid}` and `{name}` filled in |
+| **Saying it** | Say it in game chat | A line in chat, or a popup where PopupNotifications is installed |
+| **Optional plugins** | Start a Dangerous Treasures event | |
+| | Place a guarded crate | |
+| | Spawn a raid base | A RaidableBases base that is the event's own |
+| **Anything else** | Run console commands | Free text, as typed at the server console, with commands to run when the event ends. Needs a tick saying you are sure |
+
+The optional-plugin steps need their plugin on the server; [Optional
+plugins](/docs/rust/optional-plugins/) covers each. Every reward step picks its recipients the same
+way: everyone who scored, the top N, a minimum score, N drawn at random, the top X per cent — or
+every player with a [linked Steam account](/docs/rust/linking-steam-accounts/), with no tally at
+all, for something like a kit weekend. A recipient need not be linked otherwise: rewards go to
+Steam accounts, and one who is offline gets theirs on their next time in.
+
+**What an event places is the event's.** At its end, the run gives back what it borrowed and
+removes what it placed — its zones, crates, NPCs, and a raid base it spawned. A server restart in
+the middle does not lose track: the plugin keeps the registry on disk, and something that outlives
+its deadline is removed and recorded as *expired*.
+
+## Values an event may borrow
+
+Core's **Borrow a value** step holds a setting for the length of the event and gives it back at
+the end. Rust lends four kinds of value, on each server:
+
+- **Decay rate**
+- **Population** — an animal or vehicle population
+- **Spawn scalar**
+- **Group permission** — a permission on a group, which the [permission
+  mirror](/docs/rust/permissions-and-groups/) leaves alone while the lease holds
+
+## Zone presets
+
+**Admin → Rust zone presets** (`/admin/rust/zones`) holds named sets of ZoneManager flags and
+settings. Core's step editor has single-value fields, so a zone's flags are ticked here, and an
+event's *Open a zone* step offers the presets in its **Options** field. Picking one **copies** it
+into the step, so changing a preset later does not change an event already published.
+
+The screen lists each server's ZoneManager version, how many flags it has, and whether domes are
+available. None ship with the module: what an arena is differs by server. Who is exempt from a
+flag is a `zonemanager.ignoreflag.*` permission, set on the permissions page. Where TruePVE is
+installed, a zone can also turn PvP protection off inside it, or name a TruePVE ruleset.
+
+## Triggers
+
+A phase can advance when something happens in the game, and the vocabulary of *something* is
+the module's trigger catalog. Rust's includes a server wiping, coming online or going offline, a
+new kills leader, a raided base, a guarded crate landing or being cleared, a treasure event
+starting or being won, and a RunicNPC boss appearing, changing phase or dying. The same catalog
+drives [Engagement rules](/docs/administration/engagement-rules/).
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§14 to §16 and §20 are leases, world verbs, rewards and the step editor on the wire;
+[`website/EVENTS.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/EVENTS.md)
+is core's event system, and
+[`modules/rust/PLAN_REDESIGNS.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/PLAN_REDESIGNS.md)
+the design of the step editor and the zones.
diff --git a/src/content/docs/docs/rust/index.mdx b/src/content/docs/docs/rust/index.mdx
new file mode 100644
index 0000000..c215f03
--- /dev/null
+++ b/src/content/docs/docs/rust/index.mdx
@@ -0,0 +1,100 @@
+---
+title: The Rust module
+description: What the rust module adds to a site, the pieces that connect it to a Rust server running Oxide or Carbon, and where each page in this group fits.
+---
+
+import platform from '../../../../data/platform.json';
+
+The `rust` module turns a Runic Gateway site into a *Rust* community's site. It follows any
+number of Rust servers, each running **Oxide** or **Carbon**. Everything in this group is
+specific to it; the rest of the documentation is core, and describes the platform in core's
+own words.
+
+## The pieces
+
+| Piece | What it is | Release |
+|---|---|---|
+| **The module** | [`Module-Rust`](https://gitea.whitlocktech.com/RunicGateway/Module-Rust) — every Rust screen on the site | {platform.releases['Module-Rust']} |
+| **The sidecar** | [`Rust-Link`](https://gitea.whitlocktech.com/RunicGateway/Rust-Link), the **rust-link sidecar** — the only part of the bridge that listens on a network | {platform.games.rust.bundle.sidecar} |
+| **The bridge plugin** | [`Rust-Plugins`](https://gitea.whitlocktech.com/RunicGateway/Rust-Plugins) — `RunicGateway.cs`, one file that runs unchanged on Oxide and Carbon, plus its optional helpers | {platform.games.rust.bundle.plugin} |
+| **RunicNPC** | [`runicnpc-rust`](https://gitea.whitlocktech.com/RunicGateway/runicnpc-rust) — our NPC plugin, which the bridge drives for every NPC an event places. **Required** | {platform.games.rust.bundle.runicnpc} |
+
+The sidecar, the bridge plugin and RunicNPC are installed together on the game host as a
+**bundle** — {platform.games.rust.bundle.tag} today, speaking protocol
+{platform.games.rust.protocol}. A bundle is an exact set CI has checked, never "the latest of
+each". **One sidecar serves one Rust server**: a community running six servers runs six
+sidecars, each with its own port, database and token, and the site holds six rows.
+
+The bundle needs Oxide {platform.games.rust.bundle.oxideMin} or Carbon
+{platform.games.rust.bundle.carbonMin} or newer, and the uMod plugins
+{platform.games.rust.bundle.requiresPlugins.join(' and ')}. RunicNPC will not load without
+Kits, so a server without it cannot place NPCs in an event.
+
+## What the module adds
+
+Install it from **Admin → Modules** like any module — the install manifest is the
+`module-rust-<version>.json` asset on
+[its releases page](https://gitea.whitlocktech.com/RunicGateway/Module-Rust/releases). It
+needs Module API {platform.games.rust.module.coreApi}.
+
+**For visitors**, at `/rust`: every server as it last reported itself, and a page per server
+with six tabs.
+
+| Tab | What it shows |
+|---|---|
+| **Feed** | Kills, chat, comings and goings, the server's own story, RunicNPC bosses, and Rust's world events — cargo, helicopters, airdrops — as they happen |
+| **Leaderboard** | Per wipe: kills, deaths, NPC kills, structures, time played, and the chat titles players have earned |
+| **Online** | Who is on right now |
+| **Map** | The [live map](/docs/rust/the-live-map/): the server's own map picture, with layers |
+| **Wipes** | Every wipe the site has seen. The next one, once the server has a wipe schedule, is in the page's header |
+| **Clans** | Each clan's name, colour, score and members |
+
+A server's **clans are the site's [Teams](/docs/administration/teams/)**, so a clan gets a
+page, a feed for its members, and core's Team notifications. Who may see a clan's roster —
+and who may see a named player at all — is an operator's choice, set on
+[Who sees who is online](/docs/rust/who-sees-who-is-online/).
+
+**For players**, at `/player/rust`: linking a Steam account, what they can do in game, their
+NPC kills, coins and backpack. See [Linking Steam accounts](/docs/rust/linking-steam-accounts/).
+
+**For staff**, seven screens in the admin sidebar, each covered in this group:
+
+| Sidebar row | Page here |
+|---|---|
+| Rust servers | [Connect the site](/docs/rust/connect-the-site/) |
+| Rust permissions | [Permissions and groups](/docs/rust/permissions-and-groups/) |
+| Rust mod config | [Mod config from the site](/docs/rust/mod-config/) |
+| Rust visibility | [Who sees who is online](/docs/rust/who-sees-who-is-online/) |
+| Rust zone presets | [Events, zones and rewards](/docs/rust/events-zones-and-rewards/) |
+| Rust NPC profiles, Rust NPC placements | RunicNPC, which has its own pages |
+
+The module also adds a **Rust** section to each user's page under **Admin → Users** (their
+linked Steam accounts, permissions, coins and backpack), Rust steps and triggers to core's
+[Scheduled events](/docs/administration/events/), and Rust triggers to
+[Engagement rules](/docs/administration/engagement-rules/) — *your base was raided*, *a server
+wiped*, *a new kills leader* and more.
+
+Its capabilities are {platform.games.rust.module.capabilities.join(', ')}.
+
+Until a server is connected, its pages exist and report it as offline. That is the same
+thing the public site does when a server goes down, and it is designed to be unremarkable:
+every list, count and last-reported time comes from what the site stored.
