diff --git a/.claude/settings.json b/.claude/settings.json
index b40e0dad..03c5d4e4 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -3,7 +3,7 @@
     "allow": [
       "Bash(gh issue:*)",
       "Bash(node */skills/hermit-scribe/file-issue.js*)",
-      "Bash(node */scripts/cron-tz-shift.js *)",
+      "Bash(bun */scripts/routines.ts tz-shift *)",
       "Bash(node */scripts/resolve-outbound-channel.js *)"
     ],
     "deny": []
diff --git a/.claude/skills/stale-proposals/SKILL.md b/.claude/skills/stale-proposals/SKILL.md
index 468e8bb0..aa32bc79 100644
--- a/.claude/skills/stale-proposals/SKILL.md
+++ b/.claude/skills/stale-proposals/SKILL.md
@@ -62,7 +62,7 @@ Skip this entire step under `--no-apply`.
 For each `SHIPPED-STRONG` verdict, resolve the ID to a filename, then close it the same way `/claude-code-hermit:proposal-act` does — the metrics event goes first so the summary regen reflects it:
 
 ```bash
-bun plugins/claude-code-hermit/scripts/resolve-prop.ts .claude-code-hermit "<PROP-ID>"
+bun plugins/claude-code-hermit/scripts/proposal.ts resolve-id .claude-code-hermit "<PROP-ID>"
 
 bun plugins/claude-code-hermit/scripts/append-metrics.ts \
     .claude-code-hermit/state/proposal-metrics.jsonl \
@@ -76,7 +76,7 @@ HERMIT_PATCH
 
 Writing the evidence into the Decision line is what makes an automatic flip auditable: the operator can later see exactly which bullet closed the proposal and reopen it if the match was wrong.
 
-`resolve-prop.ts` returning `AMBIGUOUS` or `NONE` means don't guess — move that proposal into the Step 4 list instead. `proposal.ts` returning `ERROR|<reason>` means nothing was patched; report it and continue with the rest.
+`proposal.ts resolve-id` returning `AMBIGUOUS` or `NONE` means don't guess — move that proposal into the Step 4 list instead. `proposal.ts` returning `ERROR|<reason>` means nothing was patched; report it and continue with the rest.
 
 ## Step 4 — Ask about the rest
 
diff --git a/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
index f25928d6..f500913a 100644
--- a/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
@@ -1,7 +1,7 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   },
   "min_claude_code_version": ">=2.1.172"
 }
diff --git a/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json b/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
index 4beece81..af5711bb 100644
--- a/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
@@ -4,7 +4,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ],
   "description": "Language-agnostic safety layer + dev conventions for any agent your hermit uses to write code",
diff --git a/plugins/claude-code-dev-hermit/CHANGELOG.md b/plugins/claude-code-dev-hermit/CHANGELOG.md
index 251630dc..9693f69f 100644
--- a/plugins/claude-code-dev-hermit/CHANGELOG.md
+++ b/plugins/claude-code-dev-hermit/CHANGELOG.md
@@ -8,6 +8,7 @@
 - `hatch`'s CLAUDE-APPEND version gate said to "extract the stamped version from the existing block", but no template or renderer ever wrote a version into the block — the gate degenerated to marker-present-only, so a plugin version bump alone never refreshed an already-hatched install. It now reads the stamp from `_hermit_versions["claude-code-dev-hermit"]` in `config.json`, which `hatch` itself already writes on every run.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - The CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-dev-hermit: Development Workflow -->`), placed outside both mode regions so it survives both renderings. Lets core's `hermit-evolve` bound the block exactly instead of a heuristic that used to mistake the template's own `<!-- mode:standard-only -->` annotation for the block marker.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - §Tests Before PR folded into §Implementation Flow (both stated one ordering, and `dev-pr` Gate 0 enforces the test-freshness half mechanically), the slug algorithm and its worked examples became one naming line, and the harness built-ins left §Dev Quick Reference. Rendered standard block 9,330 B → ~6,158 B, safety 6,338 B → ~4,703 B. No git-safety rule was removed.
diff --git a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
index 0e344a20..4ae9a7a6 100644
--- a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand dev-voice brainstorm — reads codebase friction signals
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
index 77e21845..a91e590c 100644
--- a/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
@@ -1,6 +1,6 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   }
 }
diff --git a/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json b/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
index 1d50763d..12c7f85f 100644
--- a/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
@@ -4,7 +4,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ],
   "description": "Fitness/training layer for claude-code-hermit — Strava MCP integration, activity analysis skills, and routine templates for an autonomous training assistant",
diff --git a/plugins/claude-code-fitness-hermit/CHANGELOG.md b/plugins/claude-code-fitness-hermit/CHANGELOG.md
index bacb0313..1b78a53b 100644
--- a/plugins/claude-code-fitness-hermit/CHANGELOG.md
+++ b/plugins/claude-code-fitness-hermit/CHANGELOG.md
@@ -11,6 +11,7 @@
 - `hatch` no longer tells the operator to `cp .env.example .env`; a `.env.example` does not ship with the plugin.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - `strava-sync` and `strava-health-check` routines removed — `fitness-brief` (morning + evening) now owns Strava connectivity, activity sync, RPE binding, and Run deep-dive as the plugin's two daily beats.
 - Activity notes carry `cardiac_drift_bpm` in frontmatter; `weekly-patterns` reads it there and falls back to the rendered line for older notes.
diff --git a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
index c39c843d..585a181d 100644
--- a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand fitness-voice brainstorm — reads Strava history and tra
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
index 60c1e903..060cd813 100644
--- a/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
@@ -4,7 +4,7 @@
   "credentials": [
     {
       "name": "setup-token",
-      "expiry_probe": "bun ${CLAUDE_PLUGIN_ROOT}/scripts/setup-token-probe.ts",
+      "expiry_probe": "bun ${CLAUDE_PLUGIN_ROOT}/scripts/setup-token-mint.ts probe",
       "warn_days": 14,
       "reauth_skill": "/claude-code-hermit:relogin"
     }
diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 544035a4..d0f57716 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -5,10 +5,12 @@
 ### Added
 - Channel-originated harness commands: an exact `/model <arg>`, `/effort <arg>`, `/compact`, or `/clear` from a trusted channel sender is recorded by a new `UserPromptSubmit` hook and typed into the session's pane when the turn ends. Args are passed through to Claude Code rather than checked against a fixed list, so new models and effort levels work without a plugin change.
 - `config.effort` — passed as `--effort` on every `hermit-start`, mirroring `config.model`, so a channel effort change reverts on restart instead of persisting. Ships `null` (no flag, model default); set it to opt into the revert-on-restart guarantee. Not the same lever as `config.env.CLAUDE_CODE_EFFORT_LEVEL`, which pins the session and makes a runtime `/effort` a no-op.
-- `micro-proposal.ts brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
-- Two `Bash(.claude-code-hermit/bin/hermit-run <script> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
+- `proposal.ts micro <dir> brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
+- Two `Bash(.claude-code-hermit/bin/hermit-run proposal <verb> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). Each is pinned to the one verb that plugin needs — a bare `hermit-run proposal *` would also expose `create`, `patch`, `shell-append`, `next-task` and `routine`. The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
+- `apply-settings.ts permissions-plan` and `permissions-sync` — the script now owns hermit's permission list end to end. `permissions-plan` prints `{"missing":[],"obsolete":[]}` without writing; `permissions-sync` applies it, adding sealed entries and removing only entries a previous plugin version shipped and has since retired. Operator-authored rules are never removed — deletion is filtered by a sealed registry, not by shape.
 
 ### Fixed
+- A pending shutdown is now terminal for the whole prompt path. When a shutdown send failed, the prompt used to fall through and an exact `status` message could still send and block on its own — discarding the shutdown relay instruction the model was supposed to act on. `pause`/`resume`/`snooze` and channel harness commands could likewise mutate session state mid-shutdown and get only a shutdown reply. Both were possible by construction in the seven-process shape, where no hook could see what another had done; the pipeline now answers the shutdown and stops.
 - A `/clear` reaching the pane outside the watchdog no longer skips the hermit's own reset bookkeeping. The runtime stamp, `SHELL.md` breadcrumb, and status-cache clear moved to `lib/context-reset.ts`; skipping the cache clear previously let the watchdog fire a spurious `/compact` against a freshly-cleared context.
 - Turn cost is attributed from the delivered prompt alone, not the whole turn's text. A routine id appearing in a turn's own tool output no longer captures that turn's cost — `heartbeat-restart`'s re-arm, whose `CronList`/`CronDelete` output names concrete routine ids, was billing $3-7 turns to unrelated routines. Corrects `cost-reflect` and cost exports too, not just `hermit-doctor`.
 - Subagent-completion turns are attributed to the routine that dispatched the agent, resolved through the notification's task/tool-use id, instead of falling to `other`. The hop matches the assistant entry that emitted the `tool_use` block, so a repeat notification for the same agent no longer shadows the dispatch and drops the turn to `other`.
@@ -21,23 +23,39 @@
 - The CLAUDE-APPEND block dropped content already owned elsewhere: the watch authoring rules (the `watch` skill), the `channel-send.ts` exit-code walkthrough (`channel-responder` § Outbound notification protocol), the delegation break-even math (plugin `CLAUDE.md`), and the suggestion-path/exemption list behind the memory-first rule (the `proposal-triage` and `reflection-judge` gates that execute it). 7,877 B → ~6,199 B on a surface re-paid every session load and every subagent dispatch; no safety rule changed.
 - `≤200 chars` for push messages is stated once, in § Operator Notification. The notification skills point at it and keep their own condensation priorities, ending nine prose copies of one constant across four plugins.
 - A CLAUDE-APPEND marker that appears more than once in the target file is now refused (reported `block-ambiguous`, no Edit applied) instead of risking a replace that hits the wrong instance.
-- Micro-approval resolve/expire/nudge now go through the new `scripts/micro-proposal.ts` instead of hand-edited JSON, which could leave `state/micro-proposals.json` unparseable.
-- `queue-micro-proposal.ts` refuses to write over an unparseable `micro-proposals.json` instead of resetting it and silently dropping the pending backlog.
+- Micro-approval resolve/expire/nudge now go through `proposal.ts micro` instead of hand-edited JSON, which could leave `state/micro-proposals.json` unparseable.
+- `proposal.ts queue-micro` refuses to write over an unparseable `micro-proposals.json` instead of resetting it and silently dropping the pending backlog.
 - `hermit-evolve`'s sibling upgrade now applies `local > project` scope precedence when the same sibling is installed at both scopes in one project, matching `resolve-siblings.ts` and Claude Code's own settings layering — it previously read the project-scope install's version and changelog while the session was running the local-scope one.
-- `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches `micro-proposal.ts` via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
+- `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches core's micro-approval writer via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
 
-### Changed
+- One `UserPromptSubmit` process per submitted prompt instead of seven. `user-prompt-pipeline.ts` reads stdin once, parses the channel envelope once, and reads `config.json` and `runtime.json` at most once each, then runs the former hooks as ordered stages (six now live in `scripts/lib/prompt-stages/`). Stage precedence is explicit in code rather than implied by entry order in `hooks.json`, and a blocked prompt emits the decision JSON alone — mixed context text alongside it does not parse as a decision, which would silently drop the block.
 - Proactive operator notifications unified onto `channel-send.ts --notice`; `weekly-review`, `cost-reflect`, and (via § Operator Notification) `heartbeat`/`brief`/`capability-brainstorm` are tier-aware, so spend and technical detail no longer reach the client chat. On a `non-technical` install with no `maintainer_channel_id`, routine spend reports now land in `SHELL.md` Findings instead of the primary chat.
+- `hatch` Step 8 and `hermit-evolve` Step 8 no longer restate the permission list — both call the new verbs. Two copies of the list are gone, along with the hand-maintained stale-entry list in `hermit-evolve/reference.md`, which had drifted to 15 of the canonical entries and told the model to add a `Write` rule the writer deliberately strips. The delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - The core CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-hermit: Session Discipline -->`), matching `claude-code-homeassistant-hermit`/`claude-code-fitness-hermit`/`feed-hermit`/`laravel-forge-hermit`. Bounds detection still falls back correctly for already-installed blocks that predate the marker.
-- `hermit-evolve` Step 8 now delegates the permission merge to `bun scripts/apply-settings.ts <settings-file> allow` instead of maintaining a hand-enumerated script list in prose. The prose list had drifted to 15 of the canonical 28 entries and told the model to add a `Write` rule the writer deliberately strips; the delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
+- The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
+- Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- The heartbeat and routine mechanics are two CLIs over `lib/heartbeat/` and `lib/routines/`: `heartbeat.ts precheck|alert-state` and `routines.ts due|precheck|cron-registry|tz-shift|log-event`. Every verdict token and emission line is unchanged — `SKIP|…`/`EVALUATE`/`AUTO_CLOSE`/`ALERT`, `PROCEED`, and the `ROUTINE_DUE [hermit-routine:<id>]` line the monitors grep and `isRoutinePrompt()` matches.
+- `log-routine-event.sh` is now TypeScript (`lib/routines/event.ts`), the last shell script in the routine path. The appended line is byte-identical — same key order, same second-precision UTC stamp — and the `fired`-after-`fired` dedup guard is preserved. `routines.ts due` and `routines.ts precheck` call it in-process instead of spawning a subprocess per stamp.
+- `HEARTBEAT_PRECHECK` / `ROUTINE_DUE_SCRIPT` keep their exact contract: an override is still a bare script path invoked with the same arguments. The monitors pass the new verb only on the default path.
+- The setup-token expiry probe is a `setup-token-mint.ts probe` verb, and `hermit-meta.json`'s `expiry_probe` command moves with it. The `OK | EXPIRED | EXPIRES:<iso8601>` one-line protocol is unchanged, including printing `OK` (not a false expiry) for a hermit with no record or an unreadable one. Another authority change: the probe had no allow entry of its own and is now covered by the existing `setup-token-mint.ts` grant, so doctor's credential-expiry check runs unattended.
+- The three cost readouts are `cost-report.ts` verbs: `today`, `session <id> [--opened-at --closed-at]`, `reflect [<dir>] [<days>] [--plain]`, over `lib/cost-report/{today,session,reflect}.ts`. All three stay fail-open readers — an unreadable log still prints `cost data unavailable` rather than a misleading `$0.00`, and `reflect` still turns a throw into a one-line error at exit 0 — because their callers are briefs and channel replies that must compose without cost data.
+- The three Artifact-page renderers and the strings scaffold are `artifact.ts` verbs: `render dashboard|proposals|weekly` and `scaffold-strings`. The `{path,bytes,hash}` receipt, the default out paths, and exit-1-on-failure are unchanged — the refresh protocols hash-gate on that receipt. The weekly page's frontmatter-strip moved to `lib/weekly-artifact.ts`, beside the dashboard and proposals-page renderer libs.
+- `proposal-metrics-report.ts` and `eval-success-signal.ts` had no allow entry and were prompted for on every run; as `proposal.ts` verbs they are covered by the existing `proposal.ts` grant and run unattended. That is an authority change: a headless brainstorm kill-check and a success-signal validation now proceed without asking.
+
+### Removed
+- `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
+- Seven top-level proposal scripts, absorbed into `proposal.ts` verbs: `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `proposals-index.ts`, `proposal-metrics-report.ts`, `eval-success-signal.ts`.
+- Four top-level artifact scripts, absorbed into `artifact.ts` verbs: `render-dashboard.ts`, `render-proposals-page.ts`, `render-weekly-artifact.ts`, `artifact-strings-scaffold.ts`.
+- Three top-level cost scripts, absorbed into `cost-report.ts` verbs: `today-cost.ts`, `session-cost.ts`, `cost-reflect.ts`. (`lib/session-cost.ts`, the shared window-cost algorithm, is unrelated and stays.)
+- `setup-token-probe.ts`, absorbed into `setup-token-mint.ts probe`.
+- Seven top-level heartbeat/routine scripts, absorbed into `heartbeat.ts` and `routines.ts` verbs: `heartbeat-precheck.ts`, `update-alert-state.ts`, `routine-due.ts`, `routine-precheck.ts`, `cron-registry.ts`, `cron-tz-shift.ts`, `log-routine-event.sh`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
-2. Re-run `/claude-code-hermit:hatch` (or the settings refresh) on existing installs so `Bash(bun */scripts/channel-send.ts*)` lands in the operator's settings allow-list — without it, the proactive notify path prompts/denies in unattended sessions.
+2. Run `bun <plugin_root>/scripts/apply-settings.ts <settings-file> permissions-sync` against the install's settings file (`.claude/settings.local.json` for a `local` hatch target, `.claude/settings.json` for `committed`). This is now the one step that reconciles permissions: it adds every sealed entry the install is missing — including `channel-send.ts`, new this version — and scrubs entries from retired plugin versions: `next-prop-id.ts`, the five proposal satellites absorbed into `proposal.ts` verbs, and the two pre-absorption `hermit-run` routes. It replaces the per-entry "re-run hatch so X lands in the allow-list" instructions.
 3. If `claude-code-dev-hermit` is installed and its CLAUDE.md/CLAUDE.local.md contains the literal string `<!-- mode:standard-only -->`, a prior version of `hermit-evolve` hit the marker-discovery bug above and appended the raw, un-rendered dev-hermit template. Remove the entire stray block (from the first `<!-- mode:standard-only -->` or `<!-- mode:safety-only -->` line it introduced through the end of that appended region) — the correctly-rendered `<!-- claude-code-dev-hermit: Development Workflow -->` block elsewhere in the file is unaffected and should be left in place.
 4. If an operator customized their CLAUDE-APPEND block in place (core, `hermit-scribe`, or `claude-code-dev-hermit`), note that the next version-gap sync for that plugin will replace it with the shipped template now that closing markers make the block bounds authoritative — re-apply any customization after that sync.
-3. Re-run `/claude-code-hermit:hatch` (or the settings refresh) on existing installs so `Bash(bun */scripts/micro-proposal.ts*)` lands in the operator's settings allow-list — without it, micro-approval resolve/expire/nudge is functionally denied in unattended sessions.
 
 ## [1.2.33] - 2026-07-24
 
diff --git a/plugins/claude-code-hermit/CLAUDE.md b/plugins/claude-code-hermit/CLAUDE.md
index acfae527..af89e043 100644
--- a/plugins/claude-code-hermit/CLAUDE.md
+++ b/plugins/claude-code-hermit/CLAUDE.md
@@ -108,8 +108,8 @@ bun test
   Hooks and helper scripts print verdict-sized digests, never raw logs or full state dumps
   (everything a hook prints on success is injected into context). Skills must not `Read`
   unbounded surfaces (`cost-log.jsonl`, `*.jsonl` event logs, the channel DB) directly —
-  front them with a script that returns a bounded summary (the `session-cost.ts` /
-  `heartbeat-precheck.ts` / `lib/search.ts` pattern); a bounded slice (e.g. reflect's
+  front them with a script that returns a bounded summary (the `cost-report.ts` /
+  `heartbeat.ts precheck` / `lib/search.ts` pattern); a bounded slice (e.g. reflect's
   tail-20 of cost-log) is the ceiling, not the norm. Session-start injection
   (`startup-context.ts`, `generate-summary.ts`) is the largest recurring cost — a new
   section there must justify its per-session tokens against how often it changes behavior.
diff --git a/plugins/claude-code-hermit/docs/always-on-ops.md b/plugins/claude-code-hermit/docs/always-on-ops.md
index ce9f8126..ff79148e 100644
--- a/plugins/claude-code-hermit/docs/always-on-ops.md
+++ b/plugins/claude-code-hermit/docs/always-on-ops.md
@@ -183,13 +183,13 @@ Manage with `/claude-code-hermit:hermit-settings routines`. Changes take effect
 
 `hermit-start.ts` auto-sends `/claude-code-hermit:hermit-routines load` after launching the always-on session. The skill resolves `$CLAUDE_PLUGIN_ROOT`, then:
 
-**Monitor mode (tried first).** Registers one persistent Monitor subprocess (`scripts/routine-monitor.sh`, 60s poll) running `scripts/routine-due.ts`, which reads `config.routines` directly, evaluates each enabled non-anchor routine's schedule against `state/routine-schedule.json` cursors, applies the pause/waiting/idle gates itself, and prints a single `ROUTINE_DUE [hermit-routine:<id>] ...` line only for routines that should actually wake the session — a routine that's due-but-skipped costs zero model tokens. `hermit-routines run <ids>` handles the wake: it re-runs `scripts/routine-precheck.ts` for the `started` stamp, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`. The anchor (`heartbeat-restart`) still registers via a single `CronCreate`, kept fresh by the same diff-planner (`scripts/cron-registry.ts`) described below, scoped to that one routine.
+**Monitor mode (tried first).** Registers one persistent Monitor subprocess (`scripts/routine-monitor.sh`, 60s poll) running `scripts/routines.ts due`, which reads `config.routines` directly, evaluates each enabled non-anchor routine's schedule against `state/routine-schedule.json` cursors, applies the pause/waiting/idle gates itself, and prints a single `ROUTINE_DUE [hermit-routine:<id>] ...` line only for routines that should actually wake the session — a routine that's due-but-skipped costs zero model tokens. `hermit-routines run <ids>` handles the wake: it re-runs `scripts/routines.ts precheck` for the `started` stamp, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`. The anchor (`heartbeat-restart`) still registers via a single `CronCreate`, kept fresh by the same diff-planner (`scripts/routines.ts cron-registry`) described below, scoped to that one routine.
