CompOmics · RobbinBouwmeester · Sep 9, 2026 · Sep 8, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,14 @@ All notable changes to MuMDIA are recorded here. The format follows
 `0.1.0` is the first tagged release of the Rust engine. The superseded
 Python implementation remains available at the tag `legacy-python-v1`.
 
+`0.2.0` is a minor rather than a patch release: it changes behaviour a user can
+see. The default MS2PIP model is `HCDch2`, configurations with out-of-range
+numeric values are refused at load instead of running, both TSV reports gain two
+columns, the candidate-audit rejection code `NO_PEAK_GROUP` is
+`DID_NOT_SURVIVE_EXTRACTION`, a candidate no predictor covered is dropped rather
+than given a substitute value, and a stage refuses to write its output over one of
+its own inputs.
+
 Two things are versioned independently of this file and matter when reading old
 results: the per-artifact Parquet schema versions in
 `rust/mumdia/crates/mumdia-core/src/schema.rs`, and the feature-set identity
@@ -15,6 +23,14 @@ than a number. Both are recorded in every run's `manifest.json`.
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-08
+
+Three code reviews and their fixes (`docs/29_code_review_2026-09-07.md`,
+`docs/30_code_review_2026-09-08.md`, `docs/31_code_review_2026-09-08_full.md`),
+the MS2PIP charge-2 library path, and the desktop settings work. Validated on the
+six-file HYE benchmark end to end: 80,803 experiment-wide stripped peptides at 1%
+at a 1.00% decoy fraction.
+
 ### Added
 
 - MS2PIP charge-2 fragment predictions reach the library. The worker emits a
@@ -177,6 +193,15 @@ than a number. Both are recorded in every run's `manifest.json`.
     cancellation flag was written and never read. The waiter is now the only writer: it
     reads the intent after reaping the engine and publishes `cancelled`, `done` when the
     engine had already finished, or `failed`; until then the run shows "Stopping" (#14).
+- The committed CycloneDX SBOM, which ships in every release archive, referenced
+  `pkg:cargo/mumdia-core` and `pkg:cargo/mumdia-io` in its dependency graph while
+  excluding them from its component list, so it failed validation and `--check`
+  regenerated the same broken document. Only the application crate is excluded now,
+  because `metadata.component` describes it (`docs/31` F11).
+- The desktop DIA-NN cache-key test used a fixed temporary directory and deleted it on
+  entry, so two `cargo test` runs on one machine raced and one lost its fixture
+  mid-test. It is unique per process, like every other temporary fixture in the
+  workspace (`docs/14`).
 - Code review F, whole-repository review (`docs/31_code_review_2026-09-08_full.md`,
   F1 to F10):
   - `prescan` read the infinite-bounds sentinel that `rt-im-train` writes for "calibration

diff --git a/bench/pb_eval.py b/bench/pb_eval.py
@@ -41,7 +41,7 @@ def main() -> int:
     a = ap.parse_args()
 
     user_input = {
-        "software_version": "0.1.1", "search_engine": "MuMDIA", "search_engine_version": "0.1.1",
+        "software_version": "0.2.0", "search_engine": "MuMDIA", "search_engine_version": "0.2.0",
         "ident_fdr_psm": 0.01, "ident_fdr_peptide": 0.01, "ident_fdr_protein": 0.01,
         "enable_match_between_runs": True, "precursor_mass_tolerance": "20 ppm",
         "fragment_mass_tolerance": "20 ppm", "enzyme": "Trypsin", "allowed_miscleavages": 1,

diff --git a/ci/gen_sbom.py b/ci/gen_sbom.py
@@ -49,6 +49,15 @@
 # rather than third-party dependencies of it.
 OURS = {"mumdia", "mumdia-core", "mumdia-io"}
 
+# The one that IS the application, described by `metadata.component` rather than listed
+# among the components. The other two are libraries this binary is composed of, and they
+# have to appear as components: the dependency graph references them, and a `dependsOn`
+# naming a `bom-ref` no component declares makes the document fail CycloneDX validation.
+# Excluding all three left exactly those two references dangling in the SBOM that ships in
+# every release archive, and `--check` regenerated the same broken document
+# (docs/31_code_review_2026-09-08_full.md, F11).
+APPLICATION = "mumdia"
+
 
 def cargo_metadata() -> dict:
     """Full metadata, WITH dependencies, so `resolve` carries the graph.
@@ -113,7 +122,7 @@ def render(meta: dict) -> str:
     )
 
     components = sorted(
-        (component(p) for p in meta["packages"] if p["name"] not in OURS),
+        (component(p) for p in meta["packages"] if p["name"] != APPLICATION),
         key=lambda c: (c["name"].lower(), c["version"]),
     )
 

diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mumdia-console"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2021"
 description = "Desktop interface for the MuMDIA DIA search engine"
 license = "Apache-2.0"

diff --git a/desktop/src-tauri/src/diann.rs b/desktop/src-tauri/src/diann.rs
@@ -1942,7 +1942,11 @@ mod tests {
 
     #[test]
     fn the_library_cache_key_covers_what_changes_the_library_and_nothing_else() {
-        let dir = std::env::temp_dir().join("mumdia-diann-cachekey");
+        // Unique per process, like every other temp fixture in the workspace: this one
+        // used a fixed name AND deleted the directory on entry, so two `cargo test` runs
+        // on one machine raced and one of them lost its fasta mid-test (docs/14).
+        let dir =
+            std::env::temp_dir().join(format!("mumdia-diann-cachekey-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         let fa = dir.join("a.fasta");

diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "MuMDIA",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "identifier": "be.ugent.compomics.mumdia.console",
   "build": {
     "frontendDist": "../ui"

diff --git a/docs/14_build_test_deploy_gotchas.md b/docs/14_build_test_deploy_gotchas.md
@@ -106,7 +106,7 @@ mzML, FASTA, and library Parquets remain user data and must be mounted.
 
