v1.2.27

More work in flight, and a cockpit that tells you only what needs you. 323 pull requests merged in ten days, and this section covers all of them. Waves stop being one at a time — you choose how many run side by side, queue the rest, give an entry a start time, and the queue keeps moving with no cockpit open. ACE reads one recap of the whole fleet, and the actors behind it now deliver a review's findings and nudge a quiet worker by themselves. The Fleet screen and the Workers queue are rebuilt on one shared reading of every worker, with a legend for every symbol. The War Room's board tells the truth again and reads only what you ask for. Eight new specialists join the roster (44 → 52), and the first opt-in pack ships. Windows is supported through WSL2, the sign-in gets you in, and two weeks of one customer's field report are fixed, finding by finding. This is also the release we first built as v1.2.26 — that build's Linux desktop AppImage job died on a SIGPIPE in the release workflow, so it was tagged but never promoted; no tester has it. The fix below ships Linux and Windows staged, which is why this is v1.2.27, not a v1.2.26 promote. What needs one step from you, and what is not done yet, are stated plainly at the end.

Waves: several at a time, and a queue for the rest

• 🔴 Run more than one wave at once. You set a width N, and the queue keeps N waves live; the next one starts the moment one lands. A doctor row names any ticket two runs both hold (#7244). Slots are shared fairly: starved runs are served first, each wave can carry its own maximum and weight, and a reserved floor is enforced at the gate that admits a worker. Two runs that would plan the same ticket are refused (#7137).
• The queue of waves. Queued sprints wait in a durable, per-repository queue with barriers, a park policy and a breaker (#7042). Manage it from the CLI (flowforge waves queue show|add|rm|mv|barrier|width|start|hold, waves resume|skip|abandon) or the waves_queue MCP tool. Every refusal happens when you compose the entry, never later (#7059). The queue reads the machine's own ledgers too: the shared GitHub budget, a usage pause and the start verb's refusal codes (#7084).
• A queue is a schedule as well. An entry can carry a start day and time, and you can move one to the front or to the back (#7109). The Waves board edits the queue in place: width, start time, and "third to first" in one key (#7123). A paved plan can wait in the queue too. Its begin date is answered when you add it, and it fires through plans fire when its turn comes (#7071).
• 🔴 The queue keeps moving with no cockpit open. The cockpit steps the queue on its 1 Hz beat (#7064). When no cockpit is driving, the FlowForge daemon steps every draining queue through the same verb and the same create_worker door. A cockpit that opens takes the run back by its lease, so two drivers never fire one run. A queue whose next entry is scheduled for tomorrow reads nothing from GitHub until then (#7260). Every worker spawn brings the daemon up if it is not running, unless you set FLOWFORGE_DAEMON_AUTOSPAWN=0 (#6952).
• 🔴 A ticket starts when its own dependencies land. Inside a wave, a ticket used to wait for the whole previous layer to finish. Now it starts as soon as every ticket it depends on has merged and a slot is free. A plan with no recorded edges keeps the old barrier, byte for byte (#7335). From a customer's field report.
• The Waves board. It shows the live runs and the queued entries side by side, a driver and host line, a trouble banner, and five widths (#7102). It has a focus ring, drill-in, verbs that name their target, and a latch on destructive keys (#7121). One hue means one run everywhere it appears (#7118). Each run gets its own record: an id, its scope, a driver, a typed outcome (#6957), and storage of its own, so stop and pause act on one run only (#7125).
• Wave history. Every run that ended is kept with its sprint, start, end and outcome until you clear it (#6964).
• Arm a wave without the board. flowforge waves start --sprint, the waves_start MCP tool and S all go through one verb. It layers the sprint's own tickets and refuses with named reasons (#7012). loop autofire's sprint mode passes the same refusals before it takes a lease (#7124).
• A wave is ≈1, never W0. Waves count from 1 and read ≈N on the widget, the Fleet chip, the board, the Waves screen and in ACE's words. W is for workers only (#7063).
• Smaller wave fixes. Every row shows its ticket's title, or loading…, never a blank (#6894). Waves returns to the screen that opened it, and b / t open the same sprint's Kanban and Gantt (#6715). The fire modals and the waves strip count every worker on the machine, not just this project's (#7062). An epic is a container, not work: it is never put in a wave or spawned (#7107). The wave board and depends-audit read the same full roster (#6510).

