loki-mode 11.12.1 → 11.15.0

package/autonomy/loki

@@ -1682,7 +1682,7 @@ PYEOF
 # `loki help answer`: `loki answer` is a v10 (loki-ts) command with no bash
 # implementation, so its help lives here rather than behind delegation.
 _help_answer() {
-    echo -e "${BOLD}loki answer${NC} - Resume a BLOCKED run with an answer"
+    echo -e "${BOLD}loki answer${NC} - Start a follow-up run from a BLOCKED run with your answer"
     echo ""
     echo "Usage: loki answer [<run-id>] [--text \"...\"]"
     echo ""
@@ -1711,6 +1711,8 @@ _help_verify_pr() {
     echo -e "${BOLD}loki verify-pr${NC} - Verify a PR against its linked issue (experimental, LOKI_VERIFY_PR=1)"
     echo ""
     echo "Usage: loki verify-pr <https://github.com/o/r/pull/N | o/r#N> [--out DIR]"
+    echo "       loki verify-pr respond <o/r#N>   fix open review comments (one commit each, on the PR"
+    echo "                                        branch), push, reply with the sha; never resolves threads"
     echo ""
     echo "Derives a check from the PR's linked issue (Check: \`cmd\` or a loki-check fence)."
     echo "VERIFIED only if the check fails on the PR base, passes on its head, and the"
@@ -1799,7 +1801,8 @@ show_help_all() {
     echo ""
     echo "Verify / trust:"
     echo "  verify [base]    Deterministic PR verification (CI-gate exit codes)"
-    echo "  keys export      Print the public receipt-signing key (JWK) for third-party verify --pubkey"
+    echo "  verify-pr <pr>   Verify a PR against its linked issue; 'verify-pr respond <pr>' fixes review comments"
+    echo "  keys export     Print the public receipt-signing key (JWK) for third-party verify --pubkey"
     echo "  review [opts]    Standalone code review with quality gates"
     echo "  ultracode \"task\" Run a task as a native Claude Code Dynamic Workflow (opt-in, Claude-only)"
     echo "  trust [cmd]      Visible trust trajectory; 'trust detail' for metrics"
@@ -2549,7 +2552,7 @@ cmd_start() {
     # [--auto-rollback] chains the gated `loki deploy --execute` after a start
     # that ended 0. cmd_deploy owns every gate: no VERIFIED HEAD-anchored
     # receipt means a refusal, never a deploy.
-    local _ps_ws="" _ps_deploy=0 _ps_health="" _ps_rb=0 _ps_rest=() _ps_brief=() _ps_a
+    local _ps_ws="" _ps_deploy=0 _ps_health="" _ps_hmatch="" _ps_rb=0 _ps_rest=() _ps_brief=() _ps_a
     while [ $# -gt 0 ]; do
         case "$1" in
             --workspace)
@@ -2561,12 +2564,16 @@ cmd_start() {
                 [ -n "${2:-}" ] && [ "${2#-}" = "$2" ] || { echo -e "${RED}--health-url requires a URL${NC}" >&2; exit 2; }
                 _ps_health="$2"; shift 2 ;;
             --health-url=*) _ps_health="${1#*=}"; shift ;;
+            --health-match)
+                [ -n "${2:-}" ] && [ "${2#-}" = "$2" ] || { echo -e "${RED}--health-match requires a string${NC}" >&2; exit 2; }
+                _ps_hmatch="$2"; shift 2 ;;
+            --health-match=*) _ps_hmatch="${1#*=}"; shift ;;
             --auto-rollback) _ps_rb=1; shift ;;
             *) _ps_rest+=("$1"); shift ;;
         esac
     done
-    if { [ -n "$_ps_health" ] || [ "$_ps_rb" = 1 ]; } && [ "$_ps_deploy" != 1 ]; then
-        echo -e "${RED}--health-url and --auto-rollback apply only with --deploy${NC}" >&2
+    if { [ -n "$_ps_health" ] || [ -n "$_ps_hmatch" ] || [ "$_ps_rb" = 1 ]; } && [ "$_ps_deploy" != 1 ]; then
+        echo -e "${RED}--health-url, --health-match and --auto-rollback apply only with --deploy${NC}" >&2
         exit 2
     fi
     if [ -n "$_ps_ws" ]; then
@@ -2603,6 +2610,7 @@ cmd_start() {
         fi
         local _ps_dargs=(--execute)
         [ -n "$_ps_health" ] && _ps_dargs+=(--health-url "$_ps_health")
+        [ -n "$_ps_hmatch" ] && _ps_dargs+=(--health-match "$_ps_hmatch")
         [ "$_ps_rb" = 1 ] && _ps_dargs+=(--auto-rollback)
         cmd_deploy "${_ps_dargs[@]}"
         return $?
