chore(release): 0.10.0

[devin-ai-integration]

What and why

Release branch for 0.10.0, cut from develop as docs/project/releasing.md § The release branch describes, with develop merged back in after the last fixes for the release (#842, #960, #997) and the SonarCloud gate fix (#1009) landed.

• CHANGELOG.md: the changes/unreleased/ fragments are folded into ## 0.10.0 — 2026-10-08 and deleted, the six that develop gained after the cut included. The minor segment moves because the release refuses a construct 0.9.x accepted (defer is removed) and changes derived results (exact Rationals, unbounded Integers, the -engine check horizon); see CONTRIBUTING.md § Versioning.
• Every version surface moves from 0.9.2 to 0.10.0: client/python/opensysml/_version.py, the Jupyter kernel's _version.py, client/node/package.json (package, the five platform packages, @openmbee/opensysml-wasm), client/java/pom.xml and both module poms, client/rust/opensysml/Cargo.toml, the MDK, SysON and VS Code manifests with their child poms, and the four lockfiles (npm install --package-lock-only, cargo update -p opensysml). The two READMEs that quote the version follow.
• scripts/changelog.py: 24 fragments on develop were already carried by the 0.9.2 section (they outlived their release). The fold now skips a fragment whose entry an earlier version's section already lists under the same heading, instead of repeating it in the version being prepared, and still deletes the fragment. Without this the 0.10.0 section repeated 23 entries of 0.9.2. The fix is listed under 0.10.0's Fixed.
• client/python/tests/test_snapshot_version.py: the three tests that name one night's snapshot passed declared and node as 0.9.2 but let the kernel version be read from the checkout, so they held only while the tree declared 0.9.2. They now pin the kernel version too.

How it was verified

On the branch head, after the develop merge:

• python3 client/python/scripts/check_version.py --tag v0.10.0 with --node, --java, --rust, --editors and --jupyter-kernel: each prints 0.10.0.
• python3 scripts/changelog-test.py (17 tests, one added for the carried-by-a-release case) and python3 scripts/changelog.py check; the 0.10.0 section shares no entry with 0.9.2, 0.9.1 or 0.9.0.
• gofmt -l . (empty), go build ./..., go vet ./..., make lint, make proto-breaking BUF_BREAKING_REF=origin/main, python3 scripts/check-doc-links.py, make docs-check.
• go test -race -count=1 ./... with OPENSYSML_REQUIRE_TRAINING_CORPUS, OPENSYSML_REQUIRE_PILOT_CORPORA, OPENSYSML_REQUIRE_PILOT_LIBRARY_XMI and OPENSYSML_REQUIRE_PSSM_SUITE set: all 101 packages pass (stdlib conformance and the corpus, identity and PSSM gates included).
• make build-grpc && pytest client/python/tests/: 1454 passed, 127 skipped.
• The SonarCloud quality gate on develop is OK after ci(sonar): resolve the findings against develop since 0.9.2 #1009 (new reliability and security ratings A).
• The non-publishing release packaging rehearsal is in the comment below; the CircleCI release_rehearsal=true run on this branch remains to be triggered by a maintainer with the publish contexts.

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added (folded directly into the 0.10.0 section, as a release branch does)
• baselines regenerated and make docs-counts run if a gate count moved (none moved)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/3db6a090aa214667b2a66d372c6e36b1
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/3db6a090aa214667b2a66d372c6e36b1?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Local release-packaging rehearsal and runtime smoke

The 0.10.0 version checks (check_version.py --tag v0.10.0 on all six surfaces), the Python wheel/sdist build, twine check --strict, a fresh-venv wheel import, the embedded service-digest checks and the release-manifest comparison passed, run with the non-publishing CircleCI command bodies.

The installed wheel accepted a pinned download served from localhost without sigstore, rejected tampered bytes, and refused an unpinned release before downloading its executable. An altered manifest was rejected with "nothing was signed".

Scope: Linux amd64 used a real sysml-grpc executable; the non-native and ancillary packaging inputs were labeled placeholders. No live v0.10.0 GitHub download, cross-platform build, signing or publishing is established by this rehearsal — the CircleCI release_rehearsal=true run covers those.

Native REPL and build version	Installed Python wheel

Both surfaces returned Demo::sedan.mass = 1800.0. The installed wheel declares 0.10.0; the untagged native build reports v0.9.2-1639-g584a03d8e, as expected before the tag.

[someshSandbox]

The 0.10.0 release branch is merged. Could a maintainer cut the v0.10.0 tag and publish @openmbee/opensysml (and the platform packages) to npm? As of now npm's latest is 0.9.2. Thank you.