freedays: pylint --fail-under=10, scoped to source, on pylint 4.0.8

The three import-error findings were the hook not having crdt-sync in
its own venv; it is now pinned there as in pyproject.toml. The one
source finding is the background sync's documented fail-open net, which
must catch everything by design, so it carries the one suppression.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHCbkJWXHjtTUaqvnHRAqA

freedays/.pre-commit-config.yaml

@@ -101,15 +101,18 @@ repos:
           - --disable-error-code=list-item
 
   - repo: https://github.com/pylint-dev/pylint
-    rev: v3.3.2
+    rev: v4.0.8
     hooks:
       - id: pylint
         args:
           - --rcfile=freedays/pyproject.toml
-          - --fail-under=8.0
+          - --fail-under=10
           - --jobs=4
         additional_dependencies:
           - pytest
+          # Kept in step with pyproject.toml, so pylint resolves the crdt_sync
+          # imports instead of scoring every one of them as import-error.
+          - crdt-sync @ git+https://github.com/kuhyx/utils@crdt-sync-v0.9.1#subdirectory=crdt-sync
 
   - repo: https://github.com/PyCQA/bandit
     rev: 1.9.4

freedays/freedays/_sync.py

@@ -138,7 +138,7 @@ def sync_quietly(*, paths: Paths | None = None) -> bool:
         # this is normal on a laptop and must not fill the journal.
         _logger.debug("free-day sync skipped: %s", exc)
         return False
-    except Exception:
+    except Exception:  # pylint: disable=broad-exception-caught
         _logger.exception("free-day sync failed unexpectedly")
         return False
     return True

freedays/pyproject.toml

@@ -90,11 +90,22 @@ color_output = true
 exclude = [".venv/"]
 
 [tool.pylint.main]
+# The repo root on the path, so pylint resolves the package's own imports the
+# same way pytest does instead of reporting import-error for them.
+init-hook = "import sys; sys.path.insert(0, 'freedays')"
 analyse-fallback-blocks = true
 persistent = true
 jobs = 0
 py-version = "3.14"
 ignore = [".venv", "__pycache__"]
+# Test suites intentionally use patterns (protected-access, fixture-arg
+# shadowing) that don't apply to source code; ruff's per-file-ignores carry
+# the equivalent exemptions, so tests stay linted -- by ruff. This is the same
+# source-only pylint scope wake-alarm / diet-guard / testsAndMisc use. It has
+# to be `ignore-paths`, not `ignore = ["tests"]`: `ignore` only matches the
+# basename of what pylint is *given*, and pre-commit hands it explicit file
+# paths, so a directory name in `ignore` never fires under the hook.
+ignore-paths = ["^(.*/)?tests/.*$"]
 ignore-patterns = [".*\\.pyi$"]
 
 [tool.pylint.messages_control]