+
+## In this group
+
+| Page | Read it when |
+|---|---|
+| [Install the bridge](/docs/rust/install-the-bridge/) | Setting a Rust server up: the installer, a Pterodactyl egg, or by hand |
+| [Connect the site](/docs/rust/connect-the-site/) | Adding the server to the site, and the rest of its settings |
+| [Verify the bridge](/docs/rust/verify-the-bridge/) | Proving the server, the sidecar and the site are really talking |
+| [Linking Steam accounts](/docs/rust/linking-steam-accounts/) | Joining a player's Steam account to their site account |
+| [Permissions and groups](/docs/rust/permissions-and-groups/) | Granting permissions and managing groups from the site |
+| [Mod config from the site](/docs/rust/mod-config/) | Editing your plugins' config files without a file manager |
+| [Who sees who is online](/docs/rust/who-sees-who-is-online/) | Deciding what the public sees: names, rosters, map layers |
+| [Events, zones and rewards](/docs/rust/events-zones-and-rewards/) | Running scheduled events on a Rust server |
+| [Optional plugins](/docs/rust/optional-plugins/) | What each supported uMod plugin adds, and two that catch operators out |
+| [The live map](/docs/rust/the-live-map/) | What the map shows, and where the picture comes from |
+| [Troubleshooting](/docs/rust/troubleshooting/) | Something on the game side is wrong |
+| [sidecar.toml](/docs/rust/sidecar-toml/) | Changing the sidecar's binds, token, store or history |
+| [RunicGateway.json](/docs/rust/runicgateway-json/) | Changing the bridge plugin's own settings and bounds |
+| [Event kinds](/docs/rust/event-kinds/) | Knowing what the server can tell the site, and who may see each |
diff --git a/src/content/docs/docs/rust/install-the-bridge.mdx b/src/content/docs/docs/rust/install-the-bridge.mdx
new file mode 100644
index 0000000..286dd55
--- /dev/null
+++ b/src/content/docs/docs/rust/install-the-bridge.mdx
@@ -0,0 +1,161 @@
+---
+title: Install the bridge
+description: Setting a Rust server up for the site — with the installer, from a Pterodactyl egg, or by hand — and what each puts where.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+import platform from '../../../../data/platform.json';
+
+This happens on the machine that runs your Rust server. It puts three things there — the
+bridge plugin, the sidecar and RunicNPC — from one bundle, {platform.games.rust.bundle.tag}
+today, and prints what the site needs. It never contacts your site, and it never starts or
+stops your game server.
+
+```
+Rust server ──loopback, dials out──► rust-link sidecar ──HTTP + WebSocket──► your site
+```
+
+The game server opens no port for the bridge: the plugin dials the sidecar on `127.0.0.1`.
+
+## Before you begin
+
+- **Oxide or Carbon is installed, and the server has started once with it**, so its
+  directories exist. A vanilla server has nothing to load a plugin with. Oxide
+  {platform.games.rust.bundle.oxideMin} or Carbon {platform.games.rust.bundle.carbonMin} or
+  newer — never both in one tree.
+- **Kits and ZoneManager**, from uMod. The bridge runs without them and names what is missing,
+  but rewards and zones need them, and **RunicNPC will not load without Kits**. Nothing here
+  installs them.
+- **The site has the Rust module**, and you are an administrator on it.
+
+## Three ways, one result
+
+| | Use it when |
+|---|---|
+| [**The installer**](#the-installer) | The server runs on Linux with systemd, or on Windows |
+| [**The Pterodactyl egg**](#the-pterodactyl-egg) | The server runs on a Pterodactyl panel |
+| [**By hand**](#by-hand) | Neither fits, or you want to place every file yourself |
+
+## The installer
+
+The [Runic Gateway installer](/docs/reference/installer-cli/), {platform.releases.installer},
+told it is setting up Rust. Run it as root, or from an elevated PowerShell:
+
+```bash
+sudo ./runicgateway-installer-linux-x86_64 install --game rust --rust /srv/rust --server-id main
+```
+
+```powershell
+.\runicgateway-installer-windows-x86_64.exe install --game rust --rust D:\rust --server-id main
+```
+
+`--rust` is the server root, the directory holding `RustDedicated`. **`--server-id` is
+required**: it is the id the site will know this server by — lowercase letters, digits and
+`-`, up to 64 — and it is permanent (see [Connect the site](/docs/rust/connect-the-site/)).
+Add `--verify` to see everything it would do and write nothing.
+
+A run resolves the bundle, detects Oxide or Carbon from the server itself, and refuses a tree
+that has both or neither. It writes the plugin's config with just `ServerId` and `Port`,
+**only if there is none** — an existing config is never rewritten, and one that names a
+different server stops the run. It installs the sidecar and registers its service, places the
+plugin, its helpers and RunicNPC, and prints what the site needs. Both frameworks load a
+plugin the moment it lands, so on a running server the bridge comes up at once.
+
+**More than one server on a host:** run it once per server, each with its own `--rust` and
+`--server-id`. Each gets its own service, config, database, game port (from 7799) and web
+port (from 8090), and they share one sidecar binary.
+
+| | Linux | Windows |
+|---|---|---|
+| The sidecar binary, shared | `/usr/bin/runicgateway-rust-link` | `%ProgramFiles%\RunicGateway\rust-link-sidecar.exe` |
+| One server's sidecar config — **holds its token** | `/etc/runicgateway/rust/<id>.toml`, mode 600 | `%ProgramData%\RunicGateway\rust\<id>\sidecar.toml` |
+| One server's service | `runicgateway-rust@<id>.service` | `RunicGatewayRust-<id>` |
+
+The full list, including the database and the install record, is in the
+[Rust bridge install guide](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md#where-everything-lands).
+
+## The Pterodactyl egg
+
+Each Rust-Link release carries **`egg-rust-runicgateway.json`**: the panel's *Rust Autowipe*
+egg with the bridge added. A panel administrator imports it under **Admin → Nests → Import
+Egg**. When you create a server from it, these variables matter:
+
+| Variable | |
+|---|---|
+| **Modding Framework** | `oxide` or `carbon`. `vanilla` installs no bridge |
+| **Runic Gateway: server id** | The id on the site. Read **once**, when the plugin writes its first config; changing it later changes nothing |
+| **Runic Gateway: sidecar port** | **One of this server's allocations.** A port the server was not allocated binds, but is never reachable |
+| **Runic Gateway: sidecar token** | Leave blank, and the sidecar generates one. Anyone who can see this server's startup variables can read a token typed here |
+| **Runic Gateway: bundle** | Blank takes the current bundle; a tag pins one |
+
+The install checks every file against the bundle's checksums before it places any of them.
+The **first boot** prints the generated token in the console, **once**, and a line with what
+the site needs:
+
+```
+[rust-link] Admin -> Rust -> Servers: server id 'main', sidecar URL http://<this node's address>:21009 (listening on 0.0.0.0:21009)
+```
+
+The sidecar runs inside the server's container and stops with it.
+
+- **Updating is a reinstall**, with *Regen Server* off to keep the map. A restart never
+  fetches anything, so it can never change the protocol under a site that has not been
+  updated.
+- **A wipe keeps the bridge's history.** The egg moves `rust-link/` out of the way while
+  `REMOVE_FILES` runs, so no delete list can reach the database or the token.
+
+## By hand
+
+1. **Pick the bundle.** The current one is
+   [`v2/rust/current.json`](https://gitea.whitlocktech.com/RunicGateway/installer/src/branch/bundles/v2/rust/current.json)
+   on the installer's `bundles` branch. It names the sidecar for your platform, the plugin
+   tarball and RunicNPC's, each with a `sha256`.
+2. **Download and verify** each against its checksum.
+3. **The plugin:** copy `RunicGateway.cs` into `oxide/plugins/` or `carbon/plugins/`, with
+   every other `.cs` the tarball's `manifest.json` lists beside it, and `RunicNPC.cs` from
+   its own tarball. To name the server, create `oxide/config/RunicGateway.json` (Carbon:
+   `carbon/configs/RunicGateway.json`) first, holding `{ "ServerId": "<id>", "Port": 7799 }`.
+   Without it the plugin calls the server `main`.
+4. **The sidecar:** put the binary somewhere stable, give it a
+   [`sidecar.toml`](/docs/rust/sidecar-toml/), and run
+   `rust-link-sidecar --print-config --config <file>` once — it generates the token, saves
+   it, and prints it.
+5. **Run it** under your supervisor with `--config <file>`, as an unprivileged user that can
+   write the database directory. On Windows the same `.exe` runs as a service.
+
+<Aside type="caution" title="Do not create RunicNPC's data folder yourself">
+RunicNPC makes `data/RunicNPC/` on its first load. One made from outside the game — a panel's
+file manager, say — may not be writable by it.
+</Aside>
+
+## The helpers beside the plugin
+
+The bundle ships three optional helpers beside the plugin, and the installer and the egg
+place all three. By hand, the tarball's `manifest.json` lists them in `files`:
+
+- **`RunicGatewayZones.cs`** lets ZoneManager count a player already standing in an event
+  zone when it opens or comes back after a restart, and enforce the flags of a zone opened
+  after it loaded. Without it, events still score everybody, but a zone's flags — PvP off,
+  no building — may not hold.
