diff --git a/.github/workflows/test-cross-plugin.yml b/.github/workflows/test-cross-plugin.yml
new file mode 100644
index 00000000..663316b5
--- /dev/null
+++ b/.github/workflows/test-cross-plugin.yml
@@ -0,0 +1,35 @@
+name: Cross-Plugin Guards
+# Runs repo-root behavior guards that span more than one plugin, so they can't
+# live in any single plugin's release-blocking suite. Scoped tightly to the
+# files each guard covers — a core-only or single-plugin PR must not trigger it.
+# NOTE: the automode-env glob matches the three copies under scripts/ today;
+# a future copy placed elsewhere would need its path added here.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'plugins/*/scripts/automode-env.ts'
+      - 'tests/cross-plugin/**'
+      - '.github/workflows/test-cross-plugin.yml'
+      - 'package.json'
+      - 'bun.lock'
+      - 'tsconfig.json'
+  pull_request:
+    paths:
+      - 'plugins/*/scripts/automode-env.ts'
+      - 'tests/cross-plugin/**'
+      - '.github/workflows/test-cross-plugin.yml'
+      - 'package.json'
+      - 'bun.lock'
+      - 'tsconfig.json'
+
+jobs:
+  cross-plugin:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.14'
+      - run: bun install --frozen-lockfile
+      - run: bun test tests/cross-plugin/
diff --git a/plugins/claude-code-dev-hermit/CHANGELOG.md b/plugins/claude-code-dev-hermit/CHANGELOG.md
index 04101308..251630dc 100644
--- a/plugins/claude-code-dev-hermit/CHANGELOG.md
+++ b/plugins/claude-code-dev-hermit/CHANGELOG.md
@@ -9,6 +9,7 @@
 
 ### Changed
 - The CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-dev-hermit: Development Workflow -->`), placed outside both mode regions so it survives both renderings. Lets core's `hermit-evolve` bound the block exactly instead of a heuristic that used to mistake the template's own `<!-- mode:standard-only -->` annotation for the block marker.
+- `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - §Tests Before PR folded into §Implementation Flow (both stated one ordering, and `dev-pr` Gate 0 enforces the test-freshness half mechanically), the slug algorithm and its worked examples became one naming line, and the harness built-ins left §Dev Quick Reference. Rendered standard block 9,330 B → ~6,158 B, safety 6,338 B → ~4,703 B. No git-safety rule was removed.
 - The background-session recovery advice ("re-attempt the edit") moved out of §Git Safety into `worktree-boundary-guard`'s block message, where it appears at the moment it is actionable instead of in every session's context.
 
diff --git a/plugins/claude-code-dev-hermit/scripts/dev-pr-transforms.ts b/plugins/claude-code-dev-hermit/scripts/dev-pr-transforms.ts
index 159f7a54..45870538 100644
--- a/plugins/claude-code-dev-hermit/scripts/dev-pr-transforms.ts
+++ b/plugins/claude-code-dev-hermit/scripts/dev-pr-transforms.ts
@@ -16,6 +16,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
+import { findHermitDir } from './lib/find-hermit-dir';
 
 type Json = any;
 
@@ -102,19 +103,6 @@ function git(args: string): string {
   } catch (_) { return ''; }
 }
 
-function findHermitDir(startDir: string): string | null {
-  let dir = startDir;
-  for (let i = 0; i < 8; i++) {
-    if (fs.existsSync(path.join(dir, '.claude-code-hermit', 'config.json'))) {
-      return path.join(dir, '.claude-code-hermit');
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 function loadBinding(branch: string): { id?: string; title?: string } | null {
   const hermitDir = findHermitDir(process.cwd());
   if (!hermitDir) return null;
diff --git a/plugins/claude-code-dev-hermit/scripts/git-push-guard.ts b/plugins/claude-code-dev-hermit/scripts/git-push-guard.ts
index 4611f209..309519c9 100644
--- a/plugins/claude-code-dev-hermit/scripts/git-push-guard.ts
+++ b/plugins/claude-code-dev-hermit/scripts/git-push-guard.ts
@@ -9,20 +9,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { findHermitDir } from './lib/find-hermit-dir';
 
 const MAX_STDIN = 1024 * 1024;
 
-function findHermitDir(startDir: string): string | null {
-  let dir = startDir;
-  for (let i = 0; i < 8; i++) {
-    if (fs.existsSync(path.join(dir, '.claude-code-hermit', 'config.json'))) return path.join(dir, '.claude-code-hermit');
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 function loadProtectedBranches(): string[] {
   try {
     const hermitDir = findHermitDir(process.cwd());
diff --git a/plugins/claude-code-dev-hermit/scripts/lib/find-hermit-dir.ts b/plugins/claude-code-dev-hermit/scripts/lib/find-hermit-dir.ts
new file mode 100644
index 00000000..27173bc9
--- /dev/null
+++ b/plugins/claude-code-dev-hermit/scripts/lib/find-hermit-dir.ts
@@ -0,0 +1,24 @@
+// Walk up from startDir (max 8 levels) to the nearest .claude-code-hermit dir
+// that has a config.json; return that dir, or null when none is found.
+//
+// Returning null (rather than a fail-open default path) is load-bearing:
+// git-push-guard falls back to the built-in protected-branch list on null instead
+// of blocking, and record-test-result / dev-pr-transforms skip their hermit-state
+// writes. Do NOT change this to core's fail-open hermitDir() default.
+//
+// INVARIANT: mirrors core's cc-compat.ts hermitDir() shape (same 8-level cap,
+// same config.json sentinel) — if you change the walk here, check that file too.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function findHermitDir(startDir: string): string | null {
+  let dir = startDir;
+  for (let i = 0; i < 8; i++) {
+    if (fs.existsSync(path.join(dir, '.claude-code-hermit', 'config.json'))) return path.join(dir, '.claude-code-hermit');
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
diff --git a/plugins/claude-code-dev-hermit/scripts/record-test-result.ts b/plugins/claude-code-dev-hermit/scripts/record-test-result.ts
index 57175c45..8a25775f 100644
--- a/plugins/claude-code-dev-hermit/scripts/record-test-result.ts
+++ b/plugins/claude-code-dev-hermit/scripts/record-test-result.ts
@@ -13,22 +13,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execSync, spawnSync } from 'node:child_process';
+import { findHermitDir } from './lib/find-hermit-dir';
 
 type Json = any;
 
 const MAX_STDIN = 1024 * 1024;
 
-function findHermitDir(startDir: string): string | null {
-  let dir = startDir;
-  for (let i = 0; i < 8; i++) {
-    if (fs.existsSync(path.join(dir, '.claude-code-hermit', 'config.json'))) return path.join(dir, '.claude-code-hermit');
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 function loadTestCommand(hermitDir: string): string | null {
   try {
     const cfg = JSON.parse(fs.readFileSync(path.join(hermitDir, 'config.json'), 'utf-8'));
diff --git a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
index 0e0f3ca8..0e344a20 100644
--- a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand dev-voice brainstorm — reads codebase friction signals
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `bun scripts/proposal-metrics-report.ts .claude-code-hermit --source=capability-brainstorm` from the `claude-code-hermit` plugin root (not this plugin's; `${CLAUDE_PLUGIN_ROOT}` cannot reach it), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, cut this skill rather than tune it — signal-to-noise isn't there. That segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so a breach means brainstorm-generated proposals are noisy in general; it does not by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-dev-hermit/skills/hatch/SKILL.md b/plugins/claude-code-dev-hermit/skills/hatch/SKILL.md
index 69d5fbf2..4288135d 100644
--- a/plugins/claude-code-dev-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-dev-hermit/skills/hatch/SKILL.md
@@ -77,7 +77,7 @@ Read the plugin version from `${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json`.
 **Resolve target file:** Read `.claude-code-hermit/state/hatch-options.json`. Use the `"target"` field:
 - `"local"` → `target_file = CLAUDE.local.md`
 - `"committed"` or absent → `target_file = CLAUDE.md`
-- If the file doesn't exist (no `hatch-options.json` yet — operator's core hermit predates 1.1.1): detect `core_install_scope` from `claude plugin list --json` using the same precedence rules core hatch's Step 1.5 item 2 uses (filter to entries where plugin name is `claude-code-hermit` and `enabled == true`; apply precedence `local` > `project` (both require `projectPath == project root`) > `user` (any `projectPath`) > `null`; map `project` → `committed`, `local`/`user`/`null` → `local` as the scope-derived default). Ask with `AskUserQuestion` (header: "Visibility") — present the scope-derived default at position 0 with `(recommended)` in the label: **`.local` files** (gitignored — operator-personal) / **Committed files** (shared with teammates). Record the choice and write `.claude-code-hermit/state/hatch-options.json` with the full schema:
+- If the file doesn't exist (no `hatch-options.json` yet — operator's core hermit predates 1.1.1): detect `core_install_scope` from `claude plugin list --json` using the same precedence core hatch resolves via `resolve-siblings.ts --role core-scope` (filter to entries where plugin name is `claude-code-hermit` and `enabled == true`; apply precedence `local` > `project` (both require `projectPath == project root`) > `user` (any `projectPath`) > `null`; map `project` → `committed`, `local`/`user`/`null` → `local` as the scope-derived default). Ask with `AskUserQuestion` (header: "Visibility") — present the scope-derived default at position 0 with `(recommended)` in the label: **`.local` files** (gitignored — operator-personal) / **Committed files** (shared with teammates). Record the choice and write `.claude-code-hermit/state/hatch-options.json` with the full schema:
 
