Documentation pass before a compact

Audited rather than appended. What had drifted, now corrected:

- ROADMAP's opening still described the project before this session: no
  word of the anti-cheat fixes, 468 tests, 23 smoke assertions, and a
  screenshot list half its current size. It now summarises the session,
  lists seven open items raised with the user and not yet decided (the
  boss-kill experience edge, the hub frame rate, aggro through corner
  cracks, the Warden-hall alcoves, one-tile arena doors, the Proving
  Grounds before release, hit feedback), and quotes current numbers.
  Its radius table still gave BULLET_INTEREST_RADIUS as the bullet cull
  at 2200; it is a 2900 ceiling over a per-bullet check.
- NETCODE described the flat bullet radius as the design, claimed the
  respawn lockout gates connected players (they are unbound on death),
  and called actor scoping "next stage". All corrected, and a new section
  covers what the handshake and server now refuse: duplicate sessions,
  reasons that now arrive, paced control messages, coalesced store
  writes, bounds-checked hot decoders.
- DECISIONS gains the audit's rules, the Proving Grounds' status, the
  tunnel and entrance rules, and the interface calls -- each flagged as
  the user's or as a judgement call.
- ARCHITECTURE's file map lacked the actor classes, the dev auth
  provider, the menu backdrop and any tools section.
- README told people to start a client with --name, which now only names
  bot characters, and its feature list predated fog, tunnels and carried
  health. CLAUDE.md gains three invariants (health on the record, one
  session per account, tools that host use scratch data); WORKFLOW gains
  the four traps this session fell into or nearly did.

Every doc was checked for unintended deletions against the session's
start, and every relative link resolves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -14,7 +14,7 @@ the obvious default.
 ```bash
 tools/check.sh      # parse-check every script (~5s) -- run after every edit
 tools/test.sh       # 576 GUT tests, headless (~4s)
-tools/smoke.sh      # real server + 4 bot clients over ENet (~40s)
+tools/smoke.sh      # real server + 5 bot clients over ENet (~40s)
 tools/server.sh     # dedicated server
 tools/client.sh --listen            # host and play, no menu
 ```
@@ -209,6 +209,14 @@ ticks in milliseconds with no SceneTree.
   from `_place`.** `SimWorld` knows nothing about characters and builds a blank
   player on every instance change, so any new path that puts someone in a world
   must go through `_place` or it hands them a level-1 body with an empty bag.
+  Current health comes from the record too (`Character.hp`), and is banked by
+  `_bank_health` wherever a player leaves a world — miss one and that door
+  becomes a free heal.
+- **One account, one session.** `on_hello` refuses a peer whose account is
+  already playing; two live players on one character duplicate items.
+- **Anything that calls `Net.host()` from a tool sets `GameOpts.store_path` and
+  `GameOpts.account_override` first.** The default is the player's real store and
+  account; `screenshot.tscn` once played their character into dungeons.
 - **A player's combat numbers are derived, never stored.** `PlayerStats.build()`
   recomputes them from the character's upgrade ids every time, so a saved stat
   cannot disagree with the upgrades that produced it. Upgrade *riders* (split