+- **`RunicGatewayDomes.cs`** lets the bridge ask ZoneDomes for a dome over an event zone.
+  Without it, zones open without one.
+- **`RunicGatewayRaids.cs`** lets an event spawn a RaidableBases base of its own and despawn
+  just that base when the event ends; see
+  [Optional plugins](/docs/rust/optional-plugins/#raidablebases).
+
+## Day two
+
+| | |
+|---|---|
+| `doctor --game rust` | Per server: the framework, whether each deployed file is still the one deployed, RunicNPC (a **failure** when missing — it is required), the required uMod plugins, the service, and `/health` through to *plugin connected* |
+| `update --game rust` | Moves the sidecar and every server's plugin to the current bundle, together — they share one binary |
+| `uninstall --game rust` | Removes the service, the plugin, its helpers and RunicNPC. **Keeps the plugin's config** and RunicNPC's data, because they name the server. `--purge` also removes the token and the database |
+
+Next: [Connect the site](/docs/rust/connect-the-site/).
+
+## Canonical documents
+
+[`rust-link/INSTALL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md)
+is the operator guide, and its flags, paths and egg variables are the authority;
+[`installer/INSTALL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/installer/INSTALL.md)
+covers the installer itself.
diff --git a/src/content/docs/docs/rust/linking-steam-accounts.mdx b/src/content/docs/docs/rust/linking-steam-accounts.mdx
new file mode 100644
index 0000000..ced976f
--- /dev/null
+++ b/src/content/docs/docs/rust/linking-steam-accounts.mdx
@@ -0,0 +1,79 @@
+---
+title: Linking Steam accounts
+description: How a player joins their Steam account to their site account — a code from /link in game, or Steam sign-in — and how staff undo a wrong link.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+A Rust player is a Steam account. A site member is a site account. **Linking** joins the two,
+and it is what lets the site say *this member is that player*: their own page shows their
+kills, coins and backpack, a clan becomes a [Team](/docs/administration/teams/) whose members
+the site knows, and an event can reward a member by name.
+
+## Two ways to link
+
+**From the game, with a code.** The player page at `/player/rust` walks a player through it:
+
+1. Join any of the community's Rust servers and type **`/link`** in chat.
+2. The server answers with a **six-character code** that only that player can see. It lasts
+   five minutes.
+3. Type it on `/player/rust`. It works once.
+
+Typing a code that only reached one player into a signed-in browser is the proof that the
+person at the browser is the person in the game. **The code never crosses the bridge**: what
+the server tells the site is only that somebody asked for one.
+
+**By signing in with Steam.** When an administrator has turned on Steam under
+[Authentication](/docs/administration/authentication/#steam), a member who links Steam to
+their site account from their account page has linked that Steam account for Rust too. It is
+the same link, reached through Steam's own sign-in rather than through the game.
+
+## What a link is
+
+- **Fleet-wide.** A code from any of your servers links for all of them, and a member's
+  totals on their page are summed across every server and every wipe.
+- **One owner at a time.** A Steam account belongs to one site account. If somebody links the
+  wrong account, the site refuses to move it — including through Steam sign-in, which refuses a
+  Steam account that is already another member's Rust link.
+- **Kept by the site, not the game.** Nothing about a link is stored on the game host.
+- **A member may hold several Steam accounts.**
+
+## Undoing a link
+
+- **The player:** **`/unlink`** in game asks the site to let go.
+- **Staff:** **Admin → Users**, open the member, and the **Rust** section lists each linked
+  Steam account with an **Unlink** button. It is the way back for a player who linked the
+  wrong account and cannot reach it in game, and it is recorded in the activity log.
+
+<Aside type="note" title="Unlinking Steam sign-in leaves the Rust link in place">
+Removing Steam from a member's sign-in methods stops them signing in with it, and nothing
+else. The Rust link is removed on the Rust side — `/unlink`, or the Rust section of the
+member's page — so a member who only meant to stop using Steam to sign in does not lose
+their history.
+</Aside>
+
+## What a linked player sees
+
+On `/player/rust`: their linked Steam accounts, what they can do in game (the permissions
+the site has given them on each server), the NPCs they have killed this wipe, their coins on
+each server, and their backpack — once something is linked. Staff are sent to the admin
+area rather than the player portal, and see the same facts for anybody from that member's
+page.
+
+## What staff see
+
+On a member's page under **Admin → Users**, the Rust section shows each linked Steam account
+with when it was linked and last played, and kills, deaths and time played per server. Below
+it, staff can grant the member permissions, deposit, withdraw or set their coins on each
+server, and open their backpack.
+
+A link request and an unlink are **staff-only** [event kinds](/docs/rust/event-kinds/):
+together they name a Steam account beside a site account's activity, and *this player is
+that person* is not a public page's business.
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§9 is the link on the wire, and
+[`website/STEAM_SIGNIN.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/STEAM_SIGNIN.md)
+is Steam sign-in, including how it meets the Rust link.
diff --git a/src/content/docs/docs/rust/mod-config.mdx b/src/content/docs/docs/rust/mod-config.mdx
new file mode 100644
index 0000000..556d6a2
--- /dev/null
+++ b/src/content/docs/docs/rust/mod-config.mdx
@@ -0,0 +1,76 @@
+---
+title: Mod config from the site
+description: Admin → Rust mod config — editing your plugins' config files on the game host from the site, with a backup, a watched reload, and an automatic undo.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+**Admin → Rust mod config** (`/admin/rust/config`) edits the configuration files on the game host
+itself, read live through the bridge. It works for whatever plugins you have installed, because
+it generates its form from the values it finds in each file.
+
+## What it lists
+
+Pick a server, and the screen names the directory it is reading — `oxide/config` or
+`carbon/configs`, or wherever your framework was told to keep them — and lists the files there,
+**grouped by the plugin each one probably belongs to**, with whether that plugin is loaded and
+its version.
+
+**The data directory is not listed, on purpose.** `oxide/data` and `carbon/data` hold live state
+— kit cooldowns, zone definitions, the permission store itself — not settings. Editing them from
+a web form edits your players' cooldowns, and the running plugin writes over the change on its
+next save anyway. The one exception is RaidableBases' **profiles**, which live under its data
+directory but are settings, and are listed beside its config as *Profile · …*.
+
+## Editing a file
+
+Open a file and it shows as a form (**Settings**), or as **Raw JSON** for a change the form does
+not suit. Then choose what to **Reload** — the site suggests the plugin the file belongs to, and
+*nothing — just write the file* is an option. A folder name is convention rather than contract,
+so the guess is a field you can change, not an assumption.
+
+**Save and reload** then:
+
+1. backs the file up,
+2. writes it,
+3. reloads the plugin you named, and watches the reload,
+4. and if the plugin does not come back, **puts the old file back on its own**, and shows you
+   the line from the server's log that says why.
+
+A typo costs you a few seconds, not a plugin. The answer you see is one of:
+
+- *Saved, and the plugin reloaded.*
+- *The plugin did not come back, so the old file was put back automatically.*
+- *…and it did not come back on the old file either. It is down: check the server console.* —
+  the old file was broken too, which is worth knowing before anything else.
+- *The server never said how the reload went* — the bridge itself was reloaded, or the link
+  dropped. Re-read the file to see what is on disk.
+
+A reload fails on evidence — the framework's log saying the plugin did not compile or start —
+and a reload that says nothing at all is called lost only once a fixed ceiling has passed.
+
+**Recent changes**, at the bottom, is every save, including the ones that did not land: what
+changed, field by field, and whether it was applied or rolled back.
+
+<Aside type="caution" title="The bridge's own file is special">
+`RunicGateway.json` is editable here, except **`Host`, `Port` and `ServerId`**, which are shown
+read-only. Changing them from the site would cut the link carrying the change, or strand every
+row the site holds for the server — edit them on the host. And the bridge cannot be reloaded
+from here, for the same reason. See [RunicGateway.json](/docs/rust/runicgateway-json/).
+</Aside>
+
+<Aside type="caution" title="RaidableBases: restart, never reload">
+Change RaidableBases' config, then **restart the server** instead of reloading the plugin. A
+reload can leave its live raids broken until a restart. See
+[Optional plugins](/docs/rust/optional-plugins/#raidablebases).
+</Aside>
+
+`rg.config` at the server console prints which directory the site is reading, the log it
+watches, a reload in progress, and what the last write from the site did.
