chore(ruff): the acceptance was whatever the default happened to be [skip-docs]

`uv sync --frozen` resolved ruff 0.15.22 and the tree read clean. A loose
install resolves 0.16.6, under which the SAME untouched code reports 148
findings -- 4 more than round 9 counted, because this round added four files.
All of them are new rules rather than new defects: 0.16 widened the default
rule set to whole families (YTT, ASYNC, PL, ISC, C4, UP, B, SIM, FURB, ...).

(`[skip-docs]` is for CLAUDE.md, which a lint-configuration change does not
reach. README's developer section IS updated in this commit.)

THE DEFECT IS NOT THE 148, IT IS THAT NOBODY CHOSE THEM. `[tool.ruff]` set only
`line-length` and `target-version`, so the acceptance was ruff's default, and
the tree stayed green only as long as the lockfile froze an old ruff. `select`
is now written down: `E4`, `E7`, `E9`, `F` (the historical default), `I`
because this tree already keeps imports sorted, and `RUF100` so a `noqa` that
has stopped meaning anything is caught rather than left as decoration. Pin
`ruff>=0.9` -> `ruff>=0.16.6,<0.17`.

Per rule, before -> after: RUF100 50 -> 0, I001 20 -> 0, ISC004 19, PLW1510 8,
C408 8, EXE001 6, RUF007 5, PLE2515 4, UP031 3, B017 3, and fourteen more with
2 or fewer -- the families out of the declared set are 0 by selection, and 148
is the number to start from if they are adopted, which is a separate decision
and not one to take inside a version-pin commit. 57 were auto-fixed; one E402
was reintroduced by the import-sorting fix merging a block away from its
`noqa`, and got the directive back rather than a bare one.

`S` IS MEASURED OUT, NOT ASSUMED OUT: it reports 2657 `S101` on a suite whose
every assertion is an `assert`, and `S603` flags 19 subprocess calls of which
one was ever marked -- selecting it buys 18 suppressions and no defect. Two
`noqa` directives naming non-selected rules were dropped with that reason
recorded in the configuration instead.

THE TWO FILES 0.16 WOULD REFORMAT ARE MARKDOWN, NOT PYTHON: `README.md` and
`docs/2026-09-08-blindsone-below-k-k2.md`. 0.16 formats fenced Python inside
markdown, and both blocks are RECORDS -- the second is a quotation of
`COST_VOCABULARY` as it stood when that measurement was taken. Reformatting a
quotation makes it stop being one, so markdown is excluded from the formatter
and `ruff format --check .` stays in the acceptance over `.py`.

`tools/okf_consume_measure.py` is fenced by the order as run-not-edited, so its
three findings are exempted by path with the reason and the debt named, and its
bytes are untouched.

THE LOCKFILE TRAP IS CLOSED, NOT AVOIDED. `uv.lock` predated the `[ocr]` extra,
so any unlocked resolve wrote that extra's transitive tree back into it -- 681
insertions over 4 deletions, twice now, and round 9 recorded the cause as
`uv run` OUTSIDE the project when it is `uv run` without `--frozen` INSIDE it.
The relock is complete for every declared extra (703 insertions, 26 deletions),
and measured after it, an unfrozen `uv run` leaves the file alone.

`ruff check src tests tools`, `ruff format --check .` (0.16.6), `mypy src` over
21 files and 1535 tests, all green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/llm_ingestion_okf/__init__.py

@@ -45,16 +45,6 @@ from .errors import (
     SourceError,
 )
 from .extract import extract_text
-from .inbox import (
-    BlockedFile,
-    FailedFile,
-    Gate,
-    GateDecision,
-    InboxResult,
-    PersistedFile,
-    SkippedPath,
-    process_inbox,
-)
 from .importer import (
     BundleDecision,
     FailedConcept,
@@ -66,6 +56,16 @@ from .importer import (
     UnverifiedReference,
     import_bundle,
 )
+from .inbox import (
+    BlockedFile,
+    FailedFile,
+    Gate,
+    GateDecision,
+    InboxResult,
+    PersistedFile,
+    SkippedPath,
+    process_inbox,
+)
 from .manifest import (
     Extraction,
     FileSource,

src/llm_ingestion_okf/cli.py

@@ -77,8 +77,7 @@ from .corpus import LOG_NAME, CorpusReport, load_plans, measure
 from .errors import IngestError
 from .inbox import walk_inbox
 from .profiles import SEGMENTED_OKF_V0_2, STRUCTURED_V1, BundleProfile
-from .propose import ProposerError
-from .propose import heading_reserve_applies
+from .propose import ProposerError, heading_reserve_applies
 from .propose import run as propose_run
 
 __all__ = ["DEFAULT_STAMP", "build", "main", "measure"]

src/llm_ingestion_okf/extract.py

@@ -32,11 +32,11 @@ import statistics
 import tempfile
 import warnings
 import zipfile
-from xml.etree import ElementTree
 from collections.abc import Callable, Sequence
 from dataclasses import dataclass
 from html.parser import HTMLParser
 from pathlib import Path
+from xml.etree import ElementTree
 
 from .errors import ExtractionError, ExtractionWarning
 from .render import render_fenced_block, render_table
@@ -524,7 +524,7 @@ def _pdf_pages(
             ]
     except ExtractionError:
         raise
-    except Exception as exc:  # noqa: BLE001 - third-party parser, wrapped never leaked
+    except Exception as exc:
         raise ExtractionError(
             f"the PDF parser failed on this file: {exc}", code="extractor_pdf_error"
         ) from exc
@@ -615,7 +615,7 @@ def _extract_office(suffix: str, data: bytes) -> str:
         text = _convert_bytes(data, writer, _PANDOC_FORMATS[suffix], args)
     except ExtractionError:
         raise
-    except Exception as exc:  # noqa: BLE001 - third-party converter, wrapped never leaked
+    except Exception as exc:
         raise ExtractionError(
             f"the converter failed on this {suffix} file: {exc}",
             code="extractor_convert_error",

src/llm_ingestion_okf/inbox.py

@@ -51,8 +51,8 @@ from .structure import (
     derive_document_structure,
     facet_values,
     resolve_structure,
-    structure_frontmatter,
     structure_from_frontmatter,
+    structure_frontmatter,
 )