Documentation pass for a cold start

Audited the whole set rather than appending to it, and the two files a fresh
session reads first were both wrong.

README claimed the emergency escape takes three seconds and is CANCELLED BY
DAMAGE. It takes one, and damage explicitly does not interrupt it -- that is a
settled decision with its own entry in DECISIONS.md, and the front page said
the opposite. It also described one stationary boss, one hub portal, and none
of characters, permadeath, levels, inventory, loot, upgrades, settings or
credits. Rewritten, with the "not ready for the internet" warning made explicit.

ROADMAP had no "what is next" at all: every stage reads *done*, which for a
cold start is a dead end. It opens with where things stand and a table of
candidates -- auth, a reason to play past level 15, an economy, hit feedback,
replacing the non-redistributable packs, DTLS -- each with what blocks it, and
says plainly that the user has chosen none of them. Open questions renumbered
from the orphaned 8-11 they were left at, with the solved one dropped and three
real ones added.

ARCHITECTURE's file map listed two files twice, missed five subsystems
(upgrades, stats, poison, settings, credits, the UI theme), and still said
MapGen.build() is "the entry point both sides use" -- it is server-only, and
the whole anti-map-hack story depends on that. Rebuilt by layer and audited
against the tree: every path listed exists, and every one of the 64 source
files is covered.

CLAUDE.md's security paragraph said a client can send "exactly two things"
plus two roster requests. There are five client -> server messages. That number
is the security model, so it is now a table naming each one and what it
carries. Also records that nothing automated can see the screen.

Smaller: a stale 156/156 test count in ASSETS.md, and test counts refreshed to
468 where they are quoted.

check.sh clean, 468 tests, SMOKE PASS, all four diagnostics green, no broken
internal links.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -13,7 +13,7 @@ the obvious default.
 
 ```bash
 tools/check.sh      # parse-check every script (~5s) -- run after every edit
-tools/test.sh       # GUT suite, headless (~3s)
+tools/test.sh       # 468 GUT tests, headless (~4s)
 tools/smoke.sh      # real server + 4 bot clients over ENet (~40s)
 tools/server.sh     # dedicated server
 tools/client.sh --listen            # host and play, no menu
@@ -37,6 +37,12 @@ test cannot cover any of them: bots are poor shots, so they rarely kill
 anything, which means they neither earn levels, produce drops, nor ever reach
 the quartermaster.
 
+**Nothing automated can see the screen.** `check.sh`, the suite and `smoke.sh`
+have all passed with the entire interface rendering unstyled, an invisible
+slider and an invisible scrollbar. After touching anything under `src/ui/` or
+`src/view/`, run `screenshot.tscn` and open the files. It needs a display, so it
+is not a gate.
+
 Everything after `--` goes to `GameOpts.parse()`:
 
 | Flag | Effect |
@@ -69,12 +75,22 @@ push (~35s, skip deliberately with `SKIP_SMOKE_HOOK=1 git push`).
 
 **The server decides everything; the client only sends intent.**
 
-A client can send exactly two things: an [InputFrame] (move vector, aim angle,
-five button bits, an inventory slot) and a handshake — plus the two low-rate
-character-roster requests, which are also pure intent. There is no message for
-"I moved here", "I hit that", "I took damage", "my escape finished" or "I now
-own this item". Adding one would collapse the whole security model, so don't —
-validate-after-the-fact is strictly weaker than having no code path at all.
+There are exactly **five** client -> server messages, and that number is worth
+watching:
+
+| Message | Carries |
+| --- | --- |
+| `c_hello` | protocol version + an opaque auth ticket |
+| `c_input` | an [InputFrame]: move vector, aim angle, five button bits, an inventory slot |
+| `c_select_character` | a character id, checked against *that account's* list |
+| `c_create_character` | a name, sanitised at the boundary |
+| `c_choose_upgrade` | an index into the three options the SERVER put on the table |
+
+Every one is pure intent. There is no message for "I moved here", "I hit that",
+"I took damage", "my escape finished", "I now own this item", "I am in this
+dungeon" or "my damage is X". Adding one would collapse the whole security
+model, so don't — validate-after-the-fact is strictly weaker than having no code
+path at all.
 
 When a new player action needs a message, look at whether it fits in the input
 frame first. Item use and drop did, and got the redundancy, the replay guard and
@@ -95,7 +111,7 @@ and `tests/integration/test_replica_parity.gd` pin this down.
 | `src/actors/` | Data-only `Resource` definitions: `EnemyDef`, `BossDef`, `ItemDef`, `LootDrop`, `DungeonDef`, `UpgradeDef`. Shapes, not instances. |
 | `src/sim/patterns/` | Bullet emitters — the authoring surface for every enemy and boss. Emitters are stateless: they are shared resources, and two bosses of the same kind must not stomp each other. |
 | `src/sim/map_grid.gd` | Tile grid: collision, line of sight, chunk streaming. |
-| `src/sim/map_gen.gd` | Dungeon generation; `build()` is the only entry point. |
+| `src/sim/map_gen.gd` | Dungeon generation. **Server-side only** — handing a client the seed would be a map hack with no work required. |
 | `src/content/rooms.gd` | Hand-authored room stamps (hub, boss arenas) as text. |
 | `src/meta/` | Accounts, characters, persistence, XP curve. Server-owned. |
 | `src/content/content.gd` | All enemies and bosses, defined in code. Source of truth. |