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§11 and §19.1 are configuration on the wire;
+[`modules/rust/OPERATING.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/OPERATING.md#plugin-configuration-plugins-configuration)
+has uMod's own page on plugin configuration.
diff --git a/src/content/docs/docs/rust/optional-plugins.mdx b/src/content/docs/docs/rust/optional-plugins.mdx
new file mode 100644
index 0000000..0250588
--- /dev/null
+++ b/src/content/docs/docs/rust/optional-plugins.mdx
@@ -0,0 +1,93 @@
+---
+title: Optional plugins
+description: The uMod plugins the Rust module recognises beyond the required two, what each one adds to the site, and the two — RaidableBases and Guarded Crate — that catch operators out.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+import platform from '../../../../data/platform.json';
+
+The bridge needs {platform.games.rust.bundle.requiresPlugins.join(' and ')}, and RunicNPC. Everything
+below is optional: install what your server wants, and the site notices. The bridge reports what it
+finds when it connects and whenever a plugin loads or unloads, and **Optional mods** on a row of
+[Admin → Rust servers](/docs/rust/connect-the-site/#the-rest-of-a-servers-settings) prints it —
+each plugin's version, and what it lets the site do on that server.
+
+**Runic Gateway never ships or modifies any of these.** They are their authors' plugins, installed
+the way uMod's own guide describes, and a server without one simply lacks that feature.
+
+| Plugin | What the site does with it |
+|---|---|
+| **BetterChat** | Shows [chat titles](/docs/rust/connect-the-site/#chat-titles) and [group chat styles](/docs/rust/permissions-and-groups/#chat-styles) in game chat. Titles still show on the leaderboard without it |
+| **PopupNotifications** | Lets news, event lines and zone messages arrive as a popup. Without it a popup falls back to chat, or is refused with a reason |
+| **Economics** | Coins: the *Pay coins* step, the *Richest* title, and balances on a member's page that staff can adjust |
+| **Backpacks** | Shows a player's backpack, and lets an event lend a bigger size |
+| **TruePVE** | Lets an event's zone turn PvP protection off, or name a ruleset |
+| **Dynamic PVP** | Its PvP zones — around a downed helicopter, a Bradley, cargo — appear in the feed and on the map |
+| **Dangerous Treasures** | Its events appear in the feed and on the map, earn the *Treasure Hunter* title, and a step may start one |
+| **Guarded Crate** | Its crates appear in the feed and on the map, earn the *Warden* title, and a step may place one. [Needs NpcSpawn](#guarded-crate) |
+| **RaidableBases** | Its bases appear in the feed and on the map, earn the *Warlord* title, and a step may spawn one that is the event's own. [Read this first](#raidablebases) |
+| **ZLevels Remastered** | An event may lend its XP boosts, which are permissions |
+| **ZoneDomes** | A dome over an event's zone, through the bridge's domes helper |
+
+PopupNotifications has a recommended look — a banner across the top of the screen — which the
+installer and the egg write only where its config is missing or still its own defaults. The
+[install guide](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INTEGRATION.md#24-the-recommended-popupnotifications-look-optional)
+has the config.
+
+**Clans is not on the list, deliberately.** A server's clans come from Rust's own clan system,
+which that plugin never touches, so installing it would split your players across two unrelated
+clan systems.
+
+## RaidableBases
+
+Either edition works, the paid or the free one. The bridge's **raids helper**,
+`RunicGatewayRaids.cs`, installed beside the plugin by default, is what lets an event spawn a base
+of its own — at a spot, with its own settings and lock — and despawn only that base when the event
+ends. Without it a base an event spawned despawns on its own timer. Difficulty, profile and base
+names in the step editor come from RaidableBases itself, so they are whatever your copy has.
+
+Two of RaidableBases' own behaviours catch operators out:
+
+<Aside type="caution" title="Change its config with a restart, never a reload">
+After a reload of RaidableBases on a running server, its list of live raids can hold an empty
+entry, and every hook that walks the list fails: damage to a base, its SAM sites, players'
+commands, and the purchase command, so a purchase does nothing and charges nothing. Only a full
+server restart clears it. It is RaidableBases' own bug. Edit its config — from
+[Mod config](/docs/rust/mod-config/) with *nothing* chosen to reload, or on the host — then restart
+the server.
+</Aside>
+
+<Aside type="caution" title="Back up before switching editions">
+Putting the free edition in place of the paid one rewrites the profiles a paid base pack installed,
+and drops their bases from them. Going back to the paid edition does not bring them back. Back up
+RaidableBases' config and data folders first.
+</Aside>
+
+## Guarded Crate
+
+Guarded Crate **needs NpcSpawn** for its guards, and NpcSpawn is not on uMod: it is a free download
+from Codefling. Install it before Guarded Crate:
+
+1. Put `NpcSpawn.cs` in the plugins directory.
+2. Put the archive's `data/Images/` files in the data directory's `Images` folder. **Without them
+   NpcSpawn unloads itself.**
+3. Leave `data/NpcSpawn/` for NpcSpawn to create. A folder made by a panel's file manager may not be
+   writable by the game.
+4. Install Guarded Crate from uMod.
+
+**NpcSpawn contacts its author's server when it loads**: it calls a version server and downloads
+clothing images. If your server may not reach the internet, or you do not want it to, know that
+before installing it.
+
+Without NpcSpawn, the *Place a guarded crate* step is refused with a reason — the bridge checks,
+because Guarded Crate would otherwise drop a crate with no guards. Its events are rows in its data
+file (Easy, Medium, Hard and Elite as it ships), and the site offers whatever names that file holds.
+**A crate placed by an event is kept when the event ends**: Guarded Crate has no way to end one
+event without ending them all.
+
+## Canonical documents
+
+[`modules/rust/OPERATING.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/OPERATING.md)
+holds the RaidableBases and Guarded Crate notes in full;
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§18 and §20 are each plugin on the wire.
diff --git a/src/content/docs/docs/rust/permissions-and-groups.mdx b/src/content/docs/docs/rust/permissions-and-groups.mdx
new file mode 100644
index 0000000..fb38103
--- /dev/null
+++ b/src/content/docs/docs/rust/permissions-and-groups.mdx
@@ -0,0 +1,90 @@
+---
+title: Permissions and groups
+description: Admin → Rust permissions — the site holds every server's permissions and groups, pushes them into Oxide or Carbon, and decides what happens to a change made in game.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+**Admin → Rust permissions** (`/admin/rust`) is where the site holds every permission and group
+on each server: what was there before the site, what is made here, and what is changed in the
+game. It reads each server's own permission store and pushes the site's set back into it, so
+every plugin you already run honours it — Kits, ZoneManager, anything that asks Oxide or
+Carbon whether a player has a permission. Nothing is configured twice, and nothing is asked of
+those plugins.
+
+## The first sync imports
+
+A server's first sync **imports everything** in its store, so taking the site into use loses
+nothing an operator had already set up at the console. Until then the server is marked *not
+imported yet*. After that, the site's set is the one that holds.
+
+**A wipe loses nothing.** The site pushes the whole set again when the server comes back, so a
+wipe script that clears the data directory costs a minute, not your permissions.
+
+## In-game changes
+
+An operator will still grant something at the console during an incident. What happens to it is
+a per-server choice:
+
+| Mode | A change made in the game |
+|---|---|
+| **auto-adopt** | Becomes the site's own, for that server |
+| **adopt** | Waits under *Waiting for a person*, to be adopted or undone |
+| **revoke** | Is undone at the next sync |
+
+The chip beside the mode says when the server last synced. **Sync now** pushes at once.
+
+## Players
+
+The **Players** tab lists everybody who holds something on the selected server; pressing Enter in
+its search reaches every player the server has seen. A player shows their site account, when they
+have [linked one](/docs/rust/linking-steam-accounts/).
+
+Pick one, and their permissions are listed by the plugin that registers them, with **Grant all**
+and **Revoke all** per plugin. Tick **Grant on every server** to make a grant fleet-wide rather
+than for this server only. Chips on a permission explain what you are looking at:
+
+| Chip | Meaning |
+|---|---|
+| *not registered here* | No loaded plugin on this server registers it, so it cannot be granted — Oxide and Carbon silently do nothing for an unknown name. Load the plugin and the grant lands by itself |
+| *revoked here only* | Granted on every other server, and taken away on this one |
+| *from an event* | An event gave it, and the event's end takes it back |
+| *waiting for their first connection* | The server has never seen this player. A grant to them lands when they first join; every sync pushes it again |
+
+## Groups
+
+The **Groups** tab lists the server's groups with their member counts, and **Create** makes a
+new one. Each group has four tabs:
+
+- **Permissions**, laid out as a player's are.
+- **Players** — who is in it. Every player who connects is in `default`, so it lists nobody.
+  A player the server has never seen cannot be put in a group yet; the site says the membership
+  is waiting, and it lands on their first connection.
+- **Settings** — the group's title, its rank and its parent group, whose permissions it
+  inherits.
+- **Servers.** A group belongs to one server unless it is **shared**. A shared group carries the
+  same permissions and players on every server it is on — including servers added later, if you
+  tick that — and a change made in one game gives that server its own copy.