ACE that acts

• 🔴 One recap of the whole fleet. The recap is one snapshot of the fleet, where every reading is either known or explicitly UNKNOWN (#6979). The daemon serves it at /v1/recap, and flowforge recap reads it (#7003). It appears as an escalation in ACE's rail, composed at the rail's width (#7010). Before ACE ends a turn, a Stop-hook gate makes sure it has read the latest recap (#7029, #7041, #7056). In production every reader that has a source is wired in (#7055), and the loop was closed and re-measured end to end (#7087).
• 🔴 The actor table — five remedies, each with a stage it has earned. The actors run in the daemon's actor host: one per home and account (#6827), supervised so that a panic costs one pass and never the daemon (#7023). Each remedy has its own trust stage, and it is promoted only on its record (#6951):
  • relay-verdict delivers a review's findings into the warm worker that owns the pull request. It acts today (#6968, #6953).
  • nudge-worker sends one "continue" per quiet spell. It names any refusal or NOT-GOLDEN, and after a usage limit it waits for the reset. It acts today.
  • order-rebase orders a rebase when a pull request turns conflicting (#6959, #7057). It runs in shadow: it records what it would have done and acts on nothing.
  • dispatch-review starts a review that is owed (#6984). It also runs in shadow.
  • reap-vanished reaps a worker whose window is gone while no cockpit runs (#7037). It records only, and it never kills anything.
  • Each row on the stuck-work board says what actually happened, read from a record: ACTED, ESCALATED, WAIVED or FAIL (#7004).
• Escalations reach ACE first. There is one ledger with four classes. A fork goes only through a gate a plan designed. A merge gate is scoped to its pull request and head. Failures and questions go to ACE first, and only a founder-class decision pages you (#6913). ACE-first escalations ride ACE's wake (#7035) and reach a headless ACE too (#7049). Below the escalation bar, the stall actor still tells ACE (#7060). A condition no remedy will act on owes ACE one notice per head that names why and the next move (#7073). Automation failures no longer have a silent route (#6949), and a red lane names the failing check and tests (#6996).
• The wake. A durable outbox and a drainer on the stream lane wake ACE when something needs it. Its composer fallback is guarded and never one-shot (#7030). A send queued behind a live turn is held, not counted as delivered (#7036). The worker-done relay to ACE re-arms after a refusal (#7093).
• A worker that needs you says why. A worker's permission prompt becomes a deferred needs-you row (#6998). claude agents --json is a second source for those rows (#6990). A /goal that never armed escalates (#7005). A goal the harness gave up on reads GOAL LOST, never a quiet park (#7000), and the /goal line fits under Claude Code's paste-collapse limit, so it arms again (#7002).
• Relays ride Claude Code's own inbox. A message to a worker is a framed message with a typed outcome, with paste kept as the fallback (#7006). It dials only the current user's sockets (#7009). A relay that lands in a worker's queue is delivered by FlowForge, not by you (#6531).

The Fleet screen and the Workers queue

• 🔴 One reading of every worker, shared by both screens. A typed projection of every work item (#6907) and of every wave (#7096) is built once and handed to both screens on the same tick. The Workers queue reads it (#7106), and ten per-field setters retire. The ticket's title, milestone, labels and kind are read in one batch (#7103), and the ticket key is read the way it was written (#7100).
• The Fleet screen. The roster is now the sessions: every live session is a lane, and a stale worker is a lane for the first time. If the daemon is down, a banner says so and no lane vanishes (#7305). The vitals strip fits one row and has a fault banner (#7310). Selecting a lane opens its detail and a peek without taking a table key (#7301). The detail modal shows each lane's conditions and fits a short terminal (#7296).
• The Workers queue. Every row tells you what the worker is doing. It shows how long it has been quiet, from the stall ledger or the pane (#7098), how many review rounds its pull request has had (#7104), and which wave it belongs to (#6898). Its title reads at 120 columns (#7111). Rows group under five groups, each with a header row (#7140, #7285), and both rows carry the same attention reading (#7132). The branch base is recorded when a worker spawns (#7101).
• Every symbol, explained. Decoder rows and legends cover every glyph, each one drawn with its colour and its label (#7145, #6909). Help has a Symbols block for the Workers and the Fleet, generated from the renderers' own tables (#7320). The keys, hints and help were reworked across both screens: k walks the focused queue, the bar and the footer name only live verbs, and ? on the Fleet shows the Fleet's own keys (#7313).
• The columns line up. Every glyph is drawn in its own cell, and a property test holds each column to one x position in the Fleet and help renders (#7322). Every screen was re-rendered from code in both themes for acceptance (#7318).
• One worker cap and one GitHub budget per machine. Every door that spawns a worker passes one host-wide slot gate (#6915). A Settings dial writes the cap, and the cockpit has a host line (#6973). A dead worker's slot is freed (#7034). Every FlowForge process on the machine shares one GitHub budget (#6902). The GraphQL part of it is measured, ledgered and reserved for the merge gates, and the status line and the autofire lane stop polling what has not changed (#7275).