 
-**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/cron-registry.ts plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `cron-tz-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routine-precheck.ts`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
+**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/routines.ts cron-registry plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `lib/cron-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routines.ts precheck`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
 
 `/claude-code-hermit:hermit-routines load --reset` bypasses both diffs and does an unconditional sweep — the escape hatch for suspected drift.
 
-`routine-precheck.ts` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routine-due.ts` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
+`routines.ts precheck` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routines.ts due` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
 
 **`heartbeat-restart`** fires at 4am daily and re-invokes `load`, which re-registers the heartbeat Monitor and re-arms the routine monitor (or, in fallback mode, the routine CronCreates — which expire after 7 days without this daily re-arm).
 
diff --git a/plugins/claude-code-hermit/docs/always-on.md b/plugins/claude-code-hermit/docs/always-on.md
index b7995cf6..665a8851 100644
--- a/plugins/claude-code-hermit/docs/always-on.md
+++ b/plugins/claude-code-hermit/docs/always-on.md
@@ -202,7 +202,7 @@ This means even a raw `docker compose down` (without `hermit-docker down`) will
 
 Heartbeat archives the current session via two triggers:
 
-- **12h inactivity** — `heartbeat-precheck.ts` checks `last-operator-action.json` on each tick. If the operator has not acted for >12h, it returns the `AUTO_CLOSE` verdict.
+- **12h inactivity** — `heartbeat.ts precheck` checks `last-operator-action.json` on each tick. If the operator has not acted for >12h, it returns the `AUTO_CLOSE` verdict.
 - **Daily midnight with lull** — the `daily-auto-close` routine fires at `0 0 * * *` (local). If the operator is currently active (last action ≤10 min), the routine writes `state/pending-close.json`. The next heartbeat tick where the operator has been idle >10 min drains the flag and emits `AUTO_CLOSE`. If the operator was already idle when the routine fired, it closes directly without queueing.
 
 On either trigger:
diff --git a/plugins/claude-code-hermit/docs/architecture.md b/plugins/claude-code-hermit/docs/architecture.md
index ce058de6..a6a7dd62 100644
--- a/plugins/claude-code-hermit/docs/architecture.md
+++ b/plugins/claude-code-hermit/docs/architecture.md
@@ -156,7 +156,7 @@ your-project/
 │   │   ├── micro-proposals.json      # Pending micro-approvals list (reflect + channel-bridged asks + channel-responder)
 │   │   ├── state-summary.md          # Auto-generated health snapshot (generate-summary.ts)
 │   │   ├── monitors.runtime.json     # Active watch registry, cleared on session start (watch-owned)
-│   │   ├── operator-pause.json       # Operator/watchdog pause (pause-keyword.ts/watchdog-owned)
+│   │   ├── operator-pause.json       # Operator/watchdog pause (pause stage/watchdog-owned)
 │   │   ├── auto-pause.json           # Budget-breach auto-pause (cost-tracker-owned)
 │   │   ├── budget-alerts.json        # Budget alert dedup (cost-tracker-owned)
 │   │   ├── telemetry-alert.json      # Telemetry export-failure alert dedup (telemetry-export-owned)
@@ -184,10 +184,10 @@ One writer per state file. No shared mutation bus. (Exception: `state/micro-prop
 | `state/reflection-state.json`  | reflect + session (non-overlapping phases)          | heartbeat (debounce), hermit-settings (scheduled-checks display) |
 | `state/channel-activity.json`  | channel-hook.ts only                                | channel-responder, heartbeat                                  |
 | `state/channel-replies.jsonl`  | channel-hook.ts (append only)                       | reflect (routine-ROI engagement join)                         |
-| `state/channel-log.sqlite`     | channel-reply-reminder.ts + channel-hook.ts (append, via `lib/channel-log.ts`); weekly-review marks/prunes | search.ts (recall, fourth source); weekly-review consolidation |
+| `state/channel-log.sqlite`     | channel-reply-reminder stage + channel-hook.ts (append, via `lib/channel-log.ts`); weekly-review marks/prunes | search.ts (recall, fourth source); weekly-review consolidation |
 | `state/session-diff.json`      | session-diff.ts only                                | session-close (display)                                       |
 | `state/observations.jsonl`     | reflect + reflect-precheck + session-close + channel-responder (append only; `source` values: `cost-spike`, `quick-deferral`, `reflect-noticed`, `startup-drift`, `skill-correction`) | reflect (step 3b graduation), reflection-judge (§1.4 ledger verification) |
-| `state/proposal-metrics.jsonl` | proposal-create + proposal-act (append only)        | generate-summary.ts, proposal-metrics-report.ts (read-only)   |
+| `state/proposal-metrics.jsonl` | proposal-create + proposal-act (append only)        | generate-summary.ts, proposal.ts metrics (read-only)   |
 | `state/usage-metrics.jsonl`    | usage-track.ts (Skill/Read PostToolUse) + record-operator-action.ts (operator-typed `/skill`, append only; compacted >180d by weekly-review) | weekly-review (untouched-knowledge/dormant-skill suggestions) |
 | `state/micro-proposals.json`   | reflect + channel-bridged skills (queue, schema owned by reflect § Queuing procedure) + channel-responder/brief (resolve) | brief, generate-summary.ts |
 | `state/state-summary.md`       | generate-summary.ts only                            | humans                                                        |
@@ -195,7 +195,7 @@ One writer per state file. No shared mutation bus. (Exception: `state/micro-prop
 | `state/heartbeat-monitor.runtime.json` | heartbeat skill only                        | heartbeat-start (write), heartbeat-stop (clear), heartbeat-restart (rewrite) |
 | `state/heartbeat-liveness.json` | heartbeat-monitor.sh (every poll iteration)         | doctor-check.ts (heartbeat liveness check), heartbeat status  |
 | `state/cc-stop-snapshot.json`  | stop-pipeline.ts only                               | doctor-check.ts (scheduler/background-task health check)      |
-| `state/operator-turn-open.json` | record-operator-action.ts (opens, on kept operator prompts + `--force`); stop-pipeline.ts (clears at Stop — the only deleter) | routine-due.ts (defer gate, 60-min TTL backstop against a marker orphaned by a failed Stop) |
+| `state/operator-turn-open.json` | record-operator-action.ts (opens, on kept operator prompts + `--force`); stop-pipeline.ts (clears at Stop — the only deleter) | routines.ts due (defer gate, 60-min TTL backstop against a marker orphaned by a failed Stop) |
 | `state/.heartbeat`             | heartbeat-touch.ts only                             | heartbeat (detect activity gaps)                              |
 | `state/.lifecycle.lock`        | hermit-start.ts only                                | hermit-stop.ts (cleanup)                                      |
 | `state/cost-index.json`        | cost-tracker.ts only                                | cost-tracker.ts (writeCostSummary, getCumulativeCost fallback), doctor-check.ts |
diff --git a/plugins/claude-code-hermit/docs/artifacts.md b/plugins/claude-code-hermit/docs/artifacts.md
index da696ff7..e6f52f42 100644
--- a/plugins/claude-code-hermit/docs/artifacts.md
+++ b/plugins/claude-code-hermit/docs/artifacts.md
@@ -36,7 +36,7 @@ Every script-rendered artifact type (dashboard, proposals page, weekly review) f
 the same five steps; only the render script, `<title>`, and `state/artifacts.json` key
 differ per type (called out in each subsection below):
 
-1. Run the type's render script (e.g. `bun ${CLAUDE_PLUGIN_ROOT}/scripts/render-dashboard.ts .claude-code-hermit`)
+1. Run the type's render script (e.g. `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts render dashboard .claude-code-hermit`)
    and parse stdout JSON (`path`, `bytes`, `hash`).
 2. Read `.claude-code-hermit/state/artifacts.json` (if present) and compare `hash` to
    `<key>.hash`. **Unchanged → stop here**, no publish (avoids minting a no-op
@@ -126,7 +126,7 @@ is not localized — format, not language.
 `.md` natively — confirmed empirically) with its YAML frontmatter stripped (raw
 frontmatter renders as an ugly literal block; every field is already legible in the
 report body's evolution block and the dashboard's weekly section). Rendered by
-`scripts/render-weekly-artifact.ts` — no HTML step, so no CSS/fragment/`<title>`
+`artifact.ts render weekly` — no HTML step, so no CSS/fragment/`<title>`
 wrapping to build; the same five-step hash-gate/publish/state-write procedure still
 applies (hash is `sha256` of the frontmatter-stripped body). `<title>` for the
 `Artifact` call is the report's own top heading (e.g. `Weekly Review — 2026-W27`).
diff --git a/plugins/claude-code-hermit/docs/config-reference.md b/plugins/claude-code-hermit/docs/config-reference.md
index 1160b2e7..f5009ad7 100644
--- a/plugins/claude-code-hermit/docs/config-reference.md
+++ b/plugins/claude-code-hermit/docs/config-reference.md
@@ -256,7 +256,7 @@ Publishing of hermit-generated pages to Claude Code's [Artifacts](https://code.c
 
 **Disabling artifacts at the Claude Code level** (independent of these flags) — any of: `"disableArtifact": true` in `settings.json`, `CLAUDE_CODE_DISABLE_ARTIFACT=1`, or adding `Artifact` to `permissions.deny`. With any of these set, publish attempts fail and the hermit falls back the same way as a missing entitlement. If you run the hermit in tmux/headless (the norm for `hermit-start`), also set `CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0` in `config.env` — otherwise a successful publish tries to open a browser with nothing to receive it.
 
-Modify with `/hermit-settings artifact-dashboard`, `artifact-proposals`, `artifact-weekly-review`, or `artifact-authorization`. Validated by `validate-config.ts`. Renderers: `scripts/lib/dashboard.ts`, `scripts/lib/proposals-page.ts`, `scripts/render-weekly-artifact.ts` (all deterministic — no model authorship except the dashboard's embedded brief text — so a refresh costs a render, not a generation).
+Modify with `/hermit-settings artifact-dashboard`, `artifact-proposals`, `artifact-weekly-review`, or `artifact-authorization`. Validated by `validate-config.ts`. Renderers: `scripts/lib/dashboard.ts`, `scripts/lib/proposals-page.ts`, `scripts/lib/weekly-artifact.ts` (via `scripts/artifact.ts render weekly`) (all deterministic — no model authorship except the dashboard's embedded brief text — so a refresh costs a render, not a generation).
 
 ---
 
diff --git a/plugins/claude-code-hermit/docs/routine-authoring.md b/plugins/claude-code-hermit/docs/routine-authoring.md
index 1ef9f7be..fbba67fc 100644
--- a/plugins/claude-code-hermit/docs/routine-authoring.md
+++ b/plugins/claude-code-hermit/docs/routine-authoring.md
@@ -58,7 +58,7 @@ produce a report.
    decision "is there anything to do here?" can be answered in bash — a file's mtime, a threshold
    comparison, a hash — write a precheck script that prints one token and exits 0, and only load
    the skill body on the branch that needs it. The shipped archetypes:
-   - `scripts/heartbeat-precheck.ts` — emits `SKIP|<reason>`, `OK`, `AUTO_CLOSE`, or `EVALUATE`.
+   - `scripts/heartbeat.ts precheck` — emits `SKIP|<reason>`, `OK`, `AUTO_CLOSE`, or `EVALUATE`.
      Only `EVALUATE` loads the heartbeat skill body.
    - `scripts/reflect-precheck.ts` — emits `EMPTY` or `RUN|<phases-json>`. On `EMPTY` the precheck itself
      owns the audit trail (updates `reflection-state.json`, appends the Progress Log line) so
@@ -114,5 +114,5 @@ narrow haiku subagent instead of a broad session-model skill.
   schema, cron rules, and the `model` field this pattern relies on.
 - `skills/hermit-routines/SKILL.md` — the registration mechanism (`load`/`list`/`status`/`stop`)
   and the model-override dispatch behavior cited above.
-- `scripts/heartbeat-precheck.ts`, `scripts/reflect-precheck.ts` — the shipped precheck
+- `scripts/heartbeat.ts precheck`, `scripts/reflect-precheck.ts` — the shipped precheck
   archetypes to copy the shape of, not reinvent.
diff --git a/plugins/claude-code-hermit/docs/security.md b/plugins/claude-code-hermit/docs/security.md
index 733592e7..d646ece2 100644
--- a/plugins/claude-code-hermit/docs/security.md
+++ b/plugins/claude-code-hermit/docs/security.md
@@ -222,15 +222,15 @@ Beyond the always-on baseline above, `/claude-code-hermit:docker-security` is an
 
 ### Known limitations
 
-- **`hermit-doctor`'s `channel-liveness` check and the deterministic channel-send path (`lib/channel-send.ts`) are two of core's direct outward egress paths.** Doctor's liveness call (Telegram `getMe`, Discord `/users/@me`) sends no message content, 5s timeout, fail-soft. `channel-send.ts` does send message content — it is the mechanism behind the watchdog's lifecycle pushes (restart/wedge/forced-pause), `cost-tracker`'s budget-cap alerts, and the `channel-status-responder.ts` reply — reading the bot token straight from the already-configured channel's `state_dir/.env` (the same token the channel MCP plugin uses), a plain-text POST with an explicit 10s timeout, and no retry on failure (fail-open: the caller falls back to its existing model-mediated path). Every other doctor check is a local filesystem read. The docker-security DNS allowlist already covers both platform hosts (`telegram.org`, `discord.com`) — no allowlist change needed. Disabling a channel disables both its liveness probe and any push through it; there is no separate per-check opt-out in v1.
-- **Remote control and status disclosure trust the operator DM when no `allowed_users` is set.** A plain channel *reply* still follows the documented accept-all default when `channels.<channel>.allowed_users` is absent — but the two paths that either *mutate state* (`pause`/`resume`/`snooze` via `pause-keyword.ts`) or *disclose operator state* (the deterministic `status` reply) do **not**. With no allowlist configured they trust only the operator's own DM (`chat_id === channels.<channel>.dm_channel_id`); any other sender's control keyword is a silent no-op, and any other accepted sender gets a redacted, coarse status (no spend figures, task text, or pending-approval IDs). `<channel>` here is the normalized bare server name (`lib/channel-envelope.ts`'s `normalizeChannelSource`) — the harness injects a plugin-qualified `source` on the wire (`plugin:discord:discord`), but config keys channels by the bare name, so this gate resolves the qualified source back to it before every lookup. **Caveat:** if a channel's primary chat *is* a group/server channel, its `dm_channel_id` equals that shared chat, so every member matches the DM binding — those installs must set `allowed_users` explicitly to restrict control and full status to named operators. This is a flat trust list, not RBAC (an RBAC pass on `allowed_users` is a deliberately-deferred enterprise gap).
+- **`hermit-doctor`'s `channel-liveness` check and the deterministic channel-send path (`lib/channel-send.ts`) are two of core's direct outward egress paths.** Doctor's liveness call (Telegram `getMe`, Discord `/users/@me`) sends no message content, 5s timeout, fail-soft. `channel-send.ts` does send message content — it is the mechanism behind the watchdog's lifecycle pushes (restart/wedge/forced-pause), `cost-tracker`'s budget-cap alerts, and the `lib/prompt-stages/channel-status-responder.ts` reply — reading the bot token straight from the already-configured channel's `state_dir/.env` (the same token the channel MCP plugin uses), a plain-text POST with an explicit 10s timeout, and no retry on failure (fail-open: the caller falls back to its existing model-mediated path). Every other doctor check is a local filesystem read. The docker-security DNS allowlist already covers both platform hosts (`telegram.org`, `discord.com`) — no allowlist change needed. Disabling a channel disables both its liveness probe and any push through it; there is no separate per-check opt-out in v1.
+- **Remote control and status disclosure trust the operator DM when no `allowed_users` is set.** A plain channel *reply* still follows the documented accept-all default when `channels.<channel>.allowed_users` is absent — but the two paths that either *mutate state* (`pause`/`resume`/`snooze` via `lib/prompt-stages/pause-keyword.ts`) or *disclose operator state* (the deterministic `status` reply) do **not**. With no allowlist configured they trust only the operator's own DM (`chat_id === channels.<channel>.dm_channel_id`); any other sender's control keyword is a silent no-op, and any other accepted sender gets a redacted, coarse status (no spend figures, task text, or pending-approval IDs). `<channel>` here is the normalized bare server name (`lib/channel-envelope.ts`'s `normalizeChannelSource`) — the harness injects a plugin-qualified `source` on the wire (`plugin:discord:discord`), but config keys channels by the bare name, so this gate resolves the qualified source back to it before every lookup. **Caveat:** if a channel's primary chat *is* a group/server channel, its `dm_channel_id` equals that shared chat, so every member matches the DM binding — those installs must set `allowed_users` explicitly to restrict control and full status to named operators. This is a flat trust list, not RBAC (an RBAC pass on `allowed_users` is a deliberately-deferred enterprise gap).
 - **Telemetry export is another direct outward egress — opt-in, off by default.** `config.telemetry_export` (absent or `enabled: false` = nothing ever leaves the box) periodically POSTs a versioned health/cost bundle to an operator-configured webhook from the watchdog tick. The bundle is allowlist-built: only named numerics/enums/counts are copied in by default (cost totals, doctor check statuses, alert counts, session cost/duration, watchdog event counts); free text (task descriptions, error messages, alert detail strings) is included only when the operator explicitly sets `redact_operator_text: false`. The bearer token comes from an env var named in config, never from `config.json` itself, and neither the webhook URL nor the token ever appear in logs or error output. Under docker-security, the webhook's host must be added to the DNS allowlist or exports fail (and spool) inside the hardened container.
 - **Three artifact pages publish session-derived content to claude.ai — default on, per-page opt-out.** `config.artifacts.dashboard`/`proposals`/`weekly_review` (default `true`) each publish a rendered page — status/latest-brief/proposals/weekly-evolution, open-proposal full text, and the compiled weekly review, respectively — via Claude Code's built-in Artifacts feature, not a hermit-authored HTTP call. Same publish path as any other Artifact a session creates, so it's governed by Claude Code's own controls (`disableArtifact`, `CLAUDE_CODE_DISABLE_ARTIFACT`, `permissions.deny`), not the docker-security DNS allowlist. Private to the publishing account on Pro/Max; Team/Enterprise can additionally Share within the org, never across it. Every automatic publish is a deterministic render of enumerated state files — with one caveat: the dashboard's latest-brief section embeds `state/last-brief.json`, whose `text` field is itself model-composed by the `brief` skill, so that one section is not exclusively machine-generated content. On-demand publish of a compiled doc or proposal (operator-initiated, no config gate) is likewise a direct file publish, no model authorship. See `docs/config-reference.md#artifacts` and `docs/artifacts.md`.
 - **`permissions.allow: ["Artifact"]` is a sanctioned pre-approval of an outward-publishing tool for autonomous use.** Applied via the `artifacts.publish_authorized` config flag (§ Auto-mode Classifier above) so unattended sessions don't stall on the first-publish permission ask (a headless "ask" is an effective deny) — a channel reply sets the flag only, and `hermit-start`'s boot-time grant, running outside any session, is what actually writes the permission (needed because the classifier blocks a session from widening its own `permissions.allow`, even attended-seeded). Re-ensured every boot, so a hand-wiped entry heals itself; revoke via `/hermit-settings artifact-authorization`. Assessment: on Pro/Max, artifacts are private to the publishing account with no share option, so a prompt-injected publish is persistence/noise, not exfiltration — the attacker cannot view the page, and `channel-send.ts` (above) remains the materially riskier egress. The real cost is losing the human checkpoint before irreversible external persistence: there is no tool-side delete, and published content may be cached even after removal from the gallery, so a mistaken publish (e.g. a render that embeds a secret that leaked into state) can't be fully recalled. Mitigation: every automatic-path publish is a deterministic render of enumerated state files (no free-form model-authored pages on the automatic path — see the brief-text caveat above); operators who decline the flag get the same outcome via setup-time banking (first publish happens inline, attended, at hatch/evolve time) instead of a standing grant.
 - **Egress filtering is opt-in.** Bridge networking isolates from localhost but the container can still reach the internet by default. A successful prompt injection can exfiltrate data to external hosts. **Mitigation available**: `/claude-code-hermit:docker-security` adds LAN containment + DNS policy via a firewall sidecar with kernel-level port-53 redirect for real enforcement. **Remaining gap**: direct public-IP egress (hardcoded IPs, no DNS) is not blocked even with the wizard — v1.1 may add nftset-driven IP allowlisting. See [Docker Security](docker-security.md).
-- **No input sanitization for fetched content.** Content fetched from external APIs enters Claude's context unsanitized. Deny patterns cannot catch injection via fetched content — that's an instruction-following boundary, not a mechanical one. **The scheduled-wake surface is now scanned.** HEARTBEAT.md is model-editable and feeds the autonomous evaluation subagent verbatim, so a poisoned checklist item written in one session could steer every future wake. `heartbeat-precheck.ts` scans it pre-wake for three pattern classes (instruction-override phrases, context-marker tags, decode-pipes); a hit converts the tick into an operator alert and suspends checklist evaluation until the file is edited. The suspension is scoped to checklist evaluation only — deterministic operator-safety notifications still fire (a pending budget alert pierces the announced-damper; a due stale auto-close still runs), since neither reads HEARTBEAT.md. This breaks the self-persistence path but is defense-in-depth, not a boundary — the PreToolUse/permissions chokepoint remains the actual guard during any wake turn.