   ```json
   {
diff --git a/plugins/claude-code-fitness-hermit/CHANGELOG.md b/plugins/claude-code-fitness-hermit/CHANGELOG.md
index cf0fede7..bacb0313 100644
--- a/plugins/claude-code-fitness-hermit/CHANGELOG.md
+++ b/plugins/claude-code-fitness-hermit/CHANGELOG.md
@@ -11,6 +11,7 @@
 - `hatch` no longer tells the operator to `cp .env.example .env`; a `.env.example` does not ship with the plugin.
 
 ### Changed
+- `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - `strava-sync` and `strava-health-check` routines removed — `fitness-brief` (morning + evening) now owns Strava connectivity, activity sync, RPE binding, and Run deep-dive as the plugin's two daily beats.
 - Activity notes carry `cardiac_drift_bpm` in frontmatter; `weekly-patterns` reads it there and falls back to the rendered line for older notes.
 - The CLAUDE-APPEND block dropped the routine and scheduled-check tables (schedules and `enabled` state live in `config.json`) and the five-file state map, which now points at `docs/knowledge-schema.md`. ~3,852 B → ~2,881 B. Connection-first, the secrets rules, the settings-blocked write tools, the `fitness-lab.ts` mediation boundary, the zones rule, and the full-history grounding gotcha are unchanged.
diff --git a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
index 23bed876..c39c843d 100644
--- a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand fitness-voice brainstorm — reads Strava history and tra
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `bun scripts/proposal-metrics-report.ts .claude-code-hermit --source=capability-brainstorm` from the `claude-code-hermit` plugin root (not this plugin's; `${CLAUDE_PLUGIN_ROOT}` cannot reach it), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, cut this skill rather than tune it — signal-to-noise isn't there. That segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so a breach means brainstorm-generated proposals are noisy in general; it does not by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-fitness-hermit/skills/hatch/SKILL.md b/plugins/claude-code-fitness-hermit/skills/hatch/SKILL.md
index a2c0e840..0c6db78f 100644
--- a/plugins/claude-code-fitness-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-fitness-hermit/skills/hatch/SKILL.md
@@ -152,7 +152,7 @@ Read the source file (using Read tool), then check if the destination exists (`.
 **Resolve target file:** Read `.claude-code-hermit/state/hatch-options.json`. Use the `"target"` field:
 - `"local"` → `target_file = CLAUDE.local.md`
 - `"committed"` or absent → `target_file = CLAUDE.md`
-- If the file doesn't exist (no `hatch-options.json` yet — operator's core hermit predates 1.1.1): detect `core_install_scope` from `claude plugin list --json` using the same precedence rules as core hatch Step 1.5 item 2 (filter entries where plugin name is `claude-code-hermit` and `enabled == true`; precedence `local` > `project` (both require `projectPath == project root`) > `user` (any `projectPath`) > `null`; map `project` → `committed`, `local`/`user`/`null` → `local`). Ask with `AskUserQuestion` (header: "Visibility") — scope-derived default at position 0 with `(recommended)`: **`.local` files** (gitignored — operator-personal) / **Committed files** (shared with teammates). Write the canonical 5-field schema to `.claude-code-hermit/state/hatch-options.json`:
+- If the file doesn't exist (no `hatch-options.json` yet — operator's core hermit predates 1.1.1): detect `core_install_scope` from `claude plugin list --json` using the same precedence core hatch resolves via `resolve-siblings.ts --role core-scope` (filter entries where plugin name is `claude-code-hermit` and `enabled == true`; precedence `local` > `project` (both require `projectPath == project root`) > `user` (any `projectPath`) > `null`; map `project` → `committed`, `local`/`user`/`null` → `local`). Ask with `AskUserQuestion` (header: "Visibility") — scope-derived default at position 0 with `(recommended)`: **`.local` files** (gitignored — operator-personal) / **Committed files** (shared with teammates). Write the canonical 5-field schema to `.claude-code-hermit/state/hatch-options.json`:
 
   ```json
   {
diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 91973a7d..544035a4 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -5,6 +5,8 @@
 ### Added
 - Channel-originated harness commands: an exact `/model <arg>`, `/effort <arg>`, `/compact`, or `/clear` from a trusted channel sender is recorded by a new `UserPromptSubmit` hook and typed into the session's pane when the turn ends. Args are passed through to Claude Code rather than checked against a fixed list, so new models and effort levels work without a plugin change.
 - `config.effort` — passed as `--effort` on every `hermit-start`, mirroring `config.model`, so a channel effort change reverts on restart instead of persisting. Ships `null` (no flag, model default); set it to opt into the revert-on-restart guarantee. Not the same lever as `config.env.CLAUDE_CODE_EFFORT_LEVEL`, which pins the session and makes a runtime `/effort` a no-op.
+- `micro-proposal.ts brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
+- Two `Bash(.claude-code-hermit/bin/hermit-run <script> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
 
 ### Fixed
 - A `/clear` reaching the pane outside the watchdog no longer skips the hermit's own reset bookkeeping. The runtime stamp, `SHELL.md` breadcrumb, and status-cache clear moved to `lib/context-reset.ts`; skipping the cache clear previously let the watchdog fire a spurious `/compact` against a freshly-cleared context.
@@ -21,10 +23,14 @@
 - A CLAUDE-APPEND marker that appears more than once in the target file is now refused (reported `block-ambiguous`, no Edit applied) instead of risking a replace that hits the wrong instance.
 - Micro-approval resolve/expire/nudge now go through the new `scripts/micro-proposal.ts` instead of hand-edited JSON, which could leave `state/micro-proposals.json` unparseable.
 - `queue-micro-proposal.ts` refuses to write over an unparseable `micro-proposals.json` instead of resetting it and silently dropping the pending backlog.
+- `hermit-evolve`'s sibling upgrade now applies `local > project` scope precedence when the same sibling is installed at both scopes in one project, matching `resolve-siblings.ts` and Claude Code's own settings layering — it previously read the project-scope install's version and changelog while the session was running the local-scope one.
+- `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches `micro-proposal.ts` via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
 
