Correct what --cron actually suppresses (closes #84)

The Vaultik.UI doc comment claimed the cli layer replaces the writer with
a discarding writer in --cron mode. It does not. UI is built once as
ui.New(os.Stdout) and never reassigned; internal/cli/app.go calls
UI.SetQuiet(true) when --cron or --quiet is set, which drops Begin,
Complete, Info, Notice, Detail, Progress and Banner - but Warningf and
Errorf have no quiet check and are still emitted.

That distinction matters: the end-of-run summary is deliberately routed
through UI.Warningf so cron delivers something, so a reader who believed
the comment would have concluded the opposite of how the code is meant to
work.

The README's --cron description carried the same imprecision ("Silent
unless error") and is corrected alongside it.

Comment and documentation only - the Go diff contains no non-comment
lines, so there is no behavior change.

README.md

@@ -168,7 +168,8 @@ needed.
   (System Settings → Privacy & Security → Full Disk Access) to read
   TCC-protected directories; without it the backup aborts with a permission
   error that explains how to fix it
-* `--cron`: Silent unless error (for crontab)
+* `--cron`: Silent on total success; warnings and errors are still printed
+  (for crontab)
 * `--prune`: After backup, drop older snapshots of each backed-up name and
   remove orphaned blobs from remote storage. By default keeps only the latest
   snapshot per name; use `--keep-newer-than` for a rolling window.

TODO.md

@@ -19,6 +19,16 @@ or delete the branch.
 
 # Completed Steps
 
+- 2026-08-09: Corrected the `Vaultik.UI` doc comment (issue #84). It
+  claimed the cli layer replaces the writer with a discarding one in
+  `--cron` mode; the actual mechanism is `UI.SetQuiet(true)` in
+  `setupGlobals`, which drops Begin/Complete/Info/Notice/Detail/
+  Progress/Banner but still emits Warning and Error. The `--cron` line
+  in `README.md` said "Silent unless error", which understated what
+  survives, and now names warnings too. The other `--cron` comments
+  (`internal/log/log.go`, `internal/cli/snapshot.go`,
+  `internal/vaultik/snapshot.go`) were audited and already accurate.
+  Comments and docs only, no behavior change.
 - 2026-08-09: Made `snapshot list` list the destination store without
   the private key (issue #64). The listing is now the union of the
   local index and a single streamed listing of the `metadata/` prefix,

internal/vaultik/vaultik.go

@@ -49,9 +49,12 @@ type Vaultik struct {
 	Stdin  io.Reader
 
 	// UI is the writer for user-facing status, progress, warnings, errors.
-	// See package internal/ui for formatting conventions. Defaults to a
+	// See package internal/ui for formatting conventions. It always wraps
-	// writer wrapping Stdout; the cli layer replaces it with a discarding
+	// Stdout and is never swapped out; under --cron (and --quiet) the cli
-	// writer in --cron mode.
+	// layer instead calls UI.SetQuiet(true), which drops Begin, Complete,
+	// Info, Notice, Detail, Progress, and Banner messages. Warning and
+	// Error are still emitted in that mode, so callers must not assume
+	// that --cron makes this writer silent.
 	UI *ui.Writer
 
 	// restoreCacheObserver, if non-nil, is invoked once with the