release: 0.14.0

[vladimirrott]

Version bump and CHANGELOG for 0.14.0.

Why the middle digit

sysknife audit checkpoint with no database configured returned exit 2 and now returns exit 4 (#381). docs/cli.md calls the exit codes the contract a wrapper script reads, and docs/release.md#version-numbering is explicit that behaviour counts and not only signatures:

v0.9.0 also made sysknife-setup refuse a malformed .mcp.json that earlier versions overwrote, so a run that used to succeed now exits 1. No signature changed and it is still a compatibility break.

So this is 0.14.0 rather than 0.13.2, and it would have been even without the API change queued in #384.

What is in it

Two fixes in the daemon's authorization path:

• a cancelled transaction could keep a live approval receipt, so claim_approved_for_execution could still consume it (fix: revoke approvals when queued work is canceled #380, closes Cancel and the TTL sweep end an approval without revoking it or writing an event #251)
• a peer the kernel could not pin was still credited with the supplementary groups of whatever process held that PID by the time /proc was read (fix(daemon): fail closed when a peer cannot be pinned #382, closes peer_pidfd cannot tell a pre-6.5 kernel from a peer that already exited, so the PID-reuse check is off in the reuse case #250)

Plus the CLI exit-code contract (#381), the release-pin check that was filtering out the one broken pin it existed to catch (#378), single-source story metadata (#386), derived markdown link coverage (#376), and a dead daemon lock arm (#375).

The lockfile

Cargo.lock was regenerated by cargo, not edited. phf, phf_codegen, phf_generator, phf_macros and phf_shared are also pinned at 0.13.1, so substituting the string across the lockfile would have moved five unrelated crates to a version that does not exist. Only the 8 workspace crates moved; phf is untouched.

Verification

test_baseline: 1845 rust tests, matching the recorded baseline
Public claims contract passed
release-version-pins: missing inline versions fail explicitly
All release versions match 0.14.0 (15 internal dependency pins checked)
Registry preflight: sysknife-types/brain/daemon/cli  0.14.0 available