Pin pre-commit's ruff to 0.16.7 and satisfy the CPY001 it brings

The three Python packages pinned ruff twice at different versions:
requirements.txt at 0.16.7, .pre-commit-config.yaml at v0.15.2. Only the
older one ever ran, so `select = ["ALL"]` was enforced two minor versions
behind. Measured before aligning: v0.15.2 reports 0 findings, every 0.16.x
reports CPY001 on each file -- 70 crdt-sync, 23 freedays, 71 gatelock, and
no other rule.

Resolved by adding the notice rather than ignoring the rule, so the gate
keeps its teeth.

Two gatelock modules sat at exactly the 250-line cap, so a one-line header
tipped them to 251. Both are split along a real seam rather than shaved:

  _widget_fills.py    colour arithmetic over LockConfig, no tkinter import
  _surfaces_focus.py  selects among existing surfaces, never mutates them

The focus split keeps _surfaces.py's documented containment (it stays the
only module that creates, moves or destroys windows), and the static guard
in test_recovery_invariants.py globs _surfaces*.py, so the new sibling is
covered with no list to extend. widgets.py re-exports the fills helpers,
which keeps gatelock.widgets the single public surface its tests import.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019kMvSMtsVMB3d2uoZ56pbp

crdt-sync/.pre-commit-config.yaml

@@ -65,7 +65,7 @@ repos:
         types: [python]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
+    rev: v0.16.7
     hooks:
       - id: ruff
         args: [--fix, --unsafe-fixes, --exit-non-zero-on-fix, --show-fixes]

crdt-sync/crdt_sync/__init__.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Shared CRDT merge scheme + pluggable remote sync transports."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/_autherrors.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Turning a Firebase auth response into a message, and reading its verdict.
 
 Split from :mod:`crdt_sync._firebase_auth`, which keeps the token provider.

crdt-sync/crdt_sync/_config.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The one place every app learns how to reach Firebase.
 
 Before this module each caller re-read ``~/.config/crdt-sync/firebase.json``

crdt-sync/crdt_sync/_credentials.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Firebase credentials and the stores that persist them.
 
 Split from :mod:`crdt_sync._firebase_auth`, which keeps the token provider.

crdt-sync/crdt_sync/_device.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """This device's stable sync identity.
 
 Every device that pushes into a namespace needs an id that is *its own*: it

crdt-sync/crdt_sync/_fberrors.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The errors the Firebase sync backend raises.
 
 Split from :mod:`crdt_sync._firebase` for the 250-line cap, mirroring

crdt-sync/crdt_sync/_fbkeys.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Escaping arbitrary strings into Firebase Realtime Database keys.
 
 Split from :mod:`crdt_sync._firebase`, which keeps the client. RTDB forbids

crdt-sync/crdt_sync/_firebase.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Firebase Realtime Database as dumb keyed storage, over its REST API.
 
 The RTDB REST endpoints are plain HTTPS, so this works identically under

crdt-sync/crdt_sync/_firebase_auth.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Firebase Authentication over its REST API, with no SDK dependency.
 
 The Firebase Admin SDK authenticates with a service-account key, which

crdt-sync/crdt_sync/_gherrors.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The errors the GitHub sync backend raises.
 
 Split from :mod:`crdt_sync._github` for the 250-line cap. Kept separate so a

crdt-sync/crdt_sync/_github.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Minimal GitHub Contents API client used as dumb file storage.
 
 GitHub is used purely as file storage via the REST Contents API, not a git

crdt-sync/crdt_sync/_hlc.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Hybrid Logical Clock: a totally-ordered, monotonic per-node timestamp.
 
 An HLC combines wall-clock time with a logical counter so that two ticks

crdt-sync/crdt_sync/_http.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Pooled HTTP sessions, so every request does not re-handshake.
 
 Every call site in this package used the module-level ``requests.get`` /

crdt-sync/crdt_sync/_log.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Log: a collection of Records keyed by id, with a union-merge."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/_mirror.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """A remote store that writes to two backends and reads from both.
 
 Exists for the GitHub -> Firebase cutover: each app can move to Firebase

crdt-sync/crdt_sync/_pull.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Downloading peers' logs, skipping the ones we already have.
 
 Split from :mod:`crdt_sync._sync`, which keeps the push half and the

crdt-sync/crdt_sync/_record.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Record: a per-field LWW map with a sticky (monotonic) delete flag.
 
 This is the unit CRDT merges operate on. It's deliberately domain-agnostic --

crdt-sync/crdt_sync/_remote.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Backend-neutral remote-storage contract that sync talks through.
 