@@ -5061,11 +5069,14 @@ cmd_pause() {
 }
 
 # RUN-25 iter 22 (Wave D #3): `loki steer "<note>"` writes an operator directive
-# the running loop actually reads (.loki/HUMAN_INPUT.md), replacing the dead
-# steering.md hint the cockpit used to advertise (nothing read it). The loop only
-# INJECTS the note when LOKI_PROMPT_INJECTION=1 (default off, for safety), so we
-# write the note and tell the operator the exact flag -- honest: the control now
-# genuinely persists the directive instead of silently no-op'ing.
+# to .loki/HUMAN_INPUT.md. engine10 reads it before the next plan or implement
+# session (default on; only LOKI_PROMPT_INJECTION=0/false opts out, steer.ts).
+# The legacy loop injects it only when LOKI_PROMPT_INJECTION=1.
+# Each steer is a numbered revision: `## Operator directive rev N (ts) actor=A source=S`.
+# engine10 (util/steer.ts) archives the file and appends the revisions to
+# .loki/intent-revisions.jsonl. Actor and source come from LOKI_STEER_ACTOR
+# (default: git user.name, then $USER) and LOKI_STEER_SOURCE (cli, chat or an
+# https comment URL; default cli). Both are reduced to a safe character set.
 cmd_steer() {
     case "${1:-}" in
         --help|-h|help|"")
@@ -5073,13 +5084,14 @@ cmd_steer() {
             echo ""
             echo "Usage: loki steer \"<guidance>\""
             echo ""
-            echo "Writes your guidance to .loki/HUMAN_INPUT.md, which the running"
-            echo "loop reads at the next iteration boundary (when LOKI_PROMPT_INJECTION=1)."
+            echo "Writes your guidance to .loki/HUMAN_INPUT.md as a numbered revision"
+            echo "(rev N, actor, source). The Loki 10 engine applies it once, before the"
+            echo "next plan or implement session, and records it in .loki/intent-revisions.jsonl."
             echo ""
             echo "  loki steer \"focus on the auth flow, skip the docs for now\""
             echo ""
-            echo "The loop injects the note only when prompt injection is enabled:"
-            echo "  LOKI_PROMPT_INJECTION=1 loki start ...   (or export it before starting)"
+            echo "Opt out with LOKI_PROMPT_INJECTION=0. The legacy loop reads the note"
+            echo "only when LOKI_PROMPT_INJECTION=1."
             [ -z "${1:-}" ] && return 2
             return 0
             ;;
@@ -5089,20 +5101,34 @@ cmd_steer() {
         return 1
     fi
     local note="$*"
-    # Append with a timestamp so multiple steers accumulate; the reader consumes
-    # and clears the file each iteration, so this is the pending-directive buffer.
+    local actor source rev pending archived
+    actor="${LOKI_STEER_ACTOR:-$(git config user.name 2>/dev/null || true)}"
+    actor="${actor:-${USER:-unknown}}"
+    actor="$(printf '%s' "$actor" | tr -c 'A-Za-z0-9._@-' '-' | cut -c1-64)"
+    source="$(printf '%s' "${LOKI_STEER_SOURCE:-cli}" | tr -c 'A-Za-z0-9:/._#?=&%-' '-' | cut -c1-300)"
+    # rev = consumed revisions + steers still pending in the buffer + 1
+    archived=0; pending=0
+    [ -f "$LOKI_DIR/intent-revisions.jsonl" ] && archived="$(wc -l < "$LOKI_DIR/intent-revisions.jsonl" | tr -d ' ')"
+    [ -f "$LOKI_DIR/HUMAN_INPUT.md" ] && pending="$(grep -c '^## Operator directive rev ' "$LOKI_DIR/HUMAN_INPUT.md" 2>/dev/null || true)"
+    rev=$(( ${archived:-0} + ${pending:-0} + 1 ))
+    # Append so multiple steers accumulate; the reader consumes and clears the
+    # file, so this is the pending-directive buffer.
