[DJRHails]

Follow-up to #185, which was already merged when the review ran. See the inline review.

• uv lock interaction (docs fixed, behaviour not changed): uv writes the user-level exclude-newer into uv.lock ([options] exclude-newer-span = "P7D"). A lock made without the gate fails uv sync --locked / uv lock --check on a gated host, and uv run re-resolves it. A lock re-made on a gated host fails --locked everywhere else. Reproduced on uv 0.12.23. The README's "Lockfiles win" and the uv.toml comment now say so. Whether to keep uv gated at user level, or move to a per-repo [tool.uv] setting, is a separate decision this PR does not make.
• Test isolation: rebased onto main, where release-age: track npm policy in a file, pnpm 12 config.yaml #187 had already isolated tests/release-age.test.sh (filtered system bin dir, sandbox HOME) independently. I resolved the conflict by keeping main's test, so this PR now changes only docs.

Verified after rebase: bash tests/release-age.test.sh under a throwaway HOME prints "all passed" (1 skip: no cargo here).

via gantry

[DJRHails]

Review Summary

No findings. Both changes do what the description says.

• Test isolation: I ran it on a host with a system /usr/bin/npm (10.9.9). The suite passes: 33 ok, 1 skip (no cargo), and the throwaway HOME only gained uv's .cache. Swapping PATH back to the old $bin:/usr/bin:/bin brings back the bug: no-npm-message fails because the real npm answers ("npm 10.9.9 predates min-release-age"), so the suite would catch a regression. The symlink farm keeps /usr/bin-before-/bin order and dedupes merged-usr hosts via [ -e ].
• uv lock docs: reproduced on uv 0.12.23 (offline, project with no dependencies, user config through XDG_CONFIG_HOME). A gated uv lock writes [options] exclude-newer-span = "P7D". A lock made without the gate fails uv lock --check under the gate. A gated lock fails --check without the gate. uv sync --frozen goes through. The "downgrading anything younger than 7 days" part was not reproduced, because the index is offline here.

Verified: bash tests/release-age.test.sh under a throwaway HOME, plus a mutation check with the old PATH. shellcheck and shfmt -i 2 -d on the test are clean. I ran the uv experiment above.
Fix commit: none pushed
Reviewed head: 49e496b

Verdict: approve

via gantry