 Deliberately tiny: :func:`crdt_sync.sync_log` and every app-level sync

crdt-sync/crdt_sync/_revisions.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The revision string a device publishes alongside its log.
 
 Split from :mod:`crdt_sync._sync` so both the push and pull halves can import

crdt-sync/crdt_sync/_store.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Local JSON persistence for a ``Log``.
 
 Mirrors ``crdt_sync_dart``'s ``logToJson``/``FileLogPersistence`` serialization

crdt-sync/crdt_sync/_sync.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Domain-agnostic pull/merge/push sync orchestration.
 
 Generalizes diet_guard's original ``_sync.py`` (pull every other device's

crdt-sync/crdt_sync/_syncargs.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The three argument bundles :func:`crdt_sync.sync_log` takes.
 
 Split from :mod:`crdt_sync._sync` for the 250-line cap. Grouping sync_log's

crdt-sync/crdt_sync/_syncstate.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Where a device records what it has already pushed and pulled.
 
 Split from :mod:`crdt_sync._sync`, which keeps the sync itself. The state is

crdt-sync/crdt_sync/tests/__init__.py

@@ -1 +1,2 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the crdt_sync package."""

crdt-sync/crdt_sync/tests/conftest.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Shared pytest fixtures for crdt_sync's test suite."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_config.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the shared Firebase configuration loader.
 
 Every failure mode here is one that would otherwise surface as an

crdt-sync/crdt_sync/tests/test_config_client.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for building a sync client from a config file.
 
 Split from ``test_config.py`` (250-line cap);

crdt-sync/crdt_sync/tests/test_config_credentials.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for reading the sync password and building a client from config.
 
 Split from ``test_config.py`` (250-line cap), which keeps loading and

crdt-sync/crdt_sync/tests/test_device.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for this device's persisted sync identity."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_firebase.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the Realtime Database sync client.
 
 The HTTP layer is fully mocked, so every branch -- success, absent path,

crdt-sync/crdt_sync/tests/test_firebase_auth.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for Firebase Authentication over the REST API.
 
 The HTTP layer is fully mocked, so every branch -- sign-in, refresh, rotated

crdt-sync/crdt_sync/tests/test_firebase_auth_google.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the Google sign-in path.
 
 Split from ``test_firebase_auth.py`` (250-line cap), which keeps credential

crdt-sync/crdt_sync/tests/test_firebase_auth_session.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the auth session lifecycle.
 
 Split from ``test_firebase_auth.py`` (250-line cap);

crdt-sync/crdt_sync/tests/test_firebase_auth_tokens.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ID-token refresh and the session lifecycle.
 
 Split from ``test_firebase_auth.py`` (250-line cap), which keeps credential

crdt-sync/crdt_sync/tests/test_firebase_writes.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for Firebase writes, string maps and deletion.
 
 Split from ``test_firebase.py`` (250-line cap), which keeps key escaping

crdt-sync/crdt_sync/tests/test_github.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the GitHub Contents API sync client.
 
 The HTTP layer is fully mocked (``requests.get``/``requests.put``), so every

crdt-sync/crdt_sync/tests/test_github_writes.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for GitHub writes and access checks.
 
 Split from ``test_github.py`` (250-line cap), which keeps the read paths.

crdt-sync/crdt_sync/tests/test_hlc.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the Hybrid Logical Clock."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_log.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for merge_logs, including its CRDT convergence properties."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_mirror.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the dual-write client used during the GitHub -> Firebase cutover.
 
 The asymmetry is the whole point and is what these assert: a primary failure

crdt-sync/crdt_sync/tests/test_mirror_fallback.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for mirror fallback reads, revision maps and lifecycle.
 
 Split from ``test_mirror.py`` (250-line cap), which keeps plain writes,

crdt-sync/crdt_sync/tests/test_record.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for Record, merge_field, and merge_record."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_store.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for local Log persistence (dump/load and atomic file read/write)."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_sync.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the pull/merge/push sync orchestration."""
 
 from __future__ import annotations

crdt-sync/crdt_sync/tests/test_sync_revisions.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the revision tracking that keeps sync inside the free tier.
 
 Two savings, both measured against the GitHub-backed history this replaces:

crdt-sync/crdt_sync/tests/test_sync_revisions_backends.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for backends without bulk map reads, and publishing order.
 
 Split from ``test_sync_revisions.py`` (250-line cap);

crdt-sync/crdt_sync/tests/test_sync_revisions_peers.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for revision handling across peers.
 
 Split from ``test_sync_revisions.py`` (250-line cap), which keeps revision

crdt-sync/crdt_sync/tests/test_sync_skips.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the peer files sync_log declines to merge.
 
