fetch-event-source's openWhenHidden:true keeps the connection logically
alive across visibility changes. On iOS Safari (and Chrome on iOS) the
OS suspends the network stack when the tab is backgrounded, killing
the underlying socket without firing onerror in JS. The library thinks
the stream is fine and never retries — the user returns to a tab whose
SSE has been silently dead for hours, showing pre-suspend data.

Drop the flag (default is false). The library now closes on
visibilitychange→hidden and reopens on visible, giving a clean
reconnect every time the user returns. Last-Event-ID replay covers
the missed window server-side.

Pairs with App.tsx's existing refetchOnWindowFocus on react-query
(shipped earlier this session) so on resume both the SSE stream and
the cached query data are fresh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The PostToolUse hook (ctm log-tool-use) is invoked per tool call by
claude. It must always exit 0 to avoid blocking the tool pipeline,
which until now meant every error path was a silent return nil. If
sessionID was empty, the logs dir was missing, the stdin was malformed
JSON, or the file write failed, no signal reached the user — the
daemon would simply observe nothing for that session and the UI would
show 'idle' with no clue why.

Add a warn() helper that surfaces failures via two channels:
- slog.Warn to stderr (claude usually captures hook stderr)
- A one-line JSON entry appended to ~/.config/ctm/logs/.hook-errors.log
  for a forensic trail

Hook contract preserved — every error path still returns nil. Empty
stdin stays silent (legitimately a no-op).

Failure modes covered: stdin read, JSON unmarshal, missing/invalid
session_id (sanitizes to 'unknown' which the daemon won't tail under
any session name), mkdir, marshal, openfile, write.

To diagnose 'session shows idle but is active' reports going forward,
tail .hook-errors.log during the repro.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.codeiq/ holds a local code-intelligence cache (.mv.db) and a neo4j
graph store rebuilt on demand by the codeiq tool. Without this rule,
the auto-checkpoint hook captured several MB of binary blobs into
'pre-yolo' snapshot commits — clean up the working tree and prevent
future contamination.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>