     {
-        printf '## Operator directive (%s)\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+        printf '## Operator directive rev %s (%s) actor=%s source=%s\n' "$rev" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$actor" "$source"
         printf '%s\n\n' "$note"
     } >> "$LOKI_DIR/HUMAN_INPUT.md"
     emit_event session cli steer "chars=${#note}" 2>/dev/null || true
-    echo -e "${GREEN}Steering note written to .loki/HUMAN_INPUT.md${NC}"
-    if [ "${LOKI_PROMPT_INJECTION:-false}" != "1" ] && [ "${LOKI_PROMPT_INJECTION:-false}" != "true" ]; then
-        echo -e "${YELLOW}Note: prompt injection is OFF, so the loop will NOT read this yet.${NC}"
-        echo -e "${DIM}Enable it: export LOKI_PROMPT_INJECTION=1 (then the next iteration ingests the note).${NC}"
-    else
-        echo -e "${DIM}The next iteration will read and apply it.${NC}"
-    fi
+    echo -e "${GREEN}Steering note (rev $rev) written to .loki/HUMAN_INPUT.md${NC}"
+    case "${LOKI_PROMPT_INJECTION:-}" in
+        0|false|FALSE|False)
+            echo -e "${YELLOW}Note: LOKI_PROMPT_INJECTION is off, so the run will NOT read this.${NC}"
+            ;;
+        *)
+            echo -e "${DIM}The Loki 10 engine applies it before the next plan or implement session.${NC}"
+            # Same text the issue comment ack posts (trigger-server.py steer_ack_text).
+            echo "Steer rev $rev received: applies at next plan/implement stage."
+            ;;
+    esac
     return 0
 }
 
@@ -9771,7 +9797,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -9794,6 +9820,7 @@ _deploy_record() {
     local health_status="${7:-unchecked}" health_url="${8:-}"
     local rb_attempted="${9:-false}" rb_exit="${10:-}"
     local receipt_sha="${11:-}" started_at="${12:-}" finished_at="${13:-}" target="${14:-}" canary="${15:-false}"
+    local post_rb="${16:-unchecked}" hcode_rec="${17:-}" hmatch="${18:-}" tree_sha="${19:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -9801,7 +9828,7 @@ _deploy_record() {
     DR_CMD="$command" DR_RC="$rc" DR_RUN="$run_id" DR_ANCHOR="$anchor" DR_OUT="$f" \
     DR_STATE="$anchor_state" DR_HS="$health_status" DR_HU="$health_url" \
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
-    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" \
+    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -9827,6 +9854,10 @@ json.dump({
     "health_url": os.environ.get("DR_HU") or "",
     "rollback_attempted": os.environ.get("DR_RBA") == "true",
     "rollback_exit": int(os.environ["DR_RBX"]) if os.environ.get("DR_RBX", "") != "" else None,
+    "post_rollback_health": os.environ.get("DR_PRB") or "unchecked",
+    "health_match": os.environ.get("DR_HM", ""),
+    "tree_sha": os.environ.get("DR_TREE", ""),
+    "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
     # Sign through the one Bun implementation. A subshell, because the delegate execs.
@@ -9895,20 +9926,31 @@ except Exception:
     return 0
 }
 
-# _deploy_probe_health <url>
-# Bounded poll: echoes the last HTTP status, returns 0 on any 2xx. Attempts and
+# _deploy_probe_health <url> [match]
+# Bounded poll: echoes the last HTTP status, returns 0 on any 2xx. With a match
+# string the 2xx body must also contain it (fixed-string), else the attempt fails
+# and the status is still echoed. Attempts and
 # spacing are env-tunable (LOKI_DEPLOY_HEALTH_ATTEMPTS / _INTERVAL) for tests.
 _deploy_probe_health() {
-    local url="${1:-}" attempts="${LOKI_DEPLOY_HEALTH_ATTEMPTS:-5}" interval="${LOKI_DEPLOY_HEALTH_INTERVAL:-3}"
-    local i=0 code="000"
+    local url="${1:-}" match="${2:-}" attempts="${LOKI_DEPLOY_HEALTH_ATTEMPTS:-5}" interval="${LOKI_DEPLOY_HEALTH_INTERVAL:-3}"
+    local i=0 code="000" body="/dev/null"
+    if [ -n "$match" ]; then body="$(mktemp 2>/dev/null)" || body="/dev/null"; fi
     case "$attempts" in ''|*[!0-9]*) attempts=5 ;; esac
     case "$interval" in ''|*[!0-9]*) interval=3 ;; esac
     while [ "$i" -lt "$attempts" ]; do
         i=$((i + 1))
-        code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$url" 2>/dev/null)" || code="000"
-        case "$code" in 2??) printf '%s' "$code"; return 0 ;; esac
+        code="$(curl -s -o "$body" -w '%{http_code}' --max-time 10 "$url" 2>/dev/null)" || code="000"
+        case "$code" in
+            2??)
