Documentation pass before a compact

Audited rather than appended. What had drifted, now corrected:

- ROADMAP's opening still described the project before this session: no
  word of the anti-cheat fixes, 468 tests, 23 smoke assertions, and a
  screenshot list half its current size. It now summarises the session,
  lists seven open items raised with the user and not yet decided (the
  boss-kill experience edge, the hub frame rate, aggro through corner
  cracks, the Warden-hall alcoves, one-tile arena doors, the Proving
  Grounds before release, hit feedback), and quotes current numbers.
  Its radius table still gave BULLET_INTEREST_RADIUS as the bullet cull
  at 2200; it is a 2900 ceiling over a per-bullet check.
- NETCODE described the flat bullet radius as the design, claimed the
  respawn lockout gates connected players (they are unbound on death),
  and called actor scoping "next stage". All corrected, and a new section
  covers what the handshake and server now refuse: duplicate sessions,
  reasons that now arrive, paced control messages, coalesced store
  writes, bounds-checked hot decoders.
- DECISIONS gains the audit's rules, the Proving Grounds' status, the
  tunnel and entrance rules, and the interface calls -- each flagged as
  the user's or as a judgement call.
- ARCHITECTURE's file map lacked the actor classes, the dev auth
  provider, the menu backdrop and any tools section.
- README told people to start a client with --name, which now only names
  bot characters, and its feature list predated fog, tunnels and carried
  health. CLAUDE.md gains three invariants (health on the record, one
  session per account, tools that host use scratch data); WORKFLOW gains
  the four traps this session fell into or nearly did.

Every doc was checked for unintended deletions against the session's
start, and every relative link resolves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/WORKFLOW.md

@@ -224,6 +224,40 @@ character decoder, which then read a field its encoder never wrote. Both are
 codecs and both had the same trailing lines. Check the match count when patching
 by pattern, not by line.
 
+### Slicing between two headings deletes whatever was between them
+
+Replacing a section by cutting from its heading to "the next big heading" took
+**451 lines** of the roadmap with it — every stage section sat between the two —
+and it was committed and pushed before anything noticed, because no gate reads
+prose. End a slice at the marker that actually closes the section (here the
+`---` rule after it), and before committing any doc edit, check
+`git diff --numstat` for a deletion count bigger than the edit you meant.
+
+### A mutation that survives is a test that cannot fail
+
+Twice in one session a new test passed with its fix reverted. One staged a turret
+behind a barricade — a turret's muzzle offset cannot clear its own radius plus a
+tile, so the scenario could never have failed. Another computed its sample point
+*from* the constant under test, so zeroing the constant moved the sample instead
+of failing it. Reverting the fix and watching the test go red is the only way to
+know it tests anything.
+
+### A flaky gate needs its logs kept, not rerun
+
+The smoke test failed intermittently for weeks, always in the pre-push hook,
+which discards logs; every rerun passed and the trail went cold. Pushing with
+`KEEP=1 git push` kept the third failure's logs, which named the cause in one
+grep (a bot walking through the wrong portal). Keep the evidence first; rerun
+second.
+
+### A tool that hosts a server must not use the player's data
+
+`screenshot.tscn` hosted a listen server with the default character store and
+account — the player's own — and walked their character into dungeons for
+pictures. Every diagnostic already set `GameOpts.store_path` and
+`GameOpts.account_override`; the screenshot tool had simply never been asked to.
+Anything new that calls `Net.host()` sets both first.
+
 ## CI
 
 `.github/workflows/ci.yml` runs check → test → smoke on a container image with