release: 0.4.0

[RobbinBouwmeester]

Version bump for v0.4.0. main already carries the content; this makes the tag gate accept it.

Why minor rather than patch

It changes results. A run repeated across this upgrade will not reproduce its old counts or its old runtime.

• Multi-head retention-time calibration is on by default. On a six-file Astral experiment: 113,961 → 131,646 precursors at an unchanged 0.0100 decoy fraction, for 1.4×–1.7× wall clock.
• The library it produces is adapted once per experiment, not once per run (experiment.rt_library_scope, default first_run_only). That returns about 1% of the gain — measured at −0.97% precursors on the same six files — in exchange for removing N−1 full re-predictions of a 9.4M-row library.
• predict_frag.predictor = "peptdeep" is a new fragment-intensity predictor, opt-in and benchmark-gated.
• experiment.finetune_scope is now experiment.rt_library_scope. The old name still parses, so existing configurations keep working.

Same reasoning the CHANGELOG already records for 0.2.0 ("a minor rather than a patch release: it changes behaviour a user can see") — and this set is larger than that one.

Also in it

Fixed	DeepLC workers no longer fill the log with blank lines (99% of one real log); the desktop progress ladder follows each file instead of freezing after the first
Added	AlphaPeptDeep predictor; desktop Managed data card, so the ~9 GB of downloaded and generated files can be removed from the interface
Deps	arrow/parquet 59.3.0, mzdata 0.66.6 (conversion output verified byte-identical over 20,000 spectra), and six minor bumps

Changes in this PR

0.4.0 in rust/mumdia/Cargo.toml (workspace), desktop/src-tauri/Cargo.toml, desktop/src-tauri/tauri.conf.json, docs/14 and bench/pb_eval.py — which carries it twice, software_version and search_engine_version; a grep caught the second. Both Cargo.lock files refreshed, and sbom.cdx.json, THIRD_PARTY_LICENSES.md and the config reference regenerated.

CHANGELOG.md: [Unreleased] becomes ## [0.4.0] - 2026-09-14 with a fresh empty section above it, and the preamble explains the minor bump beside the same note for 0.2.0 and 0.3.0.

Validation

Engine fmt --check / clippy --all-targets --locked -D warnings / test --workspace --locked (285); desktop the same (88); pytest tests/python (83 passed, 8 skipped); all seven generator and checker scripts clean; the rebuilt binary reports mumdia 0.4.0.

After merging

With a green main run for the merge commit: tag v0.4.0 on main and publish. The release workflow verifies the tag matches the workspace version, that the commit is an ancestor of main, and that a successful ci.yml run exists for that SHA — so wait for CI on the merge commit before tagging, which is what bit v0.3.0.

🤖 Generated with Claude Code