+                if [ -z "$match" ] || grep -qF -- "$match" "$body" 2>/dev/null; then
+                    [ "$body" = /dev/null ] || rm -f "$body"
+                    printf '%s' "$code"; return 0
+                fi
+                ;;
+        esac
         [ "$i" -lt "$attempts" ] && [ "$interval" -gt 0 ] && sleep "$interval"
     done
+    [ "$body" = /dev/null ] || rm -f "$body"
     printf '%s' "$code"
     return 1
 }
@@ -9974,6 +10016,7 @@ _deploy_try_execute() {
     local dir="${1:-.}" type="${2:-}"
     # Set by cmd_deploy (dynamic scope); empty/false when called any other way.
     local health_url="${_LOKI_DEPLOY_HEALTH_URL:-}" auto_rollback="${_LOKI_DEPLOY_AUTO_ROLLBACK:-false}"
+    local health_match="${_LOKI_DEPLOY_HEALTH_MATCH:-}"
 
     local command
     command="$(_deploy_first_installed_command "$dir" "$type")"
@@ -10086,7 +10129,7 @@ _deploy_try_execute() {
 
     local rc=0 started_at finished_at purl="" canary_out=""
     started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-    local health_status="unchecked" rb_attempted=false rb_exit="" hcode=""
+    local health_status="unchecked" rb_attempted=false rb_exit="" hcode="" rb_hcode="" post_rb="unchecked"
     if [ "$canary_kind" = vercel ]; then
         # Staged: a preview deploy (no --prod), probe the preview URL, promote only if healthy.
         # Nothing reaches production before the probe, so there is nothing to roll back.
@@ -10098,7 +10141,7 @@ _deploy_try_execute() {
         if [ "$rc" -eq 0 ] && [ -n "$purl" ]; then
             health_url="$purl"
             echo "Probing canary health: ${health_url}"
-            if hcode="$(_deploy_probe_health "$health_url")"; then
+            if hcode="$(_deploy_probe_health "$health_url" "$health_match")"; then
                 health_status="healthy"
                 echo "Promoting: vercel promote ${purl}"
                 exec_cmd="vercel; vercel promote ${purl}"
@@ -10119,7 +10162,7 @@ _deploy_try_execute() {
     # failed deploy, status is "unchecked": never a claim the service is healthy.
     if [ "$canary_kind" != vercel ] && [ "$rc" -eq 0 ] && [ -n "$health_url" ]; then
         echo "Probing health: ${health_url}"
-        if hcode="$(_deploy_probe_health "$health_url")"; then
+        if hcode="$(_deploy_probe_health "$health_url" "$health_match")"; then
             health_status="healthy"
         else
             health_status="FAILED_HEALTH"
@@ -10127,14 +10170,21 @@ _deploy_try_execute() {
     fi
 
     if [ "$health_status" = "FAILED_HEALTH" ]; then
-        echo -e "${RED}FAILED_HEALTH: ${health_url} did not return 2xx (last status ${hcode:-000}).${NC}" >&2
+        echo -e "${RED}FAILED_HEALTH: ${health_url} did not return 2xx${health_match:+ containing \"${health_match}\"} (last status ${hcode:-000}).${NC}" >&2
         if [ "$auto_rollback" = true ] && [ -n "$rb_cmd" ] && ! _deploy_is_destructive "$rb_cmd"; then
             echo "Rolling back: ${rb_cmd}" >&2
             rb_attempted=true
             rb_exit=0
             ( cd "$dir" && eval "$rb_cmd" ) || rb_exit=$?
             if [ "$rb_exit" -eq 0 ]; then
-                echo "Rollback command exited 0. Health of the rolled-back service was NOT re-checked." >&2
+                echo "Rollback command exited 0. Re-checking health: ${health_url}" >&2
+                if rb_hcode="$(_deploy_probe_health "$health_url")"; then
+                    post_rb="healthy"
+                    echo -e "${GREEN}Rolled-back service is healthy${NC} (HTTP ${rb_hcode})." >&2
+                else
+                    post_rb="FAILED_HEALTH"
+                    echo -e "${RED}Rolled-back service is STILL unhealthy (last status ${rb_hcode:-000}).${NC}" >&2
+                fi
             else
                 echo -e "${RED}Rollback command exited ${rb_exit}.${NC}" >&2
             fi
@@ -10150,7 +10200,7 @@ _deploy_try_execute() {
     rsha="$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || printf '')"
     rec="$(_deploy_record "$dir" "$exec_cmd" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
-        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary")"
+        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -10177,6 +10227,8 @@ _deploy_try_execute() {
     fi
     # A deploy that exited 0 but failed its health probe is a failed deploy.
     if [ "$rc" -eq 0 ] && [ "$health_status" = "FAILED_HEALTH" ]; then
+        # 5: the rollback ran and the service is still down.
