Update-time does not log an update the cooldown holds back #414

Version

Update-time 0.0.44

Summary

When the cooldown holds back a new version, Update-time logs nothing about it, not even at DEBUG. A reader cannot tell a reference that is up to date from one whose update is waiting. The README promises otherwise: its table of log levels says DEBUG shows updates held back.

Steps to reproduce

In a git repository, create .github/workflows/ci.yml:

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: github/codeql-action/init@v4.38.2

On 2026-10-12, run update-time --log-level DEBUG. github/codeql-action published v4.38.3 on 2026-10-08, four days before, so the default cooldown of 7 days holds it back.

Expected

A DEBUG line saying the cooldown held v4.38.3 back, and until when. For example:

DEBUG Holding back github/codeql-action/init 4.38.3 in .github/workflows/ci.yml:5: published 2026-10-08 13:01, within the cooldown of 7 days

Actual

The log pins the reference to v4.38.2 and says nothing about v4.38.3:

INFO Pinned github/codeql-action/init in .github/workflows/ci.yml:5 to 4.38.2@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2

Analysis

The only DEBUG message about a held-back update is the one in io/log.py that names the marker directive holding it back. The cooldown is applied where each source picks its new version, through first_eligible, and the versions it passes over are not logged.

#390 asks for a related line: one saying why a package manager's own setting overrides the cooldown. A line for the cooldown itself would be the natural place to say which cooldown applied: the run's, a marker's, or the project's own.

To settle

1. Whether to log every version the cooldown passes over, or only the newest. The newest is the one a reader waits for, and logging every one would cost a line per version for a repository that releases often.
2. Which sources the line can reach. Update-time applies the cooldown itself for requirements.txt, Maven, Docker Hub, GitHub, and jsDelivr. For the dependencies uv, npm, and pnpm update, the package manager applies the cooldown and reports nothing back.
3. Whether to change the README instead. If the line is not worth adding, the log-level table should say that DEBUG shows the updates a marker holds back, rather than updates held back in general.

Documentation

The README section on the cooldown shows the new line. The change gets a changelog entry.