The Cantor gets its own portal; bullets stop strobing

A dungeon now names the boss arena it ends in, and the arena decides the boss.
Three entrances in the hub: Warden's Descent, The Choir Vault, Proving Grounds.

That replaces the seed coin-flip from the last commit, which was the wrong
call. Which boss you are about to fight is the single thing a player decides
before walking into a dungeon, and rolling it for them makes that decision
unavailable. Only the Proving Grounds still leaves its arena open, because a
harness you re-enter every couple of minutes wants whichever fight comes up
first -- and it is the one place where "either will do" is true.

test_every_boss_has_a_dungeon_that_reaches_it is the check that matters here:
adding a boss and forgetting to give it a way in is now a failing test rather
than a boss nobody meets. The smoke test asserts all three portals open over a
real socket -- bots pick theirs by account id, so a run exercises each.

Bullets no longer animate. The sheet's eight frames are a COLOUR cycle rather
than a shape change, so running it had every bullet on screen strobing through
a palette in unison, which with a few hundred in the air is exactly as hard to
look at as it sounds. Each bullet holds one frame and turns slowly instead,
offset by its own id so a ring of twenty does not rotate as one rigid wheel.
The rate is slow enough that nothing completes a full turn inside its own
lifetime, so it reads as drift rather than spin, and a test pins that against
the longest-lived bullet in the game. The renderer slices four textures at
startup now instead of thirty-two.

check.sh clean, 414 tests, SMOKE PASS (22 assertions), all four diagnostics
green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -403,6 +403,29 @@ asserts the burst lands where the marker promised.
 other thing in the view. A warning you cannot see is an unavoidable hit with
 extra steps, which is the opposite of what a telegraph is for.
 
-**Which boss a run has comes from its seed, not its depth.** Depth is a dev flag
-that nothing in play raises, so keying the arena to it meant the second boss
-existed and no player could ever reach it.
+**Each boss has its own entrance in the hub.** A dungeon names the arena it ends
+in, and the arena decides the boss. Which fight you are walking into is the one
+thing a player chooses before a run, so it is not rolled for them — not from the
+depth (a dev flag nothing in play raises, which left the second boss
+unreachable) and not from the seed either. Only the Proving Grounds leaves it
+open, because a harness you re-enter every couple of minutes wants whichever
+fight comes up first.
+
+---
+
+## Bullets do not animate
+
+**One frame, and a slow turn.** The bullet sheet's eight frames are a colour
+cycle rather than a shape change, and running it meant every bullet on screen
+strobed through a palette in unison — genuinely hard to look at with a few
+hundred in the air, which is the normal case for this game.
+
+Each bullet now holds one frame and rotates at `Art.BULLET_SPIN_RATE`, offset by
+its own id so a ring of twenty does not turn as one rigid wheel. The rate is
+slow enough that nothing completes a full turn inside its own lifetime, so it
+reads as drift rather than as spin — a test pins that against the
+longest-lived bullet in the game.
+
+The other seven frames stay in the atlas because that is what the source art is.
+Nothing draws them, and the renderer now slices four textures at startup instead
+of thirty-two.

docs/ROADMAP.md

@@ -20,8 +20,8 @@ What "everything passes" currently means. Numbers move; the shape does not.
 | Gate | Covers | Runtime |
 | --- | --- | --- |
 | `tools/check.sh` | every script parses and type-checks | ~5s |
-| `tools/test.sh` | 409 GUT tests, no SceneTree | ~4s |
-| `tools/smoke.sh` | 19 assertions over a real ENet socket: handshake, auth, character creation and persistence, both dungeon kinds, escape, hard kill, polite disconnect | ~40s |
+| `tools/test.sh` | 414 GUT tests, no SceneTree | ~4s |
+| `tools/smoke.sh` | 22 assertions over a real ENet socket: handshake, auth, character creation and persistence, both dungeon kinds, escape, hard kill, polite disconnect | ~40s |
 | `diag_prediction.tscn` | client-prediction gap, with injected clock drift | ~10s |
 | `diag_progression.tscn` | kill → xp → level → health, death → retire → roster, swap guards | ~10s |
 | `diag_loot.tscn` | drop → snapshot → pick up → persist → use → drop, and both loot visibilities on the wire | ~10s |
@@ -74,24 +74,33 @@ draws whatever it holds. The defence is what the server declines to send.
 
