commit 411c9c7a0d28e074dca09d1a95c24ea1d5d0b112
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Sep 23 16:21:47 2026 -0300

add(metadata/{md5-cache/app-editors/zed-1.23.0_pre20260923, md5-cache/app-editors/zed-bin-1.21.0, md5-cache/app-editors/zed-bin-1.22.0_pre, md5-cache/dev-util/claude-agent-acp-plus-0.20.1, md5-cache/dev-util/claude-agent-acp-tui-0.14.0, md5-cache/dev-util/goose-1.52.0, md5-cache/dev-util/goose-bin-1.52.0, md5-cache/dev-util/spirv-headers-1.4.357.0_p20260923, md5-cache/dev-vcs/trufflehog-3.97.8, md5-cache/sci-ml/lemonade-2026.39.1, md5-cache/sci-ml/lemonade-bin-2026.39.1, md5-cache/sys-apps/ai-jail-2.1.0, md5-cache/sys-apps/ai-jail-bin-2.1.0, md5-cache/sys-apps/pnpm-12.6.0}), mod(.autoupdate/packages.toml), up(app-editors/{zed-1.22.0_pre20260923-r1 -> 1.23.0_pre20260923, zed-bin-1.20.2 -> 1.21.0, zed-bin-1.21.0_pre -> 1.22.0_pre}, dev-util/goose{,-bin}-1.51.0 -> 1.52.0, dev-vcs/trufflehog-3.97.6 -> 3.97.8, sci-ml/{lemonade-11.9.0-r1 -> 2026.39.1, lemonade-bin-11.9.0 -> 2026.39.1}, sys-apps/ai-jail{,-bin}-2.0.0 -> 2.1.0)

commit cc5bb86636f61f6b58a0b053e599e5f7c6793cbb
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Sep 17 22:25:23 2026 -0300

bump 24 packages; fix the tlottie/telegram-desktop static-link pin

Batch autoupdate sweep, plus three things the applier could not have done
on its own.

tlottie/telegram-desktop -- the proposed bump was wrong.
The autoupdate offered tlottie 0.1.0_pre20260908. Telegram v7.2.9's
prepare.py pins commit 31f1b542f8, dated 2026-09-11, and v7.2.9 newly
applies tlottie.patch from desktop-app/patches (pinned there at
519aaa0846). tlottie is linked STATICALLY into the Telegram binary, so a
wrong pin is an ABI mismatch with no soname to catch it. Bumped to
0.1.0_pre20260911 with files/tlottie-tdesktop-compat.patch (six hunks over
three files; verified with both `git apply --check` and eapply's own flag
set against a real checkout of the pinned commit), and revbumped
telegram-desktop to 7.2.9-r1 with the matching floor.

check-tlottie-pin.sh had a false negative.
Its detector anchored the category right after leading whitespace, so any
version-range prefix made the atom invisible and it reported "declares no
dependency on media-libs/tlottie". Widened the detector rather than
dropping the floor: the floor is the only thing that forces a rebuild on
someone who already has the old archive installed, precisely because the
linkage is static. Self-test grew 17 -> 23 assertions covering bare,
floored and slotted atoms as matches, and comment, blocker and
prefix-lookalike as non-matches.

uutils-coreutils-bin 0.12.0 changed its documentation source.
Upstream dropped the architecture-independent docs.tar.zst and now ships a
`uudoc` binary beside the payload. The ebuild derives the applet list from
`coreutils --list` and renders man pages and completions through uudoc,
which means the build host must be able to execute the target binary --
src_install dies with an explicit message when it cannot. Verified by
running the payload: all 106 applets render a man page and bash, zsh and
fish completions with no failure, and the completion sed anchors still
match.

dev-db/redis returns as an ahead-of-::gentoo mirror.
It was removed on 2026-09-07 because the ::gentoo ebuild had gained a zstd
USE flag this copy lacked. That is no longer true: the ebuild here is
byte-identical to ::gentoo's 8.10.1, zstd included, one release ahead at
8.10.2. The record carries the condition that closes it again -- drop it
once ::gentoo ships >=8.10.2.

Carried forward deliberately, not re-derived from a stale base:
mt7927-dkms -r1 (MT6639 BT firmware ungated from USE=btmtk, needed because
the kernel's own btmtk wants it) and nvidia-cuda-toolkit -r1 (GCC_MAX 15
-> 16, CLANG_MAX 21 -> 22, two targets/ globs fixed to ${narch} for
arm64/sbsa).

Verification, all local:
- pkgcheck on the 20 touched packages: no finding that is not also present
on the previous version.
- check-tlottie-pin.sh exits 0 (was 1); check-slot-naming-contract.sh and
check-autoupdate-damage.sh exit 0.
- gentoo-parity.sh: 0 ALIGN, 0 packages behind ::gentoo, [missing] 0,
[digest] 0, [orphans] 4 (the documented floor), and [cache] back from 14
to 0 -- the stale entries were the killed applier's leftovers.
- md5-cache _md5_ matches the ebuild md5sum for all 25 new ebuilds.

Nothing was merged or compiled: this host has no sudo and Portage reads
/var/db/repos/bentoo, not the checkout. The evidence above is fetch-and-
hash, static analysis and running the uutils payload -- not a build.

