v1.1.2

The all-night hotfix. v1.1.1 went out on July 11; the founder then drove the cockpit hard for a real customer evaluation and filed everything that got in the way. This release is that list, closed: 25+ tickets sealed in roughly 24 hours, every one through an independent reviewer-vehicle GOLDEN, most through the self-driving merge pipeline end-to-end.

The cockpit stops freezing

The headline: typing froze for 1–3 seconds every few seconds while CPU sat idle. Root cause found in a trace — the session lock was held across a network round-trip in the completion probe, blocking the whole update loop. The lock no longer spans I/O; typing stays fluid regardless of network weather. Crash recovery is fixed with it: --take-over and the startup gate now read the same liveness truth, and a half-dead session self-heals loudly instead of refusing — no more quitting your terminal to get the cockpit back.

Integrity, by construction

A dev-built binary can never hijack the production daemon socket again (bind-time identity gate, a single-binder lock, and periodic eviction of impostors). Merged worktrees now reap themselves — squash-aware, keyed on real PR state, with a hard safety contract (never dirty, never open work); the first sweep reclaimed 37 GB. The line-budget merge wall became growth-aware so legacy-file hotfixes merge without ceremony while new debt still refuses. The merge driver reports success honestly when only local branch cleanup fails, and the "repo not registered" false alarm is dead — worktrees inherit their repo's identity, so time tracking never cries wolf again.

The rail and the boards tell the truth

Background-job notifications render as quiet system events instead of impersonating you. Operator turns render once (single-producer contract). Composer drafts survive navigation — only submit or an explicit double-esc clears them. Kanban wave state no longer leaks across milestone switches, and the waves chip names the milestone it was computed for. The gantt board decodes closed tickets case-correctly, z cycles day/week density, Tab and d do what the spec says, and the fixtures now speak the real wire format so this class can't hide again.

ForgePlay, ratification-grade

The Gate-1 reader is redesigned: the document you're ratifying gets a proper 68–84-column reading measure with the list collapsing to a rail — no more squinting at a strip. The feature-description editor wraps correctly, counts honestly, and fills its column. The running-play screen now says what was always true: you can leave, it runs on its own, and it calls you at the checkpoints.

Documents worth handing to a client

PDF exports always render one coherent print palette — dark-mode hosts no longer leak washed-out headings and dark code pills onto white pages. The Product Manual got its Option-A visual pass (the engineered-blueprint identity retinted to the FlowForge purple system, the component library everywhere) with a manifest-driven figure pipeline — and the web manual is the canonical, always-current surface; PDFs stamp their version and point back to it.

A bigger design org

Two new heads of craft: fft-tui-designer joins as the terminal visual-design leaf (the roster is now 36 specialists — the site and docs list all of them, each with what-it-does and when-to-use), and fft-designer gained a deep print/editorial corpus. The TUI test wall v2 seals the CPU-melt class for good, control-plane version drift self-heals (stale processes refuse to serve old code after an update), tmux copy reaches the system clipboard, and the release process itself is now a documented runbook (RELEASING.md) instead of tribal knowledge.