Test-only; no shipped behaviour changes, so no release needed.
${BUFFER} is valid zsh and does not contain the substring $BUFFER, so the check enforcing this project's central claim was bypassable by two characters. $RBUFFER was missing entirely.
The scan also never asserted it had scanned. If walk returned empty, the test passed green having read zero files — success reported while nothing was checked.
Widened by prefix where safe: CGEvent, IOHID, plus addLocalMonitorForEvents, AXObserver, AXUIElement. Bare NSEvent stays allowed — the keylogger-shaped API is the monitor, not the class, and the post-1.0 menu-bar face needs it for UI.
A new test pins both the catches and the deliberate non-catches. Verified end to end by planting ${BUFFER} in the real hook: the scan fails and names file and token, and passes again on revert.
Closes #14