v0.7.0

Fixed

• SOURCE_DATE_EPOCH fixes the time stamped into the title block, following the
  reproducible-builds convention. Without it the committed demo screenshots
  changed on every regeneration, by exactly the thirty pixels of their
  timestamp, which made a real rendering change indistinguishable from the clock
  ticking. make demo-images sets it; a real map still stamps the time it was
  drawn.

• The first screenshot's caption said most clients "fall back to plain shapes".
  They have not for some time: eleven of them draw the console's own generic
  glyphs, which is what the image shows. The caption now describes the image,
  and says that those glyphs need an icon font only a controller serves, so a
  fresh clone genuinely does see shapes there. The two statements were both
  true of different machines, which is the confusing kind of wrong.

Added

• -f json writes the normalised topology: nodes, edges, networks and counts,
  rather than the controller's payloads. The model is the stable thing here and
  UniFi's schemas are not, so this is what to build an inventory check or an
  integration against, and it is a far smaller disclosure than a snapshot. It
  honours --obfuscate, overrides and --per-network like the diagram does.
  Carries a schema number: fields may be added and will not be removed.

• -f mermaid writes a .mmd that GitHub, GitLab and most wikis draw in
  place. It reaches the one destination the other formats cannot: a page that
  renders the diagram itself, with no file to open and no colour scheme to
  guess. Artwork is lost, necessarily, since Mermaid draws boxes and text; node
  kind is carried by shape and link meaning by line style, so nothing depends on
  colour. The README embeds a live one of the demo.

• unifi-map overrides check applies an overrides file against the cached
  snapshot and reports, without rendering anything. Overrides fail loudly by
  design, so the only way to find a stale selector used to be producing a whole
  map. Exits non-zero on the first selector matching nothing or several things,
  which makes it usable in a hook or in CI. A missing file is an error rather
  than a pass.

• unifi-map shape, which prints a short plain-text description of the shape
  of a network: counts, fan-out, which field names the controller returns, and
  versions. Meant for a bug report or for the features that are stuck waiting on
  a network nobody here has.

  Built from an allowlist rather than by redacting: every line is a counted
  integer, a boolean, or a field name from a list written in advance. A filter
  that strips identifying values can be incomplete, and UniFi's own does exactly
  that and was observed leaving unredacted tokens in a real support file. A list
  that only ever adds cannot leak by omission.

  It asks before producing anything, printing what it does and does not collect,
  and --yes skips that once read. A non-interactive run without --yes
  refuses rather than assuming: a cron job has nobody to consent on behalf of.

  It reports counts and fan-out, topology depth, artwork resolution rates, the
  Graphviz version and the offline device count. The artwork numbers were
  already computed and thrown away as log lines, and they measure the most
  fragile join in the tool; depth because fan-out alone does not distinguish a
  flat network from a daisy chain; the Graphviz version because layout differs
  between them.

  Pointed at an archive with --support-file it reads that directly rather
  than the cache, and adds how much there was to walk, how many entries, and
  how many sites it holds. Those are the numbers behind the support-file limits
  (set from a single archive) and the untested multi-site handling. Sites are
  counted, never named: the keys carrying those names are user-chosen.

  CONTRIBUTING.md asked people to gather this sort of thing by hand and now
  points at the command instead.

  Named shape rather than report because a diagnostic --report is planned
  and does the opposite job: it describes your map for your benefit and may
  freely name your devices, since it never leaves your terminal. This one
  describes a network for somebody else and is constrained so it can be shared.
  One name for both would have guaranteed the constraint eventually leaked.

  Two tests hold the promise up. One renders a snapshot built entirely of
  identifying values and searches the output for every one. The other is
  stronger and matches the design: it asserts the report's whole vocabulary is
  closed, so a value arriving by a route nobody predicted fails even though no
  test knew to look for it.

• A small rendering flourish, off unless an environment variable asks for it.
  Not in --help, not in the README, and not described further here. It is
  emitted straight into the DOT rather than added to the topology, so it cannot
  reach counts, filtering, obfuscation or the report; a test holds that. Harmless
  and cosmetic, and findable by anyone who already knows to look.