Pre-existing and left alone, outside this batch's scope:
sys-power/upower-1.91.4 installs a systemd unit with no OpenRC counterpart
(check-openrc-coverage.sh FAIL, from commit 43e3f0617), and
mail-client/thunderbird{,-l10n}-156.0 account for the sweep's remaining
2 UNDOCUMENTED and 1 REDUNDANT rows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 2e5a496ebc969b3c7a227e9564c9feb12b5df65e
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Sep 15 01:30:04 2026 -0300

add(metadata/{md5-cache/app-admin/awscli2-2.36.45, md5-cache/app-editors/cursor-3.20.21, md5-cache/app-editors/kiro-1.1.14, md5-cache/app-editors/vim-9.2.1108, md5-cache/app-editors/vim-core-9.2.1108, md5-cache/app-editors/zed-bin-1.20.1_pre, md5-cache/dev-python/openai-3.14.0, md5-cache/dev-python/tavily-python-0.8.3, md5-cache/dev-python/uv-bin-0.12.14, md5-cache/dev-util/claude-code-2.1.272, md5-cache/dev-util/codex-desktop-bin-26.908.70816, md5-cache/dev-util/glslang-1.4.357.0_p20260914, md5-cache/dev-util/goose-1.50.1, md5-cache/dev-util/goose-bin-1.50.1, md5-cache/dev-util/mesa_clc-26.3.0_pre20260915, md5-cache/dev-util/openchamber-bin-1.23.2, md5-cache/dev-util/opencode-bin-1.18.31, md5-cache/dev-util/qwen-code-0.23.4, md5-cache/dev-util/spirv-tools-1.4.357.0_p20260914, md5-cache/media-libs/mesa-26.3.0_pre20260915, md5-cache/media-libs/vulkan-layers-1.4.362_p20260915, md5-cache/net-misc/nxplayer-10.1.7, md5-cache/sci-ml/llama-cpp-0.4.1, md5-cache/sys-kernel/linux-firmware-20260915}), mod(.autoupdate/packages.toml), up(app-admin/awscli2-2.36.44 -> 2.36.45, app-editors/{cursor-3.20.17 -> 3.20.21, kiro-1.0.437 -> 1.1.14, vim-9.2.1099 -> 9.2.1108, vim-core-9.2.1099 -> 9.2.1108, zed-bin-1.20.0_pre -> 1.20.1_pre}, dev-python/{openai-3.13.0 -> 3.14.0, tavily-python-0.8.2 -> 0.8.3, uv-bin-0.12.13 -> 0.12.14}, dev-util/goose{,-bin}-1.50.0 -> 1.50.1, media-libs/{mesa-26.3.0_pre20260914 -> 26.3.0_pre20260915, vulkan-layers-1.4.362_p20260914 -> 1.4.362_p20260915}, net-misc/nxplayer-10.0.60 -> 10.1.7, sci-ml/llama-cpp-0.4.0 -> 0.4.1, sys-kernel/linux-firmware-20260912 -> 20260915)

commit 14e7e5411daf431c0eec96db8bb73423a05287cc
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Sep 10 21:10:27 2026 -0300

add(dev-util/{cline-bin-3.0.61, copilot-cli-bin-1.0.83, goose-bin-1.50.0, kilocode-bin-7.6.2}), add(licenses/github-copilot-cli), add(metadata/md5-cache/dev-util/{cline-bin-3.0.61, copilot-cli-bin-1.0.83, goose-bin-1.50.0, kilocode-bin-7.6.2}), mod(.autoupdate/packages.toml)

Four terminal AI coding agents that neither ::gentoo nor any other overlay
carries. All four are binary-only here for a reason, not for convenience:

copilot-cli github/copilot-cli publishes NO source at all -- the repository
holds only LICENSE.md, README.md, changelog.md and install.sh.
cline the GitHub releases carry only the macOS/Windows desktop app;
the Linux build lives on npm, behind the optionalDependencies
of the "cline" wrapper (@cline/cli-linux-{x64,arm64}).
goose a from-source ebuild is still to come; upstream does publish a
source tarball, so this -bin is one half of the pair.
kilocode likewise.

Two upstream traps are pinned here so a future bump cannot walk into them:

* github/copilot-cli runs TWO trains out of one tag list -- "vX.Y.Z-N" is a
pre-release and only the bare "vX.Y.Z" is stable. On 2026-09-10 the five
newest tags were all pre-releases while stable sat at v1.0.83. Both the
ebuild comment and the autoupdate record probe /releases/latest, which
skips them by definition; the bare-version regex cannot match a "-N" tag,
so it fails loudly instead of shipping a pre-release.

* block/goose is now aaif-goose/goose. The old path answers only through a
GitHub 301 that can be withdrawn without notice, so HOMEPAGE, SRC_URI and
the probe all pin the canonical org.

kilocode-bin bundles bubblewrap 0.11.2 and a sandbox-runtime, hence
LICENSE="MIT Apache-2.0 LGPL-2" rather than upstream's bare MIT. Its bwrap is
left 0755, never setuid: it is static-pie and relies on unprivileged user
namespaces. cline-bin and kilocode-bin need an explicit fperms 0755 because
doins drops the executable bit -- npm marks every file in the cline tarball
executable, and only the ELF needs it back.

licenses/github-copilot-cli is the first entry in a licenses/ directory that
did not exist in this overlay before.

Verified, not assumed: pkgcheck reports 0 findings on each of the four scanned
separately; emerge -pv resolves all four; and each one completed a full
`ebuild ... clean install` without root, after which the installed image was
inspected and every binary executed -- goose 1.50.0, kilo 7.6.2, copilot
"GitHub Copilot CLI 1.0.83", cline 3.0.61, with all /opt/bin symlinks
resolving. That run is what caught the copilot version being a pre-release.

Not verified: no package was actually merged onto the system -- this host has
no sudo -- so ownership of the installed directories is untested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>