commit a267e33d24c9dd5c9933ccd7cb2713408be2c147
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Sep 6 09:53:42 2026 -0300

fix(sci-ml/lemonade, dev-games/godot, app-emulation/crossover-bin, app-text/libetonyek)

Four unrelated packages, each closing an item that had been recorded and left.

sci-ml/lemonade -- the R6 service hardening story 003 Task 5 asked for and never
got. The account ids were ACCT_USER_ID=-1 / ACCT_GROUP_ID=-1; they are now a
static 601, next to acct-user/localai at 600 and above ::gentoo's highest
assigned id (563). Dynamic ids break exactly the cases this overlay exists to
cover: a container image and its host disagreeing on the number, NFS mapping the
wrong owner, an image built on one machine being wrong on the next.

/etc/conf.d/lemond is now 0640 rather than the 0644 newconfd leaves. It holds
HF_TOKEN, LEMONADE_API_KEY and LEMONADE_ADMIN_API_KEY. root:root is sufficient:
OpenRC sources conf.d as root and only then drops to the lemonade user.

pkg_postinst named the wrong path. It told users to put secrets in
/etc/lemonade/conf.d/ "for the systemd unit", but upstream's unit reads
`EnvironmentFile=-/etc/default/lemond` (data/lemond.service.in:23). Corrected.

It also now discloses the UDP presence broadcast, which is ON BY DEFAULT --
runtime_config.cpp:1241 falls back to `true` -- and announces on RFC1918
interfaces even with the API bound to loopback.

The init script passes --host explicitly. Unlike sci-ml/localai, this is
robustness rather than a fix: upstream already defaults to localhost
(docs/dev/getting-started.md:752). Stating it keeps the bind if that default
ever changes, and LEMOND_HOST is the one place to widen it.

Not done, and recorded as superseded in the story instead: the rc_ulimit
disclosure Task 5.8 also asked for. There is no mlock, MAP_LOCKED or
RLIMIT_MEMLOCK anywhere in the 11.9.0 tree, so nothing sets it and nothing needs
it -- there was no disclosure to preserve.

dev-games/godot -- godot-4.5-scons.patch shared ::gentoo's FILENAME with
different CONTENT, so the parity sweep pairs them and reports a difference
forever. Renamed to godot-4.8-scons-toolchain.patch.

Renamed rather than replaced by ::gentoo's, because they are not older and newer
cuts of one patch: they are two mechanisms, each coupled to how its ebuild
invokes scons. ::gentoo does `tc-export AR CC CXX RANLIB` and patches
platform/linuxbsd/detect.py to read os.environ; src_compile here passes them as
scons command-line variables, so the patch declares them with opts.Add. Both
were dry-run against the 4.8-dev4 tree and both apply cleanly; mixing them is
what would break.

What ::gentoo's had and ours did not is RANLIB, which was not respected at all.
Added on our own mechanism -- opts.Add("RANLIB") plus RANLIB="$(tc-getRANLIB)"
in esconsargs -- and re-dry-run. Gentoo bug #977691 covers the AR half.

app-emulation/crossover-bin -- capi is now default-off. The flag stays, because
someone with legacy ISDN hardware should be able to turn it on and "not useful
to me" is not an exclusion criterion here. But net-libs/libcapi needs
abi_x86_32, so leaving it on made every crossover user pull a 32-bit multilib
dependency for a network technology switched off commercially across most of the
world by 2022. Enabling it later costs nothing extra: the support is already
inside the shipped binary, so the flag only decides whether the library is there
for it to use.

Its Manifest also carried a DIST line for crossover-bin-26.2.0.deb, a version no
longer in the tree. Removed; pkgcheck's UnknownManifest is gone.

app-text/libetonyek -- metadata.xml used `remote-id type="libreoffice-git"`,
which is not in metadata.xsd's enumeration, so the file failed validation. There
is no valid type for a LibreOffice-hosted project and ::gentoo carries no
remote-id here at all, so the <upstream> block is dropped. The file is now
identical to ::gentoo's and validates.

