docs(roadmap): M4-b lands; the Title screen was already built

The creation screen is done — 302 client tests (up from the 250 baseline),
content build green. Also flips the M3 Title screen from planned to done: it
shipped in a77bf03/f071392 and the roadmap never caught up, which would have
misled M4-c into thinking it must build one.

Adds six new trap species to docs/traps.md from this milestone's review
passes: substring-collision assertions, a BBCode wrapper masking an empty
ContentDB, a test asserting the script's own loop bound, a trivially-true
gating fixture, assertions already true before the action under test ran, an
"iterates everything" guard that checked three hardcoded pairs, a node-type
sweep that missed RichTextLabel, tests that called handlers instead of
pressing nodes, GUT silently skipping an unparseable class_name test file at
the old count, and a test that can hang instead of fail. Also documents the
new client-docs convention: clickable cards are Buttons with mouse_filter = 2
on every child, and pressed on a toggle_mode Button is the chosen state.

Human F6 confirmation of the rendered screen against the mock is still
outstanding and is not claimed here.

docs/traps.md

@@ -119,6 +119,178 @@ nothing changed that you did not intend.
 
 ---
 
+## 7. An assertion can pass because one string happens to sit inside another
+
+**M4-b.** `assert_string_contains(line, Callings.armor(id))` checked that a calling's
+detail line mentioned its armour — using the **raw** table value (`"light"`, `"none"`),
+not the word the card actually prints (`"light armour"`, `"no armour"`). For
+light/medium/heavy this passed **by accident**: `"light"` is a substring of `"light
+armour"`. It broke only on the Hedge-Mage, the one calling with `armor: "none"`, because
+`"none"` is not a substring of `"no armour"`. Delete the Hedge-Mage and the bug goes
+dormant and silent — nothing else in the roster would ever expose it.
+
+The same species, same milestone: `assert_string_contains(line, str(Callings.skill_count(id)))`
+could not fail for the Reaver — its skill count is 2, and `"2"` is already sitting inside
+`"d12"` (its hit die). Hardcoding the wrong skill count in the card would still pass, satisfied
+by a digit in an unrelated number.
+
+**The guard:** anchor the assertion to the **full derived phrase** the code actually
+produces (`CreationCopy.armor_word(id)`, `"picks %d skills" % Callings.skill_count(id)`),
+never to a bare fragment that might coincidentally be present for the wrong reason. If an
+assertion would still pass with the code deleted and a different, unrelated number
+substituted, it is checking overlap, not correctness.
+
+---
+
+## 8. A wrapper can hide the void it was supposed to catch
+
+**M4-b.** A §7 sweep asserted every race×calling combination's DM-panel prose was
+non-empty — the guard meant to catch a blank `ContentDB` leaking onto the one screen that
+must never show a raw error. But the binder wraps prose in BBCode (`"[i]%s[/i]"`) and the
+origin panel always emits its own literal connective (`" Now you carry a %s's work — "`)
+even when every authored fragment and blurb is blank. `"[i][/i]".strip_edges().is_empty()`
+reads `false` regardless of what content actually rendered. The 28-combination sweep was
+proving the *wrapper* is non-empty, not that the guard against a blank `ContentDB` held.
+
+**The guard:** when a value is always wrapped in a fixed template before display, assert
+that the render **contains the payload's own string** (and that the payload's own string
+is itself non-blank) — never just that the wrapped result is non-empty. A non-empty
+assertion downstream of a non-empty literal proves nothing.
+
+---
+
+## 9. A test that asserts the script's own loop bound, not the artifact
+
+**M4-b.** `test_five_ability_cards_never_six` asserted `_ability_cards.size() == 5` — but
+that array is filled by the binder's own `for i in range(5)`, so it is exactly 5 **by
+construction**, independent of what the scene actually contains. An `Ab5` node could be
+added to the `.tscn` and this test stayed green while a sixth ability card — the exact
+regression §7 exists to prevent — rendered on screen.
+
+**The guard:** interrogate the artifact, not the code that reads it.
+`get_node_or_null("Ab5")` must be null, or `get_child_count()` on the authored container
+must equal the expected count. A test whose only source of truth is a literal in the same
+file it is meant to be guarding is not a test of that file.
+
+---
+
+## 10. A guard whose only fixture makes it trivially true
+
+**M4-b.** `test_only_the_origin_s_allowed_callings_are_shown` checked that shown calling
+cards equal the origin's `allowed_callings`. The only origin in the game (the deserter)
+allows all seven callings, and cards default to visible — so the assertion was `7 == 7`
+no matter what the hiding logic did. **Deleting the entire hide branch left the test
+green.**
+
+**The guard:** a gating rule needs a fixture that actually gates. Inject a restrictive
+origin (the injection seam for `origin`/`ContentDB` already existed for exactly this) that
+allows a strict subset, and assert the excluded cards are absent. A test with only the
+permissive case in play is not testing the restrictive path at all.
+
+---
+
+## 11. An assertion that was already true before the action under test ran
+
+**M4-b.** A re-roll test asserted `"points left: 3"` **after** calling re-roll — but a
+freshly-constructed draft already reads 3 points left. Removing `spend = {}` from
+`reroll()` entirely left the test green, because the assertion never depended on the
+reset actually happening.
+
+The same species bit a displayed-scores test harder: it asserted the ability cards show
+`draft.final()` values, but spent zero points before checking — so `final() == rolled()`
+and a binder bug that read `rolled` instead of `final` (arguably the single most obvious
+possible bug in a point-buy panel) passed clean.
+
+**The guard:** drive the state away from its default before asserting the reset or the
