v1.2.9

The honesty patch. Every terminal state a worker row can show is now proof-gated: "merged" requires a real merge, "closed" requires a real close, and a parked worker can no longer be silently killed and stamped with an ending that never happened. Plus: a crash now always leaves an artifact, the ACE context gauge holds one baseline truth across Refresh, and the Jira-facing sync verb goes runnable.

Worker-row truth — no terminal state without proof (#4676, #4688, #4694)

• The 2h in-review timeout no longer destroys a parked warm worker: the reap edge is severed, so a lane in review survives long reviews instead of being killed and tagged "PR merged" with no merge (#4676 F1).
• DONE · merged is proof-gated end to end — every surface that can render a merge claim (row sub-line, retire marker, archive, breadcrumbs) requires real merge evidence (mergedAt / a MERGED closing ref), never a close reason, a PR number, or set membership (F2 + rounds R3–R5).
• A hand-closed ticket (not_planned or plain gh issue close) retires honestly as "closed", never as "merged" — the disposition now travels to the reconciler instead of being flattened away.
• New REMEDIATING axis: a worker actively fixing review findings renders as remediating, not a frozen "in review" (#4688, partial — the crew-live rung follows in F8/#4699).
• Vanished sessions with open PRs surface for respawn instead of being auto-retired; the archive gate excludes live lanes; retire markers carry honest bodies with breadcrumbs.

Reliability — a crash always leaves an artifact (#4689, #4693)

• Crash-artifact-by-construction: a runtime crash writes a crash file and an exit ledger entry before the process dies; goroutines are guarded, signals recorded — the cockpit can no longer die 5×/session with nothing to autopsy.

ACE context gauge — one baseline truth (#4663, #4665)

• The durable context baseline pin is gated on the refresh epoch: a stale pre-Refresh reading can never poison the gauge permanently again; the pinned start cost self-heals monotone-down; fill, marks and readout share one clamped baseline; a placeholder <synthetic> model can never steal the denominator.

Provider — Jira-lane sync runnable (#4429, #4667)

• s sync-now is wired to the reconcile engine for the active project — the T4 verb of the Jira onboarding path is runnable end to end.

Pipeline

• reviewlease liveness re-pointed onto the shared proclive probe — one liveness truth for review crews (#4628, #4702).