 ### Changed
 - Proactive operator notifications unified onto `channel-send.ts --notice`; `weekly-review`, `cost-reflect`, and (via § Operator Notification) `heartbeat`/`brief`/`capability-brainstorm` are tier-aware, so spend and technical detail no longer reach the client chat. On a `non-technical` install with no `maintainer_channel_id`, routine spend reports now land in `SHELL.md` Findings instead of the primary chat.
 - The core CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-hermit: Session Discipline -->`), matching `claude-code-homeassistant-hermit`/`claude-code-fitness-hermit`/`feed-hermit`/`laravel-forge-hermit`. Bounds detection still falls back correctly for already-installed blocks that predate the marker.
+- `hermit-evolve` Step 8 now delegates the permission merge to `bun scripts/apply-settings.ts <settings-file> allow` instead of maintaining a hand-enumerated script list in prose. The prose list had drifted to 15 of the canonical 28 entries and told the model to add a `Write` rule the writer deliberately strips; the delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
+- `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
diff --git a/plugins/claude-code-hermit/scripts/apply-settings.ts b/plugins/claude-code-hermit/scripts/apply-settings.ts
index 3665ce62..45c91888 100644
--- a/plugins/claude-code-hermit/scripts/apply-settings.ts
+++ b/plugins/claude-code-hermit/scripts/apply-settings.ts
@@ -63,6 +63,12 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/session-archive.ts*)',
   'Bash(bun */scripts/routine-precheck.ts*)',
   'Bash(bun */scripts/cron-registry.ts*)',
+  // Domain plugins reach core's shared scripts through the project-resident
+  // bin/hermit-run (their own ${CLAUDE_PLUGIN_ROOT} can't reach core's versioned
+  // cache dir). Space before * is a word boundary — `micro-proposal *` matches
+  // `micro-proposal brief-cycle` but not a `micro-proposal…`-prefixed name.
+  'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
+  'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
   "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
   'Edit(.claude-code-hermit/**)',
 ];
@@ -138,13 +144,17 @@ function writeJson(filePath: string, data: Json): void {
   fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
 }
 
-function mergeAllow(settings: Json, entries: string[]): void {
+// Returns the entries that were newly added (absent before) — the `allow` op
+// prints these so hermit-evolve's Step 8 report can list what it granted.
+function mergeAllow(settings: Json, entries: string[]): string[] {
   settings.permissions ??= {};
   settings.permissions.allow ??= [];
   const existing = new Set<string>(settings.permissions.allow);
+  const added: string[] = [];
   for (const e of entries) {
-    if (!existing.has(e)) settings.permissions.allow.push(e);
+    if (!existing.has(e)) { settings.permissions.allow.push(e); added.push(e); }
   }
+  return added;
 }
 
 function mergeAutoModeList(settings: Json, key: 'allow' | 'environment', entries: string[]): void {
@@ -193,6 +203,7 @@ if (!targetFile || !op) {
 }
 
 const settings = readTargetJson(targetFile);
+let addedAllow: string[] = [];
 
 switch (op) {
   case 'task-id': {
@@ -204,7 +215,7 @@ switch (op) {
   }
 
   case 'allow': {
-    mergeAllow(settings, HERMIT_ALLOW);
+    addedAllow = mergeAllow(settings, HERMIT_ALLOW);
     break;
   }
 
@@ -264,3 +275,8 @@ switch (op) {
 }
 
 writeJson(targetFile, settings);
+
+// After the write lands, report each newly-granted allow entry (one per line) so
+// hermit-evolve's Step 8 can list what it added in its run report. Silent when
+// nothing was added.
+for (const e of addedAllow) console.log(`allow: ${e}`);
diff --git a/plugins/claude-code-hermit/scripts/evolve-plan.ts b/plugins/claude-code-hermit/scripts/evolve-plan.ts
index 23b9021a..7558d0a2 100644
--- a/plugins/claude-code-hermit/scripts/evolve-plan.ts
+++ b/plugins/claude-code-hermit/scripts/evolve-plan.ts
@@ -543,11 +543,13 @@ function _pluginName(id: string): string {
 }
 
 // Find the project-effective entry for `name` in a pre-filtered plugin slice.
-// Scope precedence: project > local.
+// Scope precedence: local > project — the same order resolve-siblings.ts applies
+// (its header, "local overrides project"), matching Claude Code's own settings
+// layering where .local sits on top of the committed layer.
 function resolveProjectEffectivePlugin(projectEffective: any[], name: string): any | null {
   const candidates = projectEffective.filter(e => _pluginName(String(e.id || '')) === name);
   const byScope = (scope: string) => candidates.find(e => e.scope === scope);
-  return byScope('project') ?? byScope('local') ?? null;
+  return byScope('local') ?? byScope('project') ?? null;
 }
 
 // Compute per-sibling plan entries from _hermit_versions and the plugin list.
diff --git a/plugins/claude-code-hermit/scripts/hermit-exec.sh b/plugins/claude-code-hermit/scripts/hermit-exec.sh
index c6e2b547..f601979a 100755
--- a/plugins/claude-code-hermit/scripts/hermit-exec.sh
+++ b/plugins/claude-code-hermit/scripts/hermit-exec.sh
@@ -14,6 +14,15 @@ shift
 # Tolerate legacy callers that pass filenames instead of logical names.
 NAME="${NAME%.ts}"
 
+# NAME must be a bare script basename — reject path separators and traversal so a
+# permission glob that spans '/' can't drive this into an arbitrary .ts outside scripts/.
+case "$NAME" in
+  ""|*/*|*..*)
+    echo "[hermit] Invalid script name: '$NAME'" >&2
+    exit 1
+    ;;
+esac
+
 if [ -f "$SCRIPT_DIR/$NAME.ts" ]; then
   exec bun "$SCRIPT_DIR/$NAME.ts" "$@"
 fi
diff --git a/plugins/claude-code-hermit/scripts/lib/cc-compat.ts b/plugins/claude-code-hermit/scripts/lib/cc-compat.ts
index 03e9ea96..9f288dfc 100644
--- a/plugins/claude-code-hermit/scripts/lib/cc-compat.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cc-compat.ts
@@ -31,9 +31,9 @@ type TriState = { state: string; count: number; entries: Json[] };
 
 /**
  * Fleet resolver — one of three; same walk-up logic, different return and fallback:
- *   core hermitDir    (scripts/lib/cc-compat.ts)              → the .cch dir (this file)
- *   HA   projectRoot  (homeassistant-hermit/src/config.ts)    → the project root (parent)
- *   dev  findHermitDir(dev-hermit/scripts/git-push-guard.ts)  → the .cch dir or null
+ *   core hermitDir    (scripts/lib/cc-compat.ts)                    → the .cch dir (this file)
+ *   HA   projectRoot  (homeassistant-hermit/src/config.ts)          → the project root (parent)
+ *   dev  findHermitDir(dev-hermit/scripts/lib/find-hermit-dir.ts)   → the .cch dir or null
  * INVARIANT: hermitDir() === path.join(projectRoot(), '.claude-code-hermit').
  * Fix one (env-var precedence, iteration cap) → check the other two.
  *
diff --git a/plugins/claude-code-hermit/scripts/micro-proposal.ts b/plugins/claude-code-hermit/scripts/micro-proposal.ts
index d65ac985..f28bb618 100644
--- a/plugins/claude-code-hermit/scripts/micro-proposal.ts
+++ b/plugins/claude-code-hermit/scripts/micro-proposal.ts
@@ -5,15 +5,26 @@
 // Usage:
 //   bun micro-proposal.ts <hermit-state-dir> resolve <MP-id> --action approved|rejected|answered|expired [--answer "<label>"]
 //   bun micro-proposal.ts <hermit-state-dir> nudge <MP-id>
+//   bun micro-proposal.ts <hermit-state-dir> brief-cycle
 // Output (stdout, one line):
 //   RESOLVED|<id>|<action>
 //   NUDGED|<id>|<follow_up_count>
 //   NONE|no-match
+//   brief-cycle: JSON {"new":[{id,tier,question,options}],
+//                      "renudged":[{id,tier,question,options,follow_up_count}],
+//                      "expired":[{id,question}]}
+// brief-cycle ages the whole queue in one pass so the brief skills drive the
+// count-0/1/2+ lifecycle through one call instead of one per entry: count-0
+// entries are reported for first display (not mutated), count-1 entries reported
+// and re-nudged (bumped to 2), count>=2 entries expired. One atomic write (only
+// when something changed), one micro-resolved ledger line per expiry.
 // Exit 1 (+ stderr) on: unparseable micro-proposals.json (never overwritten),
 // unknown verb/action, a missing/flag-shaped <MP-id>, missing --action, or a
 // ledger-append failure. Every malformed invocation fails loud rather than
 // exiting 0 on `NONE|no-match` — a silent no-op is the failure mode this script
-// exists to remove.
+// exists to remove. (Targeted resolve/nudge keep `NONE|no-match` exit 0 for a
+// well-formed but absent id — channel-responder's benign double-resolve relies
+// on it; brief-cycle never emits NONE.)
 // Implements channel-responder/SKILL.md § Micro-approval response and
 // brief/SKILL.md's MP lifecycle step.
 