+derivation. Spend a point, *then* re-roll and check the pool refilled. Spend a point,
+*then* check the card shows the spent value, not the rolled one. If the assertion would
+already hold on a brand-new object with no action taken, the test has not exercised
+anything.
+
+---
+
+## 12. A "covers everything" claim that covers three things
+
+**M4-b.** `test_committed_tres_matches_builder` is the drift guard between the theme
+builder and the committed `.tres` artifact — the thing that stops "changed the palette,
+forgot to regenerate" from shipping silently. The plan described it as iterating
+`ThemeKeys.ALL`. It did not: it checked a hardcoded list of exactly three
+variation/state pairs, so every variation added since — including all five this
+milestone added for the creation screen — could drift from its generator with the test
+still green.
+
+**The guard:** when a guard is described as covering "every X," check that it actually
+enumerates `X.ALL` (or equivalent) rather than a literal list someone wrote down once. And
+make the failure message name the specific variation and property that drifted — a guard
+that only says "theme mismatch" does not tell the next person which of forty checks
+failed.
+
+---
+
+## 13. A node-type sweep that misses the types that matter most
+
+**M4-b.** The §7 Luck-invisibility guard swept `find_children("*", "Label", ...)` across
+the creation screen looking for the word "luck." `RichTextLabel` does **not** extend
+`Label` in Godot's class hierarchy — and the two `RichTextLabel` nodes on the screen were
+the only nodes rendering authored prose (the DM origin panel and the calling detail
+panel), i.e. the single likeliest place for a stray "luck" to leak onto the screen. The
+sweep also missed every `Button` (whose text is a property, not a child Label) and
+`LineEdit.placeholder_text`.
+
+**The guard:** a sweep for "does this string appear anywhere on screen" must walk
+`Control` and check every text-bearing property that type can hold (`text`, `.text` on
+buttons, `placeholder_text`, `bbcode_text`), not one Label subclass. Naming the node type
+you filtered on is not the same as covering the node types that carry the content you care
+about.
+
+---
+
+## 14. A test that calls the handler instead of pressing the button
+
+**M4-b.** Every interaction test for the creation screen invoked `_on_race_pressed(i)` /
+`_on_calling_pressed(i)` / etc. directly. **Commenting out `_wire()` entirely — the method
+that connects every button's `pressed` signal to its handler — left the whole suite
+green**, because no test ever went through the signal. A mis-bound `bind(i)` (wrong card
+wired to the wrong index) would have been equally invisible.
+
+**The guard:** drive the interaction through the actual node —
+`button.pressed.emit()` (or, for a real click, `button.pressing`/`gui_input`) — not the
+handler function. This covers the wiring *and* the index binding for free, and it is the
+only way a test can tell you a button that looks correct in the editor is inert at
+runtime.
+
+---
+
+## 15. GUT can skip a test file with a warning, not a failure
+
+**M4-b.** A new `class_name`-declaring script (`CreationDraft`, `CreationCopy`) needs
+Godot's `.godot/` import cache rebuilt before GUT can resolve the global class name from a
+sibling test file. Until that happens, the test file fails to parse and GUT **silently
+skips it with a `WARNING`**, not a failure — and the run still prints `All tests passed!`,
+at the **old** test count. A TDD RED phase against a brand-new global class can therefore
+be **fake**: you believe you watched the new test fail, but it never ran at all.
+
+**The guard:** check the test **count**, every time, not the green banner text. If a
+change was supposed to add N tests and the total didn't move, the suite lied by omission.
+`rm -rf .godot && ./run_tests.sh` forces the cache rebuild if a new file seems to be
+missing.
+
+---
+
+## 16. A test can hang instead of fail
+
+**M4-b.** The natural way to write "drain the point-buy pool" in a test is
+`while draft.points_left() > 0: plus.pressed.emit()`. Run that against a broken `_wire()`
+(trap 14) and `points_left()` never changes — the loop **never terminates**, and the test
+runner hangs instead of reporting a failure.
+
+**The guard:** bounded `for` loops only, with an explicit iteration cap well above the
+expected count, and an assertion after the loop that the expected end-state was actually
+reached. A test that can hang is worse than a test that can silently pass — it costs a
+human a wall-clock timeout to even learn something is wrong.
+
+---
+
 ## The checklist this all reduces to
 
 - Can the new test **fail**? Re-break the code and watch it. If it can't fail, it isn't a test.
@@ -127,3 +299,19 @@ nothing changed that you did not intend.
 - Anything the **model can emit**? Ask what happens if it emits it *twice*.
 - Any fact written down **twice**? Guard every copy — including docs and tooling.
 - Touched **content**? Check the generated tree and the build.
+- Does an assertion string appear **only as a fragment** of another string? Anchor to the
+  full derived phrase.
+- Is the value under test **always wrapped** in a fixed template first? Assert on the
+  payload, not the wrapper.
+- Could the assertion be reading a bound the **test's own setup** guarantees, rather than
+  the artifact under test?
+- Does the fixture make the guard's condition **trivially true** regardless of the logic
+  it claims to check?
+- Would the assertion **already hold before the action under test runs**? Drive state away
+  from its default first.
+- Does "covers everything" actually **iterate the full set**, or a hardcoded sample of it?
+- Does a node-type sweep account for **every type** that can carry the content, not just
+  the common one?
+- Does the test **press the node** (emit the real signal), or call the handler directly?
+- Did the test **count** move by the expected amount — not just the green banner?
+- Can the test **hang** on a broken precondition? Bound every loop.