v1.2.2

The Never Alone hotfix release. A launch-blocker found live the day of this cut — a second or switched-to project silently ran with no ACE of its own — is fixed and headlines the release; everything else already in flight rides along with it. The ledger grows a full epic → milestone → umbrella → child hierarchy with honest rollups, waves gets its full lifecycle seal, desktop sign-in gains real degrade states and silent renewal, and the first multi-provider legs — Jira and Notion — land behind the same agnostic seam that now also carries the Gantt board, the Stats overlay, the Kanban board, and ticket labels off hardcoded GitHub calls. The ACE rail itself gets calmer and faster to write in, the desktop app's menu bar finally reads like a native Mac app, and the self-driving merge pipeline closes a run of small honesty gaps found running it for real.

Never Alone — every project gets its own ACE

• Opening or switching to a second project now arms its own live, independent headless ACE instead of silently inheriting an empty repo id and never re-arming — both projects' ACEs stay alive at once, and direct-launch is unchanged (#4439).

Ledger hierarchy

• The full epic → milestone → umbrella → child ladder renders with honest rollups, resolved through real ancestry — not string matching — mapped and planned before a line of code landed (#4315, #4333, #4331).
• N-level group folding gets an injective composite path, an honest total, and a guard against a stray rollup silently merging into the wrong group (#4330, #4357).
• The hierarchy is polished with sentinel rows, open-question gate wiring, and goldens pinned across four breakpoints (#4334).

Waves

• The full waves lifecycle is sealed — traced and design-reviewed end to end before the last pieces landed (#4298): the drain no longer strands cards on stale data (#4323), the cockpit's two progress bands unify onto one model (#4324), the wave band shows a subtle done-percentage instead of a binary green mark (#4325), a single learnable w shortcut stops a wave symmetrically (#4326), a stale wave retires mid-session instead of lingering past its run (#4327), and in-product help — widget copy, a control-screen header, and a manual section — finally explains what a wave is doing (#4328).

ACE rail

• The status strip gets its own state machine — no more a stale spinner or a missed wait-cue, and which model is answering is always in view (#4295).
• The composer gets real text-editor behavior: click to place the cursor, ctrl/cmd+arrow to jump by word or line, and a 24× fix for input lag on long drafts (#4302).
• A refresh (R) is sized for the real handoff — a receipt that lands late no longer leaves the rail looking stuck (#4363).
• The Worker Detail rail gets a real layout region underneath it — groundwork for a resizable, honestly-degrading pane instead of a fixed one (#4371).

Desktop app

• The menu bar is recomposed to match how a native Mac app is organized — File, About, Updates, and Support in the order macOS users expect (#4336).

Desktop sign-in

• In-app login gets honest degrade states while the session is renewing, offline, or expired, with an email pre-fill so re-entry doesn't start from scratch — designed end-to-end (ADR-0115) before it was built (#4316, #4339); a boot-gate silent-renew path and a headless auth refresh --json verb keep the session current whether the app is on-screen or not (#4335, #4337, #4338); end-to-end coverage pins the whole seam through a post-update relaunch (#4340).

Provider seam — Jira, Notion, and the rest of the agnostic surface

• The first real multi-provider legs ship: a Jira trial seeds itself straight from FlowForge's own tickets (#4403), Jira gets canonical-project provisioning (#4398) and its own sync leg scoped so a Jira hiccup can never wedge the GitHub side (#4397, #4426); a Notion → GitHub import path lands with honest field-mapping — no silent drops (#4391, #4392); a reconcile verb compares Supabase against GitHub for fidelity (#4387); and a sanctioned hybrid enable + tickets backfill path lets a customer turn on the database-backed side without anyone touching raw SQL (#4414).
• Ticket-system selection is now honest end to end: one active-provider setting that the picker writes and every read respects, replacing a dead second setting that could silently disagree with it — mapped and planned before the fix landed (#4300, #4423, #4431).
• A headless field-map command does the same de-para field mapping FlowForge itself uses to seed a trial, straight from the command line (#4399).
• More surfaces move off hardcoded GitHub calls onto the provider seam: the Gantt board's data face (#4283, #4282), the Stats overlay (#4284), the Kanban board (#4281), ticket label/type classification (#4272), and cross-provider release windows for Fleet (#4271, #4269).

Context, quality zones & views

• The context gauge stops drifting stale under load — a pinned start-cost baseline plus activity-aware staleness (#4294); model quality-zone thresholds are unified at 200k/400k across fable/opus/sonnet, with the dead haiku row dropped (#4347).
• Fleet's Done-band period ring grows from a handful of windows to six (adding last-week and last-month) with more room in Band 2 on a dense fleet (#4270); a release-axis mode lets Fleet step, filter, and cache by release the same way it already does by ticket (#4273).
• The Gantt board tells the truth about progress with done-truncated bars, an early-finish shadow, and dependency arrows (#4351); the ticket status glyph now leads the ticket number and the ledger's zebra striping is toggleable (#4350); global focus/navigation shortcuts (J / P / Ctrl+Shift+W / Ctrl+Shift+S) now work the same everywhere in the cockpit (#4297).

Self-driving pipeline & discipline

• A gate-carrying document can no longer land un-ratified — the ratification wall blocks the merge until the founder has actually ratified it (#4329).
• A merged PR always heals its worker to DONE even if the tracker briefly showed a stale ERRORED (#4385); a stuck reviewer-crew now times out and surfaces instead of hanging, and an orphaned-but-posted verdict reconciles instead of duplicating (#4349).
• The release cut itself now merges in an isolated worktree, so a dirty operator tree can never abort it (#4289); two new installed skills tighten how devops operations and ticket creation get run day to day (#4303, #4304).

Planning & groundwork

• Groundwork for what ships next: the rails-v2 worker-experience blueprint (#4382), the iFood 3-day launch plan (#4383), and a completeness study of the data → Supabase → console-dashboard pipeline (#4301) that scopes the following release's work.

Fixes

• The desktop preview pane: a PDF renders in its native viewer instead of a blanked sandbox (#4307), and a single-file preview never claims success over a blank result (#4306).
• The in-session "update available" banner re-checks periodically instead of only at launch (#4292); the Linux AppImage build pins its toolchain instead of riding a rolling tag (#4291); a vanishing line-cap waiver now self-heals from its own ledger, and the Waivers tab never shows a false "0 waivers" over a failed read (#4287); duplicate hook registrations collapse to one on install/repair (#4296).