+- **No input sanitization for fetched content.** Content fetched from external APIs enters Claude's context unsanitized. Deny patterns cannot catch injection via fetched content — that's an instruction-following boundary, not a mechanical one. **The scheduled-wake surface is now scanned.** HEARTBEAT.md is model-editable and feeds the autonomous evaluation subagent verbatim, so a poisoned checklist item written in one session could steer every future wake. `heartbeat.ts precheck` scans it pre-wake for three pattern classes (instruction-override phrases, context-marker tags, decode-pipes); a hit converts the tick into an operator alert and suspends checklist evaluation until the file is edited. The suspension is scoped to checklist evaluation only — deterministic operator-safety notifications still fire (a pending budget alert pierces the announced-damper; a due stale auto-close still runs), since neither reads HEARTBEAT.md. This breaks the self-persistence path but is defense-in-depth, not a boundary — the PreToolUse/permissions chokepoint remains the actual guard during any wake turn.
 - **Deny patterns are a blocklist.** They catch commands you anticipated. Equivalent commands not on the list execute normally. Bind mount scope and network isolation are stronger defenses for novel attacks. The runtime hook (`enforce-deny-patterns.ts`) additionally normalizes each Bash candidate (whole command and every compound segment) before matching — collapsing horizontal whitespace runs, backslash-newline continuations, and unquoted `$IFS`/`${IFS}` — so a pattern like `rm -rf` also catches `rm  -rf`, `rm${IFS}-rf`, and the same hidden behind `&&`/`;`/`|`. Deliberately **not** implemented: Unicode normalization (NFKC), ANSI/NUL stripping, base64/decode-pipe detection, or general flag-order canonicalization. Bash does not treat those as equivalent to the canonical spelling — e.g. a fullwidth `ｓudo` is a distinct token that fails with "command not found," not an executable bypass — so folding them would close a non-threat while adding false-positive surface on legitimate unicode/binary arguments. This mirrors a full deobfuscation pipeline (as competitor agents implement as their *only* execution boundary) being disproportionate here: it sits behind the bash sandbox and container hardening layers above, not in front of an unsandboxed process.
-- **Episodic channel-log (PROP-010) stores raw DM text locally.** `state/channel-log.sqlite` holds the operator's Discord/Telegram DM text verbatim — capture is gated by the same `channels.<channel>.allowed_users` allowlist channel-responder enforces (envelope source normalized to the bare channel key, same as above; unauthorized senders are never logged), but authorized senders' full message text is retained until weekly-review consolidation and its retention window prune it. Storage is deliberately unsanitized (fidelity for consolidation), but the `/recall` read path (`search.ts`) runs recalled text through `safeForLLM` — the same control-char/tag-impersonation defusal `channel-reply-reminder.ts` already applies to the envelope's `source`/`chat_id` — before it reaches model context. Treat it as untrusted external input regardless: it's the operator's own words, but unreviewed. The file is local-only, covered by the standard `state/` gitignore, and never committed. Disable capture with `knowledge.channel_log_enabled: false` if this tradeoff isn't wanted.
+- **Episodic channel-log (PROP-010) stores raw DM text locally.** `state/channel-log.sqlite` holds the operator's Discord/Telegram DM text verbatim — capture is gated by the same `channels.<channel>.allowed_users` allowlist channel-responder enforces (envelope source normalized to the bare channel key, same as above; unauthorized senders are never logged), but authorized senders' full message text is retained until weekly-review consolidation and its retention window prune it. Storage is deliberately unsanitized (fidelity for consolidation), but the `/recall` read path (`search.ts`) runs recalled text through `safeForLLM` — the same control-char/tag-impersonation defusal `lib/prompt-stages/channel-reply-reminder.ts` already applies to the envelope's `source`/`chat_id` — before it reaches model context. Treat it as untrusted external input regardless: it's the operator's own words, but unreviewed. The file is local-only, covered by the standard `state/` gitignore, and never committed. Disable capture with `knowledge.channel_log_enabled: false` if this tradeoff isn't wanted.
 
 ---
 
diff --git a/plugins/claude-code-hermit/hooks/hooks.json b/plugins/claude-code-hermit/hooks/hooks.json
index e145ebec..ad0a8815 100644
--- a/plugins/claude-code-hermit/hooks/hooks.json
+++ b/plugins/claude-code-hermit/hooks/hooks.json
@@ -133,82 +133,11 @@
           {
             "type": "command",
             "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/prompt-context.ts"]
-          }
-        ],
-        "description": "Inject current local time before every prompt so the model never anchors to a stale 'now'"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/channel-reply-reminder.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Inject reply-tool reminder when inbound prompt starts with a <channel source=...> envelope"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/record-operator-action.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Record last operator-action timestamp; skips routine/loop/channel prompts"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/pause-keyword.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Deterministic pause/resume/snooze keyword writer — writes state/pause.json before any model turn, gated by the channel's allowed_users"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/harness-command-keyword.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Record an exact channel /model|/effort|/compact|/clear request to state/pending-harness-command.json, gated by isTrustedController; the Stop hook types it into the pane once the turn ends"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/shutdown-gate.ts"],
-            "timeout": 8
-          }
-        ],
-        "description": "Deterministic shutdown gate — while a shutdown is pending, send-then-block channel messages from allowed senders so the hermit takes no new work"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/channel-status-responder.ts"],
-            "timeout": 12
+            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/user-prompt-pipeline.ts"],
+            "timeout": 15
           }
         ],
-        "description": "Deterministic status responder — send-then-block reply to an exact idle 'status' message, gated by the channel's allowed_users; never fires on a near-miss or mid-turn arrival"
+        "description": "Single prompt pipeline: records operator action, injects time + channel reply reminder, then applies pause / harness-command / shutdown / status in explicit precedence (shutdown is terminal)"
       }
     ],
     "SessionStart": [
diff --git a/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts b/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
index 715beca3..535a88ba 100644
--- a/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
+++ b/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
@@ -8,7 +8,7 @@
 //         metrics_event, shell_findings_line}, ...]}
 // Output: one JSON line — {"ok":true,"applied":{...}} (+ "errors" when any
 // post-validation write failed) or {"ok":false,"reason":...} with zero writes.
-// Exit 0 always (update-alert-state.ts pattern); only missing argv exits 1.
+// Exit 0 always (lib/heartbeat/alert-update.ts pattern); only missing argv exits 1.
 //
 // Durability split: proposal frontmatter patches and metrics appends are the
 // all-or-nothing core; SHELL.md `## Findings` appends are best-effort session
diff --git a/plugins/claude-code-hermit/scripts/apply-settings.ts b/plugins/claude-code-hermit/scripts/apply-settings.ts
index 45c91888..40dc4924 100644
--- a/plugins/claude-code-hermit/scripts/apply-settings.ts
+++ b/plugins/claude-code-hermit/scripts/apply-settings.ts
@@ -6,6 +6,14 @@
  * Operations:
  *   task-id <id>             Merge env.CLAUDE_CODE_TASK_LIST_ID
  *   allow                    Merge hermit's fixed permissions.allow list
+ *   permissions-plan         Print {"missing":[],"obsolete":[]} for the target — read-only,
+ *                            writes nothing. `missing` is the sealed HERMIT_ALLOW entries the
+ *                            target lacks; `obsolete` is the sealed HERMIT_OBSOLETE entries it
+ *                            still carries. Callers (hatch, hermit-evolve) show this diff.
+ *   permissions-sync         Apply that plan: add every missing HERMIT_ALLOW entry and remove
+ *                            only entries listed in HERMIT_OBSOLETE. Prints the applied plan.
+ *                            Operator-authored entries are structurally untouchable — removal
+ *                            is filtered by the sealed registry, never by shape or heuristic.
  *   artifact-allow           Merge just ["Artifact"] into permissions.allow — kept as its
  *                            own op (not folded into `allow`) so declining the Artifact
  *                            publish-authorization ask never touches hook permissions.
@@ -19,7 +27,9 @@
  *
  * Rules:
  * - Never removes existing keys or array entries — except channel-env, which strips
- *   any *_BOT_TOKEN from the env block (tokens must live only in .env, never settings).
+ *   any *_BOT_TOKEN from the env block (tokens must live only in .env, never settings),
+ *   and permissions-sync, which removes only entries named in the sealed HERMIT_OBSOLETE
+ *   registry below (scripts this plugin itself shipped and has since deleted).
  * - Permission sets are read from state-templates — callers cannot inject arbitrary JSON.
  * - Safe to call under AGENT_HOOK_PROFILE=strict: writes via fs, not the Edit/Write tools.
  */
@@ -29,31 +39,26 @@ import path from 'node:path';
 
 const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(import.meta.dir, '..');
 
-// Fixed allow-list — sealed here; cannot be extended by callers.
-// Keep in sync with the "Required permissions" list in skills/hatch/SKILL.md Step 8.
+// Fixed allow-list — sealed here; cannot be extended by callers. This array is the
+// single source of truth: hatch and hermit-evolve reach it through permissions-plan /
+// permissions-sync rather than restating it, so there is nothing to keep in sync.
 const HERMIT_ALLOW = [
   'Bash(git diff:*)',
   'Bash(git status:*)',
   'Bash(git log:*)',
   'Bash(bun */scripts/cost-tracker.ts*)',
-  'Bash(bun */scripts/heartbeat-precheck.ts*)',
+  'Bash(bun */scripts/heartbeat.ts precheck*)',
   'Bash(bun */scripts/reflect-precheck.ts*)',
   'Bash(bun */scripts/archive-shell.ts*)',
   'Bash(bun */scripts/evaluate-session.ts*)',
   'Bash(bun */scripts/append-metrics.ts*)',
-  'Bash(bun */scripts/resolve-prop.ts*)',
-  'Bash(bun */scripts/next-prop-id.ts*)',
   'Bash(bun */scripts/proposal.ts*)',
-  'Bash(bun */scripts/record-gate.ts*)',
-  'Bash(bun */scripts/queue-micro-proposal.ts*)',
-  'Bash(bun */scripts/micro-proposal.ts*)',
   'Bash(bun */scripts/generate-summary.ts*)',
-  'Bash(bun */scripts/proposals-index.ts*)',
   'Bash(bun */scripts/update-reflection-state.ts*)',
   'Bash(bun */scripts/apply-reflection-actions.ts*)',
   'Bash(bun */scripts/transcript-digest.ts*)',
   'Bash(bun */scripts/setup-token-mint.ts*)',
-  'Bash(bun */scripts/cron-tz-shift.ts*)',
+  'Bash(bun */scripts/routines.ts tz-shift*)',
   'Bash(bun */scripts/evolve-plan.ts*)',
   'Bash(bun */scripts/evolve-finalize.ts*)',
   'Bash(bun */scripts/manifest-seed.ts*)',
@@ -61,18 +66,52 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/channel-log.ts*)',
   'Bash(bun */scripts/channel-send.ts*)',
   'Bash(bun */scripts/session-archive.ts*)',
-  'Bash(bun */scripts/routine-precheck.ts*)',
-  'Bash(bun */scripts/cron-registry.ts*)',
+  'Bash(bun */scripts/routines.ts precheck*)',
+  'Bash(bun */scripts/routines.ts cron-registry*)',
   // Domain plugins reach core's shared scripts through the project-resident
   // bin/hermit-run (their own ${CLAUDE_PLUGIN_ROOT} can't reach core's versioned
-  // cache dir). Space before * is a word boundary — `micro-proposal *` matches
-  // `micro-proposal brief-cycle` but not a `micro-proposal…`-prefixed name.
-  'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
-  'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
+  // cache dir). Pinned to the two verbs they actually need, not a bare
+  // `hermit-run proposal *` — that would also hand them create, patch,
+  // shell-append, next-task and routine, i.e. arbitrary state-dir writes. The
+  // space before * is a word boundary: `proposal micro *` matches
+  // `proposal micro .claude-code-hermit brief-cycle` but not a
+  // `micro…`-prefixed verb.
+  'Bash(.claude-code-hermit/bin/hermit-run proposal micro *)',
+  'Bash(.claude-code-hermit/bin/hermit-run proposal metrics *)',
   "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
   'Edit(.claude-code-hermit/**)',
 ];
 
+// Entries this plugin itself shipped in an earlier version and has since retired.
+// permissions-sync removes these from an operator's settings; nothing else is ever
+// removed, so an operator's own rules cannot be caught by a shape or prefix match.
+// Append here in the same change that deletes a permissioned script — this registry
+// is what makes a deletion reach already-hatched hermits.
+const HERMIT_OBSOLETE = [
+  'Bash(python3:*)',
+  'Bash(node:*)',
+  'Edit(.claude/.claude-code-hermit/**)',
+  'Write(.claude/.claude-code-hermit/**)',
+  'Bash(bun */scripts/run-with-profile.ts*)',
+  'Bash(bun */scripts/suggest-compact.ts*)',
+  'Bash(bun */scripts/next-prop-id.ts*)',
+  // Proposal satellites absorbed into proposal.ts verbs — the scripts are gone,
+  // so these grants now name nothing.
+  'Bash(bun */scripts/resolve-prop.ts*)',
+  'Bash(bun */scripts/record-gate.ts*)',
+  'Bash(bun */scripts/queue-micro-proposal.ts*)',
+  'Bash(bun */scripts/micro-proposal.ts*)',
+  'Bash(bun */scripts/proposals-index.ts*)',
+  // …and the two hermit-run routes that pointed at the pre-absorption names.
+  'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
+  'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
+  // Heartbeat/routine scripts absorbed into heartbeat.ts and routines.ts verbs.
+  'Bash(bun */scripts/heartbeat-precheck.ts*)',
+  'Bash(bun */scripts/routine-precheck.ts*)',
+  'Bash(bun */scripts/cron-registry.ts*)',
+  'Bash(bun */scripts/cron-tz-shift.ts*)',
+];
+
 // Sealed autoMode entries — operator-owned policy seeded at attended hatch and
 // re-ensured by hermit-start at boot. Declarative, no persuasion prose (a live
 // probe model flags over-argued entries as planted justification). Keep in sync
@@ -157,6 +196,28 @@ function mergeAllow(settings: Json, entries: string[]): string[] {
   return added;
 }
 
+interface PermissionsPlan {
+  missing: string[];
+  obsolete: string[];
+}
+
+// Read-only diff of the target against the two sealed registries above.
+function planPermissions(settings: Json): PermissionsPlan {
+  const allow: string[] = Array.isArray(settings?.permissions?.allow) ? settings.permissions.allow : [];
+  const existing = new Set<string>(allow);
+  return {
+    missing: HERMIT_ALLOW.filter((e) => !existing.has(e)),
+    obsolete: HERMIT_OBSOLETE.filter((e) => existing.has(e)),
+  };
+}
+
+// Removes exactly the entries handed in — always a subset of HERMIT_OBSOLETE.
+function removeAllow(settings: Json, entries: string[]): void {
+  if (entries.length === 0 || !Array.isArray(settings?.permissions?.allow)) return;
+  const drop = new Set(entries);
+  settings.permissions.allow = settings.permissions.allow.filter((e: string) => !drop.has(e));
+}
+
 function mergeAutoModeList(settings: Json, key: 'allow' | 'environment', entries: string[]): void {
   settings.autoMode ??= {};
   const block = settings.autoMode as Record<string, unknown>;
@@ -203,7 +264,10 @@ if (!targetFile || !op) {
 }
 
 const settings = readTargetJson(targetFile);
-let addedAllow: string[] = [];
+
+// permissions-plan reports without touching the file; every other op falls through
+// to the write below.
+let readOnly = false;
 
 switch (op) {
   case 'task-id': {
@@ -214,8 +278,33 @@ switch (op) {
     break;
   }
 
+  // Legacy alias for permissions-sync's additive half. No in-repo caller since
+  // hatch and hermit-evolve moved to the verbs — kept for already-hatched hermits
+  // still running older skill text.
   case 'allow': {
-    addedAllow = mergeAllow(settings, HERMIT_ALLOW);
+    mergeAllow(settings, HERMIT_ALLOW);
+    break;
+  }
+
+  case 'permissions-plan': {
+    console.log(JSON.stringify(planPermissions(settings)));
+    readOnly = true;
+    break;
+  }
+
+  case 'permissions-sync': {
+    // Plan first: the diff is computed against the pre-merge state, so the printed
+    // result is exactly what this run changed.
+    const plan = planPermissions(settings);
+    // Nothing to do — don't rewrite the file. hermit-evolve runs this on every
+    // upgrade, and a target that is already current must not come back reformatted
+    // (or with a fresh mtime) just for having been checked.
+    if (plan.missing.length === 0 && plan.obsolete.length === 0) readOnly = true;
+    else {
+      mergeAllow(settings, HERMIT_ALLOW);
+      removeAllow(settings, plan.obsolete);
+    }
+    console.log(JSON.stringify(plan));
     break;
   }
 
@@ -269,14 +358,9 @@ switch (op) {
   }
 
   default: {
-    console.error(`Unknown operation: ${op}. Valid ops: task-id, allow, artifact-allow, automode-seed, deny, channel-env`);
+    console.error(`Unknown operation: ${op}. Valid ops: task-id, allow, permissions-plan, permissions-sync, artifact-allow, automode-seed, deny, channel-env`);
     process.exit(1);
   }
 }
 
-writeJson(targetFile, settings);
-
-// After the write lands, report each newly-granted allow entry (one per line) so
-// hermit-evolve's Step 8 can list what it added in its run report. Silent when
-// nothing was added.
-for (const e of addedAllow) console.log(`allow: ${e}`);
+if (!readOnly) writeJson(targetFile, settings);
diff --git a/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts b/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts
deleted file mode 100644
index c0bf289f..00000000
--- a/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// artifact-strings-scaffold.ts — prints the artifact-strings.json scaffold with
-// every chrome key at its English default, for a language-set skill (hatch /
-// hermit-settings) to translate the *values* in place and write to
-// state/artifact-strings.json. Keeps DEFAULT_STRINGS the single source of keys —
-// the model never hand-transcribes the key set.
-// Usage: bun artifact-strings-scaffold.ts <language> [generatedISO]
-
-import { DEFAULT_STRINGS } from './lib/artifact-strings';
-
-const language = process.argv[2] || 'en';
-const generated = process.argv[3] || '';
-process.stdout.write(JSON.stringify({ language, generated, strings: DEFAULT_STRINGS }, null, 2) + '\n');
diff --git a/plugins/claude-code-hermit/scripts/artifact.ts b/plugins/claude-code-hermit/scripts/artifact.ts
new file mode 100644
index 00000000..c8622f5d
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/artifact.ts
@@ -0,0 +1,92 @@
+// artifact.ts — single CLI for the Artifact-page renderers and the
+// artifact-strings scaffold. One script per page was three copies of the same
+// twelve lines: resolve an out path, render, mkdir -p, write, print the
+// {path,bytes,hash} receipt, exit 1 on anything thrown.
+//
+// Usage:
+//   bun artifact.ts render <dashboard|proposals|weekly> <hermit-state-dir> [outPath]
+//     Renders the page to disk. Prints {"path":…,"bytes":…,"hash":…} on success;
+//     exits 1 on failure. The refresh protocols in docs/artifacts.md treat any
+//     failure as "skip silently", so the stderr text is diagnostic only — the
+//     exit code is the contract.
+//
+//   bun artifact.ts scaffold-strings <language> [generatedISO]
+//     Prints the artifact-strings.json scaffold with every chrome key at its
+//     English default, for a language-set skill (hatch / hermit-settings) to
+//     translate the *values* in place and write to state/artifact-strings.json.
+//     Keeps DEFAULT_STRINGS the single source of keys — the model never
+//     hand-transcribes the key set.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadDashboardState, renderDashboard } from './lib/dashboard';
+import { loadProposalsPageState, renderProposalsPage } from './lib/proposals-page';
+import { renderWeeklyArtifact } from './lib/weekly-artifact';
+import { DEFAULT_STRINGS } from './lib/artifact-strings';
+
+interface Rendered { content: string; hash: string }
+
+// Each page contributes only what actually differs between them: where it lands
+// by default, and how its bytes are produced.
