Releases 2.14.0

[johnnyt]

Release prep for statifier 2.14.0. The prep only: the conductor merges, tags v2.14.0 at the merge SHA and pushes the tag; release.yml publishes on the tag push.

The version and why

2.14.0, a minor. The validator's closed reason union, Statifier.Validator.Error's t:reason/0, grows by {:duplicate_attribute, element, attribute}: a document that writes one attribute twice on one element is refused where it compiled. The refusal was ruled by the operator, 2026-10-10 (a validator refusal, error severity, located at the repeated occurrence, released in a minor), and its fragment carries the Breaking entry. The other fragments are two Fixed entries; none is a Removed or Deprecated entry.

The closed-set answer

Read from git diff v2.13.0..origin/main -- lib priv and each fragment, for a new member of a closed vocabulary a host pattern-matches:

• Statifier.Validator.Error t:reason/0 gains {:duplicate_attribute, element :: binary(), attribute :: binary()}, and so Statifier.Validator.Error.code/1 can answer :duplicate_attribute. This is the one new member. Its constructor, Statifier.Validator.Error.duplicate_attribute/3, is new beside the other reason constructors in that module.
• Statifier.Session: the budget-halted handle_info/2 clause for a fired delayed send and the drain's drain_halted/1 are private; no new message, halt reason or reply shape reaches a host. The halted messages a host can receive are unchanged in shape; only when {:halted, :cancelled} arrives after a budget halt, and that no further {:halted, :budget_exhausted} follows a dropped fire, change (both Fixed).
• Statifier.Session.Inbox.take_cancel/1 is @doc false; Statifier.Replay's drain_halted/1 is private.
• Statifier.Publish.findings/2: its doc only (row S3 and a generated invoke id); no finding changes.
• lib/mix/ (the ADR guard, its task, the host case runner): docs and gate tooling, not in the Hex package.

No runtime dependency requirement moves. Since v2.13.0 the only requirement and lock lines that moved are the dev-only ex_quality ones (~> 0.16, locked at 0.16.0), which are not part of the Hex package's requirements.

Fragments promoted

Into ## [2.14.0] 2026-10-11, each bullet byte for byte, then deleted (changelog.d/README.md stays):

• Changed: changelog.d/st-6lu.md (the Breaking entry, carried exactly as written)
• Fixed: changelog.d/st-2w9k.md, changelog.d/st-jdxs.md

The heading carries no dash and the file gains no link reference (.claude/wurk/release.md step B). The lead paragraph names the Breaking entry and the two session answers that change; it makes no "registers nothing" claim, as no send type changes.

The upgrading page

A separate commit, as docs/upgrading.md is outside the release commit's files. The title and the intro's range move to 2.14.0. The intro's sentence that no release in the range has a Breaking entry now says only 2.14.0 has one, and a new intro sentence names the hosts 2.14.0's changed answers reach. The 2.14.0 section, written from the fragments' host-facing sentences:

• must change: only where one of three answers reaches a host. The Breaking refusal of a repeated attribute (remove the repeat; add a clause for the new reason where the validator's reasons are matched exhaustively); cancel/1 reaching a budget-halted session past queued events; a delayed send fired under a budget halt to an internal target or an unreachable route dropped without stepping. A ~> 2.13 requirement already accepts 2.14.0.
• may start: nothing new.
• the corpus: the statifier suite gains loan_renew_refused_by_standing and loan_dispute_restores_late_shallowly, the registry claims both, and the corpus hash moves, so a sibling implementation that vendors the corpus re-vendors at the v2.14.0 tag. No case repeats an attribute, so the refusal moves no case. The case schema's description changes change no verdict.

The commits

1. Carries the upgrading page to 2.14.0 (above).
2. Releases 2.14.0: exactly .claude/wurk/release.md's files, mix.exs @version "2.14.0", the README pin {:statifier, "~> 2.14"}, the CHANGELOG.md section and the deleted fragments. Committed on the staged tree the full mix quality and mix quality --profile merge ran green on, with no change between the green runs and the commit, the repository's gate lock and a machine slot held across both runs and the commit.

Gate

Full mix quality green on the final tree (3,305 of 3,305 tests, 96.3% coverage, Dialyzer clean, regression ratchet and conformance corpus passed, README stage green), and mix quality --profile merge green; its ADR judge skipped, as no file in this diff is in a judged scope.

After the merge

The conductor merges, pulls main, tags v2.14.0 at the merge SHA and pushes the tag once every other round that reads this repository at a tag reads closed; release.yml publishes on that tag push. Nothing in this PR tags or publishes.