+        [ "$post_rb" = "FAILED_HEALTH" ] && return 5
         return 4
     fi
     return "$rc"
@@ -10290,7 +10342,7 @@ cmd_deploy() {
     # file alone weakens this gate.
     local LOKI_DEPLOY_ALLOW_UNANCHORED=false
     # Per-invocation like --execute; local so an ambient env var cannot set them.
-    local _LOKI_DEPLOY_HEALTH_URL="" _LOKI_DEPLOY_AUTO_ROLLBACK=false _LOKI_DEPLOY_CANARY=false
+    local _LOKI_DEPLOY_HEALTH_URL="" _LOKI_DEPLOY_HEALTH_MATCH="" _LOKI_DEPLOY_AUTO_ROLLBACK=false _LOKI_DEPLOY_CANARY=false
 
     # Arg parse (mirror cmd_preview: lenient on unknown args -> no behavior drift).
     while [ $# -gt 0 ]; do
@@ -10298,7 +10350,7 @@ cmd_deploy() {
             --help|-h|help)
                 echo -e "${BOLD}Loki Mode -- deploy command advisory (print-only by default)${NC}"
                 echo ""
-                echo "Usage: loki deploy [--dir <path>] [--no-clip] [--execute [--canary]] [--health-url URL [--auto-rollback]]"
+                echo "Usage: loki deploy [--dir <path>] [--no-clip] [--execute [--canary]] [--health-url URL [--health-match STR] [--auto-rollback]]"
                 echo ""
                 echo "Detects your project type and your installed cloud CLI (and any"
                 echo "CI/CD pipeline), then PRINTS the exact deploy command for YOU to run."
@@ -10359,11 +10411,14 @@ cmd_deploy() {
                 echo "                    non-2xx marks the deploy FAILED_HEALTH and exits 4."
                 echo "                    Without a URL, health is recorded as 'unchecked',"
                 echo "                    never as healthy."
+                echo "  --health-match S  The 2xx body must also contain S (for example the HEAD sha"
+                echo "                    or version), else FAILED_HEALTH. Needs --health-url."
                 echo "  --auto-rollback   On FAILED_HEALTH run the provider's documented rollback:"
                 echo "                    'vercel rollback' or 'fly releases rollback <version"
                 echo "                    captured before the deploy>'. Netlify and Cloudflare"
                 echo "                    print a manual note. Needs --health-url. The rolled-back"
-                echo "                    service is not re-probed."
+                echo "                    service is re-probed and recorded as post_rollback_health;"
+                echo "                    still unhealthy exits 5."
                 echo ""
                 echo "Staged rollout (only with --execute):"
                 echo "  --canary          Vercel: deploy without --prod, health-check the preview"
@@ -10402,6 +10457,10 @@ cmd_deploy() {
                     *) echo "loki deploy --health-url requires an http(s) URL" >&2; return 1 ;;
                 esac
                 ;;
+            --health-match)
+                [ -n "${2:-}" ] && [ "${2#-}" = "$2" ] || { echo "loki deploy --health-match requires a string" >&2; return 1; }
+                _LOKI_DEPLOY_HEALTH_MATCH="$2"; shift
+                ;;
             --auto-rollback)
                 _LOKI_DEPLOY_AUTO_ROLLBACK=true
                 ;;
@@ -10429,6 +10488,10 @@ cmd_deploy() {
         echo "loki deploy --auto-rollback requires --health-url (no health signal, no rollback)" >&2
         return 1
     fi
+    if [ -n "$_LOKI_DEPLOY_HEALTH_MATCH" ] && [ -z "$_LOKI_DEPLOY_HEALTH_URL" ]; then
+        echo "loki deploy --health-match requires --health-url" >&2
+        return 1
+    fi
     if [ "$_LOKI_DEPLOY_CANARY" = true ] && [ "$do_execute" != true ]; then
         echo "loki deploy --canary requires --execute" >&2
         return 1
@@ -11492,7 +11555,7 @@ fi
 # Post-completion: auto-merge if requested
 if [[ "$LOKI_AUTO_MERGE" == "true" ]]; then
     branch_current=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
-    if gh pr merge "$branch_current" --squash --delete-branch 2>/dev/null; then
+    if "$LOKI_CMD" merge watch "$branch_current" --require-verified --delete-branch; then