The War Room

• 🔴 The board tells the truth, and r corrects it. Cards no longer vanish from a sprint board when another read lands. The lane board counts and draws one list, says when it is stale, and r re-reads it. A ticket with an open pull request sits in Review, not To-do, because a pull request now joins its ticket by branch. A merged-but-open ticket shows in Review with a badge, and START and DUE read in your own time (#7293). From a customer's field report.
• The War Room reads what you ask for. Reload whenever you want. Read one sprint, one milestone, the standalone tickets, or everything updated since a date, each answered by the provider's own query (#7196). A read row under the title says what the board asked for. R opens the read picker, r reloads in every state, and your choice is remembered per project (#7284).
• Schedules and containers that add up. Behind and ahead follow one rule: undated work inherits the sprint end, epics never count, the header equals the rows, and work that finished early finally shows as ahead (#6545). A sprint can be detached from its initiative (#6555). A closed initiative reopens when a live sprint is attached (#6551). However old the "Plans ready to fire" shelf is, it shows as one named row (#6696). container-sweep names every epic it considered, including one held open by an open child (#6869).
• A clock you read is your own clock. The War Room, Release Letters and every cockpit clock render in your own time (#6549).

Merges and reviews you can trust

• A verdict binds the head and the base. A retarget earns a fresh review without a byte-changing commit (#6475). A retarget also re-arms review, the merge gate ignores CI runs from the old base, and worker park refuses a pull request off the lane (#7302).
• A merge never lands under a worker that is still working. It holds while the worker has uncommitted changes, unpushed commits or a turn in flight, tells the worker once per head, and retries on the next pass (#7011).
• Conflicts are ordered once. A merge refused as a conflict at a head is tried once, ordered once, and re-armed only by a push (#7295). One shared conflict-order round per pull request, head and base (#7091).
• One decision per round. A gate's refusal on the code is posted as one refusal notice, never banked as a verdict (#6687). The review-of-record says who judged a head, and a refused GOLDEN is not reported as a dead crew (#6597). An unreadable ledger is said on the merge row, never shown as "no ask" (#6969). A founder gate cleared after a NOT-GOLDEN can re-bind the head (#6963).
• Reviews start through one door. The review crews launch through one door, with measured turn and budget ceilings and SIGINT before any kill (#6992). A worker's durable park on any branch marks review as owed (#6911). Dispatch budgets split judged, died and refused, every lane honours a host-wide usage pause, and the merge verb spends nothing (#6965).
• Closing is exact. A default-branch pull request closes only the tickets it declares (#6480). Two projects stop sharing one verify record and lock per pull-request number (#6906). A founder's post-merge step is a durable record, shown as an absolute command (#6658).

A customer's field report, fixed finding by finding

One customer ran FlowForge on a real project for two weeks and reported what broke, with incident counts. Every finding below was worked on its own ticket.

