v5.14.0

5.14.0 is about the paths nothing had ever walked. Every fix was found by running something that had never been run — two example directories CI does not cover, and then the server paths they took.

Fixes

• #856 — a coroutine spawned by a module function reached through a foreign closure was owned by the wrong VM and silently dropped. A context captured on another VM carried that VM's builtins; restoring it wholesale made spawn / run_loop act on the wrong VM. Adopted onto this VM's builtins at the point of installation. The judge-panel example runs for the first time.
• #862 — a step that exceeded the budget under nodus serve hung the request forever (the deadline's exception escaped the worker thread above its accounting). while (true) in a step was a one-line denial of service. A breach returns ok: false now.
• #855 — the TLS trust store is built once per process, not once per VM: every runtime's and every server request's first HTTP call paid ~0.5 s loading the CA bundle.

Changed

• #857 — nodus serve --time-limit SECS sets the ceiling every submitted program runs under; a request may pass timeout_ms to ask for less, never more; a malformed value is refused. workflow run and goal-run take --time-limit too, and the legacy workflow-run --time-limit means seconds (it silently took milliseconds).
• #858 — POST /workflow/run, POST /goal/run, nodus workflow run and nodus goal-run no longer run a self-running program's flow a second time; they report the program's own run.

Verified

Gate 10a: 8/8 dependent suites, 939 tests · Gate 10b: 129/129 release-claims probes against the wheel, from outside the repo · Stage 5: 10/10 through the published package. Records in docs/evals/v5.14.0/.

Full changelog: https://github.com/Masterplanner25/Nodus/blob/main/CHANGELOG.md#5140---2026-09-18