Summary

Phase 5: Code Review & Quality Gate (v1.3.3)
Goal: The inherited/forked source is reviewed, every actionable finding is fixed, and the manual pytest/ruff/mypy gate is the single documented quality path.
Status: Verified ✓ · Threat-secure ✓ · Nyquist-validated ✓

Every inherited module was reviewed and severity-triaged (22 findings), all 15 actionable findings were fixed with atomic commits, and the quality gate was consolidated: codespell config moved into pyproject.toml, the unused .pre-commit-config.yaml removed, and a contributor-facing CONTRIBUTING.md now documents the manual gate as the single quality path.

Changes

Code review fixes

• CR-01 — auto-reconnect on serial connection loss (scheduled via hass.loop, robust without a running loop)
• CR-02 / WR-07 — wrap blocking serial.Serial() opens in the executor (config flow + options flow)
• CR-03 — time.monotonic() for elapsed calibration timing
• CR-04 — log broad excepts via _LOGGER.exception
• CR-05 — route legacy calibration save through cover._save_calibration() (fixes calibration silently lost on reload)
• T-05-04 — fix sl-branch length guard (>= 8 → >= 12) so short frames can't yield a truncated device_id
• WR-01/02/04/08/09/11/13, IN-03 — entry-unload cleanup, deprecated-API removal, public entity-registry access, manifest HA min version, dead-branch removal, None-enum guard, SET_POSITION gating for uncalibrated timed motors

Tooling / quality gate

• Install codespell and migrate its config to pyproject.toml [tool.codespell]
• Remove .pre-commit-config.yaml and the orphaned pre-commit lint dependency
• Add CONTRIBUTING.md documenting all four gate commands (pytest via WSL; ruff / mypy / codespell native) with the WSL/native split
• Add tests/test_quality_gate_tooling.py regression guards

Key files: custom_components/schellenberg_usb/{api,cover,config_flow,options_flow,options_flow_calibration,options_flow_pairing,options_flow_timed_calibration,__init__,const}.py, manifest.json, pyproject.toml, CONTRIBUTING.md, README.md

Requirements Addressed

• REVIEW-01 — every inherited module reviewed, findings severity-triaged
• REVIEW-02 — all actionable findings fixed with atomic commits; gate green
• TOOL-01 — .pre-commit-config.yaml removed; manual gate documented as the single path
• TOOL-02 — codespell wired into the dev process

Verification

• Automated gate: 212 tests pass (pytest); ruff check / ruff format --check / mypy / codespell all clean
• Phase verification: 5/5 success criteria (05-VERIFICATION.md)
• Security: 9/9 threats closed, threats_open: 0 (05-SECURITY.md)
• Nyquist validation: tooling invariants now guarded (05-VALIDATION.md)

Key Decisions

• CR-01 reconnect uses hass.loop.call_later() (not asyncio.get_running_loop()) so the synchronous transport callback works without a running loop.
• HA config-flow broad catches kept with # noqa: BLE001 + justification (surface "unknown" to the user) rather than narrowed.
• Patch bump (1.3.2 → 1.3.3): treated as fixes + internal tooling.