Collateral, and correct: egencache also removed
metadata/md5-cache/sci-ml/lemonade-11.8.1-r1, orphaned since b62ee0572 bumped
the package to 11.9.0 without dropping its cache entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit b62ee057267025e5c039eadf1f96068e16acaab1
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Sep 2 20:30:08 2026 -0300

add(metadata/{md5-cache/app-admin/awscli2-2.36.38, md5-cache/app-editors/vim-9.2.1036, md5-cache/app-editors/vim-core-9.2.1036, md5-cache/app-editors/zed-1.20.0_pre20260902, md5-cache/app-editors/zed-bin-1.18.0, md5-cache/app-editors/zed-bin-1.19.0_pre, md5-cache/app-misc/claude-desktop-bin-1.44121.2, md5-cache/dev-util/antigravity-hub-bin-2.12.0.5051501534642176, md5-cache/dev-util/claude-code-2.1.259, md5-cache/dev-util/codex-desktop-bin-26.901.20858, md5-cache/dev-util/spirv-tools-1.4.357.0_p20260902, md5-cache/dev-vcs/gitkraken-12.4.1, md5-cache/net-im/telegram-desktop-7.1.5, md5-cache/sci-ml/ik_llama-cpp-0_pre20260902, md5-cache/sci-ml/lemonade-11.9.0, md5-cache/sci-ml/lemonade-bin-11.9.0, md5-cache/www-client/brave-browser-1.94.119}), mod(.autoupdate/packages.toml), up(app-admin/awscli2-2.36.37 -> 2.36.38, app-editors/{vim-9.2.1031 -> 9.2.1036, vim-core-9.2.1031 -> 9.2.1036, zed-1.19.0_pre20260902 -> 1.20.0_pre20260902, zed-bin-1.17.2 -> 1.18.0, zed-bin-1.18.0_pre -> 1.19.0_pre}, app-misc/claude-desktop-bin-1.40609.1 -> 1.44121.2, dev-util/{antigravity-hub-bin-2.11.0.6376446768316416 -> 2.12.0.5051501534642176, claude-code-2.1.258 -> 2.1.259, codex-desktop-bin-26.831.21537 -> 26.901.20858, spirv-tools-1.4.357.0_p20260901 -> 1.4.357.0_p20260902}, dev-vcs/gitkraken-12.4.0 -> 12.4.1, net-im/telegram-desktop-7.1.4 -> 7.1.5, sci-ml/{ik_llama-cpp-0_pre20260831 -> 0_pre20260902, lemonade-11.8.1-r1 -> 11.9.0, lemonade-bin-11.8.1 -> 11.9.0}, www-client/brave-browser-1.94.117 -> 1.94.119)

commit c3579b8b4057d49ca8e388a35abb405b144e1eb4
Author: lucascouts <lucascs@protonmail.com>
Date: Mon Aug 31 21:49:18 2026 -0300

fix(sci-ml/lemonade): probe mbedtls where upstream moved it, close the slot-0 fallback

up(sci-ml/lemonade-11.8.1 -> 11.8.1-r1)

11.5.2 moved pkg_check_modules(MBEDTLS ...) out of src/cpp/cli/CMakeLists.txt
and into the top-level CMakeLists.txt. The rewrite in src_prepare followed the
file, not the line, and sed exits 0 when its pattern matches nothing -- so the
`|| die` never fired and the package failed at configure time on every release
from 11.5.2 to 11.8.1 with nothing in the ebuild noticing. Reported as #43.

Every rewrite now asserts its match with grep -qF before running, so the next
time upstream moves one of these lines the ebuild dies in src_prepare naming
the pattern it could not find, instead of producing a build that silently
skipped the fix.

