diff --git a/.limen/just/lint.just b/.limen/just/lint.just
index c7ab7b9..faea81f 100644
--- a/.limen/just/lint.just
+++ b/.limen/just/lint.just
@@ -182,9 +182,13 @@ commits range="": (_banner "lint" "commits")
     # below verify signatures — this is convenience wiring, not enforcement.
     # See https://github.com/andyfeller/gh-ssh-allowed-signers for automation
     # to retrieve contributor keys.
+    # Best-effort: sandboxed agent sessions (e.g. Claude Code) write-protect
+    # .git/config as an escape-vector guard, and losing the display wiring must
+    # not fail the lint the rules below actually enforce.
     if [ -f .allowed_signers ]; then
         git config --unset-all gpg.ssh.allowedSignersFile 2>/dev/null || true
-        git config --add gpg.ssh.allowedSignersFile .allowed_signers
+        git config --add gpg.ssh.allowedSignersFile .allowed_signers 2>/dev/null ||
+            echo "note: .git/config not writable; signature display not armed" >&2
     fi
     range="{{ range }}"
     if [ -z "$range" ] && [ -n "${GITHUB_BASE_REF:-}" ]; then
diff --git a/aqua-checksums.json b/aqua-checksums.json
index 0b91a0f..cd92c48 100644
--- a/aqua-checksums.json
+++ b/aqua-checksums.json
@@ -46,28 +46,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.0.8/limen_0.0.8_darwin_arm64.tar.gz",
-      "checksum": "57AE1E9398565E4E2A0A8DB23D6C98E406655F9BBF19DBD0EBCB7F21BE49379E",
+      "id": "github_release/github.com/farcloser/limen/v0.0.9/limen_0.0.9_darwin_arm64.tar.gz",
+      "checksum": "2E200810F3918425D584138F6D73F1597473FAFD768F01D97D00EC13D580C970",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.0.8/limen_0.0.8_linux_amd64.tar.gz",
-      "checksum": "397CEF56A8A22F6BC8BEBE492BC69587A19DDC2989CBE0F0D760356902359352",
+      "id": "github_release/github.com/farcloser/limen/v0.0.9/limen_0.0.9_linux_amd64.tar.gz",
+      "checksum": "8CD95B315F648D7D864F42E9CE3B2056299CCBDD432741E29B4809A2A12EE769",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.0.8/limen_0.0.8_linux_arm64.tar.gz",
-      "checksum": "70772E289B4F4DBA37F84E8AAE6B91C7AB09BB1EAF989B33569E0FA9886F5160",
+      "id": "github_release/github.com/farcloser/limen/v0.0.9/limen_0.0.9_linux_arm64.tar.gz",
+      "checksum": "7CCA885CFF4F77B8757E1090031E1F8B0422846F0A89E56189267CBA8F4C4B06",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.0.8/limen_0.0.8_windows_amd64.tar.gz",
-      "checksum": "BCD8DF9BAF05EF8BD06AEEA91B80E7B74455D90DA51BDD189994DB26B56933AB",
+      "id": "github_release/github.com/farcloser/limen/v0.0.9/limen_0.0.9_windows_amd64.tar.gz",
+      "checksum": "3144C8901C1AFFAC0E6357917A3976A1680A0A08296B9070D9AE1404E66E4B00",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.0.8/limen_0.0.8_windows_arm64.tar.gz",
-      "checksum": "438B1AB96EFC721446E227EA85A3B1E3A216DA52B523BF522EB6B46C6145B470",
+      "id": "github_release/github.com/farcloser/limen/v0.0.9/limen_0.0.9_windows_arm64.tar.gz",
+      "checksum": "68C1E8E2CC0066959E0000BF2D7A2ED06DEDC814E2E5D32F2C0A91095B0514F4",
       "algorithm": "sha256"
     },
     {
diff --git a/aqua.yaml b/aqua.yaml
index ffebf19..212adef 100644
--- a/aqua.yaml
+++ b/aqua.yaml
@@ -32,7 +32,7 @@ packages:
   - name: github.com/farcloser/godolint/cmd/godolint@v0.1.0
     registry: local
   # --- farcloser tools (local registry; standard once registered upstream) ---
-  - name: farcloser/limen@v0.0.8 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.0.9 # renovate: depName=farcloser/limen
     registry: local
   # --- toolchain + binary-release tools (standard registry, aqua-verified) ---
   - name: golang/go@go1.26.4
diff --git a/profile/README.md b/profile/README.md
index a570355..ab46a74 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -5,8 +5,7 @@ An organization focused on developer tooling and core (mostly go) libraries.
 Small, dependency-light, aggressively pinned. Everything here is built the same way, because
 the rules are written down and a tool enforces them.
 
-> 🔒 marks a private repository — listed for completeness, but the link will 404 unless you
-> have been granted access.
+> 🔒 marks a private repository
 
 ## Workstation & repository setup