@@ -38,7 +49,14 @@ function fail(msg: string): never {
   process.exit(1);
 }
 
-if (!stateDir || !verb || !id) {
+if (!stateDir || !verb) {
+  fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>] | brief-cycle');
+}
+
+// brief-cycle takes no <MP-id> — dispatch it before the id requirement below.
+if (verb === 'brief-cycle') briefCycle(stateDir);
+
+if (!id) {
   fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>]');
 }
 
@@ -47,6 +65,57 @@ function flag(name: string): string | undefined {
   return i === -1 ? undefined : process.argv[i + 1];
 }
 
+// Age the whole pending queue in one pass. Bucketing mirrors the per-entry rules
+// the brief skills used to issue one call at a time: count 0 -> report only,
+// count 1 -> report + bump to 2, count >=2 -> expire. Ledger lines are appended
+// only after the queue write lands (same ordering as the resolve path).
+function briefCycle(dir: string): never {
+  const mp = path.join(dir, 'state', 'micro-proposals.json');
+  const r = readMicroProposals(mp);
+  if (r.status === 'corrupt') fail(`${r.error} — refusing to write. Repair it first.`);
+  const data: Json = r.status === 'missing' ? { pending: [] } : r.data;
+  // readMicroProposals guarantees data.pending is an array on 'ok' (non-array is
+  // 'corrupt', bailed above; undefined/null is healed to []), and 'missing' set [].
+  const pending: Json[] = data.pending;
+
+  const fresh: Json[] = [];
+  const renudged: Json[] = [];
+  const expired: Json[] = [];
+  const kept: Json[] = [];
+
+  for (const e of pending) {
+    const c = typeof e.follow_up_count === 'number' ? e.follow_up_count : 0;
+    if (c >= 2) {
+      expired.push({ id: e.id, question: e.question });
+      continue; // dropped from the queue
+    }
+    // `tier` rides along: the brief skills render "MP-… (tier N): <question>" and
+    // are told not to re-read the queue file, so the verdict is their only source.
+    if (c === 1) {
+      e.follow_up_count = 2;
+      renudged.push({ id: e.id, tier: e.tier, question: e.question, options: e.options, follow_up_count: 2 });
+    } else {
+      fresh.push({ id: e.id, tier: e.tier, question: e.question, options: e.options });
+    }
+    kept.push(e);
+  }
+
+  // Only write when the queue actually changed (a re-nudge bump or an expiry
+  // removal). An all-count-0 queue is a pure read — no write, no ledger.
+  if (renudged.length > 0 || expired.length > 0) {
+    data.pending = kept;
+    writeFileAtomic(mp, JSON.stringify(data, null, 2) + '\n');
+    const ledger = path.join(dir, 'state', 'proposal-metrics.jsonl');
+    for (const e of expired) {
+      const event: Json = { ts: utcISOStamp(), type: 'micro-resolved', micro_id: e.id, action: 'expired', question: e.question };
+      const err = appendJsonlLine(ledger, JSON.stringify(event));
+      if (err) fail(`${err} — the queue write landed but the micro-resolved event for ${e.id} was NOT recorded. Do not re-run; append it by hand.`);
+    }
+  }
+
+  emit(JSON.stringify({ new: fresh, renudged, expired }));
+}
+
 // Validate the whole invocation before touching disk. Otherwise a dropped id
 // (`resolve --action approved`) makes `--action` the id, misses, and exits 0 on
 // NONE|no-match — the entry stays pending and the caller believes it resolved.
diff --git a/plugins/claude-code-hermit/skills/brief/SKILL.md b/plugins/claude-code-hermit/skills/brief/SKILL.md
index 03e08289..bf5afe34 100644
--- a/plugins/claude-code-hermit/skills/brief/SKILL.md
+++ b/plugins/claude-code-hermit/skills/brief/SKILL.md
@@ -67,11 +67,11 @@ Emphasize forward-looking content. Compose from runner JSON (see Dispatch above)
 - If `config.always_on` is `true`: run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/check-upgrade.sh" "${CLAUDE_PLUGIN_ROOT}"` from the project root. If it emits an `---Upgrade Available---` section, append a final line to the brief: `⚠ Plugin update available: <the version line>` (pass the directive verbatim). Output nothing if the script is silent. (Interactive operators already see this notice at session-start step 2; the gate avoids double-notification.)
 
 <!-- keep in sync with plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md step 9a — same MP lifecycle protocol -->
-After composing the morning brief, check `state/micro-proposals.json → pending` for entries with `status: "pending"` **(fresh read — re-read the file(s) now; do not reuse a value cached in context from before compaction)**:
-- If **one or more** pending entries with `follow_up_count` of 0: append each as a final line. Entries without `options`: `MP-YYYYMMDD-N (tier N): [question]` — Reply `"MP-YYYYMMDD-N yes"` or `"MP-YYYYMMDD-N no"`. (Bare `yes`/`no` accepted when only one pending.) Entries with `options`: render them numbered under the question and reply hint `Reply "MP-YYYYMMDD-N <number or label>"` (bare accepted when only one pending).
-- For any entry with `follow_up_count` of 1: append with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] — ignore again to drop it" (if the entry has `options`, re-render them numbered beneath it so the choices aren't lost on the re-nudge). Run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit nudge <id>`.
-- For any entry with `follow_up_count` >= 2: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action expired` (removes the entry and appends the `micro-resolved` event in one call — never hand-edit `state/micro-proposals.json`). Do not resurrect unless fresh evidence accumulates from scratch.
-- If no pending entries: brief ends without a decision prompt.
+After composing the morning brief, age the micro-proposal queue in one pass: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit brief-cycle`. It reads `state/micro-proposals.json`, runs the whole lifecycle atomically (re-nudges `follow_up_count` 1 entries, expires `follow_up_count` ≥2 entries and records each expiry), and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}` — never hand-edit the file or read it separately. Render straight from that verdict:
+- Each `new` entry (first display): append as a final line. Without `options`: `MP-YYYYMMDD-N (tier N): [question]` — Reply `"MP-YYYYMMDD-N yes"` or `"MP-YYYYMMDD-N no"`. (Bare `yes`/`no` accepted when only one pending.) With `options`: render them numbered under the question and reply hint `Reply "MP-YYYYMMDD-N <number or label>"` (bare accepted when only one pending).
+- Each `renudged` entry: append with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] — ignore again to drop it" (if it carries `options`, re-render them numbered beneath it so the choices aren't lost on the re-nudge).
+- `expired` entries were dropped this cycle — do not surface them, and do not resurrect unless fresh evidence accumulates from scratch.
+- If `new` and `renudged` are both empty: brief ends without a decision prompt.
 