+const PAGES: Record<string, { defaultOut: (dir: string) => string; render: (dir: string) => Rendered }> = {
+  dashboard: {
+    defaultOut: dir => path.join(dir, 'state', 'dashboard.html'),
+    render: dir => {
+      const { html, hash } = renderDashboard(loadDashboardState(dir));
+      return { content: html, hash };
+    },
+  },
+  proposals: {
+    defaultOut: dir => path.join(dir, 'state', 'proposals-page.html'),
+    render: dir => {
+      const { html, hash } = renderProposalsPage(loadProposalsPageState(dir));
+      return { content: html, hash };
+    },
+  },
+  weekly: {
+    defaultOut: dir => path.join(dir, 'state', 'weekly-review-artifact.md'),
+    render: renderWeeklyArtifact,
+  },
+};
+
+const PAGE_NAMES = Object.keys(PAGES).join('|');
+const USAGE = `Usage: bun artifact.ts render <${PAGE_NAMES}> <hermit-state-dir> [outPath]\n` +
+              `       bun artifact.ts scaffold-strings <language> [generatedISO]`;
+
+function usage(): never {
+  console.error(USAGE);
+  process.exit(1);
+}
+
+function verbRender(page: string | undefined, hermitDir: string | undefined, outArg: string | undefined): void {
+  if (!page || !hermitDir) usage();
+  const spec = PAGES[page];
+  if (!spec) {
+    console.error(`artifact render: unknown page "${page}" (expected ${PAGE_NAMES})`);
+    process.exit(1);
+  }
+  const outPath = outArg || spec.defaultOut(hermitDir);
+  try {
+    const { content, hash } = spec.render(hermitDir);
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, content, 'utf8');
+    process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(content), hash }) + '\n');
+  } catch (err: any) {
+    console.error(`artifact render ${page}: failed: ${err?.message ?? err}`);
+    process.exit(1);
+  }
+}
+
+function verbScaffoldStrings(language: string | undefined, generated: string | undefined): void {
+  process.stdout.write(
+    JSON.stringify({ language: language || 'en', generated: generated || '', strings: DEFAULT_STRINGS }, null, 2) + '\n',
+  );
+}
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+switch (verb) {
+  case 'render': verbRender(rest[0], rest[1], rest[2]); break;
+  case 'scaffold-strings': verbScaffoldStrings(rest[0], rest[1]); break;
+  default: usage();
+}
diff --git a/plugins/claude-code-hermit/scripts/ask-gate.ts b/plugins/claude-code-hermit/scripts/ask-gate.ts
index c1f33b7d..a2339b70 100644
--- a/plugins/claude-code-hermit/scripts/ask-gate.ts
+++ b/plugins/claude-code-hermit/scripts/ask-gate.ts
@@ -44,7 +44,7 @@ import { runHook } from './lib/hook-input';
 const REDIRECT_REASON =
   'No interactive operator on this surface (always-on channel session). Do not retry ' +
   'AskUserQuestion. Instead: (1) send the question via the channel reply tool; (2) queue it ' +
-  'durably by running `bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts ' +
+  'durably by running `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro ' +
   '.claude-code-hermit` with a heredoc payload {"tier":1,"question":"...","options":[...]} — ' +
   'never hand-edit state/micro-proposals.json; (3) continue other work — the answer arrives as a ' +
   'channel message. If a human operator is in fact attending this terminal, they can relaunch ' +
diff --git a/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts b/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts
deleted file mode 100644
index 941ade19..00000000
--- a/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — when the inbound prompt starts with a <channel>
-// envelope, injects an additionalContext reminder naming the exact reply tool
-// and chat_id. Operators on Discord/Telegram read the channel, not the
-// transcript; this reminder fires right before the model's next turn.
-//
-// Also captures the inbound message into the episodic channel log (PROP-010)
-// — see scripts/lib/channel-log.ts. Capture is best-effort and strictly
-// secondary to the reminder: it runs after the reminder is written, in its
-// own try/catch, and a logging failure never affects the reminder.
-
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { logMessage, isLoggingEnabled } from './lib/channel-log';
-import { loadConfig, isAllowedSender } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-
-type Json = any;
-
-// Known channel sources → exact MCP reply tool name.
-// Unknown sources fall back to a generic phrase so future channel plugins
-// still benefit from the reminder without a code change.
-const REPLY_TOOLS: Record<string, string> = {
-  discord: 'mcp__plugin_discord_discord__reply',
-  telegram: 'mcp__plugin_telegram_telegram__reply',
-  imessage: 'mcp__plugin_imessage_imessage__reply',
-};
-
-const MAX_SOURCE_LEN = 32;
-const MAX_CHAT_ID_LEN = 128;
-
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
-  if (!envelope) return;
-
-  const sourceKey = envelope.sourceKey;
-  const chatIdRaw = envelope.chatId;
-
-  const source = safeForLLM(sourceKey.slice(0, MAX_SOURCE_LEN));
-  const chatId = safeForLLM(chatIdRaw.slice(0, MAX_CHAT_ID_LEN));
-
-  const tool = REPLY_TOOLS[source];
-  const toolLine = tool
-    ? `\`${tool}\` with chat_id="${chatId}"`
-    : `the channel's \`reply\` tool with chat_id="${chatId}"`;
-
-  process.stdout.write(
-    `[channel reply reminder] Inbound message arrived on the \`${source || 'unknown'}\` channel` +
-    ` (chat_id=\`${chatId}\`). Substantive reply must go through ${toolLine}.` +
-    ` Transcript/terminal output does not reach the operator.\n`
-  );
-
-  // Episodic capture — best-effort, never affects the reminder above.
-  try {
-    if (!envelope.body) return;
-
-    const dir = hermitDir();
-    const config = loadConfig(dir);
-    if (!isLoggingEnabled(config)) return;
-
-    // Raw source (not sourceKey): channelEntry normalizes it internally, and
-    // pause-keyword.ts and channel-status-responder.ts feed the same raw source
-    // into this gate — one convention across every caller.
-    if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
-
-    const result = logMessage(dir, {
-      source: sourceKey,
-      chat_id: chatIdRaw,
-      direction: 'in',
-      sender: envelope.userId,
-      message_id: envelope.messageId,
-      text: envelope.body,
-      ts: envelope.ts ?? undefined,
-    });
-    if (!result.ok) {
-      process.stderr.write(`[channel-log] inbound capture failed: ${result.error}\n`);
-    }
-  } catch (e: any) {
-    process.stderr.write(`[channel-log] inbound capture failed: ${e?.message || e}\n`);
-  }
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
-}
diff --git a/plugins/claude-code-hermit/scripts/channel-send.ts b/plugins/claude-code-hermit/scripts/channel-send.ts
index 22ebe990..3abb10ec 100644
--- a/plugins/claude-code-hermit/scripts/channel-send.ts
+++ b/plugins/claude-code-hermit/scripts/channel-send.ts
@@ -3,7 +3,7 @@
 // seam synchronous callers (hermit-watchdog.ts, single-shot, no async conversion)
 // reach the deterministic channel send through via spawnSync, instead of
 // importing the lib directly the way async callers (cost-tracker.ts,
-// channel-status-responder.ts) do.
+// lib/prompt-stages/channel-status-responder.ts) do.
 //
 // Usage: bun channel-send.ts <hermit-dir> [--tier client|maintainer] <text|- >
 //   --tier     client (default) sends to the primary chat as today; maintainer
diff --git a/plugins/claude-code-hermit/scripts/cost-report.ts b/plugins/claude-code-hermit/scripts/cost-report.ts
new file mode 100644
index 00000000..195ea949
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/cost-report.ts
@@ -0,0 +1,35 @@
+// cost-report.ts — single CLI for the three cost readouts, over
+// lib/cost-report/{today,session,reflect}.ts.
+//
+// Usage:
+//   bun cost-report.ts today
+//     "$X.XX (<tokens>) across N session(s)" for today. An unreadable log prints
+//     "cost data unavailable" rather than a misleading $0.00.
+//
+//   bun cost-report.ts session <session_id> [--opened-at <iso>] [--closed-at <iso>]
+//     {"cost_usd":<n>,"tokens":<n>} for one logical session's arc window.
+//
+//   bun cost-report.ts reflect [<stateDir>] [<days>] [--plain]
+//     The spend breakdown; --plain is the channel-safe prose form.
+//
+// Each verb keeps the exit code and stdout grammar it had as its own script —
+// all three are fail-open readers (exit 0 even with no data), because their
+// callers are briefs and channel replies that must still compose without cost.
+
+import { run as runToday } from './lib/cost-report/today';
+import { run as runSession } from './lib/cost-report/session';
+import { run as runReflect } from './lib/cost-report/reflect';
+
+const USAGE = 'Usage: bun cost-report.ts <today|session|reflect> [args...]';
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+
+switch (verb) {
+  case 'today': runToday(); break;
+  case 'session': runSession(rest); break;
+  case 'reflect': runReflect(rest); break;
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/cost-tracker.ts b/plugins/claude-code-hermit/scripts/cost-tracker.ts
index 2e767331..61d7b607 100644
--- a/plugins/claude-code-hermit/scripts/cost-tracker.ts
+++ b/plugins/claude-code-hermit/scripts/cost-tracker.ts
@@ -338,10 +338,10 @@ function writeRuntimeFields(fields: Record<string, Json>): void {
   fs.renameSync(RUNTIME_JSON_TMP, RUNTIME_JSON);
 }
 
-// Maintains the [opened_at, closed_at] window that session-cost.ts sums cost-log
+// Maintains the [opened_at, closed_at] window that lib/cost-report/session.ts sums cost-log
 // rows over — the logical-session boundary, since cost-log rows carry the shared
 // transcript UUID (never the logical S-NNN) and one transcript holds many logical
-// sessions (see session-cost.ts). Three runtime.json fields define an arc:
+// sessions (see lib/cost-report/session.ts). Three runtime.json fields define an arc:
 //   opened_at        — arc start (first in_progress turn)
 //   closed_at        — arc end, stamped on the idle transition; null while live
 //   opened_transcript— the CC transcript/process id that owns the current arc
@@ -601,7 +601,7 @@ function markBudgetNotified(newPeriods: Json[], periodKey: Record<string, string
 // and, for `action:"pause"`, set the PROP-015 pause flag with an auto-resume boundary.
 // Newly-created entries also get a direct channel push; `notified` is only
 // flipped true on a confirmed send, so a failed send leaves the existing
-// heartbeat-precheck EVALUATE wake as the fallback announcement path.
+// `heartbeat.ts precheck` EVALUATE wake as the fallback announcement path.
 // Fail-open throughout — never throws, since run()'s caller must never be blocked by
 // this check.
 async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: Json, locale: Locale = 'en'): Promise<void> {
@@ -691,7 +691,7 @@ async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: J
 
     // Then push — bounded well under the Stop pipeline's 15s budget — and record
     // `notified` via a fresh read-modify-write. On failure, notified stays false so
-    // heartbeat-precheck's EVALUATE wake remains the fallback announcement path.
+    // `heartbeat.ts precheck`'s EVALUATE wake remains the fallback announcement path.
     if (newPeriods.length > 0) {
       // Full USD/cap/ratio detail is maintainer-tier; on a stock install (no
       // maintainer channel, technical profile) it falls back to the primary chat,
@@ -709,7 +709,7 @@ async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: J
       // the maintainer leg was delivered (a chat, or its intended Findings home),
       // OR the client "paused until X" line landed on the primary chat. A degraded
       // Findings fallback (configured maintainer channel unreachable) leaves
-      // notified:false so heartbeat-precheck's EVALUATE wake re-announces once the
+      // notified:false so `heartbeat.ts precheck`'s EVALUATE wake re-announces once the
       // channel recovers.
       if (res.maintainer?.delivered || res.client?.ok === true) markBudgetNotified(newPeriods, periodKey);
     }
diff --git a/plugins/claude-code-hermit/scripts/generate-summary.ts b/plugins/claude-code-hermit/scripts/generate-summary.ts
index 6fd26486..161f2451 100644
--- a/plugins/claude-code-hermit/scripts/generate-summary.ts
+++ b/plugins/claude-code-hermit/scripts/generate-summary.ts
@@ -4,7 +4,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { rebuildIndex } from './proposals-index';
+import { rebuildIndex } from './lib/proposals/index-rebuild';
 import { readMergedAlerts } from './lib/alert-state';
 
 type Json = any;
diff --git a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
index 9d8915db..98909266 100755
--- a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
 # Usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>
 # Env: HEARTBEAT_MONITOR_ONCE=1  → run one iteration and exit (tests)
-#      HEARTBEAT_PRECHECK=<path> → override precheck path (tests)
-# Polls heartbeat-precheck.ts --peek and emits a notification only when the
+#      HEARTBEAT_PRECHECK=<path> → override precheck path (tests). Still a bare
+#                                  script path called with `--peek <dir>`; the
+#                                  default now prepends heartbeat.ts's verb.
+# Polls `heartbeat.ts precheck` --peek and emits a notification only when the
 # LLM needs to wake up (EVALUATE, AUTO_CLOSE, or ALERT verdict). --peek means
 # the polling itself is read-only; the mutating tick happens once when
 # /heartbeat run re-runs precheck inside the EVALUATE handler.
@@ -14,11 +16,17 @@
 set -u
 INTERVAL="${1:?usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>}"
 HB_DIR="${2:?usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>}"
-PRECHECK="${HEARTBEAT_PRECHECK:-$(dirname "$0")/heartbeat-precheck.ts}"
+# Array, not a string: the default is two words (script + verb) and an override
+# is one, and `bun "$X"` on a spaced string would look for a file with a space.
+if [[ -n "${HEARTBEAT_PRECHECK:-}" ]]; then
+  PRECHECK=("$HEARTBEAT_PRECHECK")
+else
+  PRECHECK=("$(dirname "$0")/heartbeat.ts" precheck)
+fi
 mkdir -p "$HB_DIR/state"
 first=1
 while true; do
-  verdict="$(bun "$PRECHECK" --peek "$HB_DIR" 2>/dev/null || echo "ERROR")"
+  verdict="$(bun "${PRECHECK[@]}" --peek "$HB_DIR" 2>/dev/null || echo "ERROR")"
   _ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   printf '{"last_peek_at":"%s"}\n' "$_ts" > "$HB_DIR/state/.heartbeat-liveness.tmp" \
     && mv "$HB_DIR/state/.heartbeat-liveness.tmp" "$HB_DIR/state/heartbeat-liveness.json" \
diff --git a/plugins/claude-code-hermit/scripts/heartbeat.ts b/plugins/claude-code-hermit/scripts/heartbeat.ts
new file mode 100644
index 00000000..3a5615ae
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/heartbeat.ts
@@ -0,0 +1,37 @@
+// heartbeat.ts — single CLI for the heartbeat mechanics, over
+// lib/heartbeat/{precheck,alert-update}.ts.
+//
+// Usage:
+//   bun heartbeat.ts precheck [--peek] <hermit-state-dir>
+//     The monitor's poll and /heartbeat run's mutating tick. --peek is
+//     read-only. Prints one verdict line: OK | EVALUATE | AUTO_CLOSE | ALERT |
+//     SKIP|<reason>. The monitor greps these, so the grammar is load-bearing.
+//
+//   bun heartbeat.ts alert-state <state-file>
+//     Applies one alert-state update from stdin.
+//
+// The verb is spliced out of process.argv before the module loads, so each
+// module keeps the argv indices it used as a standalone script — 550-odd lines
+// of alert derivation and lull arithmetic stay byte-for-byte unchanged rather
+// than being rethreaded through a parameter. Loading is lazy for the same
+// reason it is in routines.ts: a precheck poll runs every interval and has no
+// business parsing the alert-update graph.
+
+export {}; // module scope: every import here is dynamic, and top-level await needs it
+
+const USAGE = 'Usage: bun heartbeat.ts <precheck [--peek] <dir> | alert-state <state-file>>';
+
+const verb = process.argv[2];
+process.argv.splice(2, 1);
+
+switch (verb) {
+  case 'precheck':
+    await import('./lib/heartbeat/precheck');
+    break;
+  case 'alert-state':
+    await import('./lib/heartbeat/alert-update');
+    break;
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/hermit-pause.ts b/plugins/claude-code-hermit/scripts/hermit-pause.ts
index d913b80c..9a93b84c 100644
--- a/plugins/claude-code-hermit/scripts/hermit-pause.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-pause.ts
@@ -12,7 +12,7 @@
 import { setPause, clearPause, isPaused, parseSnoozeDuration } from './lib/pause';
 import { hermitDir } from './lib/cc-compat';
 
-// Resolve the hermit root the same way the writer (pause-keyword.ts) does —
+// Resolve the hermit root the same way the writer (lib/prompt-stages/pause-keyword.ts) does —
 // hermitDir() honors CLAUDE_PROJECT_DIR then walks up for config.json, so the
 // CLI targets the real flag even when run from a subdirectory. A hardcoded
 // relative '.claude-code-hermit' would resolve against the caller's cwd; run
diff --git a/plugins/claude-code-hermit/scripts/hermit-start.ts b/plugins/claude-code-hermit/scripts/hermit-start.ts
index 064cbe9c..c166ebe4 100644
--- a/plugins/claude-code-hermit/scripts/hermit-start.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-start.ts
@@ -390,7 +390,7 @@ function clearStatusCacheOnBoot(): void {
 
 /**
  * Stamps a fresh per-process nonce at state/.boot-id on every always-on boot.
- * cron-registry.ts (the hermit-routines diff planner) compares this against the
+ * `routines.ts cron-registry` (the hermit-routines diff planner) compares this against the
  * boot_id stored in its state/cron-registry.json mirror: a mismatch means the
  * mirror describes a prior process's CronCreates, which durable:false already
  * killed on exit, so the planner treats every enabled routine as CREATE with no
diff --git a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
index b01aeead..3b5b9178 100644
--- a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
@@ -33,7 +33,7 @@ import { tmuxSessionAlive, getSessionName as deriveSessionName, sendKeys } from
 import { paneRootPids, collectTree, terminateSurvivors } from './lib/proc';
 import { sharedLivenessAgeSecs, LIVENESS_FRESH_SECS } from './lib/liveness';
 import { costLogPath } from './lib/cc-compat';
-import { wallMinutes } from './cron-tz-shift';
+import { wallMinutes } from './lib/cron-shift';
 import { isPaused, pauseReasonLabel } from './lib/pause';
 import { WATCHDOG, resolveLocale, type Locale } from './lib/messages';
 import { defaultConfigDir, msUntilExpiry, tokenModeActive } from './lib/setup-token';
@@ -262,7 +262,7 @@ export function inActiveHours(activeHours: Json, timezone: string, ref?: Date):
     if (!/^\d{2}:\d{2}$/.test(start) || !/^\d{2}:\d{2}$/.test(end)) return true; // fail-open on malformed window
     const now = currentHHMM(timezone, ref);
     if (now === null) return true; // fail-open on unparseable tz
-    return start <= now && now < end; // end-exclusive, matching heartbeat-precheck
+    return start <= now && now < end; // end-exclusive, matching heartbeat.ts precheck
   } catch {
     return true; // fail-open
   }
diff --git a/plugins/claude-code-hermit/scripts/lib/alert-state.ts b/plugins/claude-code-hermit/scripts/lib/alert-state.ts
index 87f3d1dc..5c42da37 100644
--- a/plugins/claude-code-hermit/scripts/lib/alert-state.ts
+++ b/plugins/claude-code-hermit/scripts/lib/alert-state.ts
@@ -118,7 +118,7 @@ export function mutateOwnedAlerts(p: string, mutator: (alerts: Json) => void): b
 // the prior alerts{} and the set of keys firing this tick. The subagent now
 // returns only `{key, text}` pairs for items that need semantic judgment
 // (checklist/custom/waiting-timeout); this ladder is prefix-agnostic — the
-// caller (update-alert-state.ts) is responsible for only including keys it
+// caller (lib/heartbeat/alert-update.ts) is responsible for only including keys it
 // trusts in `firing` (model judgment keys plus script-derived keys — see
 // deriveMicroPendingKeys / deriveProposalPendingKeys / deriveStaleSession below).
 // ---------------------------------------------------------------------------
@@ -131,7 +131,7 @@ export interface FiringItem { key: string; text: string; channelText?: string; }
 // Keys backed by a filesystem source-of-truth (see deriveMicroPendingKeys /
 // deriveProposalPendingKeys). These are the ONLY code path that bakes a raw
 // internal id into an alert's text, so channel-safety scrubbing is scoped to
-// them. Shared with update-alert-state.ts (phantom-key filter, freeze).
+// them. Shared with lib/heartbeat/alert-update.ts (phantom-key filter, freeze).
 export const MICRO_PREFIX = 'micro-proposal-pending:';
 export const PROPOSAL_PREFIX = 'proposal-pending:';
 export const STRUCTURED_PREFIXES = [MICRO_PREFIX, PROPOSAL_PREFIX];
@@ -142,7 +142,7 @@ export const isStructuredKey = (key: string): boolean =>
 // like MICRO_PREFIX/PROPOSAL_PREFIX — its text carries no internal id, so it is
 // intentionally excluded from STRUCTURED_PREFIXES/isStructuredKey (no id-scrubbing,
 // no channel-silencing). Its model-phantom-drop is a separate exact-match check
-// in update-alert-state.ts.
+// in lib/heartbeat/alert-update.ts.
 export const STALE_KEY = 'stale-session';
 
 // Strip internal ids that must never reach the operator channel. The banned set
@@ -279,7 +279,7 @@ export function classifyTick(opts: {
 // demonstrated #594 failure). Deriving them here means the model never
 // authors them — omission or garbling by the model is simply impossible,
 // because the model's `firing` entries for these prefixes are ignored
-// (see update-alert-state.ts's phantom-key filter).
+// (see lib/heartbeat/alert-update.ts's phantom-key filter).
 //
 // `ok:false` signals an ambiguous read (not "nothing pending") — the caller
 // must not let an unreadable source-of-truth file age or resolve that
diff --git a/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts b/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
index 46816e9e..03820809 100644
--- a/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
+++ b/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
@@ -1,6 +1,6 @@
 // Shared validated-append primitive for JSONL event ledgers (proposal-metrics.jsonl,
 // observations.jsonl, micro-proposals.json's metrics companion, etc). Extracted from
-// append-metrics.ts so record-gate.ts and queue-micro-proposal.ts can append
+// append-metrics.ts so proposal.ts's gate and queue-micro verbs can append
 // pre-built events through the same validate-then-append contract instead of
 // re-implementing it.
