docs: state when session reports are read and what a remembered file loses

The protocol doc said reports are read only at retirement and removed
either way. It now says the visible-target guard also reads the current
report, and that nothing in a report directory that is not private is read
or removed. CONFIG.md says that a moved or deleted remembered file opens
home even when a backup or recovery copy is left beside it, unlike a
startup --session-file, and its session command list renders as one tight
list again.

docs/CONFIG.md

@@ -2113,10 +2113,9 @@ Use the CLI helpers for quick maintenance:
 - `wayscriber --freeze --session-file ~/Documents/lecture-04.wayscriber-session` starts frozen mode with that same named session target.
 - `wayscriber --daemon --session-file ~/Documents/lecture-04.wayscriber-session` starts a daemon whose overlay activations use that named session target, the daemon's home session.
 - `wayscriber --daemon-toggle --session-file ~/Documents/meeting.wayscriber-session` asks the running daemon to launch a hidden overlay with that named session target. It applies to that activation only. If the overlay is already visible with a different target, hide it before switching.
-
 - `wayscriber --session-info --session-file <path>`, `wayscriber --clear-session --session-file <path>`, and `wayscriber --clear-tool-state --session-file <path>` target only that named file.
 
-The daemon's overlay keeps its session across hide and show. After **Open** or **Save As** switches the overlay to another session, the next activation continues in that session, until the overlay returns to the daemon's home session: the file given with `--daemon --session-file`, or the configured default session without one. The Session popover's `Back to <session>` or `Default session` button returns home. A `--daemon-toggle --session-file` request takes precedence for its activation. If the remembered file was moved, deleted, or replaced by something other than a regular file, the overlay opens the home session instead and says so. The daemon keeps this only while it runs; a restarted daemon starts at home. A daemon started with `--no-resume-session` still continues a named session the overlay switched to, since a named session file always persists; its default home stays unsaved.
+The daemon's overlay keeps its session across hide and show. After **Open** or **Save As** switches the overlay to another session, the next activation continues in that session, until the overlay returns to the daemon's home session: the file given with `--daemon --session-file`, or the configured default session without one. The Session popover's `Back to <session>` or `Default session` button returns home. A `--daemon-toggle --session-file` request takes precedence for its activation. If the remembered file was moved, deleted, or replaced by something other than a regular file, the overlay opens the home session instead and says so, even when a backup or recovery copy is left beside the old path; unlike a `--session-file` given at startup, a remembered session is never restored from those copies. The daemon keeps this only while it runs; a restarted daemon starts at home. A daemon started with `--no-resume-session` still continues a named session the overlay switched to, since a named session file always persists; its default home stays unsaved.
 
 Config values seed startup defaults. When `restore_tool_state = true`, the saved session tool state is applied after those defaults, so edits such as `[arrow] head_at_end = true` can appear ignored if the session snapshot still stores an older arrow setting. Run `wayscriber --clear-tool-state` (or add `--session-file <path>` for a named session) to make config defaults apply on the next startup without deleting saved boards. In a running overlay, Command Palette -> Reset Tool Defaults clears the saved layer for the active session and immediately applies config defaults to the current tools so the next autosave keeps those defaults.
 

docs/daemon-protocol-v2.md

@@ -83,9 +83,12 @@ An overlay with a published child identity reports its session in
 it. The canonical JSON record carries a schema version, the generation, PID and process-start
 identity, and a target: an absolute session file, or null for home. It is replaced on each change.
 When the child is retired, on exit, stop or forced reap, the daemon reads the report before it
-releases the child's identity, accepts it only from a private regular file in a private directory
-with exactly the identity captured at readiness, and removes it either way. The remembered session
-lives only in daemon memory; startup removes reports an earlier daemon left without restoring them.
+releases the child's identity and removes it, along with any temporary its writer left. While the
+child runs, the visible-target guard reads the current report without removing it. Either read
+accepts a report only from a private regular file in a real private directory, with exactly the
+identity captured at readiness; anything else is ignored. If the directory itself is not private,
+nothing in it is read or removed. The remembered session lives only in daemon memory; startup
+removes reports an earlier daemon left without restoring them.
 
 ## Compatibility and rollback