v0.1.6

An audit of 0.1.5 across six angles, with every serious finding handed to a second
reader whose job was to disprove it. What survived is fixed here. Two of them could
remove files that were never cctap's, so if you set CCTAP_DIR to a directory you
also keep other things in, this is the release to take.

Security

• --purge no longer empties bin/ and spool/ wholesale. It removes the names
  cctap actually writes, which is the three bundles it copied, the temp file an
  interrupted copy leaves, the spool and its rotated segments. Anything else in those
  directories stays, and the directory stays with it. Before this, pointing
  CCTAP_DIR at a directory that already held binaries and purging took every one of
  them, and the run then said everything cctap put there was gone, which was not what
  had happened. The daemon's permission repair had the same reach and would clamp
  files it did not write to 0600 on every start. It is on the same list now.
• The purge also stops at what a purge is for. The socket is removed only when a
  socket is what sits at that path, because the socket path is configurable and
  moving it out of the tree is the documented answer to a long CCTAP_DIR. A config
  naming a regular file used to have the purge delete that file.
• A value form of a boolean flag is refused instead of ignored. --dry-run=1 passed
  validation and then read as absent everywhere that decides anything, so the run
  told to change nothing performed the whole real thing and reported success.
  uninstall-hooks --purge --dry-run=yes really did purge. Both exit 2 now and touch
  nothing.
• The last-resort scan for a payload too damaged to parse recovers the session id and
  the event name and nothing else. It matched a key anywhere in the text, so it could
  not tell a top-level field from a tool argument of the same name, and a tool
  argument called source reached the socket and the spool on disk. The privacy
  promise is written to match what the code does, not the other way round.
• cctap stop checks the daemon it is about to signal by the paths cctap launches,
  not by the file name alone. A recycled pid running any other project's daemon.mjs
  was accepted, signalled, and reported as ours.
• A CCTAP_DIR that reaches your home directory or the filesystem root by another
  name, through a symlink or a /private prefix, is refused like the plain spelling.

Fixed

• A session can no longer be pinned to the board forever. If Claude Code dies in the
  first moments of a hook, the forwarder is reparented onto pid 1 and recorded that,
  and pid 1 always answers alive, so the session never aged out. One stuck at a
  permission prompt then sorted ahead of every real one, and the jump key went to a
  terminal that no longer existed, every press, silently. Such a session in a state
  file written by 0.1.5 heals on the next daemon start.
• cctap simulate writes its demo repositories where --purge could not see them,
  so a purge after a simulate could never finish and blamed the leftovers on you.
  Both halves are fixed: the directory is removed, and a purge that does leave
  something behind now lists what it is instead of characterizing it.
• A settings file that is a symlink whose target is not in place yet, which is what a
  dotfiles setup looks like between cloning and stowing, is written through instead
  of replaced. The link survives.
• The ascii theme stays inside its character set. The separator before the daemon
  marker and the hint was a middle dot whatever the theme, and the marker for a
  truncated field was an ellipsis, both in the one mode chosen precisely because the
  terminal cannot draw them.
• The strip's own messages fit the space they are given. The daemon-down line and the
  empty-board line ignored the width budget and could wrap the status bar they sit
  in. Each now steps down to a shorter form rather than being cut.
• top keeps the daemon-down marker and the count of hidden rows on a short
  terminal, ahead of the key legend, and a SIGCONT that follows no stop no longer
  re-enters the screen or stacks a second handler.

Changed

• CCTAP_MOTION=0 and the motion and blink config keys are documented where the
  other settings are, rather than only in this file.
• The privacy document lists every path cctap writes, including the config, the keys
  journal, its own copied bundles and the simulate repositories.
• CCTAP_NO_EXEC says what it does. Nothing outside cctap runs under it, its own
  daemon aside, which was always the behavior.