[datalegion-jack]

Adds a one-day dependency cooldown: [tool.uv] exclude-newer = "1 day", so no release under 24 hours old is resolved by any uv command here. uv.lock records it as exclude-newer-span = "P1D"; required-version moves to >=0.11.8, the first uv writing that form (CI runs 0.13.x).

test_uv_resolves_no_release_under_a_day_old holds the setting.

The relock moved no package: the lock diff is the new [options] block only.

🤖 Generated with Claude Code

[datalegion-jack]

Review: head 0931064880e909f3ada286e6631b70ad471e4373. Verdict: APPROVE (no defects)

This adds a one-day uv cooldown: [tool.uv] exclude-newer = "1 day", with required-version raised to >=0.11.8.

• The lock diff is only [options] (exclude-newer sentinel + exclude-newer-span = "P1D"), and no package moved. uv lock --check with uv 0.13.7 on this exact tree reports no change.
• The 0.11.8 floor is right. uv 0.11.8 introduced the sentinel timestamp for relative exclude-newer that the lock now records.
• Every uv that runs this lock is >= 0.11.8. All astral-sh/setup-uv steps pin version: "0.13.x" (CI and release), and dependabot's uv helper is on 0.13.7. Every .github/dependabot.yml ecosystem already has cooldown: default-days: 1, so dependabot bumps and local uv lock --upgrade now follow the same one-day rule.
• No locked package is under a day old, so nothing in the current lock trips the cooldown.
• [tool.uv] is tool configuration only. It doesn't change the published package metadata. The file also gets its missing trailing newline.

CI on this SHA: lint, test (3.11 to 3.15) and CodeQL pass. actionlint failed because curl got a 504 from github.com downloading the actionlint release. That's an infra flake, so re-run it.

[datalegion-jack]

Round 2: head 5278ad0919a4c1a301978c4bf56ceb7339b21e84. Verdict: APPROVE (no defects)

The only change since round 1 (0931064) is one commit touching the convention test and CLAUDE.md. pyproject.toml and uv.lock are unchanged, so the round 1 checks (lock --check, uv versions, exemption) still hold.

• New test test_uv_resolves_no_release_under_a_day_old asserts exclude-newer == "1 day" and the lock's exclude-newer-span = "P1D". tomllib is stdlib on 3.11+, which is the package's floor, and CI shows the test passing.
• Not blocking: the test doesn't pin required-version (>= 0.11.8). Worth one more assert some time.

CI on this SHA: every check passes. Round 1 was also APPROVE.

[datalegion-jack]

Round 3: head de4a63b1a0d6b9467d7e9324c652a5594b0ea27b. Verdict: APPROVE (no defects)

The head moved, so this is the first round on the new SHA. The only change since 5278ad0 is one line in the guard test: assert uv["required-version"] == ">=0.11.8". That matches pyproject.toml exactly and covers the round 2 note. pyproject.toml and uv.lock are unchanged, so the earlier lock, uv-version and exemption checks still hold.

CI on this SHA: every check passes, including the suite that runs the guard test.

[datalegion-jack]

Round 4: head de4a63b1a0d6b9467d7e9324c652a5594b0ea27b. Verdict: APPROVE (no defects)

The head is the same SHA as round 3 and CI is still green. This round I looked for anything that could silently undo the cooldown:

• No uv.toml, no [tool.uv.pip] section, and no UV_EXCLUDE_NEWER or --exclude-newer override anywhere in the workflows, Dockerfiles or TOML files.
• Workspace members carry no [tool.uv] of their own.
• So exclude-newer = "1 day" in the root pyproject.toml is the only setting in force for CI, the image builds and dependabot.

This is the second clean round in a row on this head.