 Split from ``test_sync.py`` (250-line cap). A peer whose pushed file is

crdt-sync/crdt_sync/tests/test_tool_google_id_token.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``tool/google_id_token``, the loopback OAuth ID-token minter.
 
 No network and no browser. The callback server is replaced wholesale so the

crdt-sync/crdt_sync/tests/test_tool_google_id_token_cli.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``tool/google_id_token``'s command line entry point.
 
 Split from :mod:`test_tool_google_id_token` to stay under the repo's 250-line

crdt-sync/crdt_sync/tests/test_tool_interop_seed.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``tool/interop_seed``, the Python half of the interop check.
 
 Patched at the module's own boundary -- ``firebase_client_for``,

crdt-sync/crdt_sync/tests/test_tool_link_google.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for token inspection and linking in ``tool/link_google``.
 
 ``main()`` and ``_read_token`` are covered in

crdt-sync/crdt_sync/tests/test_tool_link_google_main.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``_read_token`` and ``main()`` in ``tool/link_google``.
 
 Split from :mod:`test_tool_link_google` to stay under the 250-line cap.

crdt-sync/crdt_sync/tests/test_tool_link_google_token.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``describe_google_token`` in ``tool/link_google``.
 
 Split from :mod:`test_tool_link_google` (which covers linking) and

crdt-sync/crdt_sync/tests/test_tool_migrate_github.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the GitHub-reading half of ``tool/migrate_github_to_firebase``.
 
 ``main()`` is covered in :mod:`test_tool_migrate_github_main`, split to stay

crdt-sync/crdt_sync/tests/test_tool_migrate_github_main.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``main()`` in ``tool/migrate_github_to_firebase``.
 
 Split from :mod:`test_tool_migrate_github` to stay under the 250-line cap.

crdt-sync/crdt_sync/tests/test_tool_oauth_callback.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the one-shot OAuth redirect catcher in ``tool/_oauth_callback``.
 
 No network access: everything binds 127.0.0.1 on a port the module itself

crdt-sync/crdt_sync/tests/test_tool_preflight_firebase.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for the individual checks in ``tool/preflight_firebase``.
 
 ``main()`` and the loading helpers are covered in

crdt-sync/crdt_sync/tests/test_tool_preflight_firebase_main.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``tool/preflight_firebase``'s loaders and ``main()``.
 
 Split from :mod:`test_tool_preflight_firebase` to stay under the 250-line file

crdt-sync/crdt_sync/tests/test_tool_seed_session.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``seed_apps`` in ``tool/seed_session``.
 
 ``main()`` is covered in :mod:`test_tool_seed_session_main`, split to stay

crdt-sync/crdt_sync/tests/test_tool_seed_session_main.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for ``main()`` in ``tool/seed_session``.
 
 Split from :mod:`test_tool_seed_session` to stay under the 250-line cap.

crdt-sync/tool/__init__.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """One-shot operational scripts for crdt_sync.
 
 A package rather than a loose directory so the linter treats these as real

crdt-sync/tool/_oauth_callback.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The one-shot local HTTP server that catches Google's OAuth redirect.
 
 Split from :mod:`google_id_token`, which keeps the token exchange. Google

crdt-sync/tool/_seeded_apps.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Which apps keep a desktop Firebase session, and why the list is hand-kept.
 
 Split out of ``seed_session.py`` for the 250-line cap. The rationale is worth

crdt-sync/tool/google_id_token.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 r"""Fetch a Google ID token for this project, via a local loopback OAuth flow.
 
 ``link_google.py`` needs a Google ID token whose ``aud`` claim is an OAuth

crdt-sync/tool/interop_seed.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Write the Python half of the live cross-language interop check.
 
 ``crdt_sync_dart/tool/interop_check.dart`` merges a Dart record into

crdt-sync/tool/link_google.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Link a Google identity to the existing sync account, keeping the same uid.
 
 The security rules pin exactly one uid (``auth.uid === '<uid>'``), so signing

crdt-sync/tool/migrate_github_to_firebase.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """One-shot migration of the GitHub-backed sync repo into Firebase RTDB.
 
 Reads through the GitHub API rather than a local clone: a checkout goes stale

crdt-sync/tool/preflight_firebase.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Validate ``~/.config/crdt-sync`` before anything is migrated.
 
 Every failure this catches is one that would otherwise surface *after* data

crdt-sync/tool/seed_session.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 r"""Reseed each app's desktop Firebase session by signing in with Google.
 