 ### --evening (routine mode)
 
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index 6161d7bf..ec2caff4 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -578,6 +578,8 @@ Merge these into the target file:
       "Bash(bun */scripts/session-archive.ts*)",
       "Bash(bun */scripts/routine-precheck.ts*)",
       "Bash(bun */scripts/cron-registry.ts*)",
+      "Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)",
+      "Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)",
       "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
       "Edit(.claude-code-hermit/**)"
     ]
@@ -588,7 +590,8 @@ Merge these into the target file:
 **Why each one:**
 
 - `git diff`, `git status`, `git log` — session-diff.ts hook auto-populates `## Changed` in SHELL.md
-- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `next-prop-id.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, ID generation, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via the `../claude-code-hermit/scripts/` sibling path) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `next-prop-id.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, ID generation, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via `.claude-code-hermit/bin/hermit-run`) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `.claude-code-hermit/bin/hermit-run micro-proposal *` / `proposal-metrics-report *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. The space before `*` is a word boundary — matches `micro-proposal brief-cycle`, not a `micro-proposal…`-prefixed name — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
 - `bash -c 'AGENT_DIR=...` — SessionStart hook that loads session context on every startup
 - `Edit` on `.claude-code-hermit/**` — heartbeat appends to SHELL.md, increments config.json tick counter, and skills update session state without prompting (Edit rules cover all file-editing tools, including Write)
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
index e404e3c5..8bbdaa0f 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
@@ -226,7 +226,13 @@ Same logic as init step 8, but target the file determined by `hatch_target` (res
 - `hatch_target == "local"` → `.claude/settings.local.json`
 - `hatch_target == "committed"` → `.claude/settings.json`
 
-Check the target settings file for the plugin's required permissions (`git diff/status/log`, per-script `bun` entries, the SessionStart `bash -c` hook, and `Edit`/`Write` on `.claude-code-hermit/**`). The required entries are: `cost-tracker.ts`, `evaluate-session.ts`, `append-metrics.ts`, `resolve-prop.ts`, `next-prop-id.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `generate-summary.ts`, `proposals-index.ts`, `cron-tz-shift.ts`, `archive-shell.ts`, `evolve-plan.ts`, `evolve-finalize.ts`, `manifest-seed.ts`. **Delegated mode: add any missing entries without asking** (a missing `bun` permission breaks hooks, so this is non-optional), and collect them for the step-10 report. Only add missing entries — never remove existing ones. If all are already present, skip silently. Also remove stale permissions from previous versions if found in the target file:
+Delegate the additive permission merge to core's sealed writer rather than hand-enumerating the list here — `apply-settings.ts` holds the canonical `HERMIT_ALLOW` (so it can't drift from what `hatch` installs), writes via `fs` (so it works even under the strict hook profile, where an `Edit`/`Write` to `.claude/settings*.json` is denied), and is idempotent:
+
+```bash
+bun ${plugin_root}/scripts/apply-settings.ts <resolved-settings-file> allow
+```
+
+where `<resolved-settings-file>` is `.claude/settings.local.json` (local) or `.claude/settings.json` (committed) per `hatch_target`, and `${plugin_root}` is the baked absolute plugin root. It prints one `allow: <entry>` line per newly-added permission (silent when everything is already present) — collect those for the step-10 report; if it prints nothing, the report notes no permission changes. **Delegated mode: run it without asking** (a missing `bun` permission breaks hooks, so this is non-optional); it only ever adds, never removes. (On a hermit whose allow-list predates `apply-settings.ts` itself, this command may hit a permission gate inside this subagent, which can't prompt — relay that to the step-10 report so the operator can add `Bash(bun */scripts/apply-settings.ts*)` and re-run, rather than wedging.) Separately, remove stale permissions from previous versions if found in the target file:
 
 - `Bash(python3:*)`, `Bash(node:*)` — replaced by scoped bun entries
 - `Edit(.claude/.claude-code-hermit/**)`, `Write(.claude/.claude-code-hermit/**)` — replaced by `.claude-code-hermit/**` (v0.0.6 path change)
diff --git a/plugins/claude-code-hermit/state-templates/bin/hermit-run b/plugins/claude-code-hermit/state-templates/bin/hermit-run
index ad5263fb..394bea1e 100755
--- a/plugins/claude-code-hermit/state-templates/bin/hermit-run
+++ b/plugins/claude-code-hermit/state-templates/bin/hermit-run
@@ -24,25 +24,51 @@ fi
 
 PLUGIN_ROOT=""
 
-# 1. Env var (set by docker-entrypoint)
+# Confirm a directory carries the claude-code-hermit plugin manifest.
+_is_core_root() {
+  [ -f "$1/.claude-plugin/plugin.json" ] || return 1
+  local n
+  n=$(grep -o '"name"[^,]*' "$1/.claude-plugin/plugin.json" 2>/dev/null | head -1 | cut -d'"' -f4)
+  [ "$n" = "claude-code-hermit" ]
+}
+
+# 1. Env var (set by docker-entrypoint) — accepted only if it actually points at
+# core's plugin root. A stale/foreign value is ignored (not fatal), so a bad hint
+# never boots the wrong tree and never blocks the scan below.
 if [ -n "${HERMIT_PLUGIN_ROOT:-}" ] && [ -d "$HERMIT_PLUGIN_ROOT" ]; then
-  PLUGIN_ROOT="$HERMIT_PLUGIN_ROOT"
+  if _is_core_root "$HERMIT_PLUGIN_ROOT"; then
+    PLUGIN_ROOT="$HERMIT_PLUGIN_ROOT"
+  else
+    echo "[hermit] HERMIT_PLUGIN_ROOT does not point at claude-code-hermit; ignoring: $HERMIT_PLUGIN_ROOT" >&2
+  fi
 fi
 
 # 2. Scan marketplace cache for the claude-code-hermit plugin under
 # plugins/<name>/ (monorepo layout — gtapps/claude-code-hermit ships as a
-# multi-plugin marketplace).
+# multi-plugin marketplace). Collect ALL matches and fail loud on ambiguity
+# (two marketplaces shipping core) rather than silently taking glob order.
 if [ -z "$PLUGIN_ROOT" ]; then
   SEARCH_BASE="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
   _old_nullglob=$(shopt -p nullglob 2>/dev/null || true)
   shopt -s nullglob
+  _matches=()
   for d in "$SEARCH_BASE"/plugins/marketplaces/*/plugins/*/; do
-    if [ -d "$d/scripts" ] && [ -f "$d/.claude-plugin/plugin.json" ]; then
-      FOUND_NAME=$(grep -o '"name"[^,]*' "$d/.claude-plugin/plugin.json" 2>/dev/null | head -1 | cut -d'"' -f4)
-      [ "$FOUND_NAME" = "claude-code-hermit" ] && PLUGIN_ROOT="${d%/}" && break
+    if [ -d "$d/scripts" ] && _is_core_root "${d%/}"; then
+      _matches+=("${d%/}")
     fi
   done
   $_old_nullglob
+  # Each glob match is a distinct marketplace/plugin path, so _matches never holds
+  # duplicates — count the array directly instead of a sort -u no-op on the boot path.
+  if [ "${#_matches[@]}" -gt 0 ]; then
+    if [ "${#_matches[@]}" -gt 1 ]; then
+      echo "[hermit] Ambiguous claude-code-hermit install — multiple marketplaces provide it:" >&2
+      printf '[hermit]   %s\n' "${_matches[@]}" >&2
+      echo "[hermit] Set HERMIT_PLUGIN_ROOT to the one to use." >&2
+      exit 1
+    fi
+    PLUGIN_ROOT="${_matches[0]}"
+  fi
 fi
 
 if [ -z "$PLUGIN_ROOT" ] || [ ! -d "$PLUGIN_ROOT" ]; then
diff --git a/plugins/claude-code-hermit/tests/contracts.test.ts b/plugins/claude-code-hermit/tests/contracts.test.ts
index 950db21e..af9d61dd 100644
--- a/plugins/claude-code-hermit/tests/contracts.test.ts
+++ b/plugins/claude-code-hermit/tests/contracts.test.ts
@@ -2822,3 +2822,26 @@ describe('proposal lifecycle: no tool-mediated state writes', () => {
     expect(proposalAct).not.toMatch(/Write tool|Edit the/);
   });
 });
+
+// hermit-evolve Step 8 must delegate the permission merge to apply-settings.ts
+// rather than re-enumerate the allow-list in prose — the hand-maintained list had
+// already drifted (15 of 28 entries) and instructed a Write rule the writer strips.
+describe('hermit-evolve permission delegation contract', () => {
+  const evolveRef = fs.readFileSync(path.join(SKILLS, 'hermit-evolve', 'reference.md'), 'utf-8');
+
+  test('Step 8 delegates to apply-settings.ts allow', () => {
+    expect(evolveRef).toMatch(/apply-settings\.ts <resolved-settings-file> allow/);
+  });
+
+  test('Step 8 no longer hand-enumerates the per-script allow-list', () => {
+    // The removed prose opened with this phrase before listing scripts by name.
+    expect(evolveRef).not.toContain('The required entries are:');
+    // A couple of the previously-enumerated script names must not reappear as an
+    // inline permission list (they may still appear elsewhere in the file).
+    const step8 = evolveRef.slice(
+      evolveRef.indexOf('### 8. Ensure plugin permissions'),
+      evolveRef.indexOf('### 9. Write updated config'),
+    );
+    expect(step8).not.toContain('`queue-micro-proposal.ts`, `micro-proposal.ts`');
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/evolve-plan.test.ts b/plugins/claude-code-hermit/tests/evolve-plan.test.ts
index f86bb810..be8e922e 100644
--- a/plugins/claude-code-hermit/tests/evolve-plan.test.ts
+++ b/plugins/claude-code-hermit/tests/evolve-plan.test.ts
@@ -682,12 +682,13 @@ test('leak guard: duplicate hermit names in plugin list — only project-effecti
   }
 }));
 
