diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 5ecd0cb..8be9956 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.7.13"
+  ".": "0.7.14"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d329fb..819f58a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.7.14](https://github.com/vibecook-dev/truffle/compare/truffle-v0.7.13...truffle-v0.7.14) (2026-09-16)
+
+
+### Features
+
+* **apple:** the login gate — the tailnet login as the mesh boundary ([3c561cf](https://github.com/vibecook-dev/truffle/commit/3c561cfd4b3f1b5e30c42ab2622b77cfd8278bd9))
+* **apple:** the tailnet login on every public identity surface ([668e4f8](https://github.com/vibecook-dev/truffle/commit/668e4f8f7b33150833b5b70cd80d83634d68c1f0))
+* **cli:** the peer list and status show the tailnet login ([37bb71b](https://github.com/vibecook-dev/truffle/commit/37bb71b80c1b85895e3f67d9c9d4c23c436d41aa))
+* **core,napi,tauri:** the gate gets a door and the login gets a public surface ([9b3ffaf](https://github.com/vibecook-dev/truffle/commit/9b3ffaf6e65d80db798324d0bd45ad8f986ca0cd))
+* **core:** Layer 3 filters by login, and a gated node refuses a sidecar that cannot report one ([d45984a](https://github.com/vibecook-dev/truffle/commit/d45984aabc9eae04a105f1f1177471083cfb2ace))
+* **core:** RFC 025 — the login becomes a peer fact, and a node can declare which logins may join ([e729922](https://github.com/vibecook-dev/truffle/commit/e729922c9cec19f11cbe7fe557cbbd2d1296a344))
+* **core:** RFC 025 — the login gate at the hello, and a store slice bound to its sender ([feb685d](https://github.com/vibecook-dev/truffle/commit/feb685db38b5a9cef43b47e88e37366ae267d8f8))
+* **sidecar:** the login rides every peer row and the node's own status — protocol 5 ([eec5799](https://github.com/vibecook-dev/truffle/commit/eec5799defed8d12de0bcd33a84bf9b8310b4c64))
+
+
+### Bug Fixes
+
+* **apple:** a login the gate refuses is a departure, not an update ([8e41d2e](https://github.com/vibecook-dev/truffle/commit/8e41d2e0306a1ccee9526ee759dba64763f22fd7))
+* **apple:** a peer we cannot attribute reports no login, and is not dialed ([27ac01f](https://github.com/vibecook-dev/truffle/commit/27ac01f9900b57fb576da1c65803c6ccd3d7e910))
+* **apple:** preserve peer identity and recover Tailscale watches ([9d77cf9](https://github.com/vibecook-dev/truffle/commit/9d77cf97d026518099d05691b91e968ce327034b))
+* **core:** a gated node will not dial a peer whose owner it cannot state (M2) ([5894d62](https://github.com/vibecook-dev/truffle/commit/5894d62629900c571b1fb6a2d898410eb8c57624))
+* **core:** a hello-only peer's store slices bind to their sender again (M1) ([e8b65a8](https://github.com/vibecook-dev/truffle/commit/e8b65a83661d3748dd17a4fbdb5f8d7484365930))
+* **core:** a peer whose login turns foreign is EVICTED, not silently kept ([404f4b1](https://github.com/vibecook-dev/truffle/commit/404f4b1a2b56c7554326dad47124c21550b382e4))
+* **core:** one login_allow builder method after the Layer 3 merge ([b81a662](https://github.com/vibecook-dev/truffle/commit/b81a6628356ac43900cf0793e02ac0897cd954fd))
+* **deps:** rustls 0.23.45 — RUSTSEC-2026-0285 (TLS 1.3 handshake messages across encryption levels) ([ff1bbd6](https://github.com/vibecook-dev/truffle/commit/ff1bbd617e1f2da45073dcc82d1390cd74db40a2))
+
 ## [0.7.13](https://github.com/vibecook-dev/truffle/compare/truffle-v0.7.12...truffle-v0.7.13) (2026-09-06)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index 19aefbf..0e23032 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5909,7 +5909,7 @@ dependencies = [
 
