build(lint): make pyproject.toml the single source of truth for pylint

There were two divergent pylint configs: the `make lint` gate ran
`pylint --disable=all --enable=<7 checks>` (an allowlist, in the
Makefile via PYLINT_GATE_CHECKS), while `[tool.pylint.master]` in
pyproject carried a ~30-entry *denylist* that only an ad-hoc /
IDE `pylint <file>` saw. They expressed the same intent ("enforce only
a few pylint checks") in opposite directions, so a bare/IDE run actually
fired a different, larger set than the gate — the opposite of IDE/gate
parity — and the master block needed a warning comment not to disable a
check the gate enables.

Collapse to one config in pyproject.toml:

- `[tool.pylint.messages_control]` now holds `disable = ["all"]` + the
  same 7-check `enable` allowlist the gate used. Every invocation —
  `make lint`, ad-hoc `pylint <file>`, IDE/Pylance — reads it and
  behaves identically.
- `[tool.pylint.main] ignore-paths = [".*/tests/.*"]` moves the
  test exemption (tests reach across the private boundary by design,
  source_files.md §5.2) into config, so even a directly-opened test
  file self-exempts in the IDE.
- The Makefile no longer defines the check set or a non-test file list.
  PYLINT_GATE_CHECKS and PYLINT_GATE_FILES are removed; the gate runs
  `pylint --score=n --recursive=y <3 package roots>` and lets config
  drive both which checks fire and which paths are skipped.
- Dropped the now-dead `max-line-length` (line-too-long isn't enabled
  under the allowlist; black enforces 120).

Verified: gate clean; ad-hoc `pylint <file>` runs only the 7 checks; a
mutable-default probe still fires `dangerous-default-value`; a test file
self-exempts from `protected-access`. make lint clean. Tooling-only
change — no runtime source touched, so the test suite is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ccie18643

Makefile

@@ -19,30 +19,13 @@ LINT_FILES := $(PYTCP_FILES) $(NET_ADDR_FILES) $(NET_PROTO_FILES) $(EXAMPLES_FIL
 # the 'venv' target), so its name is decoupled from its path here.
 MYPY_PACKAGES := pytcp net_addr net_proto examples_legacy
 
-# The pylint gate runs a small set of checks NOT covered by flake8 / mypy
-# over the three packages' NON-TEST source (tests are exempt — they reach
-# across the private boundary by design, source_files.md §5.2):
-#   protected-access        no cross-class '_private' reach-through (§5.2);
-#                           split-class subpackages (protocols/tcp/fsm,
-#                           protocols/tcp/session, runtime/packet_handler)
-#                           carry their own file-level disable, honored here
-#   raise-missing-from      mandatory exception chaining 'raise X from err'
-#                           (net_proto.md §9.2, python_features.md §10a)
-#   dangerous-default-value no mutable default args ('= []' / '= {}')
-#   cell-var-from-loop      closure-over-loop-variable bug
-#   useless-super-delegation / super-with-arguments  redundant super() forms
-#   unused-import           genuinely-unused imports AND — uniquely — a
-#                           runtime import used only inside a STRING
-#                           annotation, i.e. an unnecessary quote that
-#                           should be unquoted (typing.md §20). flake8's
-#                           F401 reads inside string annotations so it
-#                           misses this; pylint W0611 does not. It does
-#                           NOT fire on TYPE_CHECKING imports used in
-#                           string annotations (the legit circular-import
-#                           case) or on '__all__' re-exports.
-# Everything else stays off — full pylint is not part of the gate.
-PYLINT_GATE_CHECKS := protected-access,raise-missing-from,dangerous-default-value,cell-var-from-loop,useless-super-delegation,super-with-arguments,unused-import
-PYLINT_GATE_FILES := $(shell find $(PYTCP_PATH) $(NET_ADDR_PATH) $(NET_PROTO_PATH) -name '*.py' -not -path '*/tests/*')
+# The entire pylint configuration — which checks fire AND which paths
+# are exempt — lives in pyproject.toml ([tool.pylint.*]: 'disable = all'
+# + a small 'enable' allowlist, and 'ignore-paths' for tests). It is the
+# single source of truth shared with ad-hoc / IDE pylint runs. The gate
+# below just hands pylint the three package roots and lets config decide
+# the rest ('--recursive=y' so pylint walks the tree; tests self-exempt
+# via 'ignore-paths').
 
