v1.2.6

The drain cut. One day after v1.2.5 sealed the reviewer's leases, this release makes the whole pipeline self-driving and honest end-to-end: Auto-merge ON now means merged no matter which process ran the verdict (a state-coupled reconciler over merge-readiness facts), flowforge loop autofire --drain empties a board without waves or spawns, and every dispatch is rate-limit-aware — an exhausted GitHub quota HOLDs with a resume time instead of silently killing crews. The voice stack gains the guaranteed ⌃⌃/^L escape hatch born on the Volan stage, the War Room gains the full epic lifecycle and multi-select batch-assign, the cockpit stops leaking one project's agents into another, and the founder-ratified waves seal lands its first four lanes.

Pipeline honesty (the drain engine)

• Auto-merge ON is state-coupled truth: any vehicle-provenanced GOLDEN at head on a green mergeable PR merges within one poll, regardless of verdict origin; OFF surfaces the ask universally (#4613).
• flowforge loop autofire --drain — drive every existing worker-done PR to merge truth: never spawns, never advances, honest completion summary (#4613).
• Rate-limit-aware dispatch: quota checked before every crew; exhaustion HOLDs with "resuming at HH:MM", plus per-PR exponential backoff — the retry-burn class is dead (#4613).
• The autorun chip renders the real engine state: off / armed-idle / draining / driving (#4613).

Voice (the Volan-stage fix)

• Guaranteed escape hatch: during ANY live capture — hands-free included — ⌃⌃ and ^L hard-stop listening instantly: no zombie mic, nothing auto-submits, discoverable in the live presence tokens (#4598).
• Honest VAD ceiling: a noisy-room capture that can't classify silence ends at the documented max-utterance ceiling with an honest reason — never an endless listen (#4598).

War Room

• Epic lifecycle: create epics from the board, attach/detach sprints and milestones, the Epicless bucket, all through the provider seam with umbrella-parity Epic: #N linkage (#4595).
• Multi-select that works and says so: x/X selection + A batch-assign verified live and named on the legend (#4594).
• Docs presence + o verified against live data — third strike closed with the resolver fixed at the data layer (#4596).

Cockpit honesty

• Background-agents band scoped to YOUR project: leases carry repo identity; another project's crews never render in your cockpit; legacy leases fail closed on attribution (#4616).
• Band count arithmetic from one truth: title == rendered + hidden in every state, including scrolled-empty; "+N more" only when N are actually hidden (#4608).
• The ACE model chip survives working turns: alive ⇒ chip, structurally — the composer cannot omit it mid-turn (#4601).

Waves seal (ratified sprint, first four lanes)

• WS-1 sprint-lease liveness + mid-session reaper — "armed" can never outlive a dead engine (#4617).
• WS-4 strip-region composer — one owner for the body-top: stacking order, bodyH/3 ceiling, yield ladder, respiro row, single reservation incl. the mouse hit-test (#4620).
• WS-5 width-clamped wave rows + overflow fuzz gate — overlapping symbols structurally impossible (#4621).
• The full ratified plan bundle (diagnosis · architecture · design briefs · screen specs · dated DAG) ships in-tree (#4609).

Provider lane (iFood path)

• Jira begin-to-end hardening: config-carrying ResolveConfig (#4424), the t verify-gate — a remote provider only activates on green, race-proofed by a probe generation counter (#4425), and safe CHANGE — switch providers live without a restart (#4427).
• Roster sanitize + dedupe before any third-party roster is provisioned (#4557).

Guards

• stash-guard: mutating git stash refused in shared-worktree sessions with a teaching message + audited override — canon #3775 enforced by construction (#4600).