 ## Dungeon kinds · *done*
 
-Two entrances stand side by side in the hub, labelled, and open different runs.
+Three entrances stand side by side in the hub, labelled with the fight each one
+ends in.
 
-| Dungeon | `Dungeons` id | Enemy HP | Boss HP | Loot chance |
-| --- | --- | --- | --- | --- |
-| Warden's Descent | `warden_descent` | ×1 | ×1 (3600) | ×1 (trash 8%) |
-| Proving Grounds | `proving_grounds` | ×0.2 | ×0.08 (288) | ×10 (trash 80%, clamped) |
+| Dungeon | `Dungeons` id | Arena / boss | Enemy HP | Boss HP | Loot chance |
+| --- | --- | --- | --- | --- | --- |
+| Warden's Descent | `warden_descent` | `warden_hall` → the Warden | ×1 | ×1 | ×1 (trash 8%) |
+| The Choir Vault | `choir_vault` | `choir_vault` → the Cantor | ×1 | ×1 | ×1 |
+| Proving Grounds | `proving_grounds` | *whichever the seed rolls* | ×0.2 | ×0.08 | ×10 (clamped) |
+
+**A dungeon names its arena, and the arena decides its boss.** Which boss you
+are about to fight is the one thing a player chooses before walking into a
+dungeon, so it must not be rolled for them. Only the Proving Grounds leaves
+`arena` empty — it exists to reach *a* fight fast, and runs there last a couple
+of minutes, so the one you want is one re-entry away.
 
 The Proving Grounds is a **test harness you can walk into**: same generator,
-same rooms, same enemies, the same four-phase Warden — everything simply dies
-faster and drops more. A manual pass over loot, the inventory, dropping and all
-four boss phases takes a couple of minutes instead of a quarter of an hour, and
-because it is a portal rather than a launch flag you can compare the two back to
-back without restarting the server.
+same rooms, same enemies, but everything dies far faster and drops far more. A
+manual pass over loot, the inventory, dropping and all four boss phases takes a
+couple of minutes instead of a quarter of an hour, and because it is a portal
+rather than a launch flag you can compare it to a real run without restarting
+the server.
 
-Adding a third dungeon is one entry in `Dungeons.ORDER` plus one more `P` marker
-in the lobby stamp — the Nth marker, in reading order, opens the Nth entry.
+Adding a dungeon is one entry in `Dungeons.ORDER` plus one more `P` marker in
+the lobby stamp — the Nth marker, in reading order, opens the Nth entry, so the
+two have to stay in the same order.
 
-Three things worth knowing:
+Two more things worth knowing:
 
 - **It is multipliers over the shared content, not a copy of it.** A duplicated
   `Content` would drift the moment anything was tuned, and "identical but
@@ -99,10 +108,9 @@ Three things worth knowing:
 - **Which dungeon you enter comes from where you stand.** `SimWorld.portal_at()`
   resolves the server-side position; the `PORTAL_USED` event carries the answer.
   No client message names a dungeon, which is what stops anyone picking the
-  generous loot table from the real run.
-- **`accepts_new_party_member` takes the dungeon id.** Without that, walking
-  into the Proving Grounds would drop you into whatever standard run happened
-  to still be forming.
+  generous loot table from a real run. `accepts_new_party_member` compares
+  dungeon ids too, so walking into one entrance can never drop you into
+  another's forming run on timing alone.
 
 ---
 
@@ -371,10 +379,11 @@ feet is a coin flip, the same burst with a second of notice is a question.
 | Antiphon | chase at 220u | It comes for you; walls punish running straight. |
 | Final Cadence | orbit | Movement and telegraphs at once. |
 
-**Which boss you meet comes from the run's seed**, not its depth. Depth is a dev
-flag nothing in play raises, so keying the arena to it left the second boss
-existing and unreachable. Every run rolls a fresh seed, so it is a coin flip per
-dungeon, and `test_both_bosses_are_reachable_at_the_depth_people_play` pins it.
+**The Cantor has its own portal in the hub.** Which boss a run ends with follows
+from the arena its dungeon names, not from the seed and certainly not from
+`--depth`, which nothing in play raises.
+`test_every_boss_has_a_dungeon_that_reaches_it` pins that adding a boss without
+giving it a way in is a failing test rather than a boss nobody meets.
 
 `Content.ALL_ENEMIES` / `ALL_BOSSES` exist because five places were
 hand-maintaining their own copy of the content list, and `tools/export_content.gd`