 
diff --git a/plugins/claude-code-hermit/scripts/lib/auto-close.ts b/plugins/claude-code-hermit/scripts/lib/auto-close.ts
index 32515d40..fa54feac 100644
--- a/plugins/claude-code-hermit/scripts/lib/auto-close.ts
+++ b/plugins/claude-code-hermit/scripts/lib/auto-close.ts
@@ -1,5 +1,5 @@
 // Shared 10-minute operator-lull threshold for daily-auto-close: the
-// session-archive.ts auto-close-decision verb, the heartbeat-precheck.ts
+// session-archive.ts auto-close-decision verb, the lib/heartbeat/precheck.ts
 // pending-close drain, and the hermit-watchdog.ts post-close-clear backoff
 // all gate on the same lull. Side-effect-free — safe to import from CLI scripts.
 export const AUTO_CLOSE_LULL_MINUTES = 10;
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-auth.ts b/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
index 3330aabd..a913a26e 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
@@ -1,6 +1,7 @@
 // Shared channel `allowed_users` allowlist gating — used by every
 // UserPromptSubmit hook that reacts to an inbound <channel> envelope
-// (channel-reply-reminder.ts, pause-keyword.ts, channel-status-responder.ts).
+// (the channel-reply-reminder, pause-keyword and channel-status-responder
+// stages in lib/prompt-stages/).
 // A single copy so the allowlist rule can't drift out of sync between callers.
 
 import fs from 'node:fs';
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts b/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
index 30d4cf5e..d54717a7 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
@@ -1,6 +1,7 @@
 // Shared <channel ...>body</channel> envelope parser — used by every
 // UserPromptSubmit hook that reacts to an inbound channel message
-// (channel-reply-reminder.ts, channel-status-responder.ts, pause-keyword.ts).
+// (the channel-reply-reminder, channel-status-responder and pause-keyword
+// stages in lib/prompt-stages/).
 // A single copy so the attribute regex and body-extraction rule can't drift
 // out of sync between callers.
 //
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-log.ts b/plugins/claude-code-hermit/scripts/lib/channel-log.ts
index 62c2c7fc..34b4ad87 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-log.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-log.ts
@@ -63,7 +63,8 @@ function dbExists(hermitDir: string): boolean {
 }
 
 // Busy-wait budgets. Capture runs inside hooks with their own enforced timeouts
-// (channel-reply-reminder.ts: 3s, channel-hook.ts: 5s in hooks.json), and
+// (user-prompt-pipeline.ts: 15s shared across all its stages, channel-hook.ts:
+// 5s in hooks.json), and
 // bun:sqlite blocks synchronously — so the hook path must fail fast rather than
 // stall past its budget and get killed. The weekly-review CLI writers aren't
 // timeout-bound, so they can wait out real contention.
@@ -84,7 +85,7 @@ function openDb(hermitDir: string, opts?: { readonly?: boolean; busyTimeoutMs?:
 
 /**
  * Default-on gate for episodic capture: config.knowledge.channel_log_enabled.
- * Shared by channel-hook.ts (outbound) and channel-reply-reminder.ts (inbound)
+ * Shared by channel-hook.ts (outbound) and the channel-reply-reminder stage (inbound)
  * so the "only an explicit false disables capture" rule lives in one place.
  */
 function isLoggingEnabled(config: Json): boolean {
diff --git a/plugins/claude-code-hermit/scripts/lib/cli.ts b/plugins/claude-code-hermit/scripts/lib/cli.ts
index 6f383f0a..9c6b4ddf 100644
--- a/plugins/claude-code-hermit/scripts/lib/cli.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cli.ts
@@ -3,7 +3,7 @@
 // and exits 0; readStdin() reads a heredoc payload to completion untrimmed
 // (callers trim where the original per-script behavior trimmed); readJson()
 // is a tolerant JSON-file reader for optional state files (null if missing
-// or invalid).
+// or invalid); flagValue() reads one `--flag value` pair out of an argv slice.
 
 import fs from 'node:fs';
 
@@ -28,4 +28,9 @@ function readJson(p: string): Json {
   try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; }
 }
 
-export { emit, readStdin, readJson };
+function flagValue(argv: string[], flag: string): string | undefined {
+  const i = argv.indexOf(flag);
+  return i === -1 ? undefined : argv[i + 1];
+}
+
+export { emit, readStdin, readJson, flagValue };
diff --git a/plugins/claude-code-hermit/scripts/cost-reflect.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/cost-reflect.ts
rename to plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
index 54aadd20..f7dea63c 100644
--- a/plugins/claude-code-hermit/scripts/cost-reflect.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
@@ -1,11 +1,16 @@
+// `cost-report.ts reflect [<stateDir>] [<days>] [--plain]` — the "why is my bill
+// like this" report. Table mode is the full per-model/per-source breakdown;
+// --plain is the channel-safe prose answer. Fail-open: any throw becomes a
+// one-line error on stdout at exit 0, never a blocked caller.
+
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { costByType } from './lib/pricing';
-import { loadConfig } from './lib/channel-auth';
-import { money, resolveTimezone, budgetLine } from './lib/spend-status';
-import { todayYMD } from './lib/time';
-import { costLogPath, hermitDir } from './lib/cc-compat';
+import { costByType } from '../pricing';
+import { loadConfig } from '../channel-auth';
+import { money, resolveTimezone, budgetLine } from '../spend-status';
+import { todayYMD } from '../time';
+import { costLogPath, hermitDir } from '../cc-compat';
 
 type Json = any;
 
@@ -134,8 +139,7 @@ function buildPlainStatement(stateDir: string, costLog: string): string {
   return lines.join('\n') + '\n';
 }
 
-function run() {
-  const rawArgs = process.argv.slice(2);
+function report(rawArgs: string[]) {
   const plainMode = rawArgs.includes('--plain');
   const positional = rawArgs.filter(a => a !== '--plain');
   // An absolute arg (as tests pass) is used verbatim; a relative/absent arg is
@@ -316,10 +320,12 @@ function run() {
   }
 }
 
-try {
-  run();
-} catch (err: any) {
-  // Fail-open: never block on a cost-reflect failure
-  process.stdout.write(`cost-reflect: error — ${err.message}\n`);
-  process.exit(0);
+export function run(args: string[]): void {
+  try {
+    report(args);
+  } catch (err: any) {
+    // Fail-open: never block on a cost-reflect failure
+    process.stdout.write(`cost-reflect: error — ${err.message}\n`);
+    process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts
new file mode 100644
index 00000000..599e72e7
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts
@@ -0,0 +1,80 @@
+// `cost-report.ts session <session_id> [--opened-at <iso>] [--closed-at <iso>]`
+// Sums cost-log.jsonl entries for the current logical session and prints the result.
+// Output: JSON {"cost_usd": <number>, "tokens": <number>}
+//
+// Primary mode: window-delta. cost-log.jsonl rows are tagged with the transcript's
+// process session_id (a UUID), never the logical S-NNN id (assigned only at close),
+// and one long-lived transcript holds many logical sessions — so an exact session_id
+// match against S-NNN always misses. Instead, sum every row whose timestamp falls in
+// the arc window [opened_at, closed_at]. Both bounds are read from state/runtime.json
+// (maintained by cost-tracker.ts: opened_at re-stamped per arc keyed on the transcript
+// id, closed_at stamped on the idle transition) unless overridden via --opened-at /
+// --closed-at. A live arc has no closed_at yet, so the window ends at now.
+//
+// Fallback mode: when no opened_at is available (older runtime.json, or none yet),
+// fail open to the legacy exact session_id sum — same zeros-for-unknown-id behavior
+// as before.
+// Fails open throughout: missing log or unreadable state prints {"cost_usd": 0, "tokens": 0}.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { costLogPath, hermitDir } from '../cc-compat';
+import { readRuntimeJson } from '../runtime';
+import { computeSessionCost } from '../session-cost';
+
+// Arc-window rationale is in the file header above; this just applies the
+// --opened-at / --closed-at overrides on top of runtime.json's values.
+function readWindow(root: string, openedAtOverride?: string, closedAtOverride?: string): { openedAt?: string; closedAt?: string } {
+  const rt = readRuntimeJson(path.join(root, 'state')) || {};
+  return {
+    openedAt: openedAtOverride ?? (typeof rt.opened_at === 'string' ? rt.opened_at : undefined),
+    closedAt: closedAtOverride ?? (typeof rt.closed_at === 'string' ? rt.closed_at : undefined),
+  };
+}
+
+function sumMatching(costLog: string, predicate: (e: any) => boolean): { cost: number; tokens: number } {
+  let cost = 0;
+  let tokens = 0;
+  try {
+    for (const line of fs.readFileSync(costLog, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const e = JSON.parse(line);
+        if (predicate(e)) {
+          cost += e.estimated_cost_usd || 0;
+          tokens += e.total_tokens || 0;
+        }
+      } catch {}
+    }
+  } catch {}
+  return { cost, tokens };
+}
+
+// root/costLog are resolved here, not at module scope: cost-report.ts imports
+// every verb module unconditionally, and hermitDir() is an fs.existsSync walk up
+// to 8 levels — at module scope it would run on every invocation, including the
+// verbs that never touch it. reflect.ts already resolves inside its own entry.
+export function run(argv: string[]): void {
+  const root = hermitDir();
+  const costLog = costLogPath(root);
+
+  let sessionId = '';
+  let openedAtOverride: string | undefined;
+  let closedAtOverride: string | undefined;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--opened-at') { openedAtOverride = argv[++i]; continue; }
+    if (a === '--closed-at') { closedAtOverride = argv[++i]; continue; }
+    if (!sessionId) sessionId = a;
+  }
+
+  const { openedAt, closedAt } = readWindow(root, openedAtOverride, closedAtOverride);
+  const measured = computeSessionCost({ logPath: costLog, openedAt, closedAt });
+
+  // Window mode unavailable (no opened_at) — fall back to the legacy exact-match sum.
+  const result = measured.available
+    ? { cost: measured.cost_usd, tokens: measured.tokens }
+    : sumMatching(costLog, e => e.session_id === sessionId);
+
+  process.stdout.write(JSON.stringify({ cost_usd: Math.round(result.cost * 10000) / 10000, tokens: result.tokens }) + '\n');
+}
diff --git a/plugins/claude-code-hermit/scripts/today-cost.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
similarity index 62%
rename from plugins/claude-code-hermit/scripts/today-cost.ts
rename to plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
index 8d1e3c48..71ffb826 100644
--- a/plugins/claude-code-hermit/scripts/today-cost.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
@@ -1,19 +1,19 @@
-// Prints today's spend: "$X.XX (<tokens>) across N session(s)".
+// `cost-report.ts today` — prints today's spend as
+// "$X.XX (<tokens>) across N session(s)".
 // Log resolved against the anchored hermit root (survives cwd drift), not cwd.
 // Unreadable log -> "cost data unavailable" (not a misleading $0.00); a readable
 // log with no rows today -> honest $0.00.
 
 import fs from 'node:fs';
-import { formatTokens } from './lib/format';
-import { costLogPath, hermitDir } from './lib/cc-compat';
+import { formatTokens } from '../format';
+import { costLogPath, hermitDir } from '../cc-compat';
 
-const COST_LOG = costLogPath(hermitDir());
 const UNAVAILABLE = 'cost data unavailable';
 
-function render(): string {
+function render(costLog: string): string {
   let raw: string;
   try {
-    raw = fs.readFileSync(COST_LOG, 'utf8');
+    raw = fs.readFileSync(costLog, 'utf8');
   } catch {
     return UNAVAILABLE;
   }
@@ -39,4 +39,9 @@ function render(): string {
   }
 }
 
-process.stdout.write(render() + '\n');
+// Resolved here rather than at module scope — see the note in session.ts: every
+// verb module is imported unconditionally, so a module-scope hermitDir() walk
+// would run even for the verbs that never read it.
+export function run(): void {
+  process.stdout.write(render(costLogPath(hermitDir())) + '\n');
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/cron-match.ts b/plugins/claude-code-hermit/scripts/lib/cron-match.ts
index 2dae28bc..20c42c06 100644
--- a/plugins/claude-code-hermit/scripts/lib/cron-match.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cron-match.ts
@@ -1,5 +1,5 @@
 // Pure 5-field cron matcher. Evaluates against wall-clock parts in a target timezone —
-// used by routine-due.ts to check schedules directly in config.timezone (no shiftCron).
+// used by lib/routines/due.ts to check schedules directly in config.timezone (no shiftCron).
 //
 // Two-tier API so hot loops can hoist the invariant work out of the per-candidate scan:
 //   - makeTzFormatter(tz) once per poll, then partsFromFormatter(fmt, date) per candidate;
@@ -52,7 +52,7 @@ export function datePartsInTz(date: Date, tz: string | null): DateParts | null {
 
 // Parse a 5-field cron expr into per-field Sets once. Returns null on a malformed expr
 // (wrong field count or an unparseable field), so callers fail closed. DOW: 7 ≡ 0
-// (cron-tz-shift.ts precedent). Expr should already be validated by validateCronSchedule
+// (lib/routines/tz-shift.ts precedent). Expr should already be validated by validateCronSchedule
 // (which additionally rejects DOM+DOW both restricted), so plain AND of all fields is correct.
 export function compileCron(expr: string): CompiledCron | null {
   const fields = expr.trim().split(/\s+/);
diff --git a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
similarity index 74%
rename from plugins/claude-code-hermit/scripts/cron-tz-shift.ts
rename to plugins/claude-code-hermit/scripts/lib/cron-shift.ts
index def6f705..f72e8939 100644
--- a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
@@ -1,11 +1,11 @@
-// Rewrite a 5-field cron expression from one IANA timezone to the machine's local timezone.
-// Usage: bun cron-tz-shift.ts "<cron-expr>" "<from-tz>"
-// Stdout: shifted cron (or original on unsupported/fail-open paths)
-// Stderr: WARN: <reason>  (when passing through unchanged due to unsupported pattern)
-// Exit 0 always except: malformed cron that fails validateCronSchedule, or unparseable HERMIT_CRON_TZ_SHIFT_NOW
+// Timezone-aware cron shifting — the pure logic behind scripts/routines.ts tz-shift.
+//
+// Lives in lib/ so importers (lib/routines/registry.ts, hermit-watchdog.ts, the
+// status-responder stage) don't pull in a top-level CLI script just to reach
+// two functions.
 
-import { parseCronField, validateCronSchedule } from './validate-config';
-import { currentHHMM } from './lib/time';
+import { parseCronField } from '../validate-config';
+import { currentHHMM } from './time';
 
 function wallMinutes(tz: string, ref: Date): number | null {
   const hhmm = currentHHMM(tz, ref);
@@ -14,11 +14,6 @@ function wallMinutes(tz: string, ref: Date): number | null {
   return h * 60 + m;
 }
 
-function resolveMachineTz() {
-  try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }
-  catch { return null; }
-}
-
 // Collapse a sorted array of integers back to a compact cron field token.
 function collapseField(vals: number[], lo: number, hi: number): string | null {
   if (!vals || vals.length === 0) return null;
@@ -136,45 +131,4 @@ function shiftCron(cronExpr: string, fromTz: string, machineTz: string, ref: Dat
   return { result: `${newMinF} ${newHourF} ${domF} ${monF} ${newDowF}`, shifted: true };
 }
 
-function main() {
-  const [,, cronExpr, fromTz] = process.argv;
-
-  if (!cronExpr) {
-    process.stderr.write('Usage: bun cron-tz-shift.ts "<cron-expr>" "<from-tz>"\n');
-    process.exit(1);
-  }
-
-  let ref: Date;
-  if (process.env.HERMIT_CRON_TZ_SHIFT_NOW) {
-    ref = new Date(process.env.HERMIT_CRON_TZ_SHIFT_NOW);
-    if (isNaN(ref.getTime())) {
-      process.stderr.write(`Error: HERMIT_CRON_TZ_SHIFT_NOW is not a valid ISO 8601 date: "${process.env.HERMIT_CRON_TZ_SHIFT_NOW}"\n`);
-      process.exit(1);
-    }
-  } else {
-    ref = new Date();
-  }
-
-  const validErr = validateCronSchedule(cronExpr);
-  if (validErr) {
-    process.stderr.write(`Error: invalid cron expression: ${validErr}\n`);
-    process.exit(1);
-  }
-
-  const machineTz = resolveMachineTz();
-  if (!machineTz) {
-    process.stdout.write(cronExpr + '\n');
-    process.stderr.write('WARN: could not resolve machine timezone\n');
-    return;
-  }
-
-  const { result, warn } = shiftCron(cronExpr, fromTz || '', machineTz, ref);
-  process.stdout.write(result + '\n');
-  if (warn) process.stderr.write(`WARN: ${warn}\n`);
-}
-
 export { shiftCron, wallMinutes };
-
-if (import.meta.main) {
-  main();
-}
diff --git a/plugins/claude-code-hermit/scripts/lib/dashboard.ts b/plugins/claude-code-hermit/scripts/lib/dashboard.ts
index a20786e5..864ab8df 100644
--- a/plugins/claude-code-hermit/scripts/lib/dashboard.ts
+++ b/plugins/claude-code-hermit/scripts/lib/dashboard.ts
@@ -18,7 +18,7 @@ import { sha256 } from './hash';
 import { readMergedAlerts } from './alert-state';
 import { todayYMD } from './time';
 import { costIndexPath, readCostIndex } from './cost-log';
-import { rebuildIndex, type ProposalsIndex } from '../proposals-index';
+import { rebuildIndex, type ProposalsIndex } from './proposals/index-rebuild';
 import { loadStrings, fmt, type ArtifactStrings } from './artifact-strings';
 
 type Json = any;
diff --git a/plugins/claude-code-hermit/scripts/lib/harness-command.ts b/plugins/claude-code-hermit/scripts/lib/harness-command.ts
index 3afd8f8e..f2c15bb1 100644
--- a/plugins/claude-code-hermit/scripts/lib/harness-command.ts
+++ b/plugins/claude-code-hermit/scripts/lib/harness-command.ts
@@ -1,5 +1,5 @@
 // Pending harness-command marker — written by the UserPromptSubmit hook
-// (harness-command-keyword.ts), consumed by the Stop hook (stop-pipeline.ts).
+// (lib/prompt-stages/harness-command.ts), consumed by the Stop hook (stop-pipeline.ts).
 //
 // Singleton by design, matching the existing marker files in state/. Two commands
 // arriving inside one turn therefore collapse to the last one; that is accepted rather
diff --git a/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
index 571b3ed6..dae23033 100644
--- a/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
@@ -1,5 +1,5 @@
-// Pure predicate shared by heartbeat-precheck.ts and its coherence test.
-// Extracted so both reference one definition — importing heartbeat-precheck.ts
+// Pure predicate shared by lib/heartbeat/precheck.ts and its coherence test.
+// Extracted so both reference one definition — importing lib/heartbeat/precheck.ts
 // directly would fire its top-level emit()/process.exit().
 //
 // Does a HEARTBEAT.md checklist item represent the default proposal-scan item?
diff --git a/plugins/claude-code-hermit/scripts/update-alert-state.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
similarity index 97%
rename from plugins/claude-code-hermit/scripts/update-alert-state.ts
rename to plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
index e12c37d6..78a1daba 100644
--- a/plugins/claude-code-hermit/scripts/update-alert-state.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
@@ -17,7 +17,7 @@
 //
 // The eval JSON is read from stdin (not argv) so free-text alert content can't
 // break shell quoting.
-// Usage: bun update-alert-state.ts <state-file-path>   # eval-json on stdin
+// Usage: bun heartbeat.ts alert-state <state-file-path>   # eval-json on stdin
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -25,15 +25,15 @@ import {
   readAlertState, defaultAlertState, quarantineAlertState, writeAlertState,
   classifyTick, deriveMicroPendingKeys, deriveProposalPendingKeys, deriveStaleSession, FiringItem,
   MICRO_PREFIX, PROPOSAL_PREFIX, STALE_KEY, isStructuredKey,
-} from './lib/alert-state';
-import { currentHHMM, todayYMD, resolveHermitNowMs, parseDuration } from './lib/time';
+} from '../alert-state';
+import { currentHHMM, todayYMD, resolveHermitNowMs, parseDuration } from '../time';
 
 type Json = any;
 
 const stateFile = process.argv[2];
 
 if (!stateFile) {
-  console.error('Usage: bun update-alert-state.ts <state-file-path>   # eval-json on stdin');
+  console.error('Usage: bun heartbeat.ts alert-state <state-file-path>   # eval-json on stdin');
   process.exit(1);
 }
 
diff --git a/plugins/claude-code-hermit/scripts/heartbeat-precheck.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
similarity index 96%
rename from plugins/claude-code-hermit/scripts/heartbeat-precheck.ts
rename to plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
index 7bb01d6e..5d8a1602 100644
--- a/plugins/claude-code-hermit/scripts/heartbeat-precheck.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
@@ -1,5 +1,5 @@
-// heartbeat-precheck.ts — fast-path verdict before the LLM evaluates HEARTBEAT.md.
-// Usage: bun heartbeat-precheck.ts [--peek] <hermit-state-dir>
+// `heartbeat.ts precheck` — fast-path verdict before the LLM evaluates HEARTBEAT.md.
