fix: polish transcript rescue and doc drift from review

Guard HOME for set -u in the rescue paths, surface a failed rescue mv
instead of silently dropping the transcript, and never delete the
party dir after a failed save in either close or clean (close now
refuses to delete and exits nonzero on a failed rescue too, matching
clean, since a message promising the transcript survived followed by
rm -rf was a false assurance). Also stop log --stop from announcing a
stop that never started, and sync README's knock/log/write(1) wording
with the actual behavior.

party

@@ -16,6 +16,10 @@ PARTY_VERSION=0.1.0
 # `env -i` invocations). Every cmd_* path references it, so guarantee it
 # now via id -un rather than crashing later under set -eu.
 : "${USER:=$(id -un)}"
+# $HOME can be unset in the same stripped environments; the close/clean
+# transcript rescues are the only readers, and they treat an empty
+# value as "nowhere to put it" rather than crashing under set -u.
+: "${HOME:=}"
 # Group default. Remember whether the caller supplied TMUX_PARTY_GROUP
 # explicitly: cmd_host auto-selects a candidate group only when it was
 # not (an empty value counts as unset; an empty group name gates
@@ -956,8 +960,17 @@ cmd_close() {
     # catching late writes regardless, but $HOME and PARTY_SOCKET_DIR
     # are commonly different filesystems (tmpfs /tmp vs a home
     # partition), where mv is copy+unlink and tail bytes written after
-    # the copy started would be lost from the copy.
+    # the copy started would be lost from the copy. A failed rescue
+    # (HOME unset, mv error) leaves the party dir in place rather than
+    # deleting it out from under a promise the message just made;
+    # kill-server already ran, so the party is dead either way, and
+    # `party close` (or `party clean`) can be re-run once the transcript
+    # is off to safety.
     if [ -s "$expected_dir/log" ]; then
+        if [ -z "$HOME" ]; then
+            echo "party close: HOME is unset; transcript kept, party dir left in place ($expected_dir/log); re-run close after fixing." >&2
+            exit 1
+        fi
         _cl_prev=-1
         for _cl_i in 1 2 3; do
             _cl_size=$(wc -c < "$expected_dir/log")
@@ -968,6 +981,9 @@ cmd_close() {
         _cl_dest="$HOME/party-$name-$(date -u '+%Y%m%d-%H%M%S').log"
         if mv "$expected_dir/log" "$_cl_dest" 2>/dev/null; then
             echo "party close: transcript saved to $_cl_dest"
+        else
+            echo "party close: could not save transcript; party dir left in place ($expected_dir/log); re-run close after fixing." >&2
+            exit 1
         fi
     fi
 
@@ -1012,11 +1028,18 @@ EOF
         # close there's no pipe-pane `cat` still draining and no
         # quiescence poll is needed before moving it.
         if [ -s "$d/log" ]; then
+            if [ -z "$HOME" ]; then
+                echo "party clean: skipping $d (HOME is unset; leaving transcript)" >&2
+                continue
+            fi
             _cn_name=${d##*"party-$USER:"}
             _cn_name=${_cn_name%.d}
             _cn_dest="$HOME/party-$_cn_name-$(date -u '+%Y%m%d-%H%M%S').log"
             if mv "$d/log" "$_cn_dest" 2>/dev/null; then
                 echo "party clean: transcript saved to $_cn_dest"
+            else
+                echo "party clean: skipping $d (could not save transcript)" >&2
+                continue
             fi
         fi
 
@@ -1071,6 +1094,13 @@ EOF
     logfile="${RR_SOCKET%/sock}/log"
 
     if [ "$stop" = 1 ]; then
+        # No log file means logging was never started this run; don't
+        # announce a stop that never happened or point at a transcript
+        # that doesn't exist.
+        if [ ! -e "$logfile" ]; then
+            echo "party log: nothing was being logged."
+            return 0
+        fi
         # pipe-pane with no command closes a pane's pipe; harmless on
         # panes that were never piped.
         "$PARTY_TMUX" -S "$RR_SOCKET" list-panes -s -t "$RR_PARTY_NAME" -F '#{pane_id}' \