Stage 5: bosses that move, attacks that warn, and a second boss

Boss movement is a property of the PHASE, not of the boss -- a fight that
stands still and then starts hunting you is one boss with two phases. Four
modes (STATIC, ORBIT, CHASE, WAYPOINTS) handled generically in
SimWorld._move_boss, so a boss that moves is still data. BossDef.stationary
is gone rather than kept beside the phases: a flag claiming the boss stood
still while a phase walked around would be a second source of truth and the
wrong one, so moves() is derived.

CHASE holds a distance instead of closing, because a boss standing on top of
you is a boss whose bullets cannot be read. Waypoints are fractions of the
arena so one phase works in rooms of different sizes. Every mode is speed
clamped in one place -- ORBIT computes an absolute destination and would
otherwise snap onto its circle on the first tick -- and movement slides
against geometry so a boss cannot walk through the pillars its own arena was
designed around.

The room clamp moved to after movement, where it is finally load-bearing. It
was a no-op while every boss stood still, which is exactly when an invariant
is cheapest to establish: boss rooms deliberately do not lock, so walking out
is always an escape, and that only holds if the boss cannot follow.

TelegraphedStrikeEmitter marks spots and fills them a moment later. The moment
between is the feature: a burst at your feet is a coin flip, the same burst
with a second of notice is a question. It stays stateless like every other
emitter -- they are shared resources and two bosses of the same kind must not
stomp each other -- so strike positions are derived from the volley number and
a test asserts the burst lands where the marker promised. Markers are drawn
through fog and through walls, unlike everything else in the view, because a
warning you cannot see is an unavoidable hit with extra steps.

The Cantor of the Vault fights in the choir vault: static, then a four-corner
circuit, then a chase, then orbiting while marking. It exists to prove the
format stretched, and a test asserts it uses both new mechanisms.

Which boss a run has now comes from its SEED rather than its depth. Depth is a
dev flag nothing in play raises, so the arena was keyed to something no player
can change and the second boss was unreachable in an actual game.

Two things found while finishing:

  - tools/export_content.gd had a hand-maintained boss list and had already
    gone stale, silently not writing the Cantor. Content.ALL_ENEMIES and
    ALL_BOSSES now feed the export tool, the renderer and five tests that each
    kept their own copy.
  - diag_loot failed intermittently after another diagnostic. Taking over from
    the bot cleared its input queue but not its HELD input, so a starved server
    coasted on the bot's last movement vector for half a second and walked the
    player off the item it had been placed on. The press arrived correctly,
    which is why "the press reached the simulation" passed while everything it
    should have caused failed.

check.sh clean, 409 tests, SMOKE PASS (19 assertions), all four diagnostics
green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/diag_loot.gd

@@ -158,6 +158,13 @@ func _enter_dungeon() -> void:
 	# Drop the bot's backlog. The client keeps roughly INPUT_TARGET_LEAD frames
 	# in flight, so without this the first press queues up behind them.
 	p.input_queue.clear()
+	# And stop it COASTING. A starved server repeats the last frame it was
+	# given for INPUT_MAX_AGE ticks, so the bot's final movement vector kept
+	# walking the player for half a second after the takeover -- far enough off
+	# the item it had been placed on that the pickup found nothing. The press
+	# itself arrived correctly, which is why "the press reached the simulation"
+	# passed while everything it should have caused failed.
+	p.held_input = InputFrame.new()
 	# Long arrival protection instead of god mode: it is a state the game
 	# already has, so nothing here is testing a code path players never hit.
 	p.spawn_grace = 100000

tools/export_content.gd

@@ -17,10 +17,9 @@ func _init() -> void:
 	DirAccess.make_dir_recursive_absolute(OUT_ENEMIES)
 	DirAccess.make_dir_recursive_absolute(OUT_BOSSES)
 	var written := 0
-	for id in [Content.ENEMY_DRIFTER, Content.ENEMY_TURRET, Content.ENEMY_STALKER,
-			Content.ENEMY_DUMMY]:
+	for id in Content.ALL_ENEMIES:
 		written += _save(Content.enemy(id), "%s/%s.tres" % [OUT_ENEMIES, id])
-	for id in [Content.BOSS_WARDEN]:
+	for id in Content.ALL_BOSSES:
 		written += _save(Content.boss(id), "%s/%s.tres" % [OUT_BOSSES, id])
 	print("exported %d resources" % written)
 	quit(0)

tools/smoke.sh

@@ -120,6 +120,10 @@ check  "and are played"              "$OUT/server.log" "playing 'bot1'"
 # do is produce a drop to act on -- that end of it is tools/diag_loot.tscn.
 check  "inventories reach the save file" "$OUT/characters.json" "\"inventory\""
 check  "a dungeon instance opened"   "$OUT/server.log" "opened dungeon instance"
+# Which arena a run gets is a coin flip on its seed, so this only asserts that
+# SOME boss spawned and that it is one the content knows about -- which is what
+# catches an arena wired to a boss id that does not resolve.
+check  "a boss spawned"              "$OUT/server.log" "BOSS_SPAWNED (warden|cantor) in instance"
 # Bots pick their entrance from their account id, so a run with several of them
 # opens one of each kind. This is what catches a portal wired to the wrong
 # dungeon, or an instance matcher that ignores which dungeon was asked for.