release: 0.2.0

[RobbinBouwmeester]

Version bump for v0.2.0. main already carries the content (#61 to #68); this makes the tag gate accept v0.2.0.

Why minor rather than patch

The unreleased section changes behaviour a user can see:

• predict_frag.ms2pip_model defaults to HCDch2 rather than HCD2021.
• Configurations with out-of-range numeric values are refused at load instead of running with them.
• peptides.tsv and proteins.tsv gain is_transferred and transfer_q.
• The candidate-audit rejection code NO_PEAK_GROUP is DID_NOT_SURVIVE_EXTRACTION.
• A candidate no predictor covered is dropped with its pair rather than given a substitute value, and more than 2% of the library going that way is an error.
• A stage refuses to write its output over one of its own inputs.

What is in it

Three code reviews and their fixes, the MS2PIP charge-2 library path, and the desktop settings and supervision work:

Review	Findings	Packages
docs/29_code_review_2026-09-07.md	21	A #62, B #63, C #64, D #65
docs/30_code_review_2026-09-08.md	R1 to R9	E #66
docs/31_code_review_2026-09-08_full.md	21, whole repository	F #67

Ten second-tier findings are listed in docs/31 as deliberately not fixed; one of them, the SBOM, is fixed here because it ships in the release archive.

Changes in this PR

• 0.2.0 in rust/mumdia/Cargo.toml (workspace), desktop/src-tauri/Cargo.toml and desktop/src-tauri/tauri.conf.json; both Cargo.lock files refreshed with a cargo check.
• CHANGELOG.md: [Unreleased] becomes ## [0.2.0] - 2026-09-08 with a fresh empty [Unreleased] above, and the preamble explains the minor bump.
• docs/14 and bench/pb_eval.py quote the new version.
• sbom.cdx.json regenerated, and ci/gen_sbom.py fixed: the dependency graph referenced pkg:cargo/mumdia-core and pkg:cargo/mumdia-io while the component list excluded them, so the document failed CycloneDX validation and --check regenerated the same broken output (docs/31 F11). Only the application crate is excluded now, since metadata.component describes it. 175 components, no dangling references.

Validation

Local: engine cargo fmt --check, clippy -D warnings, cargo test --workspace (280); desktop fmt, clippy, cargo test --lib (82); pytest tests/python (68 passed, 12 skipped); compileall over scripts, bench, ci; gen_sbom.py --check; gen_third_party_licenses.py --check; gen_config_reference.py --check; check_doc_refs.py; check_desktop_ui.py; check_workflows.py.

On real data, already recorded: the full default six-file HYE experiment (80,803 experiment-wide stripped peptides at 1%, 1.00% decoy fraction, 1:54 wall), an E. coli FASTA run through DeepLC 4.1.1 and MS2PIP 4.2.0, and merge checks for both calibration changes.

After merging

With a green main run for the merge commit: Releases, Draft a new release, tag v0.2.0 on main, publish. The release workflow verifies the tag matches the workspace version, that the commit is an ancestor of main and that a successful ci.yml run exists for it, then builds the three engine archives and the desktop bundles and checks the workers are inside them.

Worth one manual pass in the rehearsal installer before publishing: the desktop start guard, Stop and the converter preflight have unit tests only.

🤖 Generated with Claude Code