ADD 1.14.0 — component-polish + installer-polish

Two milestones round out lanes that shipped partially in earlier releases. Installer- and engine-pin-neutral — the ADD engine is byte-identical (ENGINE_MD5 unchanged); all changes live in the installer twins and the component validator. Backward-compatible throughout.

installer-polish — complete the global lane

• init --from-global-data rehydrates a project's user-data from the global home on a fresh clone (the non-destructive inverse of the one-way backup); fill-gaps by default, --force writes a .bak sidecar first.
• prune-data removes home snapshots with no live registry owner — dry-run by default, --force to delete.
• update --global made safe — an O_EXCL home lock serializes concurrent runs cross-twin (a pip-held lock blocks an npm run and vice-versa); every registered path is validated before any write (a relative/traversal entry aborts loud, a non-.add/ dir is dropped).
• Reconcile roll-up — every reconcile reports a file-level N restored · M refreshed summary, so a partially-gutted-but-present managed tree's heal is visible. Pure observation; copy semantics unchanged.

component-polish — close the pillar gaps + harden the edges

• add.py components reader + a components.toml schema-lint (measure-not-block).
• Federation hardening — federate pull path-confines the manifest source to a sibling-repo allowlist with a fail-closed HARD-STOP before any read; a stale producer contract snapshot is surfaced (never red).
• Registry fill + a worked example threading the component flow end-to-end.

Install / upgrade

npx @pilotspace/add@1.14.0 init     # npm
pipx install pilotspace-add==1.14.0  # PyPI

Published to npm (@pilotspace/add) + PyPI (pilotspace-add) via tokenless Trusted Publishing. Full notes: CHANGELOG.