 The sync account moved to Google-only sign-in, so the password flow that used

freedays/.pre-commit-config.yaml

@@ -65,7 +65,7 @@ repos:
         types: [python]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
+    rev: v0.16.7
     hooks:
       - id: ruff
         args: [--fix, --unsafe-fixes, --exit-non-zero-on-fix, --show-fixes]

freedays/freedays/__init__.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """One shared pool of pre-declared days on which every gate app stands down.
 
 The whole point of this package fits in one call. A gate app asks::

freedays/freedays/_api.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Ask, mark, release, report -- the whole public surface.
 
 :func:`is_free_day` is the one every gate app calls, and it is deliberately

freedays/freedays/_audit.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Append-only, HMAC-signed trail of every mark and release.
 
 Nothing reads this to make a decision -- the CRDT log is the truth, and this

freedays/freedays/_budget.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Calendar-year accounting for the pool.
 
 One global pool, shared by every app: a day is either free everywhere or

freedays/freedays/_cli.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The ``freedays`` command: the only thing that ever talks about free days.
 
 Every subcommand that says anything is pull, never push: nothing notifies,

freedays/freedays/_cli_output.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The one stdout/stderr sink every ``freedays`` subcommand writes through.
 
 A thin wrapper over ``sys.stdout.write`` (the shape diet-guard and home-guard

freedays/freedays/_constants.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """On-disk locations, remote paths and the one policy number that matters.
 
 Every path here is a *default*. Public functions take the corresponding

freedays/freedays/_day.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """What "today" means, in one place.
 
 The apps this package serves disagreed about this before it existed:

freedays/freedays/_errors.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Why a mark or un-mark was refused.
 
 Each of these is a *policy* refusal with a message meant to be shown to the

freedays/freedays/_hmac.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Signing the audit trail, using nothing but the standard library.
 
 This deliberately does not call ``gatelock.log_integrity``, even though the

freedays/freedays/_model.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Translating between a free day and a crdt-sync ``Record``.
 
 The record id *is* the ISO date, so two devices marking the same day produce

freedays/freedays/_paths.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Every file this package owns, as one value that can be swapped wholesale.
 
 Threading five separate ``*_path`` keyword arguments through the API was the

freedays/freedays/_sync.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Pushing and pulling the pool, so a day taken on the phone lands on the PC.
 
 Sync is a *separate* operation from every decision in :mod:`freedays._api`.

freedays/freedays/tests/__init__.py

@@ -1 +1,2 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Tests for :mod:`freedays`."""

freedays/freedays/tests/conftest.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Redirect every on-disk path away from real user state, for every test.
 
 This is one ``monkeypatch`` of one function, and that is the whole point.

freedays/freedays/tests/test_api.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Marking, releasing, and the budget arithmetic behind both."""
 
 from __future__ import annotations

freedays/freedays/tests/test_audit.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The audit trail: best-effort, signed, and never in the way."""
 
 from __future__ import annotations

freedays/freedays/tests/test_cli.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The command line: the only surface that ever mentions free days."""
 
 from __future__ import annotations

freedays/freedays/tests/test_day.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Date handling: the one place allowed an opinion about "today"."""
 
 from __future__ import annotations

freedays/freedays/tests/test_hmac.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Signing, and the ways it is allowed to fail."""
 
 from __future__ import annotations

freedays/freedays/tests/test_model.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Record translation, and the CRDT properties the design leans on."""
 
 from __future__ import annotations

freedays/freedays/tests/test_paths.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The path bundle itself, exercised unpatched.
 
 The autouse redirect in ``conftest`` replaces ``resolve_paths`` *as imported

freedays/freedays/tests/test_sync.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Sync: convergence across devices, and silence when the network is not there."""
 
 from __future__ import annotations

gatelock/.pre-commit-config.yaml

@@ -65,7 +65,7 @@ repos:
         types: [python]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
+    rev: v0.16.7
     hooks:
       - id: ruff
         args: [--fix, --unsafe-fixes, --exit-non-zero-on-fix, --show-fixes]

gatelock/gatelock/__init__.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Shared lock-window and HMAC log-integrity backend for blocking-overlay apps.
 
 Used by ``screen-locker``, ``diet-guard`` and ``wake-alarm``, which all need

gatelock/gatelock/_arbiter.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Decide which of N locker apps may hold the screen.
 
 On 2026-07-25 two lockers armed at the same boot. One won the X grab; the

gatelock/gatelock/_arming.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """Bringing the lock up: VT-disable, backdrop, surfaces, and the input grab.
 
 Split out of :mod:`gatelock._window`, which keeps the object's construction

gatelock/gatelock/_claims.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
 """The claim an app publishes while it holds the screen, and how to read one.
 
 Split from :mod:`gatelock._arbiter`, which keeps the arbiter itself. A claim