v1.2.17

The release that makes Linux a first-class citizen. The desktop app painted a white window on Linux and found none of the machine's themes; three days on Omarchy turned that into a supported platform. Alongside it: a customer's Jira field mapping finally reaches the board, the workspace you are in is the workspace every screen shows, and the review pipeline stops reporting states it cannot see.

Linux, first class

• The desktop app no longer paints a white window. The bundled WebKit helpers bound the host libwebkit2gtk instead of their own — a silent IPC skew with no error to read (#5351).

• The injected WebKit bundle resolved by luck, and the smoke gate stopped at first paint, so it could not have caught it. Both are closed (#5371).

• FlowForge found 0 of the machine's 27 Omarchy themes, and lost every one you picked. It now finds them and keeps your choice (#5368).

• It never followed the live Omarchy theme — the watcher looked in a directory Omarchy 4 abandoned (#5384).

• Sixteen new themes ship — the built-in set goes from 21 to 37, harvested from the machine, with a stated reason recorded for every one refused (#5383).

• The themes already shipping were repaired to WCAG contrast. The light ones were effectively unreadable; the goldens moved to the repaired values, not the other way round (#5417).

• The cockpit half-ignored the theme you chose. Every slot is now bound to every surface, and the chrome stopped painting the brand over it (#5385).

• Theme import read nothing for every customer — it resolved source roots from a path only the operator's machine had. It reads XDG now (#5391).

• The Linux folder picker was git init-ing arbitrary directories you merely browsed. Project removal and session take-over landed with it (#5365).

• The Desktop take-over dead end is gone — the GUI conducts the sign-in, and no longer demands one to evict nobody (#5378).

• The composer stops showing macOS keys on Linux, anchors attachments in the text, gives the caret somewhere to go, and lets selection mode scroll (#5410).

• ACE could not find Claude Code when FlowForge.app was opened from the Dock — a launchd PATH, plus the tmux server that froze it (#5377).

A customer's Jira reaches the board

• The field mapping takes effect on the read path (J-6). A customer could bind "Start date" to their own custom field and the Gantt still drew nothing, because the fetch never consulted the mapping. It does now (#5338).
• Assignment works against a Jira source — accountId exact-match, refuse-with-candidates, never a guess (#5321).

The workspace you are in is the one every screen shows

• The Project Switcher opens on the project you are in. Its cursor parked on the first row, so Esc then Enter silently re-exec'd you into a different project (#5344).
• A Team workspace never renders "Personal", and the bar moves the moment the switch does (#5334).
• Buckets, the War Room band and the e screen are scoped to the active workspace (#5333).
• Per-project access control — see · edit · admin is designed and authored (ADR-0127 + ff-0066); it is not yet applied (#5337).
• The initiative tier stopped going dark — the milestone read stopped at 30 and everything above it vanished (#5387).
• o opens an initiative's descendant docs, instead of reporting that a row with documents has none (#5335).
• Buckets moves u → Z, help-visible and reachable from Workers, and the help screen gains a search box (#5336).
• The Gantt bar is a clean rectangle again, and Kanban cards grow with the window (#5386).

Measured speed

• The tickets pull costs 2.13 round-trips per row instead of 13.55 — 6.4×, measured (#5225).
• 20,000 can_read_project calls become 15. The tenancy predicate ran once per row inside the row-level-security policy; it is hoisted out of the row path (#5190).

Security

• The anonymous key could write into tickets.project. Five bypassrls definers and two born-open vectors, closed (#5370).

The review and merge pipeline stops reporting what it cannot see

• The cohort composed an ALL-CLEAR it never posted — and the cut's own gate scrapes the pull request for exactly that comment. Producer and consumer never met, so no re-run could satisfy it. This forced an override on the last release; it is fixed (#5345).
• A hung review was invisible for its whole timeout. The ledger says so now, before the wall does (#5390).
• A superseded review cancels itself instead of leaving its predecessor watching its own subject (#5379).
• Every merge-path gate declares fail-open or fail-closed, and "could not evaluate" is no longer reported as "permitted" (#5402).
• The merge modal's red screen puts its own text on the ACE rails, and drops the six-lane review from that path (#5429).
• A parked worker raises "needs you" structurally, and parked is told apart from gone (#5364).
• The rail renders a turn in order — narrator lines written before the tool calls no longer land after the conclusion (#5389).
• An output style applies to the ACE session already running, and the rail shows which style is active (#5403).
• The delivery mix is classified from the ticket kind, a documentation kind exists, and every kind has a bucket (#5404).
• Headroom stops reading LOW on an idle machine — a one-hour burst was being projected across 5.5 days (#5361).

Guards that were not guarding

• The ADR guard was not weak — it was switched off, on both gates and every branch (#5356).
• Load-bearing artifacts that never entered ticket → PR → merge are now detected (#5355).
• The hermetic-HOME fixture no longer swallows the Go module cache, its cleanup is honest, and doctor gains an inode-aware row (#5405).
• A banner on stdout can no longer break FlowForge at its own exec seam (#5406).
• Migration-ledger divergence fails loudly, and the obsolete never-push reason is corrected (#5367).

Measured, and stated plainly

• The production read plane is measured — the ledger half is settled, the live half is blocked on a database credential and says so (#5332).
• The Edge Functions are live; their deploy path is not. Measured and stated rather than assumed (#5331).
• Three months of Claude Code releases read against FlowForge — what to improve, what we reinvented, what we are not using (#5413).
• The console ⇄ FlowForge seam documentation bundle lands with its ADR ratified (#5140).