+// Usage: bun heartbeat.ts precheck [--peek] <hermit-state-dir>
 // Output (stdout, one line): SKIP|<reason>  |  OK  |  AUTO_CLOSE  |  EVALUATE  |  ALERT|<detail>
 // Exit 0 always. Without --peek: writes updated alert-state.json (increments total_ticks).
 // With --peek: read-only — computes the same verdict without any state mutation.
@@ -10,14 +10,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { currentHHMM, todayYMD, parseDuration } from './lib/time';
-import { readAlertState, defaultAlertState, quarantineAlertState, writeAlertState, readMergedAlerts } from './lib/alert-state';
-import { readFrontmatter, listProposalFiles } from './lib/frontmatter';
-import { isProposalScanItem } from './lib/heartbeat-items';
-import { isPaused } from './lib/pause';
-import { scanForInjection } from './lib/injection-scan';
-import { sha256 } from './lib/hash';
-import { AUTO_CLOSE_LULL_MINUTES } from './lib/auto-close';
+import { currentHHMM, todayYMD, parseDuration } from '../time';
+import { readAlertState, defaultAlertState, quarantineAlertState, writeAlertState, readMergedAlerts } from '../alert-state';
+import { readFrontmatter, listProposalFiles } from '../frontmatter';
+import { isProposalScanItem } from '../heartbeat-items';
+import { isPaused } from '../pause';
+import { scanForInjection } from '../injection-scan';
+import { sha256 } from '../hash';
+import { AUTO_CLOSE_LULL_MINUTES } from '../auto-close';
 
 type Json = any;
 
diff --git a/plugins/claude-code-hermit/scripts/lib/messages.ts b/plugins/claude-code-hermit/scripts/lib/messages.ts
index 2234e1af..2e8d9117 100644
--- a/plugins/claude-code-hermit/scripts/lib/messages.ts
+++ b/plugins/claude-code-hermit/scripts/lib/messages.ts
@@ -267,7 +267,7 @@ export const WATCHDOG: Localized<WatchdogMessages> = {
   },
 };
 
-// ---------- deterministic shutdown gate (shutdown-gate.ts) ----------
+// ---------- deterministic shutdown gate (lib/prompt-stages/shutdown-gate.ts) ----------
 
 export interface ShutdownMessages {
   inProgress(): string;
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts
new file mode 100644
index 00000000..d9536711
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts
@@ -0,0 +1,84 @@
+// UserPromptSubmit stage — when the inbound prompt starts with a <channel>
+// envelope, injects an additionalContext reminder naming the exact reply tool
+// and chat_id. Operators on Discord/Telegram read the channel, not the
+// transcript; this reminder fires right before the model's next turn.
+//
+// Also captures the inbound message into the episodic channel log (PROP-010)
+// — see scripts/lib/channel-log.ts. Capture is best-effort and strictly
+// secondary to the reminder: it runs after the reminder is composed, in its
+// own try/catch, and a logging failure never affects the reminder.
+
+import { safeForLLM } from '../sanitize';
+import { logMessage, isLoggingEnabled } from '../channel-log';
+import { isAllowedSender } from '../channel-auth';
+import type { ChannelEnvelope, StageContext, StageResult } from './types';
+
+// Known channel sources → exact MCP reply tool name.
+// Unknown sources fall back to a generic phrase so future channel plugins
+// still benefit from the reminder without a code change.
+const REPLY_TOOLS: Record<string, string> = {
+  discord: 'mcp__plugin_discord_discord__reply',
+  telegram: 'mcp__plugin_telegram_telegram__reply',
+  imessage: 'mcp__plugin_imessage_imessage__reply',
+};
+
+const MAX_SOURCE_LEN = 32;
+const MAX_CHAT_ID_LEN = 128;
+
+// Episodic capture — best-effort, never affects the reminder. Its guards are
+// early returns from this helper, so none of them can swallow the reminder the
+// caller is about to return.
+function capture(ctx: StageContext, envelope: ChannelEnvelope): void {
+  if (!envelope.body) return;
+
+  const dir = ctx.dir;
+  const config = ctx.config();
+  if (!isLoggingEnabled(config)) return;
+
+  // Raw source (not sourceKey): channelEntry normalizes it internally, and
+  // pause-keyword.ts and channel-status-responder.ts feed the same raw source
+  // into this gate — one convention across every caller.
+  if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
+
+  const result = logMessage(dir, {
+    source: envelope.sourceKey,
+    chat_id: envelope.chatId,
+    direction: 'in',
+    sender: envelope.userId,
+    message_id: envelope.messageId,
+    text: envelope.body,
+    ts: envelope.ts ?? undefined,
+  });
+  if (!result.ok) {
+    process.stderr.write(`[channel-log] inbound capture failed: ${result.error}\n`);
+  }
+}
+
+export function run(ctx: StageContext): StageResult | void {
+  const envelope = ctx.envelope;
+  if (!envelope) return;
+
+  const sourceKey = envelope.sourceKey;
+  const chatIdRaw = envelope.chatId;
+
+  const source = safeForLLM(sourceKey.slice(0, MAX_SOURCE_LEN));
+  const chatId = safeForLLM(chatIdRaw.slice(0, MAX_CHAT_ID_LEN));
+
+  const tool = REPLY_TOOLS[source];
+  const toolLine = tool
+    ? `\`${tool}\` with chat_id="${chatId}"`
+    : `the channel's \`reply\` tool with chat_id="${chatId}"`;
+
+  const reminder =
+    `[channel reply reminder] Inbound message arrived on the \`${source || 'unknown'}\` channel` +
+    ` (chat_id=\`${chatId}\`). Substantive reply must go through ${toolLine}.` +
+    ` Transcript/terminal output does not reach the operator.\n`;
+
+  try {
+    capture(ctx, envelope);
+  } catch (e: any) {
+    process.stderr.write(`[channel-log] inbound capture failed: ${e?.message || e}\n`);
+  }
+
+  return { context: reminder };
+}
diff --git a/plugins/claude-code-hermit/scripts/channel-status-responder.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
similarity index 83%
rename from plugins/claude-code-hermit/scripts/channel-status-responder.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
index 963ad6cc..d59171bc 100644
--- a/plugins/claude-code-hermit/scripts/channel-status-responder.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
@@ -1,4 +1,4 @@
-// UserPromptSubmit hook — deterministic status responder.
+// UserPromptSubmit stage — deterministic status responder.
 //
 // When the inbound prompt is a <channel> envelope whose body is exactly
 // "status" (trimmed, case-insensitive) and the sender passes the channel's
@@ -19,15 +19,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { hermitDir } from './lib/cc-compat';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { loadConfig, isAllowedSender, isTrustedController } from './lib/channel-auth';
-import { isPaused, pauseReasonLabel } from './lib/pause';
-import { resolveTimezone, budgetLine } from './lib/spend-status';
-import { friendlyBoundary, parseSimpleCronTime } from './lib/time';
-import { wallMinutes } from './cron-tz-shift';
-import { sendToChannel } from './lib/channel-send';
-import { STATUS, resolveLocale, type Locale } from './lib/messages';
+import { isAllowedSender, isTrustedController } from '../channel-auth';
+import { isPaused, pauseReasonLabel } from '../pause';
+import { resolveTimezone, budgetLine } from '../spend-status';
+import { friendlyBoundary, parseSimpleCronTime } from '../time';
+import { wallMinutes } from '../cron-shift';
+import { sendToChannel } from '../channel-send';
+import { STATUS, resolveLocale, type Locale } from '../messages';
+import type { StageContext, StageResult } from './types';
 
 type Json = any;
 
@@ -167,25 +166,15 @@ export function composeStatusReply(dir: string, config: Json, opts: { redact?: b
   return lines.join(' ');
 }
 
-async function main(raw: string): Promise<void> {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
+export async function run(ctx: StageContext): Promise<StageResult | void> {
+  const envelope = ctx.envelope;
   if (!envelope) return;
 
   // Exact-match only — near-misses fall through to the model (probe-verified).
   if (envelope.body.trim().toLowerCase() !== 'status') return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   if (!config) return;
 
   if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
@@ -201,10 +190,10 @@ async function main(raw: string): Promise<void> {
   const result = await sendToChannel(dir, reply, {
     target: { id: envelope.sourceKey, chat_id: envelope.chatId },
     timeoutMs: 6000,
+    config, // already loaded by the pipeline — don't make the sender re-read it
   });
   if (result.ok) {
-    console.log(JSON.stringify({ decision: 'block', reason: 'status answered deterministically' }));
-    return;
+    return { block: 'status answered deterministically' };
   }
 
   // Deterministic delivery failed — an unsupported platform (iMessage/webhook aren't
@@ -216,23 +205,10 @@ async function main(raw: string): Promise<void> {
   // UserPromptSubmit hook's stdout reaches the model on the same turn
   // (compiled/spike-userprompt-additionalcontext-probe-2026-07-05.md) — the same
   // mechanism channel-reply-reminder.ts relies on.
-  process.stdout.write(
-    `[status] Deterministic status delivery is unavailable on this channel. Relay the ` +
-    `following status to the operator verbatim via the channel reply tool (to the chat ` +
-    `this message arrived on), then stop — add no commentary:\n${reply}\n`
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    main(buf)
-      .catch(() => {})
-      .finally(() => process.exit(0));
-  });
-} catch {
-  process.exit(0);
+  return {
+    context:
+      `[status] Deterministic status delivery is unavailable on this channel. Relay the ` +
+      `following status to the operator verbatim via the channel reply tool (to the chat ` +
+      `this message arrived on), then stop — add no commentary:\n${reply}\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/harness-command-keyword.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
similarity index 63%
rename from plugins/claude-code-hermit/scripts/harness-command-keyword.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
index 0c7b1669..acb9c50b 100644
--- a/plugins/claude-code-hermit/scripts/harness-command-keyword.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
@@ -1,7 +1,4 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — deterministic harness-command recorder.
+// UserPromptSubmit stage — deterministic harness-command recorder.
 //
 // Native Claude Code slash commands that control the HARNESS (/model, /effort,
 // /compact, /clear) are unreachable from a channel: inbound channel prompts are
@@ -24,42 +21,28 @@ process.stdout.on('error', () => {});
 // because these commands mutate session state. An unauthorized sender is a silent no-op:
 // no marker, no stdout, so the mechanism can't be probed by an unauthorized prompt.
 
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { loadConfig, isTrustedController } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { readRuntimeJson } from './lib/runtime';
-import { parseHarnessCommand, writePendingCommand, renderCommand } from './lib/harness-command';
-
-type Json = any;
-
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
+import { safeForLLM } from '../sanitize';
+import { isTrustedController } from '../channel-auth';
+import { parseHarnessCommand, writePendingCommand, renderCommand } from '../harness-command';
+import type { StageContext, StageResult } from './types';
 
-  const env = parseChannelEnvelope(prompt);
+export function run(ctx: StageContext): StageResult | void {
+  const env = ctx.envelope;
   if (!env) return;
   if (!env.body) return;
 
   const parsed = parseHarnessCommand(env.body);
   if (!parsed) return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   if (!isTrustedController(config, env.source, env.userId, env.chatId)) return; // unauthorized — silent no-op
 
   // Interactive sessions store tmux_session: null (hermit-start.ts), so there is no pane
   // to deliver into. Refuse HERE rather than recording a marker the drain could never
   // consume — otherwise the operator gets an acknowledgement for a command that silently
   // never happens.
-  const runtime = readRuntimeJson();
+  const runtime = ctx.runtime();
   if (!runtime || runtime.runtime_mode === 'interactive' || !runtime.tmux_session) return;
 
   const by = safeForLLM((env.userId ?? env.source ?? 'channel').slice(0, 64));
@@ -72,20 +55,7 @@ function main(raw: string): void {
   if (!ok) return;
 
   const rendered = renderCommand(parsed);
-  process.stdout.write(
-    `[harness-command] "${rendered}" requested by ${by} — will be applied to this session when the current turn ends.\n`,
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
+  return {
+    context: `[harness-command] "${rendered}" requested by ${by} — will be applied to this session when the current turn ends.\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/pause-keyword.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
similarity index 62%
rename from plugins/claude-code-hermit/scripts/pause-keyword.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
index b0088778..dc7de0bc 100644
--- a/plugins/claude-code-hermit/scripts/pause-keyword.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
@@ -1,7 +1,4 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — deterministic pause/resume/snooze keyword writer
+// UserPromptSubmit stage — deterministic pause/resume/snooze keyword writer
 // (PROP-015). Writes state/pause.json directly from an inbound <channel>
 // envelope, before any model involvement, so pause/resume never depends on
 // model cooperation or on a tool call the pause-gate itself might deny.
@@ -17,32 +14,19 @@ process.stdout.on('error', () => {});
 // silent no-op: no state change, no stdout, so the mechanism can't be probed
 // by an unauthorized prompt.
 
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { setPause, clearPause, parseSnoozeDuration } from './lib/pause';
-import { loadConfig, isTrustedController } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-
-type Json = any;
+import { safeForLLM } from '../sanitize';
+import { setPause, clearPause, parseSnoozeDuration } from '../pause';
+import { isTrustedController } from '../channel-auth';
+import type { StageContext, StageResult } from './types';
 
 const MAX_BY_LEN = 64;
 const MAX_DURATION_LEN = 32;
 
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
+export function run(ctx: StageContext): StageResult | void {
   // Shared envelope parser (also used by channel-reply-reminder/status-responder),
   // so the grammar can't drift. Requires a chat_id — which the DM-binding gate
   // below needs anyway, and every real inbound envelope carries.
-  const env = parseChannelEnvelope(prompt);
+  const env = ctx.envelope;
   if (!env) return;
   const sourceRaw = env.source;
   const userId = env.userId;
@@ -62,8 +46,8 @@ function main(raw: string): void {
   else if (snoozeMatch) { action = 'snooze'; durationRaw = snoozeMatch[1]; }
   if (!action) return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   // Stricter gate than a plain reply: pausing is state-mutating, so an unconfigured
   // channel trusts only the operator's DM (chat_id === dm_channel_id), not accept-all.
   if (!isTrustedController(config, sourceRaw, userId, env.chatId)) return; // unauthorized — silent no-op
@@ -72,36 +56,22 @@ function main(raw: string): void {
 
   if (action === 'pause') {
     setPause(dir, { reason: 'operator', by });
-    process.stdout.write(
-      `[pause] Hermit paused by ${by} (indefinite). Only the channel reply tool works until resumed.\n`
-    );
+    return {
+      context: `[pause] Hermit paused by ${by} (indefinite). Only the channel reply tool works until resumed.\n`,
+    };
   } else if (action === 'resume') {
     clearPause(dir);
-    process.stdout.write(`[pause] Hermit resumed by ${by}. Normal operation restored.\n`);
+    return { context: `[pause] Hermit resumed by ${by}. Normal operation restored.\n` };
   } else {
     const durationSafe = safeForLLM((durationRaw ?? '').slice(0, MAX_DURATION_LEN));
     const ms = durationRaw ? parseSnoozeDuration(durationRaw) : null;
     if (ms === null) {
-      process.stdout.write(
-        `[pause] Could not parse snooze duration "${durationSafe}" — expected e.g. "30m", "2h", "1d". No change made.\n`
-      );
-      return;
+      return {
+        context: `[pause] Could not parse snooze duration "${durationSafe}" — expected e.g. "30m", "2h", "1d". No change made.\n`,
+      };
     }
     const until = new Date(Date.now() + ms).toISOString();
     setPause(dir, { reason: 'operator', by, until });
-    process.stdout.write(`[pause] Hermit paused by ${by} until ${until}.\n`);
+    return { context: `[pause] Hermit paused by ${by} until ${until}.\n` };
   }
 }
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
-}
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts
new file mode 100644
index 00000000..f38fc7b4
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts
@@ -0,0 +1,29 @@
+// UserPromptSubmit stage — injects per-prompt context so the model never anchors to stale state.
+
+import type { StageContext, StageResult } from './types';
+
+export function run(ctx: StageContext): StageResult | void {
+  const config = ctx.config();
+
+  const tz = (typeof config?.timezone === 'string' && config.timezone) ? config.timezone : 'UTC';
+
+  try {
+    const fmt = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      weekday: 'long',
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+      timeZoneName: 'short',
+      hour12: false,
+    });
+
+    const parts = Object.fromEntries(fmt.formatToParts(new Date()).map(p => [p.type, p.value]));
+    const formatted = `${parts.weekday}, ${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute} ${parts.timeZoneName}`;
+    return { context: `[Now: ${formatted}]\n` };
+  } catch {
+    // Invalid TZ or Intl unavailable — emit nothing; CC's currentDate remains
+  }
+}
diff --git a/plugins/claude-code-hermit/scripts/shutdown-gate.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
similarity index 56%
rename from plugins/claude-code-hermit/scripts/shutdown-gate.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
index 9fecc2a0..715312c6 100644
--- a/plugins/claude-code-hermit/scripts/shutdown-gate.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
@@ -1,4 +1,4 @@
-// UserPromptSubmit hook — deterministic shutdown gate.
+// UserPromptSubmit stage — deterministic shutdown gate.
 //
 // While a shutdown is pending (runtime.json has shutdown_requested_at set and
 // shutdown_completed_at null), a <channel> message from an allowed sender gets a
@@ -13,39 +13,25 @@
 // /session-close command hermit-stop injects) are never a channel envelope and
 // pass through untouched.
 
-import { hermitDir } from './lib/cc-compat';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { loadConfig, isAllowedSender } from './lib/channel-auth';
-import { readRuntimeJson } from './lib/runtime';
-import { sendToChannel } from './lib/channel-send';
-import { SHUTDOWN, resolveLocale } from './lib/messages';
+import { isAllowedSender } from '../channel-auth';
+import { sendToChannel } from '../channel-send';
+import { SHUTDOWN, resolveLocale } from '../messages';
+import type { StageContext, StageResult } from './types';
 
-type Json = any;
-
-async function main(raw: string): Promise<void> {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
+export async function run(ctx: StageContext): Promise<StageResult | void> {
+  const envelope = ctx.envelope;
   if (!envelope) return; // not a channel message — operator/internal input passes
 
-  const dir = hermitDir();
+  const dir = ctx.dir;
 
   // Only gate a shutdown that is genuinely pending — check this before loading
   // config, since "no shutdown in flight" is the common case on every channel
   // message and this avoids a wasted config.json read for it.
-  const runtime = readRuntimeJson();
+  const runtime = ctx.runtime();
   const pending = !!runtime && !!runtime.shutdown_requested_at && !runtime.shutdown_completed_at;
   if (!pending) return;
 
-  const config = loadConfig(dir);
+  const config = ctx.config();
   if (!config) return;
 
   // Same allowed_users gating as the status responder — a sender the channel
@@ -57,31 +43,18 @@ async function main(raw: string): Promise<void> {
   const result = await sendToChannel(dir, reply, {
     target: { id: envelope.sourceKey, chat_id: envelope.chatId },
     timeoutMs: 6000,
+    config, // already loaded by the pipeline — don't make the sender re-read it
   });
   if (result.ok) {
-    console.log(JSON.stringify({ decision: 'block', reason: 'shutdown pending — deterministic reply sent' }));
-    return;
+    return { block: 'shutdown pending — deterministic reply sent' };
   }
 
   // Deterministic delivery failed — don't block into silence. Inject a narrow
   // instruction so the model relays the shutdown state and starts no new work.
-  process.stdout.write(
-    `[shutdown] A shutdown is in progress for this hermit. Reply to the operator (on the chat this ` +
-    `message arrived on) that you're shutting down and will be back after the restart, then stop — ` +
-    `start no new work.\n`,
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    main(buf)
-      .catch(() => {})
-      .finally(() => process.exit(0));
-  });
-} catch {
-  process.exit(0);
+  return {
+    context:
+      `[shutdown] A shutdown is in progress for this hermit. Reply to the operator (on the chat this ` +
+      `message arrived on) that you're shutting down and will be back after the restart, then stop — ` +
+      `start no new work.\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts
new file mode 100644
index 00000000..c504839e
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts
@@ -0,0 +1,42 @@
+// The contract every UserPromptSubmit stage implements.
+//
+// Stages are plain functions, not scripts: they never read stdin, never write
+// stdout, and never call process.exit. They return what they want emitted and
+// let user-prompt-pipeline.ts decide — which is what makes the "a block emits
+// JSON alone" rule enforceable in one place instead of seven.
+
+export interface ChannelEnvelope {
+  source: string;
+  sourceKey: string;
+  chatId: string;
+  userId: string | null;
+  messageId?: string | null;
+  body: string;
+  ts?: string | null;
+}
+
+export interface StageContext {
+  /** Resolved hermit state dir — computed once for the whole pipeline. */
+  dir: string;
+  /** The submitted prompt text. */
+  prompt: string;
+  /** Parsed channel envelope, or null for operator/internal input. */
+  envelope: ChannelEnvelope | null;
+  /** config.json, read at most once per prompt regardless of how many stages ask. */
+  config(): any;
+  /** state/runtime.json, read at most once per prompt. */
+  runtime(): any;
+}
+
+export interface StageResult {
+  /** additionalContext to inject. Concatenated with other stages', in stage order. */
+  context?: string;
+  /**
+   * Reason for a `{"decision":"block"}`. Set only after the stage has confirmed
+   * the operator was told out-of-band (a successful channel send) — blocking
+   * without that would swallow the message into silence.
