chore: adopt ruff 0.16.0

ruff 0.16.0 stabilized CPY001 (missing-copyright-notice) out of preview, so
`select = ["ALL"]` now picks it up. Ignore it, matching modern-di.

0.16.0 also formats Python code blocks inside Markdown; reformat the
51 affected file(s). No .py file changed.

Author: lesnik512

architecture/errors.md

@@ -3,9 +3,9 @@
 `StatusError` and all its 4xx/5xx subclasses are constructed with a **single positional `response: httpx2.Response`**. Subclasses do not override `__init__`. All fields are available via `exc.response.*` (status code, headers, content, request, etc.).
 
 ```python
-raise NotFoundError(response)          # correct
-exc.response.status_code               # 404
-exc.response.request.url               # URL of the failed request
+raise NotFoundError(response)  # correct
+exc.response.status_code  # 404
+exc.response.request.url  # URL of the failed request
 ```
 
 `__repr__` and the `str()` summary redact URL userinfo (`user:pass@`) and mask the values of known-sensitive query and fragment parameters (e.g. `token`, `api_key`, `secret`) to avoid leaking credentials in tracebacks.

docs/decoders.md

@@ -74,10 +74,7 @@ class CsvDecoder:
         (row_type,) = typing.get_args(model)
         field_types = {f.name: f.type for f in dataclasses.fields(row_type)}
         reader = csv.DictReader(io.StringIO(content.decode("utf-8")))
-        return [
-            row_type(**{name: field_types[name](value) for name, value in row.items()})
-            for row in reader
-        ]
+        return [row_type(**{name: field_types[name](value) for name, value in row.items()}) for row in reader]
 ```
 
 `can_decode` is total and never raises: a non-`list` model, a bare `list`, or `list[int]` all fall through to `False`. `decode` coerces each CSV cell with its field's type (CSV values arrive as strings) — a real decoder would handle optionals, dates, and missing columns; this is where your domain logic goes. Wire it ahead of the built-ins so it gets first refusal on `list[...]` models while pydantic still handles everything else:

docs/errors.md

@@ -106,14 +106,14 @@ async def fetch(client: AsyncClient, user_id: int) -> dict | None:
 For any `StatusError` subclass, the raw `httpx2.Response` is on `exc.response`:
 
 ```python
-exc.response.status_code     # 404
-exc.response.headers          # httpx2.Headers — case-insensitive
-exc.response.content          # raw bytes
-exc.response.text             # decoded body
-exc.response.json()           # parsed JSON (raises if not JSON)
-exc.response.request          # the failing httpx2.Request
-exc.response.request.url      # the failing URL (httpx2.URL)
-exc.response.request.method   # the HTTP method
+exc.response.status_code  # 404
+exc.response.headers  # httpx2.Headers — case-insensitive
+exc.response.content  # raw bytes
+exc.response.text  # decoded body
+exc.response.json()  # parsed JSON (raises if not JSON)
+exc.response.request  # the failing httpx2.Request
+exc.response.request.url  # the failing URL (httpx2.URL)
+exc.response.request.method  # the HTTP method
 ```
 
 **Security note:** `__repr__` and the exception's summary message strip `user:pass@` userinfo and mask the values of known-sensitive query and URL-fragment parameters (`api_key`, `apikey`, `access_token`, `refresh_token`, `token`, `secret`, `client_secret`, `password`, `passwd`, `pwd`, `auth`, `authorization`, `sig`, `signature`, `key`, `private_key`, `session`, `sessionid`, `x-api-key`) as `REDACTED`, preserving the keys. Query values under other names are **not** masked, so still avoid putting non-standard secrets in query strings. Note that request *headers* (`Authorization`, `Cookie`, etc.) are never redacted — see `exc.response.request.headers` above.

docs/index.md

@@ -42,11 +42,13 @@ import asyncio
 
 from httpware import AsyncClient
 
+
 async def main() -> None:
     async with AsyncClient(base_url="https://jsonplaceholder.typicode.com") as client:
         response = await client.get("/users/1")
         print(response.json())
 
+
 asyncio.run(main())
 ```
 
@@ -102,7 +104,7 @@ async def main() -> None:
         base_url="https://api.example.com",
         middleware=[
             AsyncBulkhead(max_concurrent=10),  # cap total in-flight
-            AsyncRetry(),                       # default: 3 attempts, full-jitter backoff
+            AsyncRetry(),  # default: 3 attempts, full-jitter backoff
         ],
     ) as client:
         user = await client.get("/users/1", response_model=User)

