v1.2.1

The post-1.2.0 hardening release — every issue from the first full live test of v1.2.0, fixed. It makes the new stream-json ACE rail feel finished: replies render cleanly and stay alive while ACE works, the composer matches Claude Code, ACE survives app restarts, and the context gauge no longer goes stale mid-turn. It also completes the desktop distribution (Intel Mac + Linux), ships the Epics screen, hardens the self-driving merge pipeline, and adds a first-class "never lock the user out" bypass.

ACE rail & composer

• Stream-path reply fidelity: protocol markers and [tts] no longer leak, prose no longer stays gray until turn-end, and text blocks are cleanly separated (#4219).
• ACE continuity across app restarts — the same ACE and its full conversation return via a persisted session id + --resume replay; a fresh ACE only via the explicit paths (#4221).
• Context gauge live on the headless path — a per-API-call producer + freshest-wins arbitration ends the "ctx stale 14m" drift while ACE works hardest (#4227).
• Composer input parity with Claude Code — Esc interrupts the turn, ↑/↓ walks sent-message history, esc-esc clears the draft (#4267).
• An instant "alive" header plus an O(n)-per-token reflow fix cut perceived reply latency (#4257).
• Founder/relay messages are never silently dropped when no generation is live — they queue and flush on the next turn (#4220).
• Rails-era keybindings: attach becomes a hidden escape hatch, ctrl+shift+Y retired, SELECT reachable mid-compose (#4222); R/Refresh and H/Handoff reach the headless rail again (via #4221).
• Dynamic slash-command palette sources every command from the live session (#4229); terminal copy-out and topbar/T-Term navigation fixed (#4223).

Screens & configuration

• Epics replaces Goals on O — a real gh-provider projection (milestones · umbrellas · subtickets · honest rollups) with an FF-native-unlock notice, no more demo scaffold (#4230).
• Configuration front door — one discoverable Sync door and calm empty states instead of an error wall (#4235).
• Waves-widget phantom fixed — run-lifecycle invalidation at the reconcile seam (#4226).
• Reviewer + architect-tier agents run on Opus, not Fable — lower cost per review (#4258).

Desktop

• Completed distribution: Intel-Mac (amd64) cross-build + Linux AppImage with GPG signing, alongside macOS arm64 (#4217).
• The admin preview pane renders in-app — the CSP frame-ancestors header, ratified earlier, is finally deployed and guarded against regression in both repos (#4224).
• The preview pane re-themes on a theme change across every content kind (#4241); the audio missing-install hint is verified intact on the stream path (#4228).

Self-driving pipeline & discipline

• An out-of-band reviewer GOLDEN now counts for the queue and the merge verb; a never-reviewed head gets one bounded fresh round instead of parking forever (#4242).
• A merged, reaped worker renders DONE — never a red "stopped unexpectedly" (#4256).
• The tui-test-guard no longer false-trips on test tokens quoted inside file/PR payloads (#4214).
• Never lock the user out — soft merge gates (lease/provenance/doc-strictness) now offer a bypass-with-reason while the hard safety guards stay intact (#4262).
• Groundwork docs: the forge-seam (GitLab, incl. self-hosted) plan, the workers-screen rethink study, and reliable doc-set drawer presentation (#4236, #4225, #4240).