lotus-build.sh merged the latest upstream tag, then built, copied to the web root, reloaded nginx and only then pushed — the one path that could change production without any CI gate (cinny#98). It now merges, runs the same local gates CI runs (npm ci, typecheck, eslint, prettier, tests), and pushes; the push triggers Gitea CI and lotus_deploy.sh deploys once "Build & Quality Checks" is green, like every other lotus commit. A failed gate leaves the merge local for inspection and notifies the room. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA