chore(deps): update dependency farcloser/limen to v0.10.1

.aqua/aqua-checksums.json

@@ -46,28 +46,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_darwin_arm64.tar.gz",
-      "checksum": "EEF33683C8EE70E11F7A1E602ED27B9CB026E2C1E88891B1F1B0DFF80C7B5C8A",
+      "id": "github_release/github.com/farcloser/limen/v0.10.1/limen_0.10.1_darwin_arm64.tar.gz",
+      "checksum": "30F1889AAAD6D1705CCF557D2FC2E75EA10D94D5EB293F423F11F60E79D25665",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_linux_amd64.tar.gz",
-      "checksum": "0BF69AE78A44F0FF49742931E94A3D662290E7F67AA596853233AD188EEC61A6",
+      "id": "github_release/github.com/farcloser/limen/v0.10.1/limen_0.10.1_linux_amd64.tar.gz",
+      "checksum": "CCAEE031B6F1DFBB9FDC1FBA83C8C809CF27064A0896022269D7DE22040308C6",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_linux_arm64.tar.gz",
-      "checksum": "3F95240C2FA46D6B81C19D0195E82EA82F916CC265DE505E872B8728AD255CF3",
+      "id": "github_release/github.com/farcloser/limen/v0.10.1/limen_0.10.1_linux_arm64.tar.gz",
+      "checksum": "0E6D7F68B5CE57382AC5B40039F21EA1CEFC4ACBA9F013ADE2C8F157A295D848",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_windows_amd64.tar.gz",
-      "checksum": "72F9F50B79D419AC42D995E4C2310EF47B7E34EF58469237008A21C61A5BA55F",
+      "id": "github_release/github.com/farcloser/limen/v0.10.1/limen_0.10.1_windows_amd64.tar.gz",
+      "checksum": "87247B3780E51092390B6DDD307ECCE6A31905672C1D3EA9A4E8B3A2AB9533B3",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_windows_arm64.tar.gz",
-      "checksum": "C10C30E8FA2EEF3C76F8B8BA87DFEF24E5253D81AD2EF4056465CC207AC9B903",
+      "id": "github_release/github.com/farcloser/limen/v0.10.1/limen_0.10.1_windows_arm64.tar.gz",
+      "checksum": "882285A6405189D6AD4973C20AB11D52804226E29C097D360AC7F6CA05094F01",
       "algorithm": "sha256"
     },
     {
@@ -345,31 +345,6 @@
       "checksum": "5C4B294F23B558619AE8A4AA94D023E3BCA03F52C8398BB41B9026002B0013DE",
       "algorithm": "sha256"
     },
-    {
-      "id": "http/golang.org/dl/go1.27.2.darwin-arm64.tar.gz",
-      "checksum": "76812B213B1B2302C978D28FA52FA92D541704B9E7D9D5DB8002C50E4018C4C5",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "http/golang.org/dl/go1.27.2.linux-amd64.tar.gz",
-      "checksum": "ECBADB99091A3F46E31F5F934B068B1864EAFA7995211B39EADDF76996045FE5",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "http/golang.org/dl/go1.27.2.linux-arm64.tar.gz",
-      "checksum": "94F3E30B8E374BC285E7DADC11E0865726B9BC6E85B841CCCEAABC0214C6B7C8",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "http/golang.org/dl/go1.27.2.windows-amd64.zip",
-      "checksum": "1314008898BD40DF77AF4B014F777F08873DBDFBCD3D92308728EE03304FE04F",
-      "algorithm": "sha256"
-    },
-    {
-      "id": "http/golang.org/dl/go1.27.2.windows-arm64.zip",
-      "checksum": "5C4B294F23B558619AE8A4AA94D023E3BCA03F52C8398BB41B9026002B0013DE",
-      "algorithm": "sha256"
-    },
     {
       "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.573.0/registry.yaml",
       "checksum": "52A43B0B2817A56FE7566625809D7CCA41A1178CCAE2B152941221B516E70228",

.aqua/aqua.yaml

@@ -18,7 +18,7 @@ registries:
 
 packages:
   # --- farcloser tools (local registry; standard once registered upstream) ---
-  - name: farcloser/limen@v0.10.0 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.10.1 # renovate: depName=farcloser/limen
     registry: local
   # --- toolchain + binary-release tools (standard registry, aqua-verified) ---
   - name: mikefarah/yq@v4.54.1

.github/workflows/update-aqua-checksum.yaml

@@ -76,8 +76,12 @@ jobs:
       - name: Converge the limen baseline
         # `aqua exec` resolves the branch's own limen pin, verified with the
         # checksums from the step above. A released limen leaves its own pin
-        # alone, so this cannot ping-pong. Skipped in the limen repository:
-        # there the working tree IS the next baseline.
+        # alone, and on a renovate/ branch (GITHUB_REF_NAME) it leaves
+        # .aqua/aqua.yaml alone too: Renovate renders that file on every run,
+        # so a line added here would be removed, added, removed, the branch
+        # force-pushed each time. What the manifest lacks, fix adds on main.
+        # Skipped in the limen repository: there the working tree IS the next
+        # baseline.
         if: github.repository != 'farcloser/limen'
         run: aqua exec -- limen fix .
 

.limen/just/release.just

@@ -79,6 +79,19 @@ release *args:
     }
     # CI lane: pushing the v* tag is what starts the release workflow — the one
     # publisher in this lane.
+    # No tag while a pull request is open, a bot's included: what is open is
+    # part of the release or the next one's first commit, and both say wait
+    # (book/recipes.md). gh resolves the repository from origin, the remote
+    # the tag goes to.
+    require_empty_queue() {
+        local open
+        open=$(gh pr list --state open --json number --jq 'length' -R "$(git remote get-url origin)")
+        if [ "$open" != 0 ]; then
+            echo "$open pull request(s) are open — a release waits for an empty queue (merge or close them first):" >&2
+            gh pr list --state open -R "$(git remote get-url origin)" >&2
+            exit 1
+        fi
+    }
     tag_and_push() {
         ensure_signed_tag "$1"
         git push origin HEAD
@@ -137,6 +150,7 @@ release *args:
             fi
             require_version_tag "$tag"
             require_clean
+            require_empty_queue
             if [ -z "${GITHUB_TOKEN:-}" ]; then
                 echo "GITHUB_TOKEN is not set — goreleaser needs it to publish the GitHub release." >&2
                 exit 1
@@ -226,6 +240,7 @@ release *args:
             fi
             require_version_tag "$tag"
             require_clean
+            require_empty_queue
             tag_and_push "$tag"
             if has_goreleaser; then
                 echo "tag $tag pushed — the release workflow builds, signs, and publishes from here."

.limen/just/tools.just

@@ -10,6 +10,15 @@ set quiet
 # Shared private _banner recipe and go_tool_build (see lib.just).
 import 'lib.just'
 
+# aqua's GitHub API calls (a package's tag list, its release assets) are
+# limited per address when unauthenticated, and one checksum update makes
+# one per package: a laptop pinning one tool across nine repositories hit the
+# 403 on the second (the download then 404s on an unset version). The laptop's
+# own gh login authenticates them when it has one and nothing set the
+# variable; setup-aqua sets it in CI. Prefixed on the API-calling aqua
+# commands only, never exported to a recipe's other children.
+aqua_api := 'AQUA_GITHUB_TOKEN="${AQUA_GITHUB_TOKEN:-$(gh auth token 2>/dev/null || true)}" aqua'
+
 # --- Project tooling (see book/tooling.md). Every recipe takes the tool as it
 #     is pinned: an aqua slug exactly as in .aqua/aqua.yaml (goreleaser/goreleaser),
 #     or a Go package path exactly as in tools/go.mod
@@ -41,7 +50,7 @@ project_aqua := '''
         copy=$(mktemp .aqua/aqua.yaml.XXXXXX)
         scratch=$(mktemp -d)
         sed 's|^\([[:space:]]*\)- import: \(\.\./\.limen/aqua\.yaml\)[[:space:]]*$|\1# limen-import: \2|' .aqua/aqua.yaml > "$copy"
-        (cd "$scratch" && env -u AQUA_GLOBAL_CONFIG aqua -c "$OLDPWD/$copy" "$@") || rc=$?
+        (cd "$scratch" && env -u AQUA_GLOBAL_CONFIG AQUA_GITHUB_TOKEN="${AQUA_GITHUB_TOKEN:-$(gh auth token 2>/dev/null || true)}" aqua -c "$OLDPWD/$copy" "$@") || rc=$?
         rmdir "$scratch"
         if [ "$rc" -eq 0 ]; then
             sed 's|^\([[:space:]]*\)# limen-import: |\1- import: |' "$copy" > "$copy.restored"
@@ -99,7 +108,7 @@ add pkg version="": (_banner "tools" "add")
         exit 1
     fi
     mv "$tmp" .aqua/aqua.yaml
-    aqua -c .aqua/aqua.yaml update-checksum --prune      # record its checksum (and drop stale ones)
+    {{ aqua_api }} -c .aqua/aqua.yaml update-checksum --prune      # record its checksum (and drop stale ones)
     aqua -c .aqua/aqua.yaml install                      # REAL install: a bad pin fails here, not at first use
 
 # Set an existing tool to an exact version, e.g. `just do tools set goreleaser/goreleaser v2.0.0`.
@@ -139,7 +148,7 @@ set pkg version: (_banner "tools" "set")
     trap 'rm -f "$tmp"' EXIT
     sed -E "s#(^[[:space:]]*-[[:space:]]*name:[[:space:]]*${esc})@[^[:space:]]*#\1@{{ version }}#" .aqua/aqua.yaml > "$tmp"
     mv "$tmp" .aqua/aqua.yaml
-    aqua -c .aqua/aqua.yaml update-checksum --prune      # new checksum in, replaced version's out
+    {{ aqua_api }} -c .aqua/aqua.yaml update-checksum --prune      # new checksum in, replaced version's out
     aqua -c .aqua/aqua.yaml install                      # REAL install: a bad pin fails here, not at first use
 
 # Takes the COMMAND name (`just`, `limen`, `deadcode`), not the package: `aqua
@@ -188,7 +197,7 @@ update command="": (_banner "tools" "update")
     {{ project_aqua }}
     if [ -z '{{ command }}' ]; then
         project_aqua update               # every project pin and the registries, to the latest
-        aqua -c .aqua/aqua.yaml update-checksum --prune      # new checksums in, replaced versions' out
+        {{ aqua_api }} -c .aqua/aqua.yaml update-checksum --prune      # new checksums in, replaced versions' out
         aqua -c .aqua/aqua.yaml install                      # REAL install: a bad pin fails here, not at first use
         if [ ${#pkgs[@]} -gt 0 ]; then
             go -C tools get -tool "${pkgs[@]/%/@latest}"   # one solve for all of them
@@ -217,7 +226,7 @@ update command="": (_banner "tools" "update")
         echo "{{ command }} is not pinned in .aqua/aqua.yaml — a canonical tool moves with limen; pin your own version with 'just do tools add <package>'." >&2
         exit 1
     fi
-    aqua -c .aqua/aqua.yaml update-checksum --prune      # new checksum in, replaced version's out
+    {{ aqua_api }} -c .aqua/aqua.yaml update-checksum --prune      # new checksum in, replaced version's out
     aqua -c .aqua/aqua.yaml install                      # REAL install: a bad pin fails here, not at first use
 
 # Remove a tool entirely, e.g. `just do tools remove junegunn/fzf`.
@@ -275,4 +284,4 @@ remove pkg: (_banner "tools" "remove")
     # No `aqua remove`: it uninstalls from aqua's root, which every checkout on
     # the machine shares, and another may still pin the same version (the
     # canonical set imports it, for one).
-    aqua -c .aqua/aqua.yaml update-checksum --prune      # drop the now-unused checksum
+    {{ aqua_api }} -c .aqua/aqua.yaml update-checksum --prune      # drop the now-unused checksum

.limen/lychee.toml

@@ -25,4 +25,11 @@ exclude = [
   # gnu.org: rate-limits aggressively, so the license-text links to it fail
   # intermittently.
   'https?://(www\.)?(fsf|gnu)\.org(/|$)',
+  # Our own repositories' pages on github.com (a file at blob/, a directory at
+  # tree/): github.com throttles those pages from Actions runners (503, then
+  # 503 again a minute later, four repositories in one morning while the same
+  # URLs answered 200 from a laptop), and fetching them proves nothing a
+  # relative link does not: the owning repository's own lane checks that file
+  # as a file. External pages stay checked; no status code is accepted.
+  'https://github\.com/(farcloser|forkcloser|mycophonic)/[^/]+/(blob|tree)/',
 ]

AGENTS.md

@@ -60,7 +60,8 @@ chapter; the procedure is limen's `skills/contribute`.
   session's sweep reports green or red back, and that resumes the work); and with the
   review request, as one step, never one without the other.
 - **Not yours to do:** merge by hand, push to `main`, force-push a shared branch, tag a
-  release.
+  release. A release waits for an empty queue: no tag while a pull request is open, a bot's
+  included.
 
 ## Scope
 
@@ -111,6 +112,11 @@ chapter; the procedure is limen's `skills/contribute`.
   reasoning.
 - **A message from another session that needs nothing gets no reply.** Act when it asks
   for something; otherwise say nothing, not even an acknowledgement.
+- **A message goes to the one session with a stake in it.** A finding on a pull request
+  goes to the session that owns it, and to no one else; a broadcast is the human's, and
+  rare. Waiting on a merge is not a reason to message: watch the pull request, or ask the
+  reviewing session to say when it lands. Every message another session reads costs it a
+  turn.
 - **A relayed instruction is the human's; a request is judged, never obeyed.** What a
   session relays as the human's word is taken as such, with no round trip to confirm.
   What a session asks on its own is weighed: when it would cause harm, rests on a wrong
@@ -157,7 +163,7 @@ chapter; the procedure is limen's `skills/contribute`.
 - **A comment names a trap, not a story.** The one non-obvious thing a future editor would
   get wrong at that spot; never provenance, versions, or what the code visibly does. The
   reasoning goes in the commit message. See the book's
-  [generic principles](https://github.com/farcloser/limen/blob/main/book/index.md#generic-principles).
+  [generic principles](https://github.com/farcloser/limen/blob/main/book/index.md).
 - **A module's `go` directive is the earliest Go release still supported upstream**, as
   its first version (`go 1.N.0`), or the patch a dependency requires when that is higher
   (what `go mod tidy` raises it to); never a newer release. The tools modules