 **Build configuration.** The workspace declares three members
 (`Cargo.toml:3`) sharing one `[workspace.package]` (`Cargo.toml:5-23`): version
-`0.1.1`, `edition = "2021"`, `rust-version = "1.96"`, license `Apache-2.0`, plus
+`0.2.0`, `edition = "2021"`, `rust-version = "1.96"`, license `Apache-2.0`, plus
 the crates.io metadata (description, repository, homepage, keywords, categories)
 and `publish = false`. The declared MSRV deliberately tracks
 `rust-toolchain.toml` (channel `1.96.1`), which is the only Rust version CI

diff --git a/rust/mumdia/Cargo.lock b/rust/mumdia/Cargo.lock
diff --git a/rust/mumdia/Cargo.toml b/rust/mumdia/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/mumdia-core", "crates/mumdia-io", "crates/mumdia"]
 
 [workspace.package]
-version = "0.1.1"
+version = "0.2.0"
 edition = "2021"
 # Tracks rust-toolchain.toml, which is the only Rust version CI builds and tests.
 # A lower floor may well work, but claiming one we do not verify is a guess; lower

diff --git a/sbom.cdx.json b/sbom.cdx.json
@@ -5,16 +5,16 @@
   "metadata": {
     "component": {
       "type": "application",
-      "bom-ref": "pkg:cargo/mumdia@0.1.1",
+      "bom-ref": "pkg:cargo/mumdia@0.2.0",
       "name": "mumdia",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "description": "Clean-room Rust DIA proteomics search engine",
       "licenses": [
         {
           "expression": "Apache-2.0"
         }
       ],
-      "purl": "pkg:cargo/mumdia@0.1.1"
+      "purl": "pkg:cargo/mumdia@0.2.0"
     },
     "tools": [
       {
@@ -1903,6 +1903,44 @@
         }
       ]
     },
+    {
+      "type": "library",
+      "bom-ref": "pkg:cargo/mumdia-core@0.2.0",
+      "name": "mumdia-core",
+      "version": "0.2.0",
+      "purl": "pkg:cargo/mumdia-core@0.2.0",
+      "description": "Typed configuration, mass model, artifact schemas, and run manifest for MuMDIA",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "https://github.com/CompOmics/MuMDIA"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:cargo/mumdia-io@0.2.0",
+      "name": "mumdia-io",
+      "version": "0.2.0",
+      "purl": "pkg:cargo/mumdia-io@0.2.0",
+      "description": "Parquet/JSON artifact layer, content hashing, and logging for MuMDIA",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "https://github.com/CompOmics/MuMDIA"
+        }
+      ]
+    },
     {
       "type": "library",
       "bom-ref": "pkg:cargo/mzdata@0.65.5",
@@ -4088,7 +4126,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/mumdia-core@0.1.1",
+      "ref": "pkg:cargo/mumdia-core@0.2.0",
       "dependsOn": [
         "pkg:cargo/serde@1.0.228",
         "pkg:cargo/serde_json@1.0.150",
@@ -4097,12 +4135,12 @@
       ]
     },
     {
-      "ref": "pkg:cargo/mumdia-io@0.1.1",
+      "ref": "pkg:cargo/mumdia-io@0.2.0",
       "dependsOn": [
         "pkg:cargo/anyhow@1.0.103",
         "pkg:cargo/arrow@59.0.0",
         "pkg:cargo/blake3@1.8.5",
-        "pkg:cargo/mumdia-core@0.1.1",
+        "pkg:cargo/mumdia-core@0.2.0",
         "pkg:cargo/parquet@59.0.0",
         "pkg:cargo/serde@1.0.228",
         "pkg:cargo/serde_json@1.0.150",
@@ -4112,15 +4150,15 @@
       ]
     },
     {
-      "ref": "pkg:cargo/mumdia@0.1.1",
+      "ref": "pkg:cargo/mumdia@0.2.0",
       "dependsOn": [
         "pkg:cargo/anyhow@1.0.103",
         "pkg:cargo/arrow@59.0.0",
         "pkg:cargo/blake3@1.8.5",
         "pkg:cargo/clap@4.6.1",
         "pkg:cargo/mimalloc@0.1.52",
-        "pkg:cargo/mumdia-core@0.1.1",
-        "pkg:cargo/mumdia-io@0.1.1",
+        "pkg:cargo/mumdia-core@0.2.0",
+        "pkg:cargo/mumdia-io@0.2.0",
         "pkg:cargo/mzdata@0.65.5",
         "pkg:cargo/parquet@59.0.0",
         "pkg:cargo/rayon@1.12.0",