• 🔴 A dead worker is found, its work is saved, and it is respawned. A worker killed by an out-of-memory error or a reboot, or a Claude session that died inside a live tmux, was never detected. The cockpit now finds it. It saves the uncommitted work to a rescue/<ticket>-<time> branch, a patch and a tarball, then respawns the worker with a brief that names the rescue. A worker that keeps dying is held for a person (#7286).
• 🔴 Workers start on the sprint's base. Worktrees ignored the sprint's declared umbrella branch. They are now cut from it, and create_worker can name a base (#7281).
• 🔴 A NOT-GOLDEN about the pull request body alone can be re-graded at the same head once the body changes. The worker no longer parks forever (#7279).
• 🔴 flowforge merge closes the ticket its pull request owns. A failed close is queued and retried (#7287).
• A fresh GOLDEN merges on the verdict. It used to wait out a GitHub-error back-off that belonged to a different call (#7328).
• A review is logged as spawned only once its round is open (#7336).
• Generated files carry no per-file line cap. A header marker, linguist-generated, or a configured glob exempts them (#7331).
• Every worker brief carries your project's standing rules from .flowforge/worker-brief.md, for example a memory limit for your test runner (#7327).
• A respawned worker is not a stopped worker. The relay re-reads tmux before it refuses, and a respawn from any door revives the worker's row (#7330).
• Your own Claude Code statusLine stays yours. FlowForge claims the slot only when it is empty or already FlowForge's, and says so once (#7334).
• A promotion or sync pull request always takes a merge commit, never a squash (#7329).
• blueprint amend writes one file per amendment, so sibling pull requests merge cleanly (#7332).
• A worker whose turn died on an API error before its first pull request gets one retry nudge, then ACE is told (#7333).
• A message you send never paints outside ACE's rail. Carriage returns and tabs in a pasted message are normalised before the wrap, and every row is clamped to the rail (#7338).
• Re-emitting an amended plan creates only the new units, not duplicates of every ticket (#7337). plans fire is safe to re-run after an interruption (#7256).
• The War Room's board truth and per-ticket readiness in a wave came from the same report; both are above (#7293, #7335).
• From the first week of the same report: a merged pull request closes only the tickets it declares (#6480). The wave board and depends-audit read one roster (#6510). A ticket your lane already touched dispatches, with the evidence in its brief (#6487). create_worker reports spawned only after it sees the session (#6481). flowforge review cleared <pr> asks about that pull request's own head (#6478). The git and GitHub write guards judge each executed command on its own arguments, not the whole line (#6485). A ticket new --live refusal names the missing line first (#6484). A rendered document never silently loses its body (#6482).

Sign in, and get in

• 🔴 The sign-in screen takes the whole screen. It used to draw under a wall of launch diagnostics. Now it owns the alternate screen, and every diagnostic is still in your scrollback (#6506).
• 🔴 The password field takes input. Validation gates the submit, never the move between fields (#6509).
• 🔴 The desktop sign-in always ends, with a value, an error or a timeout, never a spinner that turns forever (#6508).
• A sign-in click is not a takeover. Signing in on your own Mac no longer evicts you (#6535).
• Sign in to Claude Code without a terminal. A menu signs you in for the first time or switches accounts (#6548).

FlowForge Desktop, and Windows through WSL2

• 🔴 Windows, through WSL2. A WSL install prepares the Windows side by itself: the graphics check first, then the launchers, then a summary of what it skipped (#6524). flowforge desktop shortcut --windows puts Desktop and Start Menu launchers in place through WSLg, and removes them again (#6523). The app has a multi-size Windows icon (#6514), and there is an install guide (#6515). This is Windows through WSL2, not native Windows (#6520).
• 🔴 The Linux desktop AppImage ships again. flowforge version | head -1 under set -o pipefail sent SIGPIPE to the binary the moment head closed its pipe after one line, so the Linux AppImage build died and left Linux and Windows-through-WSL2 unstaged. Every … | head under pipefail in .github/workflows/*.yml is now SIGPIPE-safe (#7411).
• The desktop app says what is missing on a clean Linux or WSL host instead of aborting with a stack trace, and flowforge doctor gains a desktop-gl row (#6507). The app's environment reaches the cockpit it opens, and a document that will not open says why (#6511). The packagers refuse to bundle a flowforge with an empty or stale embed (#6976).
• The preview becomes a reader. Find in the document with ⌘F, with every match painted and "3 of 12" (#7131). Zoom to one remembered reading size (#6895), and ⌘+ ⌘− ⌘0 and Esc work wherever focus sits (#6904). Return to where you were, and read "On this page" (#7128). The Documents drawer shows a title on every row and can be widened (#7127). A split always leaves the document room to read (#7114). Every chord is written down (#7139).
• Ratify on the page. The gate band ratifies the document on screen, at the revision you are reading, with an undo window (#7119). "Not yet" opens the document's own ACE with the composer prefilled, and the document stays in view (#7122, #7120). flowforge doc status answers whether a ratification waits on these bytes (#7113), and doc ratify --json is the machine surface (#7112).
• The page fits the pane. The page fills the pane (#6897), the chrome is one band that folds (#6905), a document's own THEME button flips only that document (#6892), and the preview names each document's project (#6865).