 # If any recipe fails, delete its target file. Without this a
 # failed (or interrupted) 'venv' build leaves a half-populated
@@ -128,7 +111,7 @@ lint: venv
 	@for pkg in $(MYPY_PACKAGES); do PYTHONPATH=$(ROOT_PATH) ./$(VENV)/bin/mypy -p $$pkg || exit 1; done
 	@PYTHONPATH=$(ROOT_PATH) ./$(VENV)/bin/mypy $(ROOT_FILES)
 	@echo '<<< PYLINT'
-	@PYTHONPATH=$(ROOT_PATH) ./$(VENV)/bin/pylint --disable=all --enable=$(PYLINT_GATE_CHECKS) --score=n $(PYLINT_GATE_FILES)
+	@PYTHONPATH=$(ROOT_PATH) ./$(VENV)/bin/pylint --score=n --recursive=y $(PYTCP_PATH) $(NET_ADDR_PATH) $(NET_PROTO_PATH)
 	@echo '<<< PYRIGHT'
 	@PYTHONPATH=$(ROOT_PATH) ./$(VENV)/bin/pyright
 

pyproject.toml

@@ -102,42 +102,49 @@ reportCallIssue = "none"            # test-side; mypy-covered
 reportAbstractUsage = "none"        # tests deliberately instantiate abstract classes (with `# type: ignore[abstract]`)
 reportPrivateImportUsage = "none"   # net_proto re-export shape pyright disagrees with; mypy's no_implicit_reexport is authority
 
-# This block ONLY affects an ad-hoc 'pylint <file>' run (a developer /
-# IDE invoking pylint directly); it silences the noisy checks so such a
-# run is usable. It does NOT affect 'make lint' — that gate runs
-# 'pylint --disable=all --enable=<explicit checks>' (see the Makefile
-# 'PYLINT_GATE_CHECKS'), whose CLI '--enable' overrides everything here.
-# Do not disable a check the gate enables (e.g. 'dangerous-default-value'),
-# or a local run would miss what the gate then rejects.
-[tool.pylint.master]
-max-line-length = 120
-disable = """
-    super-init-not-called,
-    no-name-in-module,
-    import-error,
-    too-many-instance-attributes,
-    too-many-public-methods,
-    too-many-arguments,
-    too-many-locals,
-    too-many-branches,
-    too-many-lines,
-    too-many-boolean-expressions,
-    too-many-positional-arguments,
-    too-many-statements,
-    too-many-return-statements,
-    too-few-public-methods,
-    import-outside-toplevel,
-    fixme,
-    multiple-statements,
-    invalid-name,
-    redefined-builtin,
-    superfluous-parens,
-    expression-not-assigned,
-    no-member,
-    too-many-ancestors,
-    redefined-outer-name,
-    global-statement,
-    wrong-import-order,
-    consider-using-with,
-    abstract-class-instantiated
-"""
+# Single source of truth for pylint — every invocation reads this:
+# 'make lint', an ad-hoc 'pylint <file>', and the IDE/Pylance pylint
+# integration all behave identically. The Makefile gate runs 'pylint'
+# with NO check flags, so this config alone decides what fires.
+#
+# The gate is a small allowlist of checks NOT already covered by
+# flake8 / mypy / black; 'disable = all' turns off everything else
+# (pylint's many noisy / opinionated checks the project does not
+# enforce). Enabled checks:
+#   protected-access        no cross-class '_private' reach-through
+#                           (source_files.md §5.2); split-class
+#                           subpackages (protocols/tcp/fsm,
+#                           protocols/tcp/session, runtime/packet_handler)
+#                           carry their own file-level disable, honored here
+#   raise-missing-from      mandatory exception chaining 'raise X from err'
+#                           (net_proto.md §9.2, python_features.md §10a)
+#   dangerous-default-value no mutable default args ('= []' / '= {}')
+#   cell-var-from-loop      closure-over-loop-variable bug
+#   useless-super-delegation / super-with-arguments  redundant super() forms
+#   unused-import           genuinely-unused imports AND — uniquely — a
+#                           runtime import used only inside a STRING
+#                           annotation (an unnecessary quote that should
+#                           be unquoted, typing.md §20); flake8's F401
+#                           reads inside string annotations and misses
+#                           this, pylint W0611 does not. Does NOT fire on
+#                           TYPE_CHECKING imports used in string
+#                           annotations (the legit circular-import case)
+#                           or on '__all__' re-exports.
+#
+# Tests are exempt — they reach across the private boundary by design
+# (source_files.md §5.2) — via 'ignore-paths', so even a direct
+# 'pylint <test_file>' / IDE-opened test file self-exempts.
+[tool.pylint.main]
+ignore-paths = [".*/tests/.*"]
+
+[tool.pylint.messages_control]
+disable = ["all"]
+enable = [
+    "protected-access",
+    "raise-missing-from",
+    "dangerous-default-value",
+    "cell-var-from-loop",
+    "useless-super-delegation",
+    "super-with-arguments",
+    "unused-import",
+]