v1.2.7

The waves-seal release. The wave surface stops guessing and starts telling the truth: one read model feeds every wave widget, a stale engine can no longer paint dead numbers over a live run, the ratified centered pill is back, and the whole active surface is finally pinned by goldens at four breakpoints. Alongside it, a run of trust seals found by running FlowForge on FlowForge — work can no longer die silently in a worktree, a release lane in one project can no longer refuse another project's workers, and the merge chokepoint now actually honors the freeze wall it advertised.

Waves — one truth, honestly rendered

• WaveView becomes the single wave-truth read model: engine identity is a first-class field, every surface reads one cached snapshot per reconcile tick, and a stale-resumed loop-4 run is demoted instead of painting dead numbers over a live wave (#4618).
• Autorun chips carry the real engine label, and estimates relabel, suppress, or evict honestly instead of asserting a number they cannot support; the durable loop now heartbeats its own lease so a live run never reads "stale" (#4619).
• The ratified centered wave pill returns, rendered from WaveView, with a measured-fit ladder that keeps each state's self-labeling word and glyph down to the narrowest terminal — and an honest "computing…" placeholder instead of fabricated zeros before a run joins (#4622).
• The strip-region composer owns the body-top budget with a single reservation, and every wave surface is width-clamped (#4620, #4621).
• Sprint-lease liveness lands so an orphaned lease can never masquerade as an armed engine (#4617).
• The active wave surface is pinned by goldens and visual-QA artifacts at 40/60/80/120 (#4623).

Trust seals — work cannot vanish, lanes cannot cross

• No loose ends: the retire gate refuses to reap a worker whose worktree holds uncommitted or unpushed work and pages NEEDS-YOU naming the stranded paths; a new flowforge worktrees doctor classifies every worktree (clean / junk-only / real work / unpushed / stale) with a guided, confirm-gated rescue flow that pushes and archives before anything is removed; the cockpit surfaces loose ends when they exist and stays silent when they don't. A shared, network-free classifier backs all three (#4649).
• Per-project release lanes: the active staging lane is recorded per project, so FlowForge's own lane can no longer leak into another registered project and refuse every worker spawn there (#4642).
• Registration validation: a bad repo registration is refused at write time and diagnosed by the doctor, instead of silently producing an empty board and hanging provider calls (#4638).
• Merge-freeze wall: the merge chokepoint is routed through the freeze wall it already advertised, so an engaged park is a lock rather than a suggestion (#4639).
• Capped batch spawns queue and drain through the one spawn chokepoint instead of silently dropping the remainder (#4645).
• The emit guard learns the second ticket-creation door, so flowforge ticket new --live is classified like any other create (#4644).

Voice

• The talk chord's second press now ends the turn and sends what you said, transcribing and submitting through the same path as the automatic end; Esc during capture becomes the guaranteed discard hatch. Stopping no longer means losing the message (#4647).

Providers

• Switching providers invalidates the (project, provider) sync cursors and re-checks field maps, so a switch can never resume from the previous provider's watermark (#4428).

Docs & accessibility

• Manual pages advertise a dark theme so code blocks keep their dark syntax palette under a light OS scheme, restoring WCAG AA contrast (#4646).
• A study of the ACE attach/return path documents what ships today, what the process topology actually permits, and one ratifiable recommendation (#4666).