Agents, routing and the rights lane

• One source for the roster. agents/manifest.yaml is the only source of the agent roster. Every count, menu and routing skill is generated from it (#6617, #6620, #6826). A routing door and a detector grade every dispatch (#6621), and agents and skills get their own CI gate (#6619). The design chain can nest four agents deep (#6997).
• The rights lane. An agent reaches a live database only through flowforge db, under a grant you issue with flowforge grant, and every grant lands in an append-only ledger (#6630). Raw database clients are routed to that door by a real shell parser (#6628, #6697, #6694). Release, platform and marketing work get the same treatment (#6629, #6627, #6625), and every agent definition carries an ## Authorisation block (#6948). Every auto-mode denial lands in a ledger the cockpit reads (#6607).
• Existing specialists, re-cut. fft-devops-agent is re-founded as the platform operator (#6680). fft-content-strategist and fft-social-media are re-cut, and the paid-media pair operates every tracking rung (#6681). fft-medical stops shipping five wrong healthcare-billing facts (#6954).

The first optional pack: recebimento-médico

• flowforge agents install recebimento-medico adds two Brazilian medical-revenue specialists: fft-faturista (glosa, recurso, prazos, pricing; citation-first) (#6967) and fft-tiss-xml (the TISS exchange format: XSD validation, versions, portals) (#6970). The pack ships inside every release binary (#6972). It installs only on request, survives install --global, and the doctor counts it (#6978, #6981, #6982). Its PT-BR quotations are checked against their sources (#6975). /agents lists optional packs separately, so the core count never moves (#6962).

Fewer prompts, steadier service

• Customer workers run FlowForge's own gated plan and ticket verbs with no permission prompt (#7141).
• macOS stops asking whether FlowForge may access data from other apps. Claude Code's helpers now start in FlowForge's own folder, not in / (#6893).
• Licensing errors say what they are. A server error reads as a server error, not "check your connection" (#7078). The routine 29-a-day licensing grace no longer alarms you (#6528). The service behind it got its heaviest job bounded and its heartbeat made constant-time (#7086, #7099, #7094, #7291, #7290).
• Ctrl-O is the escape hatch again: Claude Code on ACE's own session, with one controller (#7259).
• A reap no longer kills a healthy cockpit (#6657). The update sweep stops only a provably abandoned cockpit server, and names it (#6464).
• Token costs are priced for the models in use (#6543).

Plans, releases and the record

• Plans are named for what they deliver. One naming rule is enforced at lint, fire and land, and there is a safe rename (#6896). ADR numbers go through one server-verified door (#6903).
• flowforge backfill-dates --across derives several sprints as one schedule (#6483).
• Releases finish. A cut that merged and then died resumes at the main-CI gate (#6473). The cut records its lane in every layer that carries it (#6477). release-ci --check honours the lane policy (#7026).
• The 2026-10-01 live-ledger re-measure is recorded — 39 vs. 79, 40 apart — owning the reconciliation #6332 left open (#7410).
• The doctor speaks one vocabulary. Every row uses six verdict marks with a hint on each non-pass (#6679, #6960). A cc-release-watch row tracks Claude Code releases (#6986).
• The header clocks are back. The session clock is in the right corner, and the context clock centres on the header (#6486).

Colado

Colado is a jiu-jitsu term — a position is colado when it's justo, perfectly adjusted, no gaps, full pressure — and it's the name for the family of FlowForge gates that leave no space between the rule and the work. This release closes these gaps:

• A merge can no longer land under a worker that is still editing its head (#7011).
• Two drivers can no longer fire one wave run: the lease decides, and the daemon checks it before every spawn (#7260).
• An epic can no longer be spawned as work (#7107).
• A merged pull request can no longer close a ticket it did not declare (#6480, #7287).
• A verdict can no longer be spent on a branch it never judged (#6475, #7302).
• A spawn can no longer report a worker that does not exist (#6481).

Studies and plans

Nothing below is built or shipped. Each one is listed only as what it is.