The mbedtls rewrite additionally closes the hand-rolled fallback the probe
drops into when pkg-config comes up empty. It searches for <mbedtls/ssl.h>
and libmbedtls.so, and the :3 slot installs neither -- so it can only ever
match net-libs/mbedtls:0, the 2.28 series, which upstream's BRANCHES.md no
longer lists as a supported LTS. Nothing downstream catches that: the CLI
only calls mbedtls_md_*, ABI-stable across 2.28 and 3.6, so the mismatch
compiles, links, and ships a binary verifying the SHA-256 digest of every
downloaded model against an out-of-support library while DEPEND advertises
net-libs/mbedtls:3= -- a subslot guarding a library the binary never loads,
so no rebuild is triggered and --depclean is free to remove the real one.
22 ebuilds in ::gentoo can bring slot 0 onto a machine, dev-libs/libevent
and net-libs/libssh2 among them. Configure now fails closed instead.

Verified against the 11.8.1 source: all four rewrites match and apply; a
simulated future move of the probe dies in src_prepare; the probe resolves to
/usr/include/mbedtls3 and mbedtls-3;mbedx509-3;mbedcrypto-3; and with
pkg-config blinded while slot 0 is visible, configure fails instead of
linking 2.28. Not build-tested end to end: this host has no sudo and lacks
dev-cpp/cpp-httplib, so only the configure-time detection was exercised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit df8dc05d16e28e5683078fbdb6701447b8cbf17e
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 28 10:32:56 2026 -0300

add(metadata/{md5-cache/app-editors/zed-1.19.0_pre20260828, md5-cache/app-text/calibre-9.14.0, md5-cache/dev-util/mesa_clc-26.3.0_pre20260828, md5-cache/dev-util/spirv-tools-1.4.357.0_p20260828, md5-cache/dev-util/vulkan-tools-1.4.361_p20260828, md5-cache/media-libs/mesa-26.3.0_pre20260828, md5-cache/media-libs/vulkan-layers-1.4.360_p20260828, md5-cache/net-misc/postman-bin-12.25.7, md5-cache/sci-ml/lemonade-11.8.1, md5-cache/sci-ml/lemonade-bin-11.8.1, md5-cache/sys-kernel/linux-firmware-20260828}), mod(.autoupdate/packages.toml), up(app-editors/zed-1.19.0_pre20260827 -> 1.19.0_pre20260828, app-text/calibre-9.13.0 -> 9.14.0, dev-util/{mesa_clc-26.3.0_pre20260827 -> 26.3.0_pre20260828, spirv-tools-1.4.357.0_p20260827 -> 1.4.357.0_p20260828, vulkan-tools-1.4.360_p20260824 -> 1.4.361_p20260828}, media-libs/{mesa-26.3.0_pre20260827 -> 26.3.0_pre20260828, vulkan-layers-1.4.360_p20260827 -> 1.4.360_p20260828}, net-misc/postman-bin-12.25.6 -> 12.25.7, sci-ml/lemonade{,-bin}-11.8.0 -> 11.8.1, sys-kernel/linux-firmware-20260827 -> 20260828)

commit 044a952e1d3d3e0b5039c2fa069fc719c8b47864
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 26 18:57:03 2026 -0300

add(metadata/{md5-cache/app-admin/awscli2-2.36.32, md5-cache/app-editors/vim-9.2.1013, md5-cache/app-editors/vim-core-9.2.1013, md5-cache/app-editors/zed-bin-1.18.0_pre, md5-cache/dev-games/godot-4.8_alpha4, md5-cache/dev-util/antigravity-hub-bin-2.11.0.6376446768316416, md5-cache/dev-util/codex-0.150.0, md5-cache/dev-util/codex-bin-0.150.0, md5-cache/media-libs/harfbuzz-14.4.0, md5-cache/sci-ml/lemonade-11.8.0, md5-cache/sci-ml/lemonade-bin-11.8.0}), mod(.autoupdate/packages.toml), up(app-admin/awscli2-2.36.31 -> 2.36.32, app-editors/{vim-9.2.1011 -> 9.2.1013, vim-core-9.2.1011 -> 9.2.1013, zed-bin-1.17.2_pre -> 1.18.0_pre}, dev-games/godot-4.8_alpha3 -> 4.8_alpha4, dev-util/codex{,-bin}-0.149.1 -> 0.150.0, media-libs/harfbuzz-14.3.1 -> 14.4.0, sci-ml/lemonade{,-bin}-11.7.0 -> 11.8.0)