+   */
+  block?: string;
+}
+
+export type Stage = (ctx: StageContext) => StageResult | void | Promise<StageResult | void>;
diff --git a/plugins/claude-code-hermit/scripts/lib/prop-id.ts b/plugins/claude-code-hermit/scripts/lib/prop-id.ts
index cecc0370..b64af7b1 100644
--- a/plugins/claude-code-hermit/scripts/lib/prop-id.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prop-id.ts
@@ -1,7 +1,7 @@
-// lib/prop-id.ts — proposal ID assignment (number + slug + timestamp + collision
-// suffix). Extracted from next-prop-id.ts so proposal.ts's create verb can claim
-// an ID and write the file as one atomic operation (next-prop-id.ts's separate
-// assign-then-write flow allows a half-created state: a burned ID with no file).
+// lib/prop-id.ts — proposal ID assignment (number + slug + timestamp). The pieces
+// here are un-claimed: proposal.ts's create verb combines them and then claims the
+// ID atomically with the file write (exclusive create, looping SUFFIX_LETTERS on
+// EEXIST), so no caller can burn an ID without producing the file it names.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -42,14 +42,6 @@ export function slugify(title: string): string {
   return slug || 'proposal';
 }
 
-export interface PropIdParts {
-  id: string;
-  num: string;
-  slug: string;
-  hhmmss: string;
-  suffix: string;
-}
-
 export const SUFFIX_LETTERS = 'abcdefghijklmnopqrstuvwxyz';
 
 export function readTimezone(stateDir: string): string {
@@ -81,32 +73,3 @@ export function computeBase(
   };
 }
 
-// existsSync suffix walk over a FIXED base — separated from computeBase so
-// the collision-suffix branch is unit-testable without the num recomputation
-// that a fresh computeBase call would trigger (any pre-seeded collision file
-// also matches computeBase's own NNN scan, which would shift `num` before
-// the walk ever runs). Returns null once the a-z suffix range is exhausted.
-export function resolveSuffix(proposalsDir: string, base: BaseId): PropIdParts | null {
-  let suffix = '';
-  let i = -1;
-  while (true) {
-    const candidateId = `PROP-${base.num}-${base.slug}-${base.hhmmss}${suffix}`;
-    if (!fs.existsSync(path.join(proposalsDir, `${candidateId}.md`))) {
-      return { id: candidateId, num: base.num, slug: base.slug, hhmmss: base.hhmmss, suffix };
-    }
-    i++;
-    if (i >= SUFFIX_LETTERS.length) return null;
-    suffix = SUFFIX_LETTERS[i];
-  }
-}
-
-// Predicts the next canonical ID — used only by next-prop-id.ts, which hands
-// the ID to a separate caller that writes the file later (a TOCTOU gap this
-// script's own callers no longer have). The create verb in proposal.ts does
-// NOT use this: it claims the ID atomically via exclusive file create (see
-// proposal.ts), looping the same suffix alphabet against write failures
-// (EEXIST) rather than a pre-check.
-export function nextPropId(stateDir: string, title: string, now: Date = new Date()): PropIdParts | null {
-  const proposalsDir = path.join(stateDir, 'proposals');
-  return resolveSuffix(proposalsDir, computeBase(stateDir, title, now));
-}
diff --git a/plugins/claude-code-hermit/scripts/record-gate.ts b/plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
similarity index 79%
rename from plugins/claude-code-hermit/scripts/record-gate.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
index f5143201..f27ca701 100644
--- a/plugins/claude-code-hermit/scripts/record-gate.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
@@ -1,6 +1,6 @@
-// record-gate.ts — parses one proposal/reflect gate-agent verdict line, appends the
-// corresponding metric event, and returns a routing token.
-// Usage: bun record-gate.ts <hermit-state-dir> --gate <triage|judge> --caller <caller>
+// `proposal.ts gate <stateDir> …` — parses one proposal/reflect gate-agent verdict
+// line, appends the corresponding metric event, and returns a routing token.
+// Usage: proposal.ts gate <hermit-state-dir> --gate <triage|judge> --caller <caller>
 //        [--evidence-source <value>] [--tags <json-array>] <<'HERMIT_GATE'
 //        Title: <candidate title>
 //        Verdict: <the gate agent's verdict line, verbatim>
@@ -25,9 +25,9 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { utcISOStamp } from './lib/time';
-import { emit, readStdin } from './lib/cli';
+import { appendJsonlLine } from '../append-jsonl';
+import { utcISOStamp } from '../time';
+import { emit, readStdin } from '../cli';
 
 function parseArgs(argv: string[]): Record<string, string> {
   const out: Record<string, string> = {};
@@ -40,9 +40,8 @@ function parseArgs(argv: string[]): Record<string, string> {
   return out;
 }
 
-(async () => {
-  const stateDir = process.argv[2];
-  const flags = parseArgs(process.argv.slice(3));
+export async function run(stateDir: string, args: string[]): Promise<void> {
+  const flags = parseArgs(args);
   const gate = flags.gate; // 'triage' | 'judge'
   const caller = flags.caller ?? 'unknown';
   const evidenceSource = flags['evidence-source'] ?? 'archived-session';
@@ -59,21 +58,17 @@ function parseArgs(argv: string[]): Record<string, string> {
 
   const agent = gate === 'judge' ? 'reflection-judge' : 'proposal-triage';
 
-  if (stateDir) {
-    try { fs.mkdirSync(path.join(stateDir, 'state'), { recursive: true }); } catch { /* appendJsonlLine below reports the real failure */ }
-  }
+  try { fs.mkdirSync(path.join(stateDir, 'state'), { recursive: true }); } catch { /* appendJsonlLine below reports the real failure */ }
 
   function failClosed(): never {
-    if (stateDir) {
-      appendJsonlLine(
-        path.join(stateDir, 'state', 'proposal-metrics.jsonl'),
-        JSON.stringify({ ts: utcISOStamp(), type: 'gate-failed', agent, title }),
-      );
-    }
+    appendJsonlLine(
+      path.join(stateDir, 'state', 'proposal-metrics.jsonl'),
+      JSON.stringify({ ts: utcISOStamp(), type: 'gate-failed', agent, title }),
+    );
     emit('GATE_FAILED');
   }
 
-  if (!stateDir || (gate !== 'triage' && gate !== 'judge') || !verdictLine) failClosed();
+  if ((gate !== 'triage' && gate !== 'judge') || !verdictLine) failClosed();
 
   const ledger = path.join(stateDir, 'state', 'proposal-metrics.jsonl');
 
@@ -106,4 +101,4 @@ function parseArgs(argv: string[]): Record<string, string> {
   if (downgrade) emit(`PROCEED|DOWNGRADE:${downgrade[1]}`);
   if (suppress) emit(`DROP|SUPPRESS:${suppress[1]}`);
   failClosed();
-})();
+}
diff --git a/plugins/claude-code-hermit/scripts/proposals-index.ts b/plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
similarity index 87%
rename from plugins/claude-code-hermit/scripts/proposals-index.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
index 3324cba8..2cff9c80 100644
--- a/plugins/claude-code-hermit/scripts/proposals-index.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
@@ -1,9 +1,7 @@
-// proposals-index.ts — derived cache of every proposal's frontmatter.
-// Usage: bun proposals-index.ts <hermit-state-dir>
-// Output (stdout, one line): OK|<n> proposals  |  SKIP|no proposals dir
-// Exit 0 always. Writes state/proposals-index.json (full rebuild — never
-// incremental, so it cannot drift). Also exported as rebuildIndex() for the
-// generate-summary PostToolUse hook to call on every proposal write.
+// Derived cache of every proposal's frontmatter. Writes state/proposals-index.json
+// (full rebuild — never incremental, so it cannot drift). Driven by `proposal.ts
+// index`, and imported directly by the generate-summary PostToolUse hook and
+// lib/dashboard.ts, which call rebuildIndex() on every proposal write.
 //
 // Why this exists: proposal-list otherwise reads every PROP-*.md body in full
 // (~22K tokens for a dozen proposals) just to render a table from frontmatter.
@@ -11,10 +9,14 @@
 // reflection-state.json still tally proposal events independently from
 // proposal-metrics.jsonl — those are event counters, a different quantity, and
 // were not migrated onto this index.)
+//
+// Named index-rebuild, not index: a bare `index.ts` here would make
+// `import … from './lib/proposals'` silently resolve to this module.
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { readFileWithFrontmatter, globDir } from './lib/frontmatter';
+import { readFileWithFrontmatter, globDir } from '../frontmatter';
+import { emit } from '../cli';
 
 type Json = any;
 
@@ -138,11 +140,8 @@ export function rebuildIndex(stateDir: string, bodyOut?: Map<string, string>): P
   return index;
 }
 
-// CLI mode
-if (import.meta.main) {
-  const stateDir = process.argv[2];
-  if (!stateDir) { process.stdout.write('SKIP|no state dir\n'); process.exit(0); }
+// `proposal.ts index <stateDir>` — full rebuild, one bounded verdict line.
+export function run(stateDir: string): never {
   const index = rebuildIndex(stateDir);
-  process.stdout.write(index ? `OK|${index.count} proposals\n` : 'SKIP|no proposals dir\n');
-  process.exit(0);
+  emit(index ? `OK|${index.count} proposals` : 'SKIP|no proposals dir');
 }
diff --git a/plugins/claude-code-hermit/scripts/proposal-metrics-report.ts b/plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/proposal-metrics-report.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
index e508a4a9..814cd40c 100644
--- a/plugins/claude-code-hermit/scripts/proposal-metrics-report.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
@@ -1,3 +1,7 @@
+// `proposal.ts metrics [<stateDir>] [--source=<key>]` — triage-survival and
+// acceptance rates per autonomous proposal source. The state dir is optional and
+// defaults to `.claude-code-hermit`, so a bare `proposal.ts metrics` still works.
+
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -40,8 +44,7 @@ const SEGMENTS: { key: string; triage: (e: Json) => boolean; accept: ((src: stri
   },
 ];
 
-function run() {
-  const rawArgs = process.argv.slice(2);
+function report(rawArgs: string[]) {
   const posArgs = rawArgs.filter(a => !a.startsWith('--'));
   const stateDir = posArgs[0] || '.claude-code-hermit';
   const sourceArg = (rawArgs.find(a => a.startsWith('--source=')) || '').slice('--source='.length) || null;
@@ -171,9 +174,11 @@ function run() {
   );
 }
 
-try {
-  run();
-} catch (err: any) {
-  process.stdout.write(`proposal-metrics-report: error — ${err.message}\n`);
-  process.exit(0);
+export function run(args: string[]): void {
+  try {
+    report(args);
+  } catch (err: any) {
+    process.stdout.write(`proposal metrics: error — ${err.message}\n`);
+    process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/micro-proposal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
similarity index 52%
rename from plugins/claude-code-hermit/scripts/micro-proposal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
index f28bb618..1ef165db 100644
--- a/plugins/claude-code-hermit/scripts/micro-proposal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
@@ -1,11 +1,11 @@
-// micro-proposal.ts — mutates state/micro-proposals.json for the micro-approval
-// queue. Every mutation goes through here so the file is only ever written by
-// JSON.stringify (issue 649: hand-edited JSON left a trailing comma, and every
-// reader treats an unparseable file as an empty queue).
+// `proposal.ts micro <stateDir> …` — mutates state/micro-proposals.json for the
+// micro-approval queue. Every mutation goes through here so the file is only ever
+// written by JSON.stringify (issue 649: hand-edited JSON left a trailing comma, and
+// every reader treats an unparseable file as an empty queue).
 // Usage:
-//   bun micro-proposal.ts <hermit-state-dir> resolve <MP-id> --action approved|rejected|answered|expired [--answer "<label>"]
-//   bun micro-proposal.ts <hermit-state-dir> nudge <MP-id>
-//   bun micro-proposal.ts <hermit-state-dir> brief-cycle
+//   proposal.ts micro <hermit-state-dir> resolve <MP-id> --action approved|rejected|answered|expired [--answer "<label>"]
+//   proposal.ts micro <hermit-state-dir> nudge <MP-id>
+//   proposal.ts micro <hermit-state-dir> brief-cycle
 // Output (stdout, one line):
 //   RESOLVED|<id>|<action>
 //   NUDGED|<id>|<follow_up_count>
@@ -29,42 +29,24 @@
 // brief/SKILL.md's MP lifecycle step.
 
 import path from 'node:path';
-import { utcISOStamp } from './lib/time';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { writeFileAtomic } from './lib/md-write';
-import { emit } from './lib/cli';
-import { readMicroProposals } from './lib/micro-proposals-io';
+import { utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+import { writeFileAtomic } from '../md-write';
+import { emit, flagValue } from '../cli';
+import { readMicroProposals } from '../micro-proposals-io';
 
 type Json = any;
 
 const VERBS = ['resolve', 'nudge'];
 const ACTIONS = ['approved', 'rejected', 'answered', 'expired'];
 
-const stateDir = process.argv[2];
-const verb = process.argv[3];
-const id = process.argv[4];
+const USAGE = 'Usage: proposal.ts micro <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>] | brief-cycle';
 
 function fail(msg: string): never {
   console.error(msg);
   process.exit(1);
 }
 
-if (!stateDir || !verb) {
-  fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>] | brief-cycle');
-}
-
-// brief-cycle takes no <MP-id> — dispatch it before the id requirement below.
-if (verb === 'brief-cycle') briefCycle(stateDir);
-
-if (!id) {
-  fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>]');
-}
-
-function flag(name: string): string | undefined {
-  const i = process.argv.indexOf(name);
-  return i === -1 ? undefined : process.argv[i + 1];
-}
-
 // Age the whole pending queue in one pass. Bucketing mirrors the per-entry rules
 // the brief skills used to issue one call at a time: count 0 -> report only,
 // count 1 -> report + bump to 2, count >=2 -> expire. Ledger lines are appended
@@ -116,48 +98,60 @@ function briefCycle(dir: string): never {
   emit(JSON.stringify({ new: fresh, renudged, expired }));
 }
 
-// Validate the whole invocation before touching disk. Otherwise a dropped id
-// (`resolve --action approved`) makes `--action` the id, misses, and exits 0 on
-// NONE|no-match — the entry stays pending and the caller believes it resolved.
-if (!VERBS.includes(verb)) fail(`Unknown verb: ${verb} (expected ${VERBS.join('|')})`);
-if (id.startsWith('-')) fail(`Missing <MP-id> — got the flag "${id}" in its place.`);
+export function run(stateDir: string, args: string[]): never {
+  const verb = args[0];
+  const id = args[1];
 
-const action = verb === 'resolve' ? flag('--action') : undefined;
-if (verb === 'resolve' && (!action || !ACTIONS.includes(action))) {
-  fail(`--action must be one of: ${ACTIONS.join(', ')}`);
-}
-const answer = flag('--answer');
+  if (!verb) fail(USAGE);
 
-const microPath = path.join(stateDir, 'state', 'micro-proposals.json');
+  // brief-cycle takes no <MP-id> — dispatch it before the id requirement below.
+  if (verb === 'brief-cycle') briefCycle(stateDir);
 
-// Deliberately NOT lib/cli.ts's readJson — it flattens "missing" and "corrupt"
-// to null. Corrupt must fail loud so the file is never silently replaced.
-const read = readMicroProposals(microPath);
-if (read.status === 'missing') emit('NONE|no-match'); // nothing queued, nothing to mutate
-if (read.status === 'corrupt') fail(`${read.error} — refusing to write. Repair it first.`);
-const micro: Json = read.data;
+  if (!id) fail(USAGE);
 
-const idx = micro.pending.findIndex((e: Json) => e.id === id);
-if (idx === -1) emit('NONE|no-match');
-const entry = micro.pending[idx];
+  // Validate the whole invocation before touching disk. Otherwise a dropped id
+  // (`resolve --action approved`) makes `--action` the id, misses, and exits 0 on
+  // NONE|no-match — the entry stays pending and the caller believes it resolved.
+  if (!VERBS.includes(verb)) fail(`Unknown verb: ${verb} (expected ${VERBS.join('|')})`);
+  if (id.startsWith('-')) fail(`Missing <MP-id> — got the flag "${id}" in its place.`);
 
-if (verb === 'nudge') {
-  const next = (typeof entry.follow_up_count === 'number' ? entry.follow_up_count : 0) + 1;
-  entry.follow_up_count = next;
-  writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
-  emit(`NUDGED|${id}|${next}`);
-}
+  const action = verb === 'resolve' ? flagValue(args, '--action') : undefined;
+  if (verb === 'resolve' && (!action || !ACTIONS.includes(action))) {
+    fail(`--action must be one of: ${ACTIONS.join(', ')}`);
+  }
+  const answer = flagValue(args, '--answer');
+
+  const microPath = path.join(stateDir, 'state', 'micro-proposals.json');
+
+  // Deliberately NOT lib/cli.ts's readJson — it flattens "missing" and "corrupt"
+  // to null. Corrupt must fail loud so the file is never silently replaced.
+  const read = readMicroProposals(microPath);
+  if (read.status === 'missing') emit('NONE|no-match'); // nothing queued, nothing to mutate
+  if (read.status === 'corrupt') fail(`${read.error} — refusing to write. Repair it first.`);
+  const micro: Json = read.data;
+
+  const idx = micro.pending.findIndex((e: Json) => e.id === id);
+  if (idx === -1) emit('NONE|no-match');
+  const entry = micro.pending[idx];
+
+  if (verb === 'nudge') {
+    const next = (typeof entry.follow_up_count === 'number' ? entry.follow_up_count : 0) + 1;
+    entry.follow_up_count = next;
+    writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
+    emit(`NUDGED|${id}|${next}`);
+  }
 
-// Capture the question before removal — the ledger event carries it.
-const question = entry.question;
-micro.pending.splice(idx, 1);
-writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
+  // Capture the question before removal — the ledger event carries it.
+  const question = entry.question;
+  micro.pending.splice(idx, 1);
+  writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
 
-const event: Json = { ts: utcISOStamp(), type: 'micro-resolved', micro_id: id, action, question };
-if (answer !== undefined) event.answer = answer;
-const err = appendJsonlLine(path.join(stateDir, 'state', 'proposal-metrics.jsonl'), JSON.stringify(event));
-// The queue write already landed, so re-running this command would only report
-// NONE|no-match — say so, or the caller retries and loses the event for good.
-if (err) fail(`${err} — ${id} was already removed from pending; the micro-resolved event was NOT recorded. Do not re-run; append it by hand.`);
+  const event: Json = { ts: utcISOStamp(), type: 'micro-resolved', micro_id: id, action, question };
+  if (answer !== undefined) event.answer = answer;
+  const err = appendJsonlLine(path.join(stateDir, 'state', 'proposal-metrics.jsonl'), JSON.stringify(event));
+  // The queue write already landed, so re-running this command would only report
+  // NONE|no-match — say so, or the caller retries and loses the event for good.
+  if (err) fail(`${err} — ${id} was already removed from pending; the micro-resolved event was NOT recorded. Do not re-run; append it by hand.`);
 
-emit(`RESOLVED|${id}|${action}`);
+  emit(`RESOLVED|${id}|${action}`);
+}
diff --git a/plugins/claude-code-hermit/scripts/queue-micro-proposal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
similarity index 83%
rename from plugins/claude-code-hermit/scripts/queue-micro-proposal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
index 5884e93d..365a81ec 100644
--- a/plugins/claude-code-hermit/scripts/queue-micro-proposal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
@@ -1,6 +1,6 @@
-// queue-micro-proposal.ts — generates an MP-id, dedups, appends a pending entry to
-// state/micro-proposals.json, and logs the micro-queued metric event.
-// Usage: bun queue-micro-proposal.ts <hermit-state-dir> <<'HERMIT_MP'
+// `proposal.ts queue-micro <stateDir>` — generates an MP-id, dedups, appends a
+// pending entry to state/micro-proposals.json, and logs the micro-queued event.
+// Usage: proposal.ts queue-micro <hermit-state-dir> <<'HERMIT_MP'
 //        {"tier":1,"question":"<full question text>","options":["..."],"on_resolve":"..."}
 //        HERMIT_MP
 //   — stdin only (question is free text and may contain apostrophes/quotes; no argv mode).
@@ -17,21 +17,15 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { todayYMD, utcISOStamp } from './lib/time';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { readStdin, readJson } from './lib/cli';
-import { writeFileAtomic } from './lib/md-write';
-import { readMicroProposals } from './lib/micro-proposals-io';
+import { todayYMD, utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+import { readStdin, readJson } from '../cli';
+import { writeFileAtomic } from '../md-write';
+import { readMicroProposals } from '../micro-proposals-io';
 
 type Json = any;
 
-(async () => {
-  const stateDir = process.argv[2];
-  if (!stateDir) {
-    console.error("Usage: bun queue-micro-proposal.ts <hermit-state-dir> <<'HERMIT_MP' ... HERMIT_MP");
-    process.exit(1);
-  }
-
+export async function run(stateDir: string): Promise<void> {
   const raw = (await readStdin()).trim();
   let payload: Json;
   try {
@@ -108,4 +102,4 @@ type Json = any;
   }
 
   process.stdout.write(`QUEUED|${id}\n`);
-})();
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts b/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts
new file mode 100644
index 00000000..757f7171
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts
@@ -0,0 +1,62 @@
+// `proposal.ts resolve-id <stateDir> <operator-input>` — resolves an operator's
+// PROP-id input to a proposal filename.
