v1.2.14

The release that opens the door between FlowForge and the web console — and, on the way, finds that several doors we believed were open never had been.

The console can finally read your board

• The ticket read surface exists. Five relations the web console reads the board from — v_ticket, v_assignee, v_milestone, v_project_rollup, v_merged_pr — were referenced by shipped client code and had never been built. The console's reads were failing outright, not returning empty. They exist now, with the tenancy predicate paid once per returned ticket instead of once per edge (#5189, #5195).
• Seven tables the console must read had no grant at all. custom_field_def, custom_field_value, field_role_map, ticket_dependency, umbrella_rollup, pull_request and ticket_ref all had row-level security forced and no SELECT for signed-in users — so every read failed closed, and the field-mapping screen reported an opaque server error. One migration opens all seven, measured sargable, with the cross-tenant leak proven red before it was proven fixed (#5188, #5193). Establishing why mattered: they were never granted, not revoked.
• Your projects group under your company, and stay yours. The tenancy anchor is live and verified by impersonating real members: a company admin and a plain member each see their own projects and tickets, and zero rows belonging to anyone else (#5143).
• The Team tier comes from your entitlement, so tier-gated features stop failing open (#5149, #5157).
• A role the console cannot express survives the derivation instead of being flattened away (#5145, #5155).

Your tickets stop colliding across repositories

• Two repositories with an issue #42 are now two different tickets. Every GitHub ticket id is scoped to its project. Before this, importing a second repository could resolve one repo's issue onto another's and overwrite it in place — silently, reported as a cheerful "updated" (#5158, #5161).
• A migration can no longer claim a ledger id that is already taken, with a CI guard that fails the build rather than letting the collision reach a database (#5174, #5176).
• Production drift is now detectable. A guard reports migrations that are committed but never applied — and it ships red, because today's production is four migrations behind (#5191, #5194).

The War Room

• Create an epic inside a sprint, and add or remove its tickets, without leaving the board (#5164, #5173).
• Move tickets into a sprint with M — it takes the multi-selection you already made, batched, and reports honestly per ticket (#5166, #5168).
• A assigns a whole subtree. The assignee picker offers your team, and assigning on a sprint or an epic assigns everything under it (#5165, #5170).
• The ladder reads by indentation — an epic's badge sits under its sprint, so two tiers are legible without decoding a glyph (#5135, #5138).
• The initiative tier renders, and a sprint attaches from either side (#5163, #5171). Waves ticket rows carry their titles, and the ledger's bands stop breaking into black rectangles (#5154, #5159). The loop-4 pill says paused for a state that is a pause, reserving stopped for termination (#5063, #5180).

Live Reviews

• The screen shows the findings, decodes its own glyphs, names the GOLDEN rule currently in force, and stops the two panes disagreeing by a row (#5134, #5141).
• Every row says what state its PR is in — settled, reviewing, remediating, or out of rounds — and you can grant a round from the row instead of dropping to a terminal (#5152, #5160).
• A remediation push supersedes the crew reviewing the old head, instead of a second crew running beside it and spending a review round on bytes nobody is waiting for (#5015, #5178).

ForgePlay 4 — the go-to-market play

• A whole go-to-market play, runnable as an artifact: a ratified 16-node DAG, its skill, and a manifest entry the build enforces (#4796, #5110).
• Its charts are enforced outputs, not optional ones — the funnel and campaign-architecture drawings are produced or the play does not pass (#4799, #5115).
• Completeness stops being a judgment call. Variants-per-placement is declared by the play and asserted by flowforge play coverage (#4801, #5116).
• The buyer pre-flight cannot pass in silence — the read-only paper build is structural, and its verdict is stated (#4800, #5112).
• Run against FlowForge itself and parked at its first gate, honestly (#4802, #5133). The emit path was proven before it was built on (#4795, #5104), the catalog iterates from one spine (#4804, #5108), and a shadowed tree stops reading as a missing play (#5121, #5127). Artifact glyphs are decoded in the ? overlay (#4798, #5111).

Guards that were not guarding

• A cap crossing can exist in no commit — and now the merge is gated too. Two branches each grew a file legally, 686→693 and 686→697; their merge landed at 704. The commit gate was right to permit both, and no branch-local check could see the crossing. It is now armed on the merge commit itself (#5030, #5181).
• A file over the cap no longer blocks unrelated work. The daemon-health seam is rehoused out of the cockpit's largest file, clearing the 700-line cap with no waiver (#5023, #5177).
• supabase config push is no longer a landmine. The declared exposed-schema set now equals the live one, so a routine push stops being one command away from taking every customer-facing surface down at once — and CI fails the day they diverge again (#5139, #5175).
• The cross-schema guard has teeth against console — reads pass, writes fail, and the contract states its real scope instead of a wider one (#5148, #5153).
• Three actively-misleading stale artifacts carry additive superseded notes (#5147, #5151), and a golden left behind by an earlier change is regenerated (#5156, #5179).

Known gaps

• The four pending migrations (ff-0050…ff-0053) are prepared and verified but not applied — the Initiative/Epic rename shipped in v1.2.13 and its migration is among them, so production still carries the previous vocabulary.
• The tenancy predicate is evaluated per row. Comfortable at a few hundred tickets; it needs the sargable rewrite before a board of tens of thousands.
• Device telemetry still requires a manual push; scheduled export is not yet wired.