docs/recipes/link-header-pagination.md

@@ -24,8 +24,8 @@ async def main() -> None:
             response, tags = await client.send_with_response(request, response_model=list[Tag])
             for tag in tags:
                 process(tag)
-            url = next_link(response.headers.get("link"))   # caller's parser
-            params = None                                    # next link carries query
+            url = next_link(response.headers.get("link"))  # caller's parser
+            params = None  # next link carries query
 ```
 
 `process` and `next_link` are caller-defined. Pick a Link-header parser that fits your project — there are several on PyPI, and the format is small enough to hand-roll.

docs/recipes/modern-di.md

@@ -64,6 +64,7 @@ class ServiceClients(Group):
         cache_settings=providers.CacheSettings(finalizer=AsyncClient.aclose),
     )
 
+
 # At Container(...) construction:
 # modern_di.exceptions.DuplicateProviderTypeError: Provider is duplicated by type
 # <class 'httpware.client.AsyncClient'>. To resolve this issue: ...

docs/recipes/phase-decorator-patterns.md

@@ -47,7 +47,8 @@ from httpware import async_before_request
 
 
 _CORRELATION_ID: contextvars.ContextVar[str | None] = contextvars.ContextVar(
-    "correlation_id", default=None,
+    "correlation_id",
+    default=None,
 )
 
 
@@ -132,7 +133,8 @@ from httpware import async_on_error
 
 @async_on_error
 async def fallback_on_network_error(
-    request: httpx2.Request, exc: Exception,
+    request: httpx2.Request,
+    exc: Exception,
 ) -> httpx2.Response | None:
     if isinstance(exc, NetworkError):
         return httpx2.Response(

docs/resilience.md

@@ -152,7 +152,7 @@ When `acquire_timeout` elapses without a slot opening, `AsyncBulkhead` raises `B
 
 ```python
 from httpware.middleware.resilience import AsyncCircuitBreaker  # async
-from httpware.middleware.resilience import CircuitBreaker        # sync
+from httpware.middleware.resilience import CircuitBreaker  # sync
 ```
 
 Classic consecutive-failure circuit breaker. Counts failures and prevents requests from reaching a downstream that is known to be broken.
@@ -208,8 +208,8 @@ from httpware.middleware.resilience import AsyncCircuitBreaker
 
 breaker = AsyncCircuitBreaker(
     failure_rate_threshold=0.5,  # open at ≥50% failures
-    window_seconds=30.0,         # over a rolling 30s window
-    minimum_calls=20,            # but only once 20+ calls are observed
+    window_seconds=30.0,  # over a rolling 30s window
+    minimum_calls=20,  # but only once 20+ calls are observed
 )
 ```
 

planning/audits/2026-06-07-deep-audit.md

@@ -539,8 +539,10 @@ async def test_on_error_lets_cancelled_propagate() -> None:
     @async_on_error
     async def swallow_all(request, exc) -> httpx2.Response | None:
         raise AssertionError("should not catch CancelledError")
+
     async def terminal(request):
         raise asyncio.CancelledError
+
     dispatch = compose_async((swallow_all,), terminal)
     with pytest.raises(asyncio.CancelledError):
         await dispatch(_make_request())
@@ -556,7 +558,10 @@ Suggested direction: add `test_on_error_lets_keyboardinterrupt_propagate` (and o
 
 ```python
 """Tests for the per-method API surface of AsyncClient."""
+
 from httpware import AsyncClient, NotFoundError
+
+
 def _client_with_handler(handler, **kwargs) -> AsyncClient: ...
 async def test_get_returns_httpx2_response() -> None: ...
 ```

planning/audits/2026-06-14-deep-audit.md

@@ -235,7 +235,9 @@ The discover map labels the file "Hypothesis property-based tests for retry inte
 
 ```python
 async def test_total_attempts_never_exceeds_max_attempts(
-    max_attempts: int, status: int, method: str,
+    max_attempts: int,
+    status: int,
+    method: str,
 ) -> None:
     ...
     await client.request(method, "https://example.test/x")
@@ -270,8 +272,15 @@ CLAUDE.md and `architecture/errors.md` mandate that all `StatusError` subclasses
 ```python
 def test_inheritance_tree() -> None:
     ...
-    for exc in (BadRequestError, UnauthorizedError, ForbiddenError, ForbiddenError,
-                ConflictError, UnprocessableEntityError, RateLimitedError):
+    for exc in (
+        BadRequestError,
+        UnauthorizedError,
+        ForbiddenError,
+        ForbiddenError,
+        ConflictError,
+        UnprocessableEntityError,
+        RateLimitedError,
+    ):
         assert issubclass(exc, ClientStatusError), exc
 ```
 
@@ -334,6 +343,7 @@ def _is_streaming_body_async(value: object) -> bool:
     ...
     return hasattr(value, "__aiter__")
 
+
 def _is_streaming_body_sync(value: object) -> bool:
     ...
     return hasattr(value, "__iter__")
@@ -410,9 +420,7 @@ The test asserts `len(budget._deposits) == expected_deposits`, relying on a comm
 
 ```python
 expected_deposits = (_N_SYNC_THREADS * _N_OPS_PER_THREAD) + _N_ASYNC_TASKS
-assert len(budget._deposits) == expected_deposits, (
-    f"expected {expected_deposits} deposits, got {len(budget._deposits)}"
-)
+assert len(budget._deposits) == expected_deposits, f"expected {expected_deposits} deposits, got {len(budget._deposits)}"
 ```
 
 Panel 2/3: code_reality, reproducer. Suggested direction: pin the injected clock so no real time elapses, making the no-purge assumption an enforced invariant rather than a fragile comment.