v1.2.5

The night the review pipeline stopped lying to itself. After a launch week in which PRs sat "in review" for hours behind the leases of dead crews — and the cockpit dutifully spawned a fresh reviewer every ten minutes on top of a live one — this cut seals the class: leases now carry holder-liveness and reap themselves, dispatch refuses to double-spawn, and crew width is governed with a visible queue. Riding with it: the company model's identity and sprint surfaces (CM-V5/V7), a data lane that never fabricates a number it doesn't know, and the lanes-only git-flow blueprint formally ratified with its cut contract sealed.

The reviewer-vehicle seal

• Review leases record their holder and self-reap when the crew is provably dead — a GOLDEN merge can never again defer on a corpse's lease, and the launch-night eight-lease pileup is now a passing regression test (#4586).
• Dispatch gains an admission guard: a live crew at head means no second vehicle — the ten-minute duplicate generator is structurally dead (#4586).
• Crew concurrency is governed at the observed-safe width with a visible queue, so wide review nights degrade to slower-but-completing instead of 15-minute timeout burns (#4586).

Company model (wave 2)

• CM-V5: the shared project-identity chip seam — every surface reads one {glyph, colour, label} mapping per project, CVD-safe, collision-proofed (owner-qualified labels; volan/ios and ifood/ios can never render the same chip), cached once in the canonical store (#4515).
• CM-V7: the cross-project sprint surface — a company-scoped sprint renders as one sprint gathering tickets from ≥2 projects, with a ⌂ scope marker, a project-coverage summary, and per-ticket project chips; per-project boards stay byte-identical. The user-facing entry affordance arrives with CM-V6 (#4517).

Honest data

• The provider status band tells the truth about the RESOLVED source: ● active only for the provider actually serving the cockpit, ▲ degraded names the real fallback — including under the env-override precedence path (#4430).
• Cloud export un-withholds canonical hours honestly: closed sessions export real corrected hours, open sessions an honest last-event-clamped estimate — never a fabricated zero (#4460).
• The closed-history GitHub puller backfills the full closed corpus with truncation-proof paging (PR-only pages can no longer silently end the walk), and the reconcile comparator annotates windowed GitHub reads instead of scoring them as drift (#4390).

Pipeline & cockpit

• The cut ceremony records the lane it opens exactly where worker spawns read it — the E1/E2 contract is one seam, and an absent record degrades honest instead of hard-blocking spawns (#4558).
• The ACE model chip re-seeds from the transcript on resume — a live session renders its model or an honest —, never a vanished chip (#4572).
• The lanes-only workflow blueprint (ADR-0112) is founder-ratified: every ticket rides a release/hotfix lane, nothing reaches main except a cut, main mirrors what customers run.