docs(site): the Event System — the platform's facts, and two pages for it

Phase 16c of the events plan: `runicgateway.com`'s half of the workstream, now
that `main` carries the engine, the module, the app and the bundle.

The checks were already red and named their own answers:

* `checkFacts` — nine values had moved. Protocol 5 → 7 in all three declaration
  sites, `moduleApi` 1.9.0 → 1.10.0, the bundle to 2026.09.10 with sidecar
  v2.2.0 and overlay v1.2.0, `link` v2.2.0, `Module-uo` v1.2.2.
* `checkReference` — twenty-seven `Bridge.cfg` keys the site listed nowhere: the
  events switch and its sweep, the ten caps, the oracle NPC, the two lease keys
  and the seven participation keys. They are five new groups rather than an
  appendix to an existing one, because `EventsEnabled` is a second consent
  switch and belongs beside its own ceilings.

Two pages, matching the treatment Teams has:

* **Scheduled events** (Administration) — where it is and who sees it, authoring
  and immutable versions, the switchboard that arrives off, caps as a condition
  on an `UPDATE` rather than a role check, the dry run, the run console, what an
  event owns versus what it borrows, generated cleanup, the shard's own switches,
  and what a player sees.
* **Events architecture** — the two sentences it turns on, what is a table and
  what deliberately is not, budgets in SQL, the ledger's two rules, at-most-once
  on a wire that can lose an answer, the three layers, and the four omissions.

And the rest of the surface:

* `/privacy` gains **`deploy-events`** — the participation ledger is personal
  data and no row named it. Scores and ranks against a module-opaque member key,
  linked to an account where one is linked; the diagnostic log swept after 90
  days on terminal runs only; the run, its steps and its participants not swept
  at all, because they are the record of what was done to a shared world.
  `deploy-game-data`'s citation moves from `link/v4.md` to `v7.md`.
* **Protocol versions** — the most recent bump touched *five* repositories, and
  the `website` row is the interesting one: core is normally out of a protocol
  bump's reach and this one reached it, because what changed was not a game noun
  but the shape of a thing core owns the ledger for. The store-migration
  paragraph now says four bumps' worth rather than two.
* Two capability entries, so `/`, `/features/` and `/modules/` stop omitting the
  subsystem — an Administration item, and an **Event calendar** under Community
  with `/site/events` as its deep link. Deliberately *not* `needsModule`: a bare
  core can author and run an event, and only the world verbs need a module.
* **`reference/event-catalog` is retitled "Shard event catalog"** and says what
  it is not. Two things in the docs were called an event catalog; the route is
  unchanged, so nothing outside this repository breaks.
* `canonicalDocs` gains `website/EVENTS.md` and moves `link/v4.md` → `v7.md`.

No screenshots. Capturing the events surfaces means standing the whole rig back
up — game server, sidecar, core, module, a published event with a live run — for
two or three images that no check requires, and the engagement workstream's own
site leg added none either.

`npm run verify` green end to end, including `checkReference` against the
protocol spec that only reached `docs` `main` in RunicGateway/docs#232 — the
seventh cutover step, which 16b had left on `edge`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

src/data/reference.mjs

@@ -151,6 +151,49 @@ export const bridgeCfg = {
     AdminReasonMaxLength: 'Reason field cap',
     AdminBanMaxDurationSec: 'Longest ban the site may set',
   },
+  'Scheduled events': {
+    EventsEnabled:
+      'Whether the website may run scheduled events against this world at all. Off by ' +
+      'default, and deliberately a separate switch from AdminWriteEnabled',
+    EventsSweepSeconds: 'How often expired gates are collected and lost objects pruned',
+    EventsMinSaveIntervalSec:
+      'Shortest gap between world saves, counted from the last save by anyone. A save ' +
+      'asked for too soon is refused rather than queued',
+  },
+  'Event caps': {
+    EventsMaxCreatures: 'Creatures one call may spawn',
+    EventsMaxBosses: 'Enhanced "boss" variants one call may spawn',
+    EventsMaxNpcs: 'Oracle NPCs one call may place',
+    EventsMaxDecor: 'Decoration items one call may place',
+    EventsMaxGateMinutes: 'Longest a temporary gate may stand',
+    EventsMaxOwnedPerRun: 'Objects one run may own across every verb — the runaway bound',
+    EventsMaxSpread: 'How far from the chosen spot things may be scattered',
+    EventsMaxBossMultiplier: 'How much harder than normal a boss may be made',
+    EventsMaxGrantPerRun: 'How many characters one item grant may reach',
+    EventsMaxGrantStack: 'How large one granted stack may be',
+  },
+  'The oracle NPC': {
+    EventsOracleMaxLines: 'Keyword lines it will answer to',
+    EventsOracleGreetRange: 'How close a player must be to be greeted',
+    EventsOracleSpeechRange: 'How close a player must be to be heard',
+    EventsOracleGreetCooldownSec: 'How often it greets the same player',
+    EventsOracleAnswerCooldownSec: 'How often it answers the same player',
+  },
+  Leases: {
+    LeaseMaxDurationSec:
+      'Longest lease this shard will hold, whatever the site asks for. A longer request ' +
+      'is refused rather than shortened',
+    LeaseGraceSec: 'How long a restored lease stays listed, so a late teardown still gets a verdict',
+  },
+  Participation: {
+    ParticipationSweepSeconds: "How often everyone standing in a run's area is credited",
+    ParticipationKillWeight: 'What one kill inside the area is worth against one minute in it',
+    ParticipationMaxRuns: 'Runs counted at once',
+    ParticipationMaxMembers: 'Members counted per run',
+    ParticipationMaxRadius: 'Widest area an event may declare',
+    ParticipationGraceSec: "How long a closed run's tally stays readable",
+    ParticipationSnapshotChunk: "Members resolved per yield of the game's core thread",
+  },
   Accounts: {
     SignupMode: 'How game accounts may be created',
     AccountCreateEnabled: 'Allow creation at all',
@@ -175,12 +218,13 @@ export const canonicalDocs = {
   'website/MODULE_SYSTEM.md': 'Why the module system is shaped this way',
   'website/MODULE_API.md': 'Everything a module may do — the contract',
   'website/TEAMS.md': 'Teams as a platform primitive',
+  'website/EVENTS.md': 'The Event System — leases, the ledger, and the module seam',
   'website/SHARD_VISIBILITY.md': 'The audience ladder, for administrators',
   'website/THEMING_AND_NAV.md': 'Admin-configurable theme, assets and navigation',
   'website/TRUSTED_DEVICES_MFA.md': 'Trusted devices and the second factor',
   'link/PLAN.md': 'The sidecar design of record, the data catalog and the wire protocol',
   'link/INTEGRATION.md': 'Integrating with the sidecar',
-  'link/v4.md': 'Protocol 4, and its cross-repository obligations',
+  'link/v7.md': 'The current protocol, and its cross-repository obligations',
   'link/ADMIN_CONTROLS.md': 'What the site may command the game to do',
   'installer/INSTALL.md': 'The operator guide for setting a shard up',
   'installer/PLAN.md': "The installer's design of record",