+// Output (stdout, one line):
+//   MATCH|<filename>
+//   AMBIGUOUS|<json array of {file, title}>
+//   NONE|not-a-prop-id
+//   NONE|no-match
+// Exit 0 always — resolution failures are reported via the verdict token, not exit code.
+// Implements proposal-act/SKILL.md § Resolving a Proposal ID. Glob matching is
+// case-insensitive: step 1 uppercases the whole input (including any slug suffix),
+// while real proposal filenames carry a lowercase slug — case-insensitive matching
+// is required for the suffix form to ever match a real file.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { readFrontmatter } from '../frontmatter';
+import { emit } from '../cli';
+
+// Anchored glob → regex. Never a bare `PROP-NNN*` — that collides with 4-digit NNN
+// filenames (e.g. `PROP-0061.md`) once proposal counts cross 1000.
+function globToRegExp(pattern: string): RegExp {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+  return new RegExp(`^${escaped}$`, 'i');
+}
+
+export function run(stateDir: string, rawInput: string | undefined): never {
+  if (rawInput === undefined) emit('NONE|not-a-prop-id');
+
+  const input = rawInput.trim().toUpperCase();
+  const m = input.match(/^PROP-(\d+)(?:-(.+))?$/);
+  if (!m) emit('NONE|not-a-prop-id');
+
+  const num = m[1].padStart(3, '0');
+  const suffix = m[2];
+
+  const proposalsDir = path.join(stateDir, 'proposals');
+  let files: string[] = [];
+  try {
+    files = fs.readdirSync(proposalsDir).filter(f => f.endsWith('.md')).sort();
+  } catch {
+    emit('NONE|no-match');
+  }
+
+  let matches: string[];
+  if (!suffix) {
+    const legacy = globToRegExp(`PROP-${num}.md`);
+    const newFormat = globToRegExp(`PROP-${num}-*.md`);
+    matches = files.filter(f => legacy.test(f) || newFormat.test(f));
+  } else {
+    const pattern = globToRegExp(`PROP-${num}-*${suffix}*.md`);
+    matches = files.filter(f => pattern.test(f));
+  }
+
+  if (matches.length === 0) emit('NONE|no-match');
+  if (matches.length === 1) emit(`MATCH|${matches[0]}`);
+
+  const payload = matches.map(f => ({
+    file: f,
+    title: readFrontmatter(path.join(proposalsDir, f))?.title ?? null,
+  }));
+  emit(`AMBIGUOUS|${JSON.stringify(payload)}`);
+}
diff --git a/plugins/claude-code-hermit/scripts/eval-success-signal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
similarity index 90%
rename from plugins/claude-code-hermit/scripts/eval-success-signal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
index 03cd6158..db3d6d87 100644
--- a/plugins/claude-code-hermit/scripts/eval-success-signal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
@@ -1,12 +1,13 @@
-#!/usr/bin/env bun
 // Evaluate or validate a success_signal predicate for a hermit proposal.
 //
-// Validate mode (grammar check only — no state reads):
-//   bun eval-success-signal.ts --validate "<predicate>"
-//   Exits 0 + prints "OK" if valid. Exits 1 + prints a reason if invalid.
+// Validate mode (grammar check only — no state reads, so no state dir):
+//   proposal.ts success-signal --validate "<predicate>"
+//   Exits 0 + prints "OK" if valid. Exits 1 + prints a reason if invalid — callers
+//   (proposal-create, proposal-act) branch on that exit code, so it must stay
+//   non-zero even though every other proposal.ts verb exits 0.
 //
 // Evaluate mode (check predicate against session reports):
-//   bun eval-success-signal.ts <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"
+//   proposal.ts success-signal <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"
 //   Prints one JSON line:
 //     {"verdict":"MET|UNMET|INSUFFICIENT_DATA","metric":"...","op":"...","threshold":N,"window":N,"observed":N,"sessions_counted":N}
 //   Never throws — any failure emits INSUFFICIENT_DATA.
@@ -16,7 +17,7 @@
 //   OP in {<, <=, >, >=}; NUMBER positive float; N positive integer.
 
 import path from 'node:path';
-import { readFrontmatter, globDir } from './lib/frontmatter';
+import { readFrontmatter, globDir } from '../frontmatter';
 
 type Json = any;
 
@@ -174,18 +175,17 @@ function runEvaluate(stateDir: string, acceptedDateStr: string, acceptedInSessio
 
 // ─── Entry point ──────────────────────────────────────────────────────────────
 
-function main() {
-  const args = process.argv.slice(2);
+export function run(args: string[]): void {
   if (args[0] === '--validate') {
     if (args.length < 2) {
-      process.stdout.write('usage: eval-success-signal.ts --validate "<predicate>"\n');
+      process.stdout.write('usage: proposal.ts success-signal --validate "<predicate>"\n');
       process.exit(1);
     }
     runValidate(args.slice(1).join(' '));
   } else {
     if (args.length < 4) {
       process.stdout.write(
-        'usage: eval-success-signal.ts <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"\n'
+        'usage: proposal.ts success-signal <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"\n'
       );
       // Fail open — emit INSUFFICIENT_DATA so reflect doesn't crash.
       emitInsufficient(null);
@@ -195,7 +195,3 @@ function main() {
     runEvaluate(stateDir, acceptedDate, acceptedInSession, rest.join(' '));
   }
 }
-
-if (import.meta.main) {
-  main();
-}
diff --git a/plugins/claude-code-hermit/scripts/routine-due.ts b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/routine-due.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/due.ts
index 0fd638ad..ba695a25 100644
--- a/plugins/claude-code-hermit/scripts/routine-due.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
@@ -1,9 +1,9 @@
-// routine-due.ts — deterministic scheduler for monitor-mode routines. Polled every
+// `routines.ts due` — deterministic scheduler for monitor-mode routines. Polled every
 // interval by routine-monitor.sh. Owns all gating (pause/waiting/idle), all state writes
 // (state/routine-schedule.json cursors, state/routine-monitor-liveness.json), and emits
 // a single ROUTINE_DUE line only for routines that should actually wake the session.
 //
-// Usage: bun routine-due.ts <hermit-dir>
+// Usage: bun routines.ts due <hermit-dir>
 // Output (stdout): nothing, or exactly one line:
 //   ROUTINE_DUE [hermit-routine:<id1>] [hermit-routine:<id2>] ...
 // The bracketed markers are load-bearing — cost-tracker.ts classifySource reads this
@@ -24,11 +24,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { isPaused } from './lib/pause';
-import { validateCronSchedule, ROUTINE_ID_RE } from './validate-config';
-import { makeTzFormatter, partsFromFormatter, compileCron, cronMatchesCompiled } from './lib/cron-match';
-import { readJson as readJSON } from './lib/cli';
+import { isPaused } from '../pause';
+import { validateCronSchedule, ROUTINE_ID_RE } from '../../validate-config';
+import { makeTzFormatter, partsFromFormatter, compileCron, cronMatchesCompiled } from '../cron-match';
+import { readJson as readJSON } from '../cli';
+import { logRoutineEvent } from './event';
 
 type Json = any;
 
@@ -44,7 +44,6 @@ const stateDir = path.join(hermitDir, 'state');
 const projectRoot = path.dirname(hermitDir);
 const schedulePath = path.join(stateDir, 'routine-schedule.json');
 const livenessPath = path.join(stateDir, 'routine-monitor-liveness.json');
-const logScript = path.join(import.meta.dir, 'log-routine-event.sh');
 
 function now(): Date {
   if (process.env.HERMIT_NOW) {
@@ -80,7 +79,7 @@ function writeLiveness(): void {
 
 function stamp(id: string, event: string): void {
   try {
-    execFileSync(logScript, [id, event, 'monitor'], { cwd: projectRoot, stdio: ['ignore', 'ignore', 'ignore'] });
+    logRoutineEvent(id, event, 'monitor', projectRoot);
   } catch { /* fail-open — a stamp failure must not block the routine */ }
 }
 
@@ -114,7 +113,7 @@ const sessionState: string | null = runtime && typeof runtime.session_state ===
 // Live-exchange signal: an operator-initiated turn is open (marker written by
 // record-operator-action.ts on kept operator prompts, cleared by stop-pipeline.ts
 // at Stop). TTL bounds a marker orphaned by a failed Stop. Absent, malformed,
-// stale, or future-dated (clock skew — heartbeat-precheck.ts precedent) all read
+// stale, or future-dated (clock skew — lib/heartbeat/precheck.ts precedent) all read
 // as no-open-turn → emit. Fail-open: a broken marker must never starve routines.
 const turnMarker: Json = readJSON(path.join(stateDir, 'operator-turn-open.json'));
 const turnAt = turnMarker && typeof turnMarker.at === 'string' ? new Date(turnMarker.at).getTime() : NaN;
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/event.ts b/plugins/claude-code-hermit/scripts/lib/routines/event.ts
new file mode 100644
index 00000000..1e634edf
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/routines/event.ts
@@ -0,0 +1,82 @@
+// `routines.ts log-event <routine-id> <event> [delivery]` — appends one line to
+// state/routine-metrics.jsonl. Events: fired | skipped-waiting | skipped-paused |
+// started. delivery: cron-create (default) | monitor.
+//
+// Ported from log-routine-event.sh. The emitted line is byte-identical to the
+// shell version — same key order, same UTC second-precision stamp — because
+// cost attribution, the doctor's routine-cost check, and several tests match on
+// the literal `"routine_id":"<id>","event":"<e>"` substring.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+
+// Deliberately not an enum check: the shell version accepted any event string,
+// and rejecting one here would refuse input that used to be recorded.
+const USAGE = 'Usage: routines.ts log-event <routine-id> <event> [delivery]';
+
+// CronCreate prompts fire with cwd set to the session's primary working
+// directory, which may be a subdirectory of the hermit project root. Walk up to
+// the nearest ancestor containing .claude-code-hermit/ so the relative path
+// resolves correctly regardless of launch cwd.
+function findHermitRoot(from: string): string | null {
+  let dir = path.resolve(from);
+  while (dir !== path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, '.claude-code-hermit'))) return dir;
+    dir = path.dirname(dir);
+  }
+  return fs.existsSync(path.join(dir, '.claude-code-hermit')) ? dir : null;
+}
+
+/**
+ * Appends one routine event. Returns null on success, or an error message.
+ *
+ * `fromDir` is where the .claude-code-hermit/ walk-up starts — the in-process
+ * callers (due.ts, precheck.ts) pass the project root they already resolved,
+ * which is what they used to pass as the subprocess `cwd`. They now call this
+ * directly rather than spawning, saving a process per stamp on the routine
+ * fire path.
+ */
+export function logRoutineEvent(
+  id: string,
+  event: string,
+  delivery = 'cron-create',
+  fromDir: string = process.cwd(),
+): string | null {
+  const root = findHermitRoot(fromDir);
+  if (!root) return `could not find .claude-code-hermit/ in any parent of ${fromDir}`;
+  const metrics = path.join(root, '.claude-code-hermit', 'state', 'routine-metrics.jsonl');
+
+  // Dedup guard (issue #464): heartbeat-restart re-invokes `hermit-routines
+  // load` at its own prompt tail, which can re-trigger the cron and emit a
+  // second `fired` with no intervening `started`. The prompt always logs
+  // `started` immediately before `fired`, so a `fired` whose latest same-routine
+  // event is already `fired` can only be the spurious re-trigger.
+  if (event === 'fired') {
+    try {
+      const needle = `"routine_id":"${id}"`;
+      const matching = fs.readFileSync(metrics, 'utf8').split('\n').filter(l => l.includes(needle));
+      const last = matching[matching.length - 1];
+      if (last && last.includes('"event":"fired"')) return null; // suppressed re-trigger
+    } catch { /* no ledger yet — nothing to dedup against */ }
+  }
+
+  return appendJsonlLine(
+    metrics,
+    JSON.stringify({ ts: utcISOStamp(), routine_id: id, event, delivery }),
+  );
+}
+
+export function run(args: string[]): void {
+  const [id, event, delivery] = args;
+  if (!id || !event) {
+    process.stderr.write(`${USAGE}\n`);
+    process.exit(1);
+  }
+  const err = logRoutineEvent(id, event, delivery || 'cron-create');
+  if (err) {
+    process.stderr.write(`routines.ts log-event: ${err}\n`);
+    process.exit(1);
+  }
+}
diff --git a/plugins/claude-code-hermit/scripts/routine-precheck.ts b/plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
similarity index 74%
rename from plugins/claude-code-hermit/scripts/routine-precheck.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
index 86fc2362..52b4ccfb 100644
--- a/plugins/claude-code-hermit/scripts/routine-precheck.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
@@ -1,20 +1,20 @@
-// routine-precheck.ts — consolidates a routine fire's pre-dispatch gate (waiting-check +
+// `routines.ts precheck` — consolidates a routine fire's pre-dispatch gate (waiting-check +
 // pause-check) and the `started` stamp into one script call, replacing 2-3 separate
-// model-issued tool calls per fire with one. Mirrors reflect-precheck.ts's / heartbeat-
-// precheck.ts's verdict-token contract. Delegates the JSONL write to log-routine-event.sh,
+// model-issued tool calls per fire with one. Mirrors reflect-precheck.ts's /
+// `heartbeat.ts precheck`'s verdict-token contract. Delegates the JSONL write to lib/routines/event.ts,
 // which stays the single writer — the #464 dedup guard and JSONL schema live in exactly
 // one place.
-// Usage: bun routine-precheck.ts <routine-id> <rdw:true|false> [delivery]
+// Usage: bun routines.ts precheck <routine-id> <rdw:true|false> [delivery]
 // Output (stdout, one line): SKIP | PROCEED
-// Side effect: stamps skipped-waiting | skipped-paused | started via log-routine-event.sh.
+// Side effect: stamps skipped-waiting | skipped-paused | started via logRoutineEvent().
 // Exit 0 always — fail-open to PROCEED on any read error (a malformed runtime.json must
 // never silently kill a routine).
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { hermitDir } from './lib/cc-compat';
-import { isPaused } from './lib/pause';
+import { hermitDir } from '../cc-compat';
+import { isPaused } from '../pause';
+import { logRoutineEvent } from './event';
 
 function emit(verdict: string): never {
   process.stdout.write(verdict + '\n');
@@ -34,11 +34,10 @@ try {
   emit('PROCEED'); // fail-open: can't resolve the hermit dir → never silently kill the routine
 }
 const PROJECT_ROOT = path.dirname(HERMIT_ROOT);
-const LOG_SCRIPT = path.join(import.meta.dir, 'log-routine-event.sh');
 
 function stamp(event: string): void {
   try {
-    execFileSync(LOG_SCRIPT, [id, event, delivery], { cwd: PROJECT_ROOT, stdio: ['ignore', 'ignore', 'ignore'] });
+    logRoutineEvent(id, event, delivery, PROJECT_ROOT);
   } catch { /* fail-open — a stamp failure must not block the routine */ }
 }
 
diff --git a/plugins/claude-code-hermit/scripts/cron-registry.ts b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/cron-registry.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/registry.ts
index 04eb2396..6539438e 100644
--- a/plugins/claude-code-hermit/scripts/cron-registry.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
@@ -1,8 +1,8 @@
-// cron-registry.ts — diff-based plan/commit for hermit-routines CronCreate registration.
+// `routines.ts cron-registry` — diff-based plan/commit for hermit-routines CronCreate registration.
 //
 // Usage:
-//   bun cron-registry.ts plan   <hermit-state-dir> <plugin-root> [--force]
-//   bun cron-registry.ts commit <hermit-state-dir> <plugin-root> <created-id-csv>
+//   bun routines.ts cron-registry plan   <hermit-state-dir> <plugin-root> [--force]
+//   bun routines.ts cron-registry commit <hermit-state-dir> <plugin-root> <created-id-csv>
 //
 // --force (used by `load --reset`) skips every mirror/hash/age comparison and
 // returns every enabled routine as CREATE with no DELETE lines — the caller is
@@ -34,9 +34,9 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { sha256 } from './lib/hash';
-import { shiftCron } from './cron-tz-shift';
-import { parseCronField } from './validate-config';
+import { sha256 } from '../hash';
+import { shiftCron } from '../cron-shift';
+import { parseCronField } from '../../validate-config';
 
 type Json = any;
 
@@ -87,7 +87,7 @@ function resolveMachineTz(): string | null {
 
 // Wraps cron-tz-shift's shiftCron for a single routine. Returns the schedule
 // unchanged (no warn) when the machine timezone can't be resolved — the same
-// fail-open behavior cron-tz-shift.ts's CLI uses.
+// fail-open behavior lib/routines/tz-shift.ts's CLI uses.
 function shiftForRoutine(
   schedule: string, configTz: string | null, machineTz: string | null, ref: Date,
 ): { result: string; warn?: string } {
@@ -289,13 +289,18 @@ export { planCron, commitCron, computeWakeSpread, readMirror, readBootId, prompt
 export type { Mirror, MirrorEntry, PlanResult, PlanCreate, ShiftedRoutine };
 
 // --- CLI ---
-if (import.meta.main) {
+// A named export, not an `import.meta.main` guard: this module is no longer an
+// entry point (routines.ts's cron-registry verb calls runCli()), and under that
+// dynamic import `import.meta.main` is false, so a guard would silently never
+// fire. tests/cron-registry.test.ts imports the pure helpers above, which is why
+// this cannot simply run at module scope.
+export function runCli(): void {
   const mode = process.argv[2];
   const hermitDir = process.argv[3];
   const pluginRoot = process.argv[4];
 
   if ((mode !== 'plan' && mode !== 'commit') || !hermitDir || !pluginRoot) {
-    process.stdout.write('SKIP|usage: cron-registry.ts <plan|commit> <hermit-dir> <plugin-root> [created-csv] [--force] [--ids <csv>]\n');
+    process.stdout.write('SKIP|usage: routines.ts cron-registry <plan|commit> <hermit-dir> <plugin-root> [created-csv] [--force] [--ids <csv>]\n');
     process.exit(0);
   }
 
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts b/plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts
new file mode 100644
index 00000000..37d4c9d1
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts
@@ -0,0 +1,54 @@
+// `routines.ts tz-shift "<cron-expr>" "<from-tz>"` — rewrites a 5-field cron
+// expression from one IANA timezone to the machine's local timezone.
+// Stdout: shifted cron (or the original on unsupported/fail-open paths)
+// Stderr: WARN: <reason>  (when passing through unchanged)
+// Exit 0 always except: a malformed cron that fails validateCronSchedule, or an
+// unparseable HERMIT_CRON_TZ_SHIFT_NOW.
+//
+// The shift arithmetic itself lives in lib/cron-shift.ts, shared with
+// lib/routines/registry.ts; this is only its CLI face.
+
+import { validateCronSchedule } from '../../validate-config';
+import { shiftCron } from '../cron-shift';
+
+function resolveMachineTz(): string | null {
+  try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }
+  catch { return null; }
+}
+
+export function run(args: string[]): void {
+  const [cronExpr, fromTz] = args;
+
+  if (!cronExpr) {
+    process.stderr.write('Usage: bun routines.ts tz-shift "<cron-expr>" "<from-tz>"\n');
+    process.exit(1);
+  }
+
+  let ref: Date;
+  if (process.env.HERMIT_CRON_TZ_SHIFT_NOW) {
+    ref = new Date(process.env.HERMIT_CRON_TZ_SHIFT_NOW);
+    if (isNaN(ref.getTime())) {
+      process.stderr.write(`Error: HERMIT_CRON_TZ_SHIFT_NOW is not a valid ISO 8601 date: "${process.env.HERMIT_CRON_TZ_SHIFT_NOW}"\n`);
+      process.exit(1);
+    }
+  } else {
+    ref = new Date();
+  }
+
+  const validErr = validateCronSchedule(cronExpr);
+  if (validErr) {
+    process.stderr.write(`Error: invalid cron expression: ${validErr}\n`);
+    process.exit(1);
+  }
+
+  const machineTz = resolveMachineTz();
+  if (!machineTz) {
+    process.stdout.write(cronExpr + '\n');
+    process.stderr.write('WARN: could not resolve machine timezone\n');
+    return;
+  }
+
+  const { result, warn } = shiftCron(cronExpr, fromTz || '', machineTz, ref);
+  process.stdout.write(result + '\n');
+  if (warn) process.stderr.write(`WARN: ${warn}\n`);
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/session-cost.ts b/plugins/claude-code-hermit/scripts/lib/session-cost.ts
index 4d726193..5cc0e458 100644
--- a/plugins/claude-code-hermit/scripts/lib/session-cost.ts
+++ b/plugins/claude-code-hermit/scripts/lib/session-cost.ts
@@ -1,7 +1,7 @@
-// Shared window-cost algorithm used by scripts/session-cost.ts (CLI) and
+// Shared window-cost algorithm used by cost-report.ts's session verb and
 // scripts/session-archive.ts (report frontmatter). Pure: caller supplies the
-// [openedAt, closedAt] arc bounds (from state/runtime.json — see session-cost.ts's
-// header for the arc-window rationale) and the cost-log path; no env/argv reads here.
+// [openedAt, closedAt] arc bounds (from state/runtime.json — see cost-report.ts's
+// session verb header for the arc-window rationale) and the cost-log path; no env/argv reads here.
 //