• Team Tier 1.0: the study, FlowForge-native parity with GitHub and Jira, the console scope and the emitted plans. No Team feature ships in this release (#7115, #7130, #7138, #7245).
• ADR-0141, the FlowForge session model, which the sign-in fixes are built against (#6505). The pipeline delivers, not only detects, the decision record behind the actor table (#6622).
• The preview study (#6744), the briefing module (#6695), ForgePlays on web screens (#6950), the FlowForge agent study (#6916), Idea to Investor and Brand Identity Creation (#6745), and the launch plan (#7283).

Agents — 44 → 52: the legal org, the release operator, the database pair, the marketing head, DevRel and product marketing

• Added fft-legal-architect — the legal head: asks before it drafts, decides which law and which contracts a deal needs, grades every issue, reconciles Brazil↔US.
• Added fft-legal-br — Brazilian software law: contracts, licenses, terms and privacy under LGPD, Marco Civil, CDC and the Lei do Software; INPI trademarks and software registration.
• Added fft-legal-us — US software law: contracts, licenses, terms and privacy under CCPA/CPRA, COPPA, CAN-SPAM and FTC §5; USPTO, Copyright Office, DMCA, DTSA.
• Added fft-release-engineer — the release operator: runs a release from a ready lane to customers having it — notes, letter pack, the cut up to your consent, tag, staging, verification by name, rehearsal, install parity. The consent and the promote stay yours (#6682).
• Renamed fft-database → fft-database-architect — the data-model head, now design only: the store, the ERD, who may read and write each table, and the migration plan with its way back. It has no shell and never opens a connection (#6683).
• Added fft-dba — the only agent that may touch a live database, and only through flowforge db: it rehearses every migration on a disposable copy, reads production read-only, applies a change only under your grant, and reports what it did (#6683).
• Added fft-marketing-architect — the marketing head: decides what your company says, to whom, in what order and through which lanes, and writes one launch brief every marketing lane plans against. It drafts; it never publishes or spends. Paid media keeps its own head for every campaign decision (#6688).
• Added fft-devrel — developer relations under the marketing head: which technical stories to tell on Hacker News, Reddit, Product Hunt and Discord, and with what proof; creator research with personal drafts for you to send. It never asks for votes, never hides who it works for and never posts as a real person. It drafts; a person posts (#6690).
• Added fft-product-marketer — product marketing: keeps the list of what your company may say, each claim with its evidence, re-checked on every release, and builds battlecards, the kit for a deal, case studies and each release's announcement from it. It never decides a price or names a competitor in anything a buyer reads. It drafts; it never publishes (#6691).
• The legal org is #6458. The customer-success, paid-media and data-analytics teams were already on the roster before this release and are unchanged in count.

One setup step

• Quit and relaunch every open cockpit after you update, so the new Fleet, Workers queue, Waves board and sign-in are the ones running.
• On Linux or WSL, install the GLES runtime if the desktop app refuses to start. That is libgles2 on Debian/Ubuntu, libglvnd-gles on Fedora/RHEL and libglvnd on Arch. flowforge doctor's desktop-gl row names it before the app does (#6507).
• Optional: put your project's standing rules for workers in .flowforge/worker-brief.md (#7327), and install the medical-revenue pack with flowforge agents install recebimento-medico if you need it (#6978).

Not yet

• Two of the five remedies only watch. order-rebase and dispatch-review run in shadow, and reap-vanished only records. They will act only once their records earn it, and until then a conflicting pull request or an owed review still needs ACE or you (#6959, #6984, #7037).
• A long single line pasted into ACE (#6504) was never reproduced. A related fault was found and fixed: a pasted message with line breaks painted over the Workers pane (#7338). If you still see a single-line overflow, a screenshot, and which app it was taken in, settles it.
• The GLES fix was not confirmed in a clean container. The probe ships as a script anyone with a container runtime can run in about a minute (#6507).
• One page-drain hole remains, pinned by a test. A full GitHub page whose every row is a pull request still ends the read (#6510).
• Team Tier is studies and plans only in this release (#7115).

Update

• flowforge update on an existing install, or curl -fsSL https://get.flowforgesoft.com/install.sh | sh for a fresh one. Both write the same release binary to /usr/local/bin and ~/.flowforge/bin together. flowforge update --repair re-lays the installed assets without the network. Then quit and relaunch every open cockpit.