+
+### Chat styles
+
+A group's **Settings** tab has a **Chat style (BetterChat)** section. Give a group a style and
+BetterChat, where it is installed, shows its members' titles, colours and sizes as you set them
+here, with a priority deciding between a player's groups. A group with a style can also be the
+**announcement voice** on [Admin → Rust servers](/docs/rust/connect-the-site/#chat-titles), so
+news and event lines in game chat wear its title.
+
+<Aside type="note" title="rg.perms at the server console">
+Prints what the last sync did. It is the fastest way to tell *that permission does not exist
+here* from *that player has never been seen here* — both look like "the site says they have it
+and the game disagrees" from the other end.
+</Aside>
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§10 and §19.9 are the permission mirror on the wire;
+[`modules/rust/OPERATING.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/OPERATING.md#permissions-plugins-permissions)
+has uMod's own guide to permissions and groups, and
+[`CARBON.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/CARBON.md)
+how Carbon's store differs.
diff --git a/src/content/docs/docs/rust/runicgateway-json.mdx b/src/content/docs/docs/rust/runicgateway-json.mdx
new file mode 100644
index 0000000..e4f8cac
--- /dev/null
+++ b/src/content/docs/docs/rust/runicgateway-json.mdx
@@ -0,0 +1,70 @@
+---
+title: RunicGateway.json
+description: The bridge plugin's own config file on the Rust server — every key, which three the site will not edit, and the event bounds that refuse rather than trim.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+import { rustPluginConfig } from '../../../../data/reference.mjs';
+
+The bridge plugin's config, written by the framework as `oxide/config/RunicGateway.json`, or
+`carbon/configs/RunicGateway.json` on Carbon. The plugin fills in every key it is missing on
+load, so a config written by an older version shows the newer keys after the first load with the
+new one — which is what lets [Mod config](/docs/rust/mod-config/) show a switch before anybody needs
+it.
+
+**Where the first one comes from.** The installer writes one holding just `ServerId` and `Port`,
+and only when there is none. On a Pterodactyl egg, the plugin's first load takes the server id from
+the `RUSTLINK_SERVER_ID` variable. After that the file is canonical, and changing either source
+changes nothing.
+
+## The keys
+
+<table>
+  <thead><tr><th>Key</th><th>What it is for</th></tr></thead>
+  <tbody>
+    {Object.entries(rustPluginConfig).flatMap(([group, keys]) => [
+      <tr key={group}><th colspan="2">{group}</th></tr>,
+      ...Object.entries(keys).map(([name, k]) => (
+        <tr key={name}>
+          <td><code>{name}</code>{k.readOnlyFromSite ? <><br /><small>read-only from the site</small></> : null}</td>
+          <td>{k.why}</td>
+        </tr>
+      )),
+    ])}
+  </tbody>
+</table>
+
+This list is checked against the plugin's own source on every build.
+
+<Aside type="caution" title="Three keys are the host's">
+`Host`, `Port` and `ServerId` are read-only in the site's config editor. Changing the first two
+from the site would cut the link carrying the change; changing `ServerId` would strand every row
+the site holds for this server. **`ServerId` is permanent** — it is not the hostname, so a server
+can be renamed for a season without losing its history.
+</Aside>
+
+## The event bounds
+
+`EventsEnabled` ships **off**. While it is off the site may still list and give back what events
+hold, so switching it off never strands anything; it may not borrow, place, count or say anything
+new. See [Events, zones and rewards](/docs/rust/events-zones-and-rewards/).
+
+Each `EventsMax…` key is how much **one step** may do on this server — or, for
+`EventsMaxWorldCalls`, one run, and for `EventsMaxTallies`, the whole server at once. Two rules
+hold for all of them:
+
+- **An operator may lower a bound, never raise it** past the plugin's own ceiling. A value above it
+  is brought down to it when the plugin loads.
+- **A step over a bound is refused, never trimmed to fit.** An event that does less than its
+  author wrote, quietly, is worse than one that says it cannot.
+
+The two `Map…` keys are different: a map answer over its bound is cut short and says so, because a
+read has nobody to refuse.
+
+## Canonical documents
+
+The `PluginConfig` class in
+[`RunicGateway.cs`](https://gitea.whitlocktech.com/RunicGateway/Rust-Plugins/src/branch/main/overlay/oxide/plugins/RunicGateway.cs)
+is the authority;
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§6.1 describes the file and §14 to §17 each key as it arrived.
diff --git a/src/content/docs/docs/rust/sidecar-toml.mdx b/src/content/docs/docs/rust/sidecar-toml.mdx
new file mode 100644
index 0000000..664286c
--- /dev/null
+++ b/src/content/docs/docs/rust/sidecar-toml.mdx
@@ -0,0 +1,83 @@
+---
+title: sidecar.toml
+description: The rust-link sidecar's whole configuration — six keys and the six environment variables that override them — and why the file is written rather than shipped.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+import { rustSidecarConfig, rustSidecarEnv } from '../../../../data/reference.mjs';
+
+The rust-link sidecar's configuration. Like every sidecar on this platform it is small on
+purpose: the sidecar forwards, and policy lives on the site where an administrator can see it.
+**One file per Rust server**, because one sidecar serves one server.
+
+## The file is written, not shipped
+
+The sidecar **writes its config on first run** if there is none, with a generated auth token, and
+nothing is compiled into the binary. `rust-link-sidecar --print-config --config <file>` resolves
+the config exactly as a start would — writing it and generating the token if needed — and prints
+the result, **token included**, which is the point.
+
+Which file: `--config <file>`, else `$RUSTLINK_CONFIG`, else `sidecar.toml` in the working
+directory. **Relative paths resolve beside the config file**, not the working directory, so a
+database configured as `rust-link.db` lives next to its config wherever the service manager
+started it. The installer's files are under `/etc/runicgateway/rust/`, or
+`%ProgramData%\RunicGateway\rust\` on Windows; the egg's is `rust-link/sidecar.toml` in the server's
+directory.
+
+<Aside type="caution" title="Authentication is always on">
+A blank token is not "no authentication": it is generated and written back, so the web side is
+authenticated from first boot. There is no way to turn it off.
+</Aside>
+
+## The keys
+
+<table>
+  <thead><tr><th>Key</th><th>What it is for</th></tr></thead>
+  <tbody>
+    {Object.entries(rustSidecarConfig).map(([name, why]) => (
+      <tr key={name}><td><code>{name}</code></td><td>{why}</td></tr>
+    ))}
+  </tbody>
+</table>
+
+**`[game].bind` stays on loopback.** There is no token on the game link — the plugin and the
+sidecar share a host, and `127.0.0.1` is the authentication. Moving it to a routable address puts
+an unauthenticated command channel for your game server on the network. `[web].bind` is the one
+that may move, behind TLS and a firewall.
+
+**`[store].retain_days` bounds the sidecar's copy, not the history.** The permanent record — per-wipe
+totals that survive a wipe — is in the site's own tables, so shortening it loses recent raw detail
+and never a player's history. Keep the sidecar's files out of any wipe script's delete list all
+the same: the config holds the token, and the database the recent history.
+
+## Environment variables
+
+Each overrides one key. **An empty variable is ignored**, so a panel can declare one and leave it
+blank without blanking the saved value.
+
+<table>
+  <thead><tr><th>Variable</th><th>Overrides</th></tr></thead>
+  <tbody>
+    {Object.entries(rustSidecarEnv).map(([name, key]) => (
+      <tr key={name}><td><code>{name}</code></td><td><code>{key}</code></td></tr>
+    ))}
+  </tbody>
+</table>
+
+Both lists are checked against the sidecar's own source on every build, so a key or a variable
+added upstream turns this page red rather than quietly going undocumented.
+
+## What is *not* in here
+
+- **No audience rules.** Who may see what is the site's, on
+  [Who sees who is online](/docs/rust/who-sees-who-is-online/).
+- **No site URL.** The site reaches the sidecar, never the other way round.
+- **No protocol version.** It is compiled in, because a sidecar that could be configured to claim
+  another protocol would defeat the check.
+
+## Canonical documents
+
+[`sidecar/src/config.rs`](https://gitea.whitlocktech.com/RunicGateway/Rust-Link/src/branch/main/sidecar/src/config.rs)
+is the authority;
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§6.2 describes it.
diff --git a/src/content/docs/docs/rust/the-live-map.mdx b/src/content/docs/docs/rust/the-live-map.mdx
new file mode 100644
index 0000000..e5482f2
--- /dev/null
+++ b/src/content/docs/docs/rust/the-live-map.mdx
@@ -0,0 +1,65 @@
+---
+title: The live map
+description: The Map tab on each server's page — where the picture comes from, what the layers show and to whom, and why positions are never stored.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+Each server's public page has a **Map** tab: this wipe's map, with the game's own grid, its
+monuments, and layers for everything that moves. It is drawn in the browser from two things the
+bridge answers live — the picture, and the positions.