-test('leak guard: scope precedence — project scope wins over local when both match', withProj(async (proj) => {
+test('leak guard: scope precedence — local scope wins over project when both match', withProj(async (proj) => {
   writeConfig(proj, JSON.stringify({
     _hermit_versions: { 'claude-code-hermit': '1.1.7', 'claude-code-dev-hermit': '0.4.1' },
   }));
   // Two entries for same sibling at same projectPath: one local, one project scope.
-  // Project scope should win (and SP is at 0.4.3).
+  // Local scope should win (local overrides project, matching resolve-siblings.ts);
+  // localSP is at 0.4.2.
   const localSP = fs.mkdtempSync(path.join(os.tmpdir(), 'hermit-local-sp-'));
   try {
     fs.mkdirSync(path.join(localSP, '.claude-plugin'), { recursive: true });
@@ -697,8 +698,8 @@ test('leak guard: scope precedence — project scope wins over local when both m
       { id: 'claude-code-dev-hermit@claude-code-hermit', version: '0.4.3', scope: 'project', enabled: true, installPath: SP, projectPath: proj },
     ]);
     const d = await runPlan(proj, 'local', pl);
-    expect(d.siblings[0].install_path).toBe(SP);
-    expect(d.siblings[0].to).toBe('0.4.3');
+    expect(d.siblings[0].install_path).toBe(localSP);
+    expect(d.siblings[0].to).toBe('0.4.2');
   } finally {
     try { fs.rmSync(localSP, { recursive: true, force: true }); } catch {}
   }
diff --git a/plugins/claude-code-hermit/tests/hermit-run.test.ts b/plugins/claude-code-hermit/tests/hermit-run.test.ts
new file mode 100644
index 00000000..3c9a53ae
--- /dev/null
+++ b/plugins/claude-code-hermit/tests/hermit-run.test.ts
@@ -0,0 +1,137 @@
+// Resolver coverage for the boot dispatcher pair: state-templates/bin/hermit-run
+// (finds core's plugin root) and scripts/hermit-exec.sh (maps a logical name to a
+// script, rejecting traversal). Spawning bash is intentional — these run at boot,
+// before any TypeScript is loaded, and the process boundary is what we assert on.
+
+import { test, expect, describe } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { PLUGIN_ROOT, RunResult } from './helpers/run';
+
+const HERMIT_RUN = path.join(PLUGIN_ROOT, 'state-templates', 'bin', 'hermit-run');
+const HERMIT_EXEC = path.join(PLUGIN_ROOT, 'scripts', 'hermit-exec.sh');
+
+async function bash(script: string, args: string[], env: Record<string, string>): Promise<RunResult> {
+  const proc = Bun.spawn({
+    cmd: ['bash', script, ...args],
+    env: { PATH: process.env.PATH ?? '', ...env },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { exitCode, stdout, stderr };
+}
+
+// A fake core plugin root: manifest with the given name + a stub hermit-exec.sh
+// that prints which root hermit-run resolved (so the test can assert on selection).
+function mkCoreRoot(dir: string, name = 'claude-code-hermit'): string {
+  fs.mkdirSync(path.join(dir, '.claude-plugin'), { recursive: true });
+  fs.mkdirSync(path.join(dir, 'scripts'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '.claude-plugin', 'plugin.json'), JSON.stringify({ name, version: '9.9.9' }));
+  fs.writeFileSync(
+    path.join(dir, 'scripts', 'hermit-exec.sh'),
+    '#!/usr/bin/env bash\necho "RESOLVED:$(cd "$(dirname "$0")/.." && pwd)"\n',
+  );
+  return dir;
+}
+
+// A hatched project whose bin/hermit-run is the real hardened script under test.
+function mkProject(root: string, withConfig = true): string {
+  const bin = path.join(root, '.claude-code-hermit', 'bin');
+  fs.mkdirSync(bin, { recursive: true });
+  fs.copyFileSync(HERMIT_RUN, path.join(bin, 'hermit-run'));
+  if (withConfig) fs.writeFileSync(path.join(root, '.claude-code-hermit', 'config.json'), '{}');
+  return path.join(bin, 'hermit-run');
+}
+
+function tmp(prefix: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+describe('hermit-run resolver', () => {
+  test('missing config.json → exit 1, points at hatch', async () => {
+    const proj = tmp('hr-noconf-');
+    const runPath = mkProject(proj, false);
+    const r = await bash(runPath, ['whatever'], { CLAUDE_CONFIG_DIR: tmp('hr-empty-') });
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('No config found');
+  });
+
+  test('scan resolves a single marketplace core install', async () => {
+    const proj = tmp('hr-single-');
+    const runPath = mkProject(proj);
+    const cfg = tmp('hr-cfg-');
+    const core = mkCoreRoot(path.join(cfg, 'plugins', 'marketplaces', 'mp1', 'plugins', 'claude-code-hermit'));
+    const r = await bash(runPath, ['probe'], { CLAUDE_CONFIG_DIR: cfg });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain(`RESOLVED:${fs.realpathSync(core)}`);
+  });
+
+  test('two marketplaces shipping core → ambiguity exit 1', async () => {
+    const proj = tmp('hr-ambig-');
+    const runPath = mkProject(proj);
+    const cfg = tmp('hr-cfg2-');
+    mkCoreRoot(path.join(cfg, 'plugins', 'marketplaces', 'mpA', 'plugins', 'claude-code-hermit'));
+    mkCoreRoot(path.join(cfg, 'plugins', 'marketplaces', 'mpB', 'plugins', 'claude-code-hermit'));
+    const r = await bash(runPath, ['probe'], { CLAUDE_CONFIG_DIR: cfg });
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('Ambiguous');
+  });
+
+  test('valid HERMIT_PLUGIN_ROOT is used directly', async () => {
+    const proj = tmp('hr-env-');
+    const runPath = mkProject(proj);
+    const envRoot = mkCoreRoot(tmp('hr-envroot-'));
+    const r = await bash(runPath, ['probe'], {
+      CLAUDE_CONFIG_DIR: tmp('hr-empty2-'),
+      HERMIT_PLUGIN_ROOT: envRoot,
+    });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain(`RESOLVED:${fs.realpathSync(envRoot)}`);
+  });
+
+  test('foreign HERMIT_PLUGIN_ROOT is ignored, scan wins', async () => {
+    const proj = tmp('hr-envbad-');
+    const runPath = mkProject(proj);
+    const foreign = mkCoreRoot(tmp('hr-foreign-'), 'some-other-plugin');
+    const cfg = tmp('hr-cfg3-');
+    const core = mkCoreRoot(path.join(cfg, 'plugins', 'marketplaces', 'mp1', 'plugins', 'claude-code-hermit'));
+    const r = await bash(runPath, ['probe'], { CLAUDE_CONFIG_DIR: cfg, HERMIT_PLUGIN_ROOT: foreign });
+    expect(r.exitCode).toBe(0);
+    expect(r.stderr).toContain('does not point at claude-code-hermit');
+    expect(r.stdout).toContain(`RESOLVED:${fs.realpathSync(core)}`);
+  });
+});
+
+describe('hermit-exec.sh name guard', () => {
+  test('path traversal is rejected', async () => {
+    const r = await bash(HERMIT_EXEC, ['micro-proposal/../../etc'], {});
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('Invalid script name');
+  });
+
+  test('bare double-dot is rejected', async () => {
+    const r = await bash(HERMIT_EXEC, ['..'], {});
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('Invalid script name');
+  });
+
+  test('unknown bare name → exit 1 with predate hint', async () => {
+    const r = await bash(HERMIT_EXEC, ['definitely-not-a-real-script'], {});
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('may predate this command');
+  });
+
+  test('a real script name dispatches to bun', async () => {
+    // micro-proposal.ts with no args prints its own usage and exits 1 — proof the
+    // name resolved to scripts/micro-proposal.ts and bun ran it.
+    const r = await bash(HERMIT_EXEC, ['micro-proposal'], {});
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout + r.stderr).toContain('micro-proposal.ts');
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index 8187e264..80ec425b 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -1766,6 +1766,56 @@ describe('micro-proposal', () => {
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
+
+  test('brief-cycle buckets 0/1/2+ in one pass: verdict + single write + one expiry ledger line', withDir(async (dir) => {
+    const c0 = { id: 'MP-c0', tier: 1, status: 'pending', follow_up_count: 0, question: 'q0', options: ['a', 'b'] };
+    const c1 = { id: 'MP-c1', tier: 1, status: 'pending', follow_up_count: 1, question: 'q1' };
+    const c2 = { id: 'MP-c2', tier: 1, status: 'pending', follow_up_count: 2, question: 'q2' };
+    seed(dir, [c0, c1, c2]);
+    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    expect(r.exitCode).toBe(0);
+    const verdict = JSON.parse(r.stdout.trim());
+    // `tier` is carried through — the brief renders "(tier N)" from the verdict alone.
+    expect(verdict.new).toEqual([{ id: 'MP-c0', tier: 1, question: 'q0', options: ['a', 'b'] }]);
+    expect(verdict.renudged).toEqual([{ id: 'MP-c1', tier: 1, question: 'q1', follow_up_count: 2 }]);
+    expect(verdict.expired).toEqual([{ id: 'MP-c2', question: 'q2' }]);
+    // Queue: c0 untouched at 0, c1 bumped to 2, c2 removed.
+    const pending = microFile(dir).pending;
+    expect(pending.map((e: any) => e.id)).toEqual(['MP-c0', 'MP-c1']);
+    expect(pending.find((e: any) => e.id === 'MP-c0').follow_up_count).toBe(0);
+    expect(pending.find((e: any) => e.id === 'MP-c1').follow_up_count).toBe(2);
+    const events = ledger(dir);
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({ type: 'micro-resolved', micro_id: 'MP-c2', action: 'expired', question: 'q2' });
+  }));
+
+  test('brief-cycle on an all-count-0 queue is a pure read (no write, no ledger)', withDir(async (dir) => {
+    seed(dir, [entryA, entryB]);
+    const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
+    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    expect(r.exitCode).toBe(0);
+    const verdict = JSON.parse(r.stdout.trim());
+    expect(verdict.new).toHaveLength(2);
+    expect(verdict.renudged).toEqual([]);
+    expect(verdict.expired).toEqual([]);
+    expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
+    expect(fs.existsSync(hermit(dir, 'state', 'proposal-metrics.jsonl'))).toBe(false);
+  }));
+
+  test('brief-cycle on an absent file -> empty verdict, exit 0, no write', withDir(async (dir) => {
+    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    expect(r.exitCode).toBe(0);
+    expect(JSON.parse(r.stdout.trim())).toEqual({ new: [], renudged: [], expired: [] });
+    expect(fs.existsSync(hermit(dir, 'state', 'micro-proposals.json'))).toBe(false);
+  }));
+
+  test('brief-cycle on a corrupt file -> exit 1, file byte-unchanged', withDir(async (dir) => {
+    write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
+    const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
+    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    expect(r.exitCode).toBe(1);
+    expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
+  }));
 });
 