         # A brief run carries a synthetic ref (b<epoch>), not a real issue: close only numeric refs.
         if [[ "${LOKI_ISSUE_NUMBER:-}" =~ ^[0-9]+$ ]]; then
             gh issue close "$LOKI_ISSUE_NUMBER" --comment "Resolved by Loki Mode" 2>/dev/null || true
@@ -11710,7 +11773,8 @@ ${_gh_receipt}"
                                 if command -v jq >/dev/null 2>&1; then
                                     jq -n --arg url "$(printf '%s' "$_pr_out" | grep -Eo 'https://[^[:space:]]+' | head -1)" \
                                           --arg branch "$branch_current" \
-                                        '{state:"created", url:$url, branch:$branch}' \
+                                        '{state:"created", url:$url, branch:$branch,
+                                          merge:{outcome:"waiting", gate:"human_review", checks:"not recorded"}}' \
                                         > .loki/state/pr.json 2>/dev/null || true
                                 fi
                             else
@@ -11744,7 +11808,7 @@ ${_gh_receipt}"
                 github|brief)
                     local branch_current
                     branch_current=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
-                    if gh pr merge "$branch_current" --squash --delete-branch 2>/dev/null; then
+                    if _merge_pr_watch "$branch_current" --require-verified --delete-branch; then
                         echo -e "${GREEN}PR merged and branch deleted${NC}"
                         if [[ "${number:-}" =~ ^[0-9]+$ ]]; then
                             gh issue close "$number" --comment "Resolved by Loki Mode" 2>/dev/null || true
@@ -18473,6 +18537,7 @@ cmd_modernize() {
             echo "Subcommands (grouped modernization surface):"
             echo "  heal <path>      Legacy system healing in phases (was: loki heal)"
             echo "  migrate <path>   Codebase migration in phases (was: loki migrate)"
+            echo "  unit --repo <owner/name> --ref <ref> --unit <id>   Run one unit (remote unit job worker)"
             echo ""
             echo "Run 'loki modernize <subcommand> --help' for each. The old"
             echo "top-level names still work; see 'loki help aliases'."
@@ -25882,6 +25947,142 @@ SHOW_EOF
     esac
 }
 
+# Poll `gh pr checks` while pending (rc=8); returns the final rc (0 = green).
+_pr_checks_wait() {
+    local pr="$1" poll="${LOKI_MERGE_POLL_S:-20}" tries="${LOKI_MERGE_MAX_POLLS:-90}" rc=8 i=0
+    while [ "$rc" = "8" ] && [ "$i" -lt "$tries" ]; do
+        rc=0; gh pr checks "$pr" >/dev/null 2>&1 || rc=$?
+        [ "$rc" = "8" ] && { sleep "$poll"; i=$((i+1)); }
+    done
+    return "$rc"
+}
+
+# CI repair loop. Waits for checks; on red, hands the failed-run log tail to one
+# bounded repair session on the PR branch (LOKI_PR_REPAIR_CMD, default: a
+# `loki start` of a generated brief; it receives the evidence file path as its last argument), pushes,
+# and re-checks, up to LOKI_PR_REPAIR_MAX attempts (default 2). Green goes through
+# _merge_pr_gated (extra args pass through). Exhausted: the PR is returned to
+# draft, nothing merges, and the last failure evidence is printed.
+# Usage: _merge_pr_watch <pr> [--require-verified] [--delete-branch]
+_merge_pr_watch() {
+    local pr="$1" max="${LOKI_PR_REPAIR_MAX:-2}" attempt=0 rc branch cur rid evid tmp
+    shift
+    case "$max" in ''|*[!0-9]*) max=2 ;; esac
+    command -v gh >/dev/null 2>&1 || { echo "$pr: not merged, gate: gh (gh CLI is required)" >&2; return 1; }
+    branch="$(gh pr view "$pr" --json headRefName -q .headRefName 2>/dev/null)" || branch=""
+    tmp="$(mktemp -d)" || return 1
+    evid="$tmp/ci-failure.md"
+    while true; do
+        rc=0; _pr_checks_wait "$pr" || rc=$?
+        if [ "$rc" = "0" ]; then
+            rm -rf "$tmp"
+            _merge_pr_gated "$pr" "$@"
+            return $?