+
+## The picture
+
+**From Rust+, when it is on.** A server with `app.port` set renders its map at boot and keeps the
+picture for the Rust+ companion app; the bridge reads that picture and nothing else of Rust+'s, and
+the site fetches it once per map and keeps it. **Admin → Rust visibility** says, per server, where
+the picture came from, its size and when it was fetched, with **Fetch again**.
+
+**Without Rust+, an admin asks for one**, with **Render now** on the same screen. The game can
+render the map on request, but it holds the server's main thread for several seconds while it
+does, so it never happens on its own. The
+rendered picture is kept on the game host and served again after a restart on the same map; a new
+map makes it stale.
+
+The picture says nothing about who plays — it is drawn from the map's seed — so it is always
+public. Monument labels follow the in-game map's own; some are hidden by default, and the
+visibility screen says how many.
+
+## The layers
+
+Every layer has its own audience, set on
+[Who sees who is online](/docs/rust/who-sees-who-is-online/#the-live-map):
+
+| Layer | What moves on it |
+|---|---|
+| **Monuments & world events** | Cargo, patrol and Chinook helicopters, Bradley, supply drops, locked crates — with how long a hack has left — and RunicNPC bosses placed outside an event |
+| **Site events** | The zones, crates and NPCs this site's events placed, while they run |
+| **Players** | Connected players, then offline sleepers, by name |
+| **Bases** | Tool cupboards and vending machines, **as positions only** — no owner, no authorised list, no shop name |
+| **PvP zones** | Dynamic PVP's zones, where they are now |
+| **Raid bases** | RaidableBases' live bases, their difficulty, when they despawn, and which an event spawned |
+
+The players layer can never show more than *who is online* does. A linked player always sees
+themselves and their online clan mates, unless an operator turns that off.
+
+<Aside type="note" title="Positions are never stored">
+The picture passes through the sidecar, and positions are never written to its database or the
+site's: the site holds the game's latest answer in memory for a few seconds, so many viewers cost
+one ask, and that is all. There is no record of where anybody was to leak later.
+</Aside>
+
+## Bounds, and the console
+
+Two keys in [`RunicGateway.json`](/docs/rust/runicgateway-json/), **`MapMaxSleepers`** and
+**`MapMaxBases`**, cap how many sleepers and bases one answer carries. Over a bound the layer is cut
+short and says so; a read has nobody to refuse, so it is trimmed rather than refused.
+
+`rg.map` at the server console prints the map's key, where the picture came from, its size, whether
+a render is running, the game's grid, the size of each layer, and how many map asks there have
+been, with the last and the slowest.
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§17 is the map on the wire, and §20.7 and §20.12 add its two optional layers.
diff --git a/src/content/docs/docs/rust/troubleshooting.mdx b/src/content/docs/docs/rust/troubleshooting.mdx
new file mode 100644
index 0000000..23e412a
--- /dev/null
+++ b/src/content/docs/docs/rust/troubleshooting.mdx
@@ -0,0 +1,60 @@
+---
+title: Troubleshooting
+description: Rust-side symptoms, what each one means, and where to look — from an install that stops to a site that shows nothing.
+---
+
+Start with [Verify the bridge](/docs/rust/verify-the-bridge/): its four checks find which link is
+broken. The site-wide symptoms — a `409`, a `401` — are on core's
+[Troubleshooting](/docs/administration/troubleshooting/) page. This page is the Rust side.
+
+## Installing
+
+| Symptom | Cause, and the fix |
+|---|---|
+| The install stops: *already names this server "x"* | The plugin's config names another server. Use that id — or, if the server really is new to the site, remove the config file |
+| The install stops: *has both Oxide and Carbon* | A tree mid-migration. Remove the framework you are leaving |
+| The install stops: *has neither* | The server has never started with a framework. Install Oxide or Carbon and start it once |
+| `doctor`: *not the file that was deployed* | The plugin was edited by hand. `update --game rust` puts the released one back |
+| `doctor`: RunicNPC missing | It is required. Reinstall or update; and check Kits is installed, because RunicNPC will not load without it |
+| The egg's console prints a new token after every boot | A sidecar older than the first Rust-Link release does this. Reinstall the server |
+
+## Connecting
+
+| Symptom | Cause, and the fix |
+|---|---|
+| The site says the sidecar is unreachable | The site cannot reach the URL: a loopback bind with the site elsewhere, a firewall — or, on the egg, a sidecar port that is not one of the server's allocations |
+| **Test** says `protocol-mismatch` | The site's Rust module and the bridge speak different protocols. Update whichever is behind |
+| `doctor`: *plugin connected — no, and the server is running* | The plugin did not compile, or cannot reach its sidecar. The server console names a compile error; the plugin's `Port` must equal the sidecar's game port |
+| The sidecar logs *refusing a plugin that names another server* | Two servers dial one sidecar: a plugin's `Port` is another server's game port. Correct that plugin's `Port` and reload it. Nothing it sent was stored |
+| `/health` shows `untyped_frames` above zero | The plugin and the sidecar are on different protocols. Move both to one bundle |
+| The server is listed but reads stale | It reported once and has not since. Either the site's poll is failing (the site's log) or the sidecar stopped (its own) |
+
+## Features
+
+| Symptom | Cause, and the fix |
+|---|---|
+| Events refuse every step on a server | `EventsEnabled` is off in its [`RunicGateway.json`](/docs/rust/runicgateway-json/). It ships off |
+| A step is refused as over a bound | The server's own bound in `RunicGateway.json` is lower than the step asks for. Steps are refused, never trimmed |
+| A permission the site granted does nothing | *not registered here*: no loaded plugin registers that name, so the framework ignores it. Load the plugin. `rg.perms` says what the last sync did |
+| A group membership has not landed | The server has never seen that player. It lands on their first connection |
+| An event zone's flags do not hold | The ZoneManager helper is missing. Reinstall, or place `RunicGatewayZones.cs` by hand |
+| A config save rolled back | The plugin did not come back on the new file. The site shows the log line that says why |
+| RaidableBases purchases and raids stop working after a config change | It was reloaded on a running server. Restart the server — see [Optional plugins](/docs/rust/optional-plugins/#raidablebases) |
+| *Place a guarded crate* is refused | NpcSpawn is missing — see [Optional plugins](/docs/rust/optional-plugins/#guarded-crate) |
+| Chat titles show on the site but not in game | BetterChat is not loaded on that server |
+| The map tab has no picture | The server runs without Rust+. Ask for a render from Admin → Rust visibility |
+| No names in the feed or on the Online tab | That is the default. [Who sees who is online](/docs/rust/who-sees-who-is-online/) widens it |
+
+## What to send when asking for help
+
+The output of `rg.link` and `rg.hooks` at the server console, `/health` from the game host, and,
+where the installer was used, `doctor --game rust`. `rg.hooks` lists which of the plugin's hooks
+have fired: both frameworks bind hooks by name with no warning when a name matches nothing, so a
+hook Rust renamed on a wipe day shows up there as silence.
+
+## Canonical documents
+
+[`rust-link/INSTALL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INSTALL.md#troubleshooting)
+and
+[`rust-link/INTEGRATION.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INTEGRATION.md)
+§3 hold the full tables.
diff --git a/src/content/docs/docs/rust/verify-the-bridge.mdx b/src/content/docs/docs/rust/verify-the-bridge.mdx
new file mode 100644
index 0000000..071aee9
--- /dev/null
+++ b/src/content/docs/docs/rust/verify-the-bridge.mdx
@@ -0,0 +1,101 @@
+---
+title: Verify the bridge
+description: The four links between a Rust server and the site, checked in order — the plugin's log, rg.link, the sidecar's /health, and Admin → Rust servers.
+---
+
+import { Aside, Code } from '@astrojs/starlight/components';
+import platform from '../../../../data/platform.json';
+
+export const P = platform.games.rust.protocol;
+
+A copied file is not a working bridge. Check the four links in the order data travels, the
+way [Verify the whole stack](/docs/getting-started/verify-the-whole-stack/) describes for
+every game; this page has Rust's commands. The first link that fails is the one to fix.
+
+## 1. The bridge plugin loaded
+
+Both frameworks compile and load `RunicGateway.cs` the moment it lands. Oxide logs to
+`oxide/logs/`; Carbon to `carbon/logs/Carbon.Core.log`. A good load reads:
+
+<Code code={`RunicGateway was compiled successfully
+[Runic Gateway] protocol ${P}, serverId 'main', sidecar 127.0.0.1:7799
+[Runic Gateway] connected to 127.0.0.1:7799`} />
+
+The second line is worth reading closely: it is the protocol this plugin speaks, the id the
+site will file everything under, and the address it dials. A wrong `ServerId` or `Port` is
+visible right here.
+
+If the third line is instead *cannot reach the sidecar: … — retrying quietly until it
+answers*, the plugin is fine and the sidecar is not there yet — or `Host` and `Port` in
+[`RunicGateway.json`](/docs/rust/runicgateway-json/) point somewhere else. It is printed once
+per load and then the plugin keeps trying.
+
+## 2. The server reached the sidecar
+
+At the server console (or over RCON):
+
+<Code code={`rg.link
+protocol=${P} serverId=main connected=True depth=0 sent=412 dropped=0 received=38 connects=1 writeErrors=0 bootId=… wipeId=w-20261005T115051Z`} />
+
+`connected=True` is the link. `dropped` above zero means the sidecar was away long enough for
+the plugin's queue to fill and shed its oldest lines — the game never waits for it.
+`wipeId=none` is a server that has never saved, which is normal for a few minutes after a
+fresh wipe.
+
+## 3. The sidecar is healthy
+
+On the game host. `/health` needs no token, so monitoring can use it:
+
+<Code lang="bash" code={`curl -s http://127.0.0.1:8090/health
+{"status":"ok","protocol":${P},"plugin_connected":true,"database":"ok","uptime":"2h 5m","last_event":"…","untyped_frames":0}`} />
+
+| Field | Working means |
+|---|---|
+| `plugin_connected` | `true`. **This is the one value that tells "files copied" from "the bridge works"** |
+| `status` | `ok`. `degraded` means the plugin is not connected or the database is unreadable |
+| `untyped_frames` | `0`. Anything else means the plugin and the sidecar speak different protocols — see below |
+
+<Aside type="caution" title="untyped_frames above zero">
+The link between the plugin and the sidecar has no version handshake, so a mismatched pair is
+not refused at connect. The sidecar drops and counts every frame it cannot file instead. The
+symptom without this counter is a server plainly up, a sidecar plainly healthy, and a site
+showing nothing. Compare `rg.link`'s protocol with `/health`'s, and update whichever is
+behind — normally by moving both to one bundle.
+</Aside>
+
+## 4. The site is ingesting
+
+On **Admin → Rust servers**, **Test the sidecar** answers *The sidecar answered (protocol
+{P})*, and the row reads online with *last seen just now*. The public page at `/rust` lists the
+server, and its feed fills as things happen in the world.
+
+Each failure the Test button can report is on
+[Connect the site](/docs/rust/connect-the-site/#test-it).
+
+## Three things that look broken and are not
+
+- **Stopping the sidecar does not disturb the game.** The plugin logs *sidecar link lost;
+  reconnecting* and keeps retrying, into a bounded queue that drops its oldest lines rather
+  than growing.
+- **A plugin started before its sidecar logs one line and goes quiet** until the sidecar
+  answers.
+- **The site renders with every server off.** Lists, counts and last-reported times come from
+  what the site stored, and the server reads offline.
+
+## On the installer's hosts, one command
+
+```bash
+runicgateway doctor --game rust
+```
+
+checks the framework, every deployed file, RunicNPC, the required uMod plugins, the service
+and `/health` through to *plugin connected*, per server. It exits non-zero when a check
+failed, so a monitor can run it. On a Pterodactyl egg there is no shell; the console is the
+diagnosis.
+
+## Canonical documents
+
+[`rust-link/INTEGRATION.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/INTEGRATION.md)
+§3 and
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§5.1 cover diagnosing the link.
diff --git a/src/content/docs/docs/rust/who-sees-who-is-online.mdx b/src/content/docs/docs/rust/who-sees-who-is-online.mdx
new file mode 100644
index 0000000..dd90445
--- /dev/null
+++ b/src/content/docs/docs/rust/who-sees-who-is-online.mdx
@@ -0,0 +1,85 @@
+---
+title: Who sees who is online
+description: Admin → Rust visibility — nothing names a player by default; where an operator widens that, for presence, clan rosters, news in game chat and each live-map layer.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+**Nothing on the site names who is online unless you choose to show it.** That covers more than
+the Online tab: the joins, deaths and chat in each server's feed, and the leaderboard's *last
+seen*, all say that a named player was on at a given moment. **How many** players are online is
+always shown — a count is never a name.
+
+**Admin → Rust visibility** (`/admin/rust/visibility`) is where an operator widens that, on
+purpose. Every setting has a fleet-wide default and a per-server override.
+
+## The audiences
+
+Each setting picks one of three audiences, narrowest last:
+
+| Audience | Who |
+|---|---|
+| **Everyone** | Anybody, signed in or not |
+| **Signed-in members** | Anybody with a site account |
+| **Staff only** | Admins and moderators |
+
+## Who is online
+
+The default is **staff only**. It decides who sees a **named** player: the Online tab, and the
+feed's [presence kinds](/docs/rust/event-kinds/#presence) — joins and leaves, respawns, deaths,
+chat, the per-minute tally, and the death of a RunicNPC boss, which names its killer. Below it,
+the public feed carries only what names nobody: a wipe, a start, a shutdown, a world event.
+
+## Clan rosters
+
+Who is in each clan, on every server. The default is **the clan's members and staff**: players
+whose linked Rust account is in the clan, plus admins and moderators. Each clan's name, colour,
+score and member count are always public.
+
+## News in game chat
+
+Per server: **off**, **in chat**, or **as a popup**. When a news post is published, its title is
+said on every server switched on here. A server that is down at that moment is skipped rather
+than told late. A popup needs PopupNotifications on that server; one without it refuses the post
+and says why.
+
+## The live map
+
+The map's **picture** is always public: it is drawn from the map's seed and says nothing about
+who plays. Everything that moves on it is a **layer**, and each layer has its own audience:
+
+| Layer | What it shows | Default |
+|---|---|---|
+| **Monuments & world events** | Cargo, helicopters, Bradley, supply drops, locked crates, and RunicNPC bosses placed outside an event | Everyone |
+| **Site events** | The zones, crates and NPCs this site's events placed, while they run | Everyone |
+| **Players** | Where everybody is, with names, and the sleepers | Staff only |
+| **Bases** | Tool cupboards and vending machines, as positions only | Staff only |
+| **PvP zones** | Dynamic PVP's own zones. Needs Dynamic PVP on the server | Everyone |
+| **Raid bases** | RaidableBases' live bases and when they despawn. Needs RaidableBases | Everyone |
+
+**The players layer can never show more than *who is online* does**, whatever it is set to here.
+**You and your clan**, on by default, lets a linked player see themselves and their online clan
+mates whatever the players layer says.
+
+Per server, this section also says how many monument labels the map has and how many are hidden,
+and where the map's picture came from, with **Fetch again**. See
+[The live map](/docs/rust/the-live-map/).
+
+<Aside type="note" title="Why the default is the narrowest one">
+A feed that says a named player was on at 3 a.m. is a record of somebody's evenings. So nobody's
+presence is published until an operator decides it should be, and a new server follows the
+fleet's default rather than starting open.
+</Aside>
+
+## What this does not cover
+
+Some kinds never reach a public page at any setting: IP addresses, player reports, bans, who
+destroyed whose base, and permission changes are [staff-only kinds](/docs/rust/event-kinds/#staff).
+They are not on this screen because there is nothing to choose.
+
+## Canonical documents
+
+[`rust-link/PROTOCOL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/rust-link/PROTOCOL.md)
+§8.5 sets out why the boundary is the module's, and
+[`modules/rust/PLAN.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/modules/rust/PLAN.md)
+§23 records the presence rule.
diff --git a/src/content/docs/docs/ultima-online/verify-the-bridge.mdx b/src/content/docs/docs/ultima-online/verify-the-bridge.mdx
index 072c8ca..8dcf6f8 100644
--- a/src/content/docs/docs/ultima-online/verify-the-bridge.mdx
+++ b/src/content/docs/docs/ultima-online/verify-the-bridge.mdx
@@ -3,7 +3,8 @@ title: Verify the bridge
 description: Four checks on a ServUO shard, one per link in the chain, that distinguish "files copied" from "the bridge works".
 ---
 
-import { Aside, Steps } from '@astrojs/starlight/components';
+import { Aside, Code, Steps } from '@astrojs/starlight/components';
+import platform from '../../../../data/platform.json';
 
 A successful install is not a working bridge, and the failure is quiet in a specific way:
 **ServUO shells out to `dotnet build`, prints the output, ignores the exit code, and
@@ -54,9 +55,7 @@ So verify each link in the chain, in order. Each check tells you which one to fi
    curl -s http://127.0.0.1:8080/health
    ```
 
-   ```json
-   {"status":"ok","protocol":4,"plugin_connected":true,"database":"ok","uptime":"2m"}
-   ```
+   <Code lang="json" code={`{"status":"ok","protocol":${platform.games.uo.protocol},"plugin_connected":true,"database":"ok","uptime":"2m"}`} />
 
    **`plugin_connected: true` is the one that matters.** It is the only value in this whole
    sequence that distinguishes "files copied" from "the bridge works".
diff --git a/src/data/platform.json b/src/data/platform.json
index 3fce7c0..9e1d51f 100644
--- a/src/data/platform.json
+++ b/src/data/platform.json
@@ -26,7 +26,7 @@
     "the same way. Which game a repository belongs to is said once, under `games` below."