 // -------------------------------------------------------
diff --git a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
index 48439c0f..45dbd3cf 100644
--- a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
+++ b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
@@ -8,7 +8,10 @@
 ### Fixed
 - `domain-brainstorm` no longer writes its own `brainstorm-emit` event — core's triage gate already records every verdict. Proposals now carry `tags: [capability-brainstorm]` instead of `[domain-brainstorm, ideation]`, so they count toward the brainstorm kill-criteria segment rather than `reflect`'s.
 - `ha-boot` and `SAFETY.md` no longer point the operator at a `.env.example` that does not ship; replaced with a direct "create `.env`" instruction.
-- `ha-morning-brief`'s micro-proposal lifecycle now mutates `state/micro-proposals.json` through a `JSON.parse`/`JSON.stringify` round-trip and an atomic temp-file rename instead of editing it by hand, so neither a nudge, an expiry, nor a crash mid-write can corrupt the queue. A non-matching id exits non-zero instead of silently doing nothing.
+- `ha-morning-brief`'s micro-proposal lifecycle now runs in one `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle` call through core's writer (one atomic round-trip that re-nudges, expires, and records expiries), instead of two inline `bun -e` re-implementations of that writer — so a nudge, an expiry, or a crash mid-write can no longer corrupt the queue.
+
+### Changed
+- `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 
 ### Changed
 - The CLAUDE-APPEND block dropped §Environment (hatch owns `.env` setup and validates it via `boot status`), §Entry Flow, the channel-routing utterance examples, and the unified-vs-legacy routine narrative — per-install config state that drifts the moment an operator edits `config.json`. 9,565 B originally, 5,076 B after the first trim, now ~2,814 B.
diff --git a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
index fd2a9988..6e46d658 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand HA-voice brainstorm — reads entity inventory, automatio
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `bun scripts/proposal-metrics-report.ts .claude-code-hermit --source=capability-brainstorm` from the `claude-code-hermit` plugin root (not this plugin's; `${CLAUDE_PLUGIN_ROOT}` cannot reach it), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, cut this skill rather than tune it — signal-to-noise isn't there. That segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so a breach means brainstorm-generated proposals are noisy in general; it does not by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
index bc6ffc97..f6520ed9 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
@@ -55,19 +55,11 @@ When both `claude-code-hermit` and `claude-code-homeassistant-hermit` are instal
    - Read `.claude-code-hermit/cost-summary.md` if it exists — include yesterday's cost
 
 <!-- keep in sync with plugins/claude-code-hermit/skills/brief/SKILL.md — same MP lifecycle protocol -->
-9a. **Micro-proposals lifecycle** — Read `.claude-code-hermit/state/micro-proposals.json`. If the `pending` array is non-empty:
-   - Each entry with `follow_up_count` of 0: include in `Awaiting decision:` output (see Output Format). Do not mutate.
-   Never hand-edit `state/micro-proposals.json` — mutate it only with the commands below, which round-trip the whole file through `JSON.parse`/`JSON.stringify` and replace it atomically via a temp file + rename, matching core's writer (issue 649: a hand-edited removal left a trailing comma, corrupting the queue; a truncating in-place write would reopen the same hole on a mid-write crash). Both exit 1 without writing if the id doesn't match, so a silent no-op can't leave an entry stranded.
-   - Each entry with `follow_up_count` of 1: include in `Awaiting decision:` with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)", then bump the counter:
-     ```bash
-     bun -e 'const fs=require("fs"),p=".claude-code-hermit/state/micro-proposals.json",d=JSON.parse(fs.readFileSync(p,"utf8")),e=(d.pending||[]).find(x=>x.id===process.argv[1]);if(!e){console.error("no-match: "+process.argv[1]);process.exit(1)}e.follow_up_count=(e.follow_up_count||0)+1;const t=p+"."+process.pid+".tmp";fs.writeFileSync(t,JSON.stringify(d,null,2)+"\n");fs.renameSync(t,p)' -- "<id>"
-     ```
-   - Each entry with `follow_up_count` >= 2: drop it and record the expiry. The ledger line is appended only after the queue write lands, and the question text is passed as an argument so it can't inject into the JSON:
-     ```bash
-     bun -e 'const fs=require("fs"),p=".claude-code-hermit/state/micro-proposals.json",d=JSON.parse(fs.readFileSync(p,"utf8")),i=(d.pending||[]).findIndex(x=>x.id===process.argv[1]);if(i<0){console.error("no-match: "+process.argv[1]);process.exit(1)}const q=d.pending[i].question;d.pending.splice(i,1);const t=p+"."+process.pid+".tmp";fs.writeFileSync(t,JSON.stringify(d,null,2)+"\n");fs.renameSync(t,p);fs.appendFileSync(".claude-code-hermit/state/proposal-metrics.jsonl",JSON.stringify({ts:new Date().toISOString().slice(0,19)+"Z",type:"micro-resolved",micro_id:process.argv[1],action:"expired",question:q})+"\n")' -- "<id>"
-     ```
-     Core's `scripts/micro-proposal.ts` is deliberately not invoked here. HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/`, so no static `../claude-code-hermit/…` path reaches core's plugin root — the version segment is not knowable from skill text.
-   - If `pending` is empty: skip this step entirely.
+9a. **Micro-proposals lifecycle** — age the queue in one call: `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle`. This runs core's writer through the project-resident `bin/hermit-run`, which resolves core's plugin root (a static `../claude-code-hermit/…` path can't — HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/` and the version segment isn't knowable from skill text). It performs the whole `follow_up_count` 0/1/2+ lifecycle atomically (re-nudges count-1 entries, expires count-2+ entries, records each expiry) and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}`. Never hand-edit `state/micro-proposals.json`. Render from that verdict:
+   - Each `new` entry: include in `Awaiting decision:` output (see Output Format).
+   - Each `renudged` entry: include in `Awaiting decision:` with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)".
+   - `expired` entries were dropped this cycle — do not surface them.
+   - If `new` and `renudged` are both empty: skip this step entirely.
 
