docs: traps.md — the bugs that passed a green suite

Six bugs this project shipped into a branch, what let each through, and the
guard that now catches it. They share a shape: the test passed, and the test
was wrong.

- a regression test that constructed its own correct object, so reverting the
  bug left the suite green
- GDScript default params turning an arity change into a silent miscompile,
  invisible to a grep for the renamed field (grep cannot see positional args)
- a determinism test comparing two runs that would change together
- a closed move vocabulary that was not bounded, because the model could repeat
  a tag and choose an amount in unary
- a roster written down in four places with only one pair guarded — including a
  shipped authoring skill that would have emitted origins allowing zero callings
- generated content that has a client consumer

Linked from CLAUDE.md §18 and docs/README.md. Also records M4-a on the roadmap
with its live end-to-end proof.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYa9u7Kdxv5gX4AnwWexy8

docs/README.md

@@ -5,7 +5,9 @@ Anything affecting **both** client and api, plus planning and roadmap. Side-spec
 Put here:
 
 - [`roadmap.md`](roadmap.md) — phases, POC scope, what's next
+- [`traps.md`](traps.md) — **bugs we have already shipped, and the guards that catch them.** Read before writing tests: every one of them passed a green suite.
 - [`adr/`](adr/) — Architecture Decision Records
+- [`canon-log.md`](canon-log.md) — the cross-boundary contract (§11)
 - Shared contracts — canon log schema, tag syntax, retry policy (§11, §12)
 - Anything spanning the HTTP boundary