   ],
   "releases": {
-    "installer": "v0.8.0",
+    "installer": "v0.8.1",
     "Android-app": "v0.5.0",
     "link": "v2.3.0",
     "Module-uo": "v1.3.0",
diff --git a/src/data/reference.mjs b/src/data/reference.mjs
index 4dd17c2..1c99ff3 100644
--- a/src/data/reference.mjs
+++ b/src/data/reference.mjs
@@ -230,6 +230,141 @@ export const bridgeCfg = {
   },
 };
 
+/**
+ * rust-link's `sidecar.toml` — `Rust-Link` `sidecar/src/config.rs`, parsed from its serde
+ * structs the same way as uo-link's above. Each section is one `struct XCfg`.
+ */
+export const rustSidecarConfig = {
+  'game.bind': 'Loopback address the bridge plugin dials. Never move it off loopback',
+  'game.server_id':
+    "A cross-check against the id the plugin announces. A plugin naming another server is refused before anything it sent is stored",
+  'web.bind': 'Address the website reaches the sidecar on',
+  'web.auth_token': 'Shared secret the website must present. Generated and saved on first run if blank',
+  'store.path': "The sidecar's own database. Relative paths resolve beside the config file",
+  'store.retain_days': 'Days of raw event history the sidecar keeps. 0 keeps everything',
+};
+
+/**
+ * The environment variables rust-link reads, each overriding one key above. Read from the
+ * `get("RUSTLINK_…")` calls in the same file. An empty variable is ignored, which is what
+ * lets a panel declare one and leave it blank.
+ */
+export const rustSidecarEnv = {
+  RUSTLINK_GAME_BIND: 'game.bind',
+  RUSTLINK_SERVER_ID: 'game.server_id',
+  RUSTLINK_WEB_BIND: 'web.bind',
+  RUSTLINK_WEB_TOKEN: 'web.auth_token',
+  RUSTLINK_DB_PATH: 'store.path',
+  RUSTLINK_RETAIN_DAYS: 'store.retain_days',
+};
+
+/**
+ * The bridge plugin's own config — `Rust-Plugins` `overlay/oxide/plugins/RunicGateway.cs`,
+ * the public fields of its `PluginConfig` class. The framework writes it as
+ * `oxide/config/RunicGateway.json` or `carbon/configs/RunicGateway.json`.
+ *
+ * `readOnlyFromSite` marks the three keys the site's mod config editor shows but will not
+ * write: changing them from the website would cut the link carrying the change, or strand
+ * every row the site holds for this server.
+ */
+export const rustPluginConfig = {
+  Connection: {
+    Host: { why: 'Where the sidecar listens. Loopback is the trust boundary', readOnlyFromSite: true },
+    Port: { why: "The sidecar's game port. Must equal its game.bind port", readOnlyFromSite: true },
+    QueueCap: { why: 'Lines that may wait for a wedged sidecar before the oldest is dropped' },
+    ServerId: {
+      why: "This server's permanent identity on the website. Not the hostname, on purpose",
+      readOnlyFromSite: true,
+    },
+  },
+  Events: {
+    EventsEnabled: {
+      why: 'Whether the website may borrow values or change this world for events at all. Off by default',
+    },
+    EventsMaxCrates: { why: 'Crates one event step may place. Lowerable, never raisable past the ceiling' },
+    EventsMaxNpcs: { why: 'NPCs one event step may place' },
+    EventsMaxRecipients: { why: 'People one reward step may name' },
+    EventsMaxTallies: { why: 'Participation tallies counting at once' },
+    EventsMaxChat: { why: 'Longest line an event or a news post may say in chat' },
+    EventsMaxWorldCalls: { why: 'World events one run may call: helicopters, cargo ships, airdrops' },
+  },
+  Map: {
+    MapMaxSleepers: { why: 'Offline sleepers one live-map answer carries' },
+    MapMaxBases: { why: 'Tool cupboards and vending machines one live-map answer carries' },
+  },
+};
+
+/**
+ * Every event kind the Rust bridge sends, through its current protocol, as `Module-Rust`
+ * `server/catalogue.js` classifies them (PLAN.md §16, D71). The module is the side that
+ * enforces the boundary, so it is what this list is checked against — the same reason the
+ * UO ladder below is checked against the module and not against prose.
+ *
+ *   - `public`: a signed-out visitor may see the kind. Some are filtered field by field
+ *     inside it — a name for the presence audience, a position for staff — and that is the
+ *     module's business, summarised on the page rather than restated here.
+ *   - `presence`: public kinds that say a NAMED player was on the server. Their audience is
+ *     an operator's choice on Admin → Rust visibility, staff only by default. A subset of
+ *     the module's public list, kept separate here because that is how a reader needs it.
+ *   - `staff`: admins and moderators, and nobody else.
+ */
+export const rustEventKinds = {
+  public: {
+    'server.wipe': 'The map was wiped',
+    'server.initialized': 'The server came up',
+    'server.shutdown': 'The server went down',
+    'npc.boss.spawned': 'A RunicNPC boss appeared',
+    'world.event': "Rust's own world events: cargo, helicopters, Bradley, airdrops, the vendor",
+    'pvp.zone.created': 'Dynamic PVP opened a PvP zone',
+    'dt.started': 'A Dangerous Treasures event opened',
+    'dt.won': 'A Dangerous Treasures chest was won',
+    'gc.started': 'A guarded crate landed',
+    'gc.ended': 'A guarded crate was cleared',
+    'raid.started': 'A RaidableBases base appeared',
+    'raid.completed': 'A raid base was completed',
+    'raid.purchased': 'A raid base was bought',
+    'raid.locked': 'An admin locked a raid base to a player',
+  },
+  presence: {
+    'player.connected': 'A player joined',
+    'player.disconnected': 'A player left',
+    'player.respawned': 'A player respawned',
+    'player.death': 'A death — the kill feed',
+    'player.chat': 'A line of in-game chat',
+    'player.tally': "A minute's gathering, kills and title counts, summed rather than sent per swing",
+    'npc.boss.died': 'A RunicNPC boss was killed, naming the killer',
+  },
+  staff: {
+    'entity.destroyed': 'A building part was destroyed — it says where somebody lives',
+    'player.reported': "One player's report about another",
+    'player.banned': 'A ban, with the IP address',
+    'player.unbanned': 'An unban, with the IP address',
+    'player.login.attempt': 'A login attempt, with the IP address',
+    'player.approved': 'A login approved, with the IP address',
+    'account.link.requested': 'Somebody asked for a link code — never the code itself',
+    'account.unlinked': 'A Steam account was unlinked in game',
+    'perm.drift': 'A permission or group was changed in game, outside the site',
+    'config.outcome': "How a config save's reload ended, with the log tail when it failed",
+    'plugin.loaded': 'A plugin loaded, with the permissions it registers',
+    'plugin.unloaded': 'A plugin unloaded',
+    'lease.expired': 'A value an event borrowed was given back on its deadline',
+    'world.expired': 'Something an event placed ended on its deadline',
+    'clan.created': 'A clan was created',
+    'clan.disbanded': 'A clan was disbanded',
+    'clan.member.added': 'Somebody joined a clan',
+    'clan.member.left': 'Somebody left a clan',
+    'clan.member.kicked': 'Somebody was removed from a clan',
+    'npc.died': 'A RunicNPC NPC died, naming everyone who hurt it',
+    'npc.health': 'A RunicNPC NPC fell to a health threshold',
+    'npc.placement.changed': 'A RunicNPC placement changed',
+    'npc.boss.phase': "A boss changed phase — told in game only to the players near it",
+    'pvp.zone.deleted': 'A Dynamic PVP zone closed',
+    'dt.ended': 'A Dangerous Treasures event ended, won or not',
+    'gc.failed': 'A guarded crate timed out with its guards standing',
+    'raid.ended': 'A raid base despawned',
+  },
+};
+
 /**
  * The five-rung visibility ladder, from `module-uo`'s `server/utils/shardVisibility.js`.
  *
@@ -275,5 +410,7 @@ export const canonicalDocs = {
     'rust-link/INTEGRATION.md': 'Integrating with the sidecar',
     'rust-link/PROTOCOL.md': 'The wire protocol between the bridge plugin and the sidecar',
     'modules/rust/PLAN.md': 'The Rust module design of record',
+    'modules/rust/OPERATING.md': "Running Oxide: uMod's operator pages, plus the notes on RaidableBases and Guarded Crate",
+    'modules/rust/CARBON.md': 'Where Carbon differs from Oxide, and nowhere else',
   },
 };