 [[package]]
 name = "truffle"
-version = "0.7.13"
+version = "0.7.14"
 dependencies = [
  "serde_json",
  "truffle-core",
@@ -5937,7 +5937,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-cli"
-version = "0.7.13"
+version = "0.7.14"
 dependencies = [
  "chrono",
  "clap",
@@ -5972,7 +5972,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-core"
-version = "0.7.13"
+version = "0.7.14"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -6006,7 +6006,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-napi"
-version = "0.7.13"
+version = "0.7.14"
 dependencies = [
  "napi",
  "napi-build",
@@ -6020,7 +6020,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-sidecar"
-version = "0.7.13"
+version = "0.7.14"
 dependencies = [
  "serde_json",
  "sha2 0.11.0",
diff --git a/Cargo.toml b/Cargo.toml
index ad39842..a427e55 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -112,8 +112,8 @@ tauri-plugin = { version = "2", features = ["build"] }
 ureq = "3"
 
 # Internal crates
-truffle-core = { version = "0.7.13", path = "crates/truffle-core" }       # x-release-please-version
-truffle-sidecar = { version = "0.7.13", path = "crates/truffle-sidecar" } # x-release-please-version
+truffle-core = { version = "0.7.14", path = "crates/truffle-core" }       # x-release-please-version
+truffle-sidecar = { version = "0.7.14", path = "crates/truffle-sidecar" } # x-release-please-version
 
 # Dev / test
 # (tokio dev features are added per-crate via `features = [...]`)
diff --git a/crates/truffle-cli/Cargo.toml b/crates/truffle-cli/Cargo.toml
index 2bcbdce..f824fd4 100644
--- a/crates/truffle-cli/Cargo.toml
+++ b/crates/truffle-cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-cli"
-version = "0.7.13" # x-release-please-version
+version = "0.7.14" # x-release-please-version
 edition.workspace = true
 description = "CLI tool for Truffle mesh networking (Node API)"
 license.workspace = true
diff --git a/crates/truffle-core/Cargo.toml b/crates/truffle-core/Cargo.toml
index 9cecaa0..7436268 100644
--- a/crates/truffle-core/Cargo.toml
+++ b/crates/truffle-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-core"
-version = "0.7.13" # x-release-please-version
+version = "0.7.14" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "Truffle mesh networking core (clean architecture)"
diff --git a/crates/truffle-napi/Cargo.toml b/crates/truffle-napi/Cargo.toml
index 60ff87b..4bc6b69 100644
--- a/crates/truffle-napi/Cargo.toml
+++ b/crates/truffle-napi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-napi"
-version = "0.7.13" # x-release-please-version
+version = "0.7.14" # x-release-please-version
 edition.workspace = true
 description = "NAPI-RS bindings for truffle-core (published to npm, not crates.io)"
 license.workspace = true
diff --git a/crates/truffle-napi/npm/darwin-arm64/package.json b/crates/truffle-napi/npm/darwin-arm64/package.json
index a066aae..34e873b 100644
--- a/crates/truffle-napi/npm/darwin-arm64/package.json
+++ b/crates/truffle-napi/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-darwin-arm64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/truffle-napi/npm/darwin-x64/package.json b/crates/truffle-napi/npm/darwin-x64/package.json
index 14e40ce..a502205 100644
--- a/crates/truffle-napi/npm/darwin-x64/package.json
+++ b/crates/truffle-napi/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-darwin-x64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/npm/linux-arm64-gnu/package.json b/crates/truffle-napi/npm/linux-arm64-gnu/package.json
index d060855..37bf20b 100644
--- a/crates/truffle-napi/npm/linux-arm64-gnu/package.json
+++ b/crates/truffle-napi/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-linux-arm64-gnu",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/truffle-napi/npm/linux-x64-gnu/package.json b/crates/truffle-napi/npm/linux-x64-gnu/package.json
index 089c74a..d87fa48 100644
--- a/crates/truffle-napi/npm/linux-x64-gnu/package.json
+++ b/crates/truffle-napi/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-linux-x64-gnu",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/npm/win32-x64-msvc/package.json b/crates/truffle-napi/npm/win32-x64-msvc/package.json
index f22967d..9349449 100644
--- a/crates/truffle-napi/npm/win32-x64-msvc/package.json
+++ b/crates/truffle-napi/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-win32-x64-msvc",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/package-lock.json b/crates/truffle-napi/package-lock.json
index 0490f11..605d2a0 100644
--- a/crates/truffle-napi/package-lock.json
+++ b/crates/truffle-napi/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@vibecook/truffle-native",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@vibecook/truffle-native",
-      "version": "0.7.13",
+      "version": "0.7.14",
       "license": "MIT",
       "devDependencies": {
         "@napi-rs/cli": "3.6.2"
diff --git a/crates/truffle-napi/package.json b/crates/truffle-napi/package.json
index 24727e9..c5bef9b 100644
--- a/crates/truffle-napi/package.json
+++ b/crates/truffle-napi/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Mesh networking for local-first apps, built on Tailscale (native addon)",
   "main": "index.js",
   "types": "index.d.ts",
diff --git a/crates/truffle-sidecar/Cargo.toml b/crates/truffle-sidecar/Cargo.toml
index c55ecff..8ea8278 100644
--- a/crates/truffle-sidecar/Cargo.toml
+++ b/crates/truffle-sidecar/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-sidecar"
-version = "0.7.13" # x-release-please-version
+version = "0.7.14" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "Auto-downloads the truffle mesh networking sidecar binary at build time"
diff --git a/crates/truffle/Cargo.toml b/crates/truffle/Cargo.toml
index 78e35f1..f0dbfeb 100644
--- a/crates/truffle/Cargo.toml
+++ b/crates/truffle/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle"
-version = "0.7.13" # x-release-please-version
+version = "0.7.14" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "P2P mesh networking for your devices, built on Tailscale"
@@ -13,8 +13,8 @@ categories = ["network-programming"]
 workspace = true
 