+        fi
+        rid="$(gh run list --branch "$branch" --status failure --limit 1 --json databaseId -q '.[0].databaseId' 2>/dev/null)" || rid=""
+        {
+            echo "# CI failed for PR $pr (branch ${branch:-unknown}); fix the failing checks, keep the change minimal"
+            [ -n "$rid" ] && gh run view "$rid" --log-failed 2>/dev/null | tail -n 120
+        } > "$evid"
+        if [ "$attempt" -ge "$max" ]; then
+            gh pr ready "$pr" --undo >/dev/null 2>&1 || true
+            echo "$pr: not merged, gate: checks (gh pr checks rc=$rc after $attempt repair attempts); PR left as draft" >&2
+            _pr_record_merge "$pr" "blocked:checks" "checks" "failing after $attempt repair attempts"
+            echo "Last failure evidence:" >&2; sed 's/^/    /' "$evid" >&2
+            rm -rf "$tmp"
+            return 1
+        fi
+        attempt=$((attempt+1))
+        cur="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")"
+        if [ -z "$branch" ] || [ "$cur" != "$branch" ]; then
+            echo "$pr: not merged, gate: repair (checkout is '${cur:-none}', repair must run on PR branch '${branch:-unknown}'); PR left open" >&2
+            rm -rf "$tmp"; return 1
+        fi
+        echo "$pr: checks red, repair attempt $attempt of $max"
+        if [ -n "${LOKI_PR_REPAIR_CMD:-}" ]; then
+            bash -c "$LOKI_PR_REPAIR_CMD \"\$1\"" _ "$evid" || { echo "$pr: repair attempt $attempt failed, not pushing"; continue; }
+        else
+            "$(command -v loki || echo "$0")" start "$evid" || { echo "$pr: repair attempt $attempt failed, not pushing"; continue; }
+        fi
+        git push origin "HEAD:refs/heads/$branch" >/dev/null 2>&1 || echo "$pr: push of repair failed" >&2
+    done
+}
+
+# Record the merge gate's own result in .loki/state/pr.json (merged,
+# blocked:<gate> or waiting) so the receipt and handoff read the same outcome
+# the gate produced. Only updates an existing "created" record that describes
+# the same PR (pr arg matches .branch or the number at the end of .url); any
+# other record is left untouched. Never invents one. File mode is preserved.
+_pr_record_merge() {
+    local pr="$1" outcome="$2" gate="${3:-}" checks="${4:-not recorded}" f=".loki/state/pr.json" t n
+    n="${pr#\#}"
+    case "$n" in */pull/*) n="${n%/}"; n="${n##*/}" ;; esac
+    [ -f "$f" ] && command -v jq >/dev/null 2>&1 || return 0
+    t="$(mktemp "$f.XXXXXX" 2>/dev/null)" || return 0
+    cp -p "$f" "$t" 2>/dev/null || { rm -f "$t"; return 0; }
+    if jq --arg p "$pr" --arg n "$n" --arg o "$outcome" --arg g "$gate" --arg c "$checks" \
+        'select(.state=="created" and (.branch==$p or ((.url // "") | (endswith("/pull/" + $n) or endswith("/pull/" + $n + "/"))))) | .merge={outcome:$o, gate:(if $g=="" then null else $g end), checks:$c}' "$f" > "$t" 2>/dev/null && [ -s "$t" ]; then
+        mv "$t" "$f"
+    else
+        rm -f "$t"
+    fi
+    return 0
+}
+
+# Shared merge gate. One PR (number or branch) merges only when it is not a
+# draft, `gh pr checks` exits 0 after polling pending (rc=8), and, with
+# --require-verified, this run's proof headline is VERIFIED (missing proof or
+# an unreadable headline is never VERIFIED). On refusal it prints the exact
+# blocking gate ("gate: draft|verdict|checks") and leaves the PR open.
+# Usage: _merge_pr_gated <pr> [--require-verified] [--delete-branch]
+_merge_pr_gated() {
+    local pr="$1" need_verified=false margs=(--squash) rc d
+    shift
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --require-verified) need_verified=true ;;
+            --delete-branch) margs+=(--delete-branch) ;;
+        esac
+        shift
+    done
+    command -v gh >/dev/null 2>&1 || { echo "$pr: not merged, gate: gh (gh CLI is required)" >&2; _pr_record_merge "$pr" "blocked:gh" "gh"; return 1; }
+    d="$(gh pr view "$pr" --json isDraft -q .isDraft 2>/dev/null)" || d=""
+    if [ "$d" != "false" ]; then
+        echo "$pr: not merged, gate: draft (PR is a draft or its state is unreadable); PR left open" >&2
+        _pr_record_merge "$pr" "blocked:draft" "draft"
+        return 1
+    fi
+    if $need_verified; then
+        local pid="" headline=""
+        [ -f .loki/state/last-proof-id.txt ] && pid="$(cat .loki/state/last-proof-id.txt 2>/dev/null)"
+        if [ -n "$pid" ] && [ -f ".loki/proofs/${pid}/proof.json" ] && command -v jq >/dev/null 2>&1; then
+            headline="$(jq -r '.honesty.headline // empty' ".loki/proofs/${pid}/proof.json" 2>/dev/null)"
+        fi
+        if [ "$headline" != "VERIFIED" ]; then
+            echo "$pr: not merged, gate: verdict (run verdict is '${headline:-missing}', need VERIFIED); PR left open" >&2
+            _pr_record_merge "$pr" "blocked:verdict" "verdict"
+            return 1
+        fi
+    fi
+    rc=0; _pr_checks_wait "$pr" || rc=$?