commit 4cca4a92c7683823283e2ceeeeeebc9cff37ec6a
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 19 21:41:24 2026 -0300

add(x11-base/xwayland-26.0.99.901), add(metadata/{md5-cache/app-editors/trilium-0.105.0, md5-cache/app-editors/vim-9.2.0984, md5-cache/app-editors/vim-core-9.2.0984, md5-cache/app-editors/zed-1.18.0_pre20260819, md5-cache/dev-lang/flutter-3.47.1, md5-cache/dev-python/openai-3.3.1, md5-cache/dev-util/claude-code-2.1.236, md5-cache/dev-util/spirv-tools-1.4.357.0_p20260819, md5-cache/media-libs/vulkan-layers-1.4.360_p20260819, md5-cache/net-misc/nxplayer-10.0.59, md5-cache/sci-ml/lemonade-11.7.0, md5-cache/sci-ml/lemonade-bin-11.7.0, md5-cache/sci-ml/llama-cpp-0_pre10502, md5-cache/www-client/brave-browser-1.93.137}), mod(.autoupdate/packages.toml), up(app-editors/{trilium-0.104.1 -> 0.105.0, vim-9.2.0976 -> 9.2.0984, vim-core-9.2.0976 -> 9.2.0984, zed-1.17.0_pre20260819 -> 1.18.0_pre20260819}, dev-lang/flutter-3.47.0-r1 -> 3.47.1, dev-python/openai-3.3.0 -> 3.3.1, dev-util/{claude-code-2.1.235 -> 2.1.236, spirv-tools-1.4.357.0_p20260814 -> 1.4.357.0_p20260819, trivy-0.74.0 -> 0.74.0-r1}, media-libs/vulkan-layers-1.4.360_p20260818 -> 1.4.360_p20260819, net-misc/nxplayer-10.0.57 -> 10.0.59, sci-ml/lemonade{,-bin}-11.6.0 -> 11.7.0, www-client/brave-browser-1.93.136 -> 1.93.137)

commit f7efe6972956726ec59f3f2f01bb0b8283465e25
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 14 22:55:47 2026 -0300

up(app-admin/ansible-14.3.0 -> 14.3.1, app-emulation/d7vk-2.0 -> 2.1, dev-python/uv-bin-0.12.4 -> 0.12.5, dev-util/{claude-code-2.1.232 -> 2.1.233, codex-desktop-bin-26.810.41047 -> 26.810.50856, glslang-1.4.357.0_p20260813 -> 1.4.357.0_p20260814, opengrep-bin-1.27.0 -> 1.27.1}, sci-ml/{lemonade{,-bin}-11.5.2 -> 11.6.0, llama-cpp-0_pre10430 -> 0_pre10435, ollama{,-bin}-0.32.11 -> 0.32.13}), del(metadata/md5-cache/* [13 stale]), mod(.autoupdate/packages.toml)

Twelve autoupdate version bumps that had accumulated in the working tree.

Also removes the md5-cache entry of every version this commit deletes. The
bumper writes the new entry but does not drop the old one, so each bump left
a cache entry describing an ebuild that no longer exists. Thirteen removed
here: the twelve superseded versions plus sci-ml/llama-cpp-0_pre10434, whose
ebuild was itself replaced by 0_pre10435 before either was committed.

Not addressed here, to keep this commit to its own scope: 25 further orphan
md5-cache entries from earlier bumps are already committed in the tree
(claude-code 2.1.222..2.1.231, llama-cpp 0_pre10405..0_pre10428, ollama and
ollama-bin 0.32.6-r1..0.32.9, uv-bin 0.12.1..0.12.3, ansible-14.2.0,
lemonade-11.5.1, codex-desktop-bin-26.803.81509). They are pre-existing debt,
not introduced by this change.

Validation: pkgcheck over the twelve packages reports no finding (explicit
-c list; the default scan crashes in the git addon on uncommitted ebuilds).
Every bumped package has a non-empty Manifest and a matching md5-cache entry.
NOT verified: nothing was built or merged -- this host has no root.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 2b8832261d5b57c9f6711daf3b39879c4facf3e0
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 5 20:52:41 2026 -0300

add(metadata/{md5-cache/app-editors/cursor-3.14.27, md5-cache/sci-ml/lemonade-11.5.2, md5-cache/sci-ml/lemonade-bin-11.5.2, md5-cache/sci-ml/llama-cpp-0_pre10289, md5-cache/sci-ml/ollama-bin-0.32.6, md5-cache/www-client/brave-browser-1.93.132, md5-cache/x11-misc/xvfb-run-21.1.24.1}), mod(.autoupdate/packages.toml), up(app-editors/cursor-3.14.7 -> 3.14.27, sci-ml/lemonade{,-bin}-11.5.1 -> 11.5.2, www-client/brave-browser-1.93.129 -> 1.93.132, x11-misc/xvfb-run-21.1.23.1 -> 21.1.24.1)

commit ccadd89eaf4a485d1c9c785a7fe706ed14baec0b
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Jul 30 10:41:15 2026 -0300

add(metadata/{md5-cache/app-editors/devin-desktop-bin-3.6.22, md5-cache/dev-util/glslang-1.4.350.1_p20260729, md5-cache/dev-util/mesa_clc-26.2.0_pre20260730, md5-cache/media-libs/mesa-26.2.0_pre20260730, md5-cache/sci-ml/lemonade-11.5.1, md5-cache/sci-ml/lemonade-bin-11.5.1}), mod(metadata/md5-cache/dev-python/pyee-13.0.1), up(app-editors/devin-desktop-bin-3.6.21 -> 3.6.22, dev-util/{glslang-1.4.350.1_p20260727 -> 1.4.350.1_p20260729, mesa_clc-26.2.0_pre20260729 -> 26.2.0_pre20260730}, media-libs/mesa-26.2.0_pre20260729 -> 26.2.0_pre20260730, sci-ml/lemonade{,-bin}-11.5.0 -> 11.5.1)

commit a8e57db34bf744fcaf43a6f7be6af7d0edad58a3
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Jul 24 16:30:56 2026 -0300

add(acct-group/lemonade-0, acct-user/lemonade-0, media-libs/dav1d-1.5.4, sci-ml/lemonade{,-bin}-11.5.0), add(metadata/{md5-cache/acct-group/lemonade-0, md5-cache/acct-user/lemonade-0, md5-cache/app-editors/cursor-3.13.10, md5-cache/app-editors/vim-9.2.0846, md5-cache/app-editors/vim-core-9.2.0846, md5-cache/app-misc/claude-desktop-bin-1.24012.9, md5-cache/dev-util/claude-code-2.1.219, md5-cache/dev-util/glslang-1.4.350.1_p20260724, md5-cache/media-libs/dav1d-1.5.4, md5-cache/media-libs/vulkan-layers-1.4.352_p20260724, md5-cache/sci-ml/lemonade-11.5.0, md5-cache/sci-ml/lemonade-bin-11.5.0, md5-cache/sci-ml/llama-cpp-0_pre10107, md5-cache/www-client/brave-browser-1.92.144}), mod(.autoupdate/packages.toml), up(app-editors/{cursor-3.12.30 -> 3.13.10, vim-9.2.0843 -> 9.2.0846, vim-core-9.2.0843 -> 9.2.0846}, app-misc/claude-desktop-bin-1.24012.1 -> 1.24012.9, dev-util/{claude-code-2.1.218 -> 2.1.219, glslang-1.4.350.1_p20260723 -> 1.4.350.1_p20260724}, media-libs/vulkan-layers-1.4.352_p20260721 -> 1.4.352_p20260724, sci-ml/llama-cpp-0_pre10106 -> 0_pre10107, www-client/brave-browser-1.92.143 -> 1.92.144)