build(lint): select ruff's rules explicitly instead of inheriting them

The gate had no `select`, so it linted with whatever the installed ruff
version defaults to. `dev` pins only `ruff>=0.6` and CI installs that
extra fresh on every run, which made the rule set a function of when pip
last resolved rather than of this code. Two developers on one commit
could get different answers, and so could CI and a laptop.

This surfaced when T-47's converged setup reinstalled ruff and pulled
0.16.3: `make lint` failed on UP017 and BLE001 in main.py, a file the
commit before it had not touched. Under the previous install the same
code passed. Nothing about the code changed — only the linter's idea of
what to look at, which had grown to 413 rules with nobody choosing them.

Naming the families fixes that; pinning the version would only have
frozen the symptom and moved the surprise to whoever unpinned it. 217
rules now, selected on purpose, and a future ruff release becomes a
decision instead of a broken push.

ASYNC is included deliberately — this is a websocket gateway, and it is
the family whose findings would be real bugs rather than style. BLE is
deliberately excluded: main.py catches bare Exception when a device
disappears mid-send, which is correct there, and selecting BLE would
mean a noqa on every such site to say so.

UP017 is fixed rather than suppressed (datetime.timezone.utc -> UTC,
identical semantics, and requires-python is already >=3.11); isort then
reordered the import, which is the whole of the main.py diff.

Verified the selection is load-bearing rather than decorative: a probe
file with a mutable default argument fails the explicit set (B006, exit
1) and passes ruff's minimal default set (exit 0), so the rules named
here are doing work the fallback would not. Probe deleted; lint,
typecheck and the 9-test suite all green after.

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -14,6 +14,9 @@ until the first tagged release.
   removed. `make test` means the same thing from any directory.
 - Firmware targets source `~/esp-idf/export.sh` themselves, so `idf.py` resolves without
   having to remember. Override the location with `IDF_EXPORT=`.
+- `make setup` now proves the gateway environment actually works instead of trusting a
+  clean `pip install` exit code: it collects the test suite and checks `ruff`/`mypy`
+  resolve in the venv, and fails the target if any of that is broken (T-47).
 
 ## [0.2.2] — 2026-07-19
 

Makefile

@@ -44,8 +44,28 @@ lint: lint-gateway ## Lint every component that has a linter
 # --- gateway ------------------------------------------------------------------
 
 .PHONY: setup
-setup: ## Create the gateway venv and install dev deps (no ML models)
+setup: ## Gateway venv + dev deps + prove it works (firmware needs export.sh — see below)
 	cd $(GATEWAY) && $(PYTHON) -m venv .venv && .venv/bin/pip install -e ".[dev]"
+	@# This covers the gateway half only, deliberately. The firmware half needs
+	@# `source ~/esp-idf/export.sh` in every shell (see the firmware gotchas
+	@# above); a Makefile recipe runs in its own subshell, so it cannot leave
+	@# that sourced in the caller's shell. A `setup` that appeared to prepare
+	@# firmware and silently left `idf.py` unresolved would be worse than one
+	@# that says plainly it does not touch that half — hence `build-firmware`
+	@# sources export.sh itself, per target, instead.
+	@#
+	@# Exit 0 from `pip install` is not evidence (D-24) — pip reports success
+	@# even when the result is unusable (e.g. a dependency that resolved but
+	@# doesn't actually import, or a stale .venv left over from a different
+	@# Python). Prove the environment works instead of trusting the install
+	@# step: `--collect-only` imports every test module and therefore every
+	@# src module each one pulls in (T-47). It runs zero tests, so it stays
+	@# cheap, and it also confirms ruff/mypy landed in .venv/bin — the venv
+	@# is the only place either binary exists (see gateway gotchas above);
+	@# `--version` is enough to prove each resolves and runs.
+	cd $(GATEWAY) && .venv/bin/python -m pytest tests/ --collect-only -q
+	cd $(GATEWAY) && .venv/bin/ruff --version >/dev/null
+	cd $(GATEWAY) && .venv/bin/mypy --version >/dev/null
 
 .PHONY: setup-speech
 setup-speech: ## Additionally install faster-whisper and piper

gateway/pyproject.toml

@@ -33,6 +33,28 @@ where = ["src"]
 line-length = 100
 src = ["src"]
 
+# Selected explicitly, because the default set is not a constant.
+#
+# With no `select` here, ruff lints with whatever its installed version
+# defaults to — 413 rules under 0.16.3. `dev` pins only `ruff>=0.6`, and CI
+# installs that extra fresh on every run, so the gate's scope was a function of
+# when pip last resolved rather than of this code. Two findings appeared here
+# the first time a converged environment ran the gate, in a file nobody had
+# touched (T-47).
+#
+# That is the failure this repo keeps meeting from the other side: a check
+# whose result depends on something other than the thing it checks. Pinning the
+# ruff version would freeze the symptom; naming the rules fixes it, and makes
+# a future ruff release a decision rather than a surprise.
+#
+# ASYNC is here on purpose — this is a websocket gateway, and it is the one
+# family whose findings would be genuine bugs rather than style.
+# BLE (blind except) is deliberately absent: main.py catches bare Exception
+# when a device disappears mid-send, which is correct there and would need a
+# noqa on every occurrence to say so.
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "UP", "B", "ASYNC", "SIM", "C4"]
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]

gateway/src/desklock_gateway/main.py

@@ -7,7 +7,7 @@ Protocol (see docs/architecture.md — keep in sync):
 
 import asyncio
 import logging
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 
@@ -41,7 +41,7 @@ async def _ensure_filler() -> bytes | None:
 
 
 def _now() -> str:
-    return datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds")
+    return datetime.now(UTC).astimezone().isoformat(timespec="seconds")
 
 
 @app.get("/healthz")