+    if [ "$rc" != "0" ]; then
+        echo "$pr: not merged, gate: checks (gh pr checks rc=$rc); PR left open" >&2
+        case "$rc" in
+            8) _pr_record_merge "$pr" "waiting" "checks" "pending" ;;
+            1) _pr_record_merge "$pr" "blocked:checks" "checks" "failing" ;;
+            *) _pr_record_merge "$pr" "blocked:checks" "checks" "unknown" ;;
+        esac
+        return 1
+    fi
+    if ! gh pr merge "$pr" "${margs[@]}" >/dev/null 2>&1; then
+        echo "$pr: not merged, gate: merge (gh pr merge failed); PR left open" >&2
+        _pr_record_merge "$pr" "blocked:merge" "merge" "passing"
+        return 1
+    fi
+    _pr_record_merge "$pr" "merged" "" "all passing"
+    return 0
+}
+
 # loki merge: serial PR merge queue. Queue lives in .loki/merge-queue (one PR
 # number per line). A PR merges only when `gh pr checks` exits 0 (all green);
 # after each merge the next PR is rebased onto the new base (gh pr update-branch
@@ -25916,8 +26117,7 @@ cmd_merge() {
             [ "${1:-}" = "--dry-run" ] && dry=true
             if [ ! -s "$qfile" ]; then echo "Merge queue is empty"; return 0; fi
             command -v gh >/dev/null 2>&1 || { echo "gh CLI is required" >&2; return 1; }
-            local poll="${LOKI_MERGE_POLL_S:-20}" tries="${LOKI_MERGE_MAX_POLLS:-90}"
-            local first=true n rc i remaining="" merged=0 blocked=0
+            local first=true n rc remaining="" merged=0 blocked=0
             while IFS= read -r n; do
                 [ -n "$n" ] || continue
                 if $dry; then
@@ -25936,29 +26136,33 @@ cmd_merge() {
                         || { echo "#$n: rebase onto new base failed, left in queue"; remaining="$remaining$n"$'\n'; blocked=$((blocked+1)); continue; }
                     echo "#$n: rebased onto new base"
                 fi
-                rc=8; i=0
-                while [ "$rc" = "8" ] && [ "$i" -lt "$tries" ]; do
-                    rc=0; gh pr checks "$n" >/dev/null 2>&1 || rc=$?
-                    [ "$rc" = "8" ] && { sleep "$poll"; i=$((i+1)); }
-                done
-                if [ "$rc" != "0" ]; then
-                    echo "#$n: checks not green (rc=$rc), left in queue, not merged"
-                    remaining="$remaining$n"$'\n'; blocked=$((blocked+1)); continue
-                fi
-                if gh pr merge "$n" --squash >/dev/null 2>&1; then
+                if _merge_pr_gated "$n" 2>"$qfile.err"; then
                     echo "#$n: merged"; merged=$((merged+1)); first=false
                 else
-                    echo "#$n: merge failed, left in queue"
+                    sed 's/^/#/' "$qfile.err"; echo "#$n: left in queue"
                     remaining="$remaining$n"$'\n'; blocked=$((blocked+1))
                 fi
             done < "$qfile"
             if $dry; then echo "Dry run: nothing changed"; return 0; fi
+            rm -f "$qfile.err"
             printf '%s' "$remaining" > "$qfile"
             echo "Merged: $merged, left in queue: $blocked"
             [ "$blocked" -eq 0 ]
             ;;
+        watch)
+            [ $# -gt 0 ] || { echo "Usage: loki merge watch <pr> [--require-verified] [--delete-branch]" >&2; return 2; }
+            _merge_pr_watch "$@" && echo "$1: merged"
+            ;;
+        pr)
+            [ $# -gt 0 ] || { echo "Usage: loki merge pr <pr-or-branch> [--require-verified] [--delete-branch]" >&2; return 2; }
+            _merge_pr_gated "$@" && echo "$1: merged"
+            ;;
         help|--help|-h|*)
-            echo "Usage: loki merge <add|list|run|clear>"
+            echo "Usage: loki merge <add|list|run|pr|watch|clear>"
+            echo "  watch <pr>         Wait for checks; on red run up to LOKI_PR_REPAIR_MAX (2) bounded"
+            echo "                     repair sessions on the PR branch, push, re-check, merge when green."
+            echo "  pr <pr|branch>     Merge one PR through the same gate (not draft, checks green;"
+            echo "                     --require-verified also needs a VERIFIED run verdict)."
             echo "  add <pr>...        Queue pull requests"
             echo "  list               Show the queue"
             echo "  run [--dry-run]    Merge one at a time, only when checks are green;"