S3.2 — Python bindings: PyO3 0.29, maturin 1.15, Python 3.11+

Intent

PyO3 removed with_gil / PyObject in 0.28 and maturin deprecated upload/publish in 1.11. Bring oxmpl-py current. Drops Python 3.8–3.10 (3.10 EOL 2026-10-01; PyO3 0.29 supports PyPy ≥ 3.11 only; pytest 9 needs ≥ 3.10).

Acceptance criteria

• pyo3 pinned to 0.29.x; no deprecation warnings
• maturin >=1.15,<2 in oxmpl-py/pyproject.toml and requirements.txt
• requires-python = ">=3.11"; classifiers updated
• pytest 9; pyo3-stubgen removed from requirements.txt (unused)
• just build-py && just test-py green

Tasks

• Python::with_gil → Python::attach (13), PyObject → Py<PyAny> (16), downcast_into → cast_into (2)
• Resolve FromPyObject changes for the 14 Clone pyclasses as the compiler reports
• Update pyproject.toml / requirements.txt
• Commit marked breaking (Python floor). See the note below: the commit uses !, and its footer token is BREAKING:, not BREAKING CHANGE:

Completion (2026-10-09)

Commit 2946808 on toolchain-refresh, pushed: build(deps)!: upgrade oxmpl-py to PyO3 0.29 and maturin 1.15, raising the Python floor to 3.11.

Evidence (run on HEAD in the worktree via direnv):

• just build-py installs; just test-py 34/34 on pytest 9.0.0, with DeprecationWarning treated as error.
• 0 compiler warnings (14 from_py_object opt-ins); cargo clippy --all-targets -- -D warnings clean; cargo fmt --check clean.
• Rust tests 91/91 still green.
• Release wheel: Requires-Python: >=3.11 and 3.11–3.13 classifiers in the metadata; the .so does not link libpython (manylinux-safe without extension-module).

Folded in (same files, small; scope-change rule):

• extension-module feature removed from Cargo.toml and pyproject.toml. maturin ≥ 1.9.4 sets PYO3_BUILD_EXTENSION_MODULE. Side benefit: cargo test and workspace clippy can link oxmpl-py.
• #[pymodule(gil_used = true)] in lib.rs: PyO3 0.28 made free-threaded support the default. The pin keeps 0.7 behaviour until free-threading is a deliberate decision.
• Python 3.11–3.13 + 3 :: Only classifiers added.

Notes:

• Footer token: the commit footer reads BREAKING:, which the Conventional Commits spec does not recognise (it needs BREAKING CHANGE:). The ! in the subject marks the commit as breaking on its own, so release-please still treats it as breaking and uses the subject as the breaking-change note. The commit is already pushed, so it is left as-is unless the owner decides to amend and force-push.
• Free-threading is now explicitly deferred (gil_used = true), not backlogged. Candidate for the backlog, owner to decide.
• The pypi.yml regeneration findings belong to S3.4; they are recorded there.