chore(release): prepare 0.3.0

[CameronBrooks11]

What

Prepares the 0.3.0 release. No code changes.

• The version is 0.3.0 in pyproject.toml, in reference/rowspec/__init__.py's __version__, and in the action's default install pin (rowspec==0.3.0). uv.lock changes only rowspec's own version line.
• The README's action example points at @v0.3.0.
• The changelog's unreleased section becomes [0.3.0] — 2026-10-08, with compare links and an empty [Unreleased] above it.
• The ROADMAP's "Where it is" figures are re-measured (below), and a short "Shipped in 0.3.0" section sits above "Shipped in 0.2.0".

Not tagged. The tag is the owner's call after review.

Why 0.3.0

Under SemVer's pre-1.0 convention a minor bump carries behaviour changes, and this release has three that a consumer can observe:

• rowspec check output changes on CSV input: a lone CR now produces a warning, and --strict refuses it (CSV mode warns on CRLF, which §3 allows, and ignores a lone CR, which §13 says to warn on #59). A pipeline running --strict on a file with a lone CR goes from green to red.
• The action has a new output, eval-outcome (ci: exercise the action's default install path after each release #72).
• conformance/run_cases.py exits 2, not 1, when the implementation will not import (fix(conformance): exit 2 when the implementation will not import #62). Anyone scripting against the runner's exit code sees a different value.

A patch release (0.2.1) would claim no observable behaviour changed, which is not true here.

The changelog against git log v0.2.0..origin/main

All 19 commits in git log --oneline v0.2.0..origin/main were checked against the section. The existing entries covered #52/#72, #68, #78, #77, #64, #60, #76 and #57. I added these, which consumers can see but the section did not mention:

• Added: the action's eval-outcome output (ci: exercise the action's default install path after each release #72). It came in with the post-release workflow and was missing from the changelog.
• Changed: the runner's exit 2 on an unimportable implementation (fix(conformance): exit 2 when the implementation will not import #62); the action's setup-python pinned to a commit (ci: pin every action to a commit, and test that it stays pinned #71); the release gate running just test/just test-xlsx and checking __version__ (ci(release): fail the build when __version__ disagrees with metadata #69, ci(release): run just test and just test-xlsx in the release gate #70); SPDX headers and the new tests/ and conformance/reserved/ LICENSE files (chore(license): add spdx headers and tests/LICENSE, and check both #74); the reference/ boundary check seeing dynamic imports (test(boundary): see __import__ and import_module with a constant name #65).
• Licensing (chore(license): add spdx headers and tests/LICENSE, and check both #74), stated in the changelog entry: conformance/reserved/ (was MIT, from conformance/LICENSE) and docs/ci/rowspec-check.yml (was CC-BY-4.0) are now CC0-1.0. The root LICENSE now names Apache-2.0 OR MIT for action.yml, .github/workflows/ and the justfile, which it did not list before. Both relicensings move to more permissive terms. git diff 228b61e~1 228b61e -- LICENSE docs/LICENSE shows all three.

The section's opening note says what is left out. #58 and #75 are documentation-only, and the note covers them as 0.2.0's did. #66, #67 and #73 are dev and CI changes with no effect outside this repository, and the note now names them.

I checked the new claims before writing them:

• cd conformance && uv run python run_cases.py no_such_impl prints the HARD FAILURE: line and exits 2.
• grep -rhn 'uses:' .github/workflows action.yml | grep -vE '@[0-9a-f]{40}' matches only local ./ refs and comments.

Re-measured figures

Run on this branch, in the order listed. Each ROADMAP figure now has the command that produced it beside it.

figure	command
All checks passed!	just check
410 conformance cases	find conformance/cases -name expect.json | wc -l
0 failure(s) across 410 case(s)	just conform
0 failure(s) across 410 case(s) (second impl)	just conform-alt
73 killed, 0 survived, 2 equivalent, 0 stale, 0 broken	just mutants
75 distinct mutations	just mutants | grep -ciE '^ (killed|equiv|survived|stale|broken|bogus) '
73 passed, 1 skipped	just test
9 passed	just test-xlsx

Two ROADMAP rows changed:

• just test went from 52 passed to 73 passed. The new tests are test_pins.py, test_licensing.py and test_tooling.py, plus additions to existing files since v0.2.0.
• The "75 distinct mutations" row's right-hand column was prose ("the gate refuses two that mutate identically"). It now gives the command, with the refusal kept as a parenthetical.

The just test-xlsx row is new.

The count command matches case-insensitively and includes bogus, because kindkit prints the failing verdicts in uppercase (SURVIVED, STALE, BROKEN, BOGUS). It was checked against a sample of all six per-mutant line shapes and kindkit's summary lines:

new regex, 6 verdict lines:  6
new regex, 5 summary lines: 0
old regex, 6 verdict lines:  2

It still gives 75 on this tree.

Dry run of release.yml's build job

I built from git archive HEAD of this commit, unpacked into an empty directory, so the build saw only tracked files. The commands are the workflow's.

• uv build produced rowspec-0.3.0.tar.gz and rowspec-0.3.0-py3-none-any.whl.
• Tag check, with GITHUB_REF_NAME=v0.3.0: tag v0.3.0 matches built version 0.3.0, exit 0. With GITHUB_REF_NAME=v0.2.0 as a negative control: ::error::tag v0.2.0 does not match built version 0.3.0, exit 1.
• Action pin check: action.yml pins rowspec==0.3.0, matching the release.
• Wheel smoke step: I extracted its run: script from the YAML with yaml.safe_load and ran it with bash -e from the build directory.

  wheel version: __version__ and metadata agree on 0.3.0 (…/uvcache/archive-v0/…/site-packages/rowspec/__init__.py)
  wheel CLI: eval refuses a broken total and annotates it
  

  The printed rowspec.__file__ is under uv's ephemeral environment, not the checkout. The version assertion therefore ran against the wheel.
• METADATA: Version: 0.3.0, License-Expression: Apache-2.0 OR MIT, Requires-Python: >=3.11, Provides-Extra: xlsx, Requires-Dist: openpyxl>=3.1; extra == 'xlsx'. Besides its .dist-info, the wheel contains only rowspec/ and rowspec_xlsx/.
• A fresh venv with the wheel installed (uv venv + uv pip install <wheel>):
  • rowspec eval on a table whose total is #REF!(/0) exits 1.
  • rowspec check on the same table exits 0 (0 refused). That is the reason the action runs both commands.
  • rowspec eval docs/example exits 0 (grand = 133.5); rowspec check docs/example exits 0.
  • A CSV with a lone CR gives a warning and exits 0 under check, and is refused with exit 1 under check --strict.
• A second fresh venv with <wheel>[xlsx]: rowspec_xlsx imports from the venv, with openpyxl 3.1.5.

After merge

Tag v0.3.0 on the squash commit. release.yml then runs the gate, builds, publishes through the trusted publisher, and runs action-published.yml against the published wheel. This is the first release in which that job runs (#52); before now it has only run on branches pushed to probe it. If it goes red, the tag and the upload are already final, and the fix is a patch release.