 [dependencies]
-truffle-core = { version = "0.7.13", path = "../truffle-core" }       # x-release-please-version
-truffle-sidecar = { version = "0.7.13", path = "../truffle-sidecar" } # x-release-please-version
+truffle-core = { version = "0.7.14", path = "../truffle-core" }       # x-release-please-version
+truffle-sidecar = { version = "0.7.14", path = "../truffle-sidecar" } # x-release-please-version
 
 [dev-dependencies]
 serde_json.workspace = true
diff --git a/npm/truffle-sidecar-darwin-arm64/package.json b/npm/truffle-sidecar-darwin-arm64/package.json
index 63a5798..4d76a70 100644
--- a/npm/truffle-sidecar-darwin-arm64/package.json
+++ b/npm/truffle-sidecar-darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-darwin-arm64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Truffle sidecar binary for macOS ARM64 (Apple Silicon)",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-darwin-x64/package.json b/npm/truffle-sidecar-darwin-x64/package.json
index 3f0746e..701e871 100644
--- a/npm/truffle-sidecar-darwin-x64/package.json
+++ b/npm/truffle-sidecar-darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-darwin-x64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Truffle sidecar binary for macOS x64 (Intel)",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-linux-arm64/package.json b/npm/truffle-sidecar-linux-arm64/package.json
index 15a8597..1d137d5 100644
--- a/npm/truffle-sidecar-linux-arm64/package.json
+++ b/npm/truffle-sidecar-linux-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-linux-arm64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Truffle sidecar binary for Linux ARM64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-linux-x64/package.json b/npm/truffle-sidecar-linux-x64/package.json
index 75969cf..506354d 100644
--- a/npm/truffle-sidecar-linux-x64/package.json
+++ b/npm/truffle-sidecar-linux-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-linux-x64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Truffle sidecar binary for Linux x64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-win32-x64/package.json b/npm/truffle-sidecar-win32-x64/package.json
index 0c753bf..8ecfccc 100644
--- a/npm/truffle-sidecar-win32-x64/package.json
+++ b/npm/truffle-sidecar-win32-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-win32-x64",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Truffle sidecar binary for Windows x64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/packages/core/package.json b/packages/core/package.json
index 4715677..d12390b 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "Mesh networking for local-first apps, built on Tailscale",
   "license": "MIT",
   "author": "James Yong",
diff --git a/packages/react/package.json b/packages/react/package.json
index cc657c5..2bbbf55 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-react",
-  "version": "0.7.13",
+  "version": "0.7.14",
   "description": "React hooks for Truffle mesh networking",
   "license": "MIT",
   "author": "James Yong",