Upgrade to openapi2zig v0.4

.deepsource.toml

@@ -1,10 +1,15 @@
 version = 1
 
 # `pkg/` is deliberately NOT excluded from DeepSource analysis.
-# It holds hand-written module loaders (e.g. the Pyodide shim et_ws_pydata1.js) alongside build output. Only the
-# int-gen outputs under `generated/` and the scenario `verification/` fixtures are excluded, since those are fully
-# generated; if genuinely-generated glue under `pkg/` turns up as a finding, add a narrow per-file exclude then.
-exclude_patterns = ["generated/**", "verification/**"]
+# It holds hand-written module loaders (e.g. the Pyodide shim et_ws_pydata1.js) alongside build output. The
+# int-gen outputs under `generated/` and the scenario `verification/` fixtures are excluded because they are
+# fully generated; if genuinely-generated glue under `pkg/` turns up as a finding, add a narrow per-file
+# exclude then.
+# `**/error.rs` is excluded from coverage tracking: these files are thin error-type plumbing (thiserror
+# `#[derive]` + `#[from]` conversions, plus the occasional unreachable defensive `From`), so their line
+# coverage is noise. No Rust static analyzer is configured here -- DeepSource only tracks Rust coverage -- so
+# the exclude costs no issue detection. (The matching Codecov exclusion is set in Codecov's web UI.)
+exclude_patterns = ["**/error.rs", "generated/**", "verification/**"]
 
 # Repo convention: tests live in a `tests/` directory or in source files prefixed `test_`.
 test_patterns = ["**/test_*.py", "**/tests/**"]

CLAUDE.md

@@ -203,6 +203,12 @@ running the whole battery for every edit is slow, expensive, and almost always w
 types changed. Pick the targeted tasks from the tables below that match the extensions of the files you actually
 modified, and run only those. Same goes for `fmt`: run the per-file-type formatter, not the aggregate.
 
+**Always run `mise run semgrep-check` before finishing a set of changes to any files** -- it is the one check to
+run regardless of which file types you touched. It carries repo-wide, cross-cutting rules that the per-file-type
+tasks don't (comment summary lines across TOML/YAML/JSON/C, the `no-non-ascii` ban, banned constructs in
+`generic` mode over config text), and it is cheap. Skipping it is how comment-style and cross-file regressions
+slip through to CI.
+
 **Agents must not invoke formatter/linter binaries directly** (e.g. `mise exec -- taplo format`, raw
 `taplo`/`dprint`/`oxfmt`/`cargo fmt` calls). Always use the corresponding mise task (`mise run taplo-fmt`,
 `mise run taplo-check`, `mise run dprint-fmt`, etc.). The tasks carry the project's config-file paths
@@ -883,6 +889,16 @@ When the rewrite can't be expressed as a single template (multiple match shapes,
 structural restructuring), keep the rule check-only and write a brief note in the rule body explaining why the
 autofix wasn't viable.
 
+### Expand `doc-summary-ends-with-period` as you touch Rust files
+
+`config/ast-grep/rules/doc-summary-ends-with-period.yaml` enforces that a doc comment's first line is a
+one-line summary ending in terminal punctuation (`.`, `!`, or `?`). The workspace had a large pre-existing
+backlog of violations, so the rule is scoped by a `files:` allowlist rather than applied workspace-wide, and it
+is rolled out incrementally. **Whenever you modify a Rust file, add it to that rule's `files:` list (keep the
+list sorted) and fix any first-line-summary violations in it as part of the same change** -- so the rule's
+coverage only ever grows. Once the `files:` list covers effectively everything, drop the `files:` scoping and
+let it apply workspace-wide.
+
 ### NEVER delete a lint rule without explicit user permission
 
 **Do not delete a rule from `config/ast-grep/rules/`, `config/semgrep/`, `config/conftest/policy/`, `config/taplo/`,