 10. **Compose brief** — Write a concise morning brief in the operator's language (from OPERATOR.md preferences). Use the format below.
 
@@ -111,9 +103,9 @@ Pending:
 - [proposals, queued tasks, or "Nothing pending"]
 
 Awaiting decision:
-- [follow_up_count 0: "MP-YYYYMMDD-N (tier N): [question] — Reply `MP-YYYYMMDD-N yes` or `MP-YYYYMMDD-N no`"]
-- [follow_up_count 1: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)"]
-- [Omit section entirely when no pending entries (count 0 or 1).]
+- [`new` entry: "MP-YYYYMMDD-N (tier N): [question] — Reply `MP-YYYYMMDD-N yes` or `MP-YYYYMMDD-N no`"]
+- [`renudged` entry: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)"]
+- [Omit section entirely when the step-9a verdict's `new` and `renudged` are both empty.]
 
 Cost:
 - [yesterday's cost if available; cost-spike alert if flagged by reflect]
diff --git a/tests/cross-plugin/automode-env.behavior.test.ts b/tests/cross-plugin/automode-env.behavior.test.ts
new file mode 100644
index 00000000..4c8afdfc
--- /dev/null
+++ b/tests/cross-plugin/automode-env.behavior.test.ts
@@ -0,0 +1,127 @@
+// Cross-plugin behavior guard for the automode-env.ts skeleton, which is
+// duplicated (deliberately — the entry payload differs per domain) across
+// fitness / scribe / HA. Instead of comparing source text, this runs each
+// plugin's script against the same fixture matrix and asserts the SHARED
+// behaviors stay in lockstep: the settings.local.json basename guard, $defaults
+// seeding, idempotent merge, sibling-key preservation, and the invalid-JSON
+// refusal (which none of the per-plugin suites cover today).
+//
+// Lives at the repo root (outside every plugin's `bun test` / run-all.sh
+// discovery) so it never blocks a plugin release; a dedicated path-scoped
+// workflow runs it when any automode-env.ts changes.
+
+import { test, expect, describe } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const ROOT = path.resolve(import.meta.dir, '../..');
+
+interface Spec {
+  name: string;
+  script: string;
+  env: Record<string, string>;
+  entrySubstr: string;
+}
+
+const SPECS: Spec[] = [
+  {
+    name: 'fitness',
+    script: path.join(ROOT, 'plugins/claude-code-fitness-hermit/scripts/automode-env.ts'),
+    env: {},
+    entrySubstr: 'www.strava.com',
+  },
+  {
+    name: 'scribe',
+    script: path.join(ROOT, 'plugins/hermit-scribe/scripts/automode-env.ts'),
+    env: { HERMIT_GH_REPO: 'octo/widget' },
+    entrySubstr: 'octo/widget',
+  },
+  {
+    name: 'ha',
+    script: path.join(ROOT, 'plugins/claude-code-homeassistant-hermit/scripts/automode-env.ts'),
+    env: { HOMEASSISTANT_URL: 'http://ha.example:8123' },
+    entrySubstr: 'ha.example:8123',
+  },
+];
+
+// Clean env: only PATH/HOME plus the spec's extras, so an ambient HOMEASSISTANT_*
+// on the dev box can't leak into HA's resolution.
+async function run(script: string, target: string, extra: Record<string, string>) {
+  const proc = Bun.spawn({
+    cmd: ['bun', script, target],
+    env: { PATH: process.env.PATH ?? '', HOME: process.env.HOME ?? '', ...extra },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { stdout, stderr, exitCode };
+}
+
+function tmp(): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'automode-env-'));
+}
+
+for (const spec of SPECS) {
+  describe(`automode-env shared behavior — ${spec.name}`, () => {
+    test('fresh file seeds $defaults + the domain entry', async () => {
+      const target = path.join(tmp(), 'settings.local.json');
+      const r = await run(spec.script, target, spec.env);
+      expect(r.exitCode).toBe(0);
+      const written = JSON.parse(fs.readFileSync(target, 'utf8'));
+      expect(written.autoMode.environment[0]).toBe('$defaults');
+      expect(written.autoMode.environment.some((e: string) => e.includes(spec.entrySubstr))).toBe(true);
+    });
+
+    test('is idempotent (no duplicate entry on a second run)', async () => {
+      const target = path.join(tmp(), 'settings.local.json');
+      await run(spec.script, target, spec.env);
+      await run(spec.script, target, spec.env);
+      const written = JSON.parse(fs.readFileSync(target, 'utf8'));
+      expect(written.autoMode.environment).toHaveLength(2); // $defaults + one entry
+    });
+
+    test('refuses a target that is not settings.local.json', async () => {
+      const target = path.join(tmp(), 'settings.json');
+      const r = await run(spec.script, target, spec.env);
+      expect(r.exitCode).toBe(1);
+      expect(r.stderr).toContain('settings.local.json');
+      expect(fs.existsSync(target)).toBe(false);
+    });
+
+    test('refuses invalid JSON without overwriting it', async () => {
+      const target = path.join(tmp(), 'settings.local.json');
+      fs.writeFileSync(target, '{ not: valid json,');
+      const before = fs.readFileSync(target, 'utf8');
+      const r = await run(spec.script, target, spec.env);
+      expect(r.exitCode).toBe(1);
+      expect(r.stderr).toContain('Refusing to overwrite');
+      expect(fs.readFileSync(target, 'utf8')).toBe(before);
+    });
+
+    test('preserves unrelated sibling keys', async () => {
+      const target = path.join(tmp(), 'settings.local.json');
+      fs.writeFileSync(target, JSON.stringify({ env: { KEEP: 'me' } }));
+      const r = await run(spec.script, target, spec.env);
+      expect(r.exitCode).toBe(0);
+      const written = JSON.parse(fs.readFileSync(target, 'utf8'));
+      expect(written.env.KEEP).toBe('me');
+      expect(written.autoMode.environment.some((e: string) => e.includes(spec.entrySubstr))).toBe(true);
+    });
+  });
+}
+
+describe('automode-env HA-specific: SKIP with no configured HA URL', () => {
+  test('emits SKIP and writes nothing when no host resolves', async () => {
+    const target = path.join(tmp(), 'settings.local.json');
+    // Empty CLAUDE_PROJECT_DIR (no .env) + no HOMEASSISTANT_* in env.
+    const r = await run(SPECS[2].script, target, { CLAUDE_PROJECT_DIR: tmp() });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('SKIP|no HA URL configured');
+    expect(fs.existsSync(target)).toBe(false);
+  });
+});