Documentation pass for a cold start

Audited the whole set rather than appending to it, and the two files a fresh
session reads first were both wrong.

README claimed the emergency escape takes three seconds and is CANCELLED BY
DAMAGE. It takes one, and damage explicitly does not interrupt it -- that is a
settled decision with its own entry in DECISIONS.md, and the front page said
the opposite. It also described one stationary boss, one hub portal, and none
of characters, permadeath, levels, inventory, loot, upgrades, settings or
credits. Rewritten, with the "not ready for the internet" warning made explicit.

ROADMAP had no "what is next" at all: every stage reads *done*, which for a
cold start is a dead end. It opens with where things stand and a table of
candidates -- auth, a reason to play past level 15, an economy, hit feedback,
replacing the non-redistributable packs, DTLS -- each with what blocks it, and
says plainly that the user has chosen none of them. Open questions renumbered
from the orphaned 8-11 they were left at, with the solved one dropped and three
real ones added.

ARCHITECTURE's file map listed two files twice, missed five subsystems
(upgrades, stats, poison, settings, credits, the UI theme), and still said
MapGen.build() is "the entry point both sides use" -- it is server-only, and
the whole anti-map-hack story depends on that. Rebuilt by layer and audited
against the tree: every path listed exists, and every one of the 64 source
files is covered.

CLAUDE.md's security paragraph said a client can send "exactly two things"
plus two roster requests. There are five client -> server messages. That number
is the security model, so it is now a table naming each one and what it
carries. Also records that nothing automated can see the screen.

Smaller: a stale 156/156 test count in ASSETS.md, and test counts refreshed to
468 where they are quoted.

check.sh clean, 468 tests, SMOKE PASS, all four diagnostics green, no broken
internal links.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -13,6 +13,41 @@ that may already have an answer.
 
 Legend: **done** · **partial** (works, with a stated gap) · **todo** (not started)
 
+---
+
+## Where things stand
+
+**Every stage in the original brief is built.** The MVP asked for a twin-stick
+bullet hell, server-side hit validation, predictable enemies, an adaptable boss,
+a lobby hub with dungeon runs, and an emergency escape. All of that exists, plus
+the four stages that followed: characters and permadeath, inventory and loot,
+upgrades, and a second boss that moves.
+
+So there is no obvious "next ticket". What follows is the honest list of
+candidates, none of which the user has chosen — **ask before starting one.**
+
+| Candidate | Why it might be next | What it needs first |
+| --- | --- | --- |
+| **Replace `LocalAuthProvider`** | It is the one thing standing between this and a server anyone else can reach. Any client can claim any account id. | Nothing technical — it is one `AuthProvider` subclass. Needs a decision about Steam vs something else. |
+| **A reason to keep playing past level 15** | Levels cap, `--depth` never rises in play, and a cleared dungeon gives experience and a potion. The long loop is missing. | Open question 1 below. |
+| **An economy** | Loot only drops from kills; nothing sells anything. The quartermaster is the obvious shop and has no currency to take. | Open questions 2 and 3. |
+| **Impact and hit feedback** | `Art.IMPACT` is loaded and validated and nothing plays it. No hit flash, no screen shake, no death animation. | Nothing. This is the cheapest visible win. |
+| **Replace the two non-redistributable packs** | Bullet and FX art is local-only and non-commercial, which blocks both a public repo copy and a commercial release. | CC0 or CC BY replacements. See [ASSETS.md](ASSETS.md). |
+| **Transport encryption** | `ENetMultiplayerPeer` supports DTLS. Required before a public server, not before then. | Follows the auth decision. |
+
+Each stage below also carries its own **Known gaps** section — those are smaller
+and more specific than the table above.
+
+### Known flake
+
+`tools/smoke.sh` failed once in a pre-push hook and then passed on four
+consecutive runs with no stray processes. It was not reproduced and is not
+diagnosed. The suspicion is machine load — the smoke test has fixed tick budgets
+and was competing with a full suite run — but that is a guess. If it recurs,
+that is the first thing to check.
+
+---
+
 ## Verification surface
 
 What "everything passes" currently means. Numbers move; the shape does not.
@@ -441,18 +476,24 @@ Not oversights — each was considered and rejected for now, with the reasoning
 ## Open questions for the user
 
 Genuinely unspecified. **Do not guess at these** — each changes the design, and
-several have no obvious default.
+several have no obvious default. The seven questions that blocked Stage 4 were
+answered and are recorded in [DECISIONS.md](DECISIONS.md#upgrades); these are
+what is left.
 
-### Blocking nothing yet
-
-8. **What advances dungeon depth?** `--depth` is a dev flag; nothing raises it
-   in play. Depth drives map size and could drive difficulty and rewards.
-9. **Where do items come from outside a dungeon?** Loot only drops from kills.
-   If the hub should sell potions, that is the Stage 4 NPC's second job — and
-   it needs a currency, which the game does not have.
-10. **Should items stack?** Four potions currently take four slots, which makes
-    a 4-slot bag small. Stacking is a count byte per slot plus a rule for
-    splitting one; neither is hard, but both change the UI.
-11. **Attribution for four asset packs.** See [ASSETS.md](ASSETS.md) — two are
-    non-redistributable and local-only, and there is no in-game credits screen
-    yet, which CC BY 4.0 requires for the audio.
+1. **What advances dungeon depth?** `--depth` is a dev flag and nothing raises
+   it in play. Depth already drives map size and could drive difficulty and
+   rewards. Without an answer there is no progression past level 15.
+2. **Where do items come from outside a dungeon?** Loot only drops from kills.
+   If the hub should sell potions, that is the quartermaster's second job.
+3. **Is there a currency?** Nothing drops money and nothing costs anything. A
+   shop needs one; so does any reward for a cleared run beyond experience.
+4. **Should items stack?** Four potions currently take four slots, which makes a
+   four-slot bag small. Stacking is a count byte per slot plus a rule for
+   splitting one — neither is hard, and both change the UI.
+5. **Does a dungeon ever get harder within a run?** Enemies are placed once at
+   generation and never reinforce. That is a deliberate decision
+   ([DECISIONS.md](DECISIONS.md#world)), but it means a slow party is never
+   punished for it.
+6. **What happens to a party when one member dies?** Permadeath removes them to
+   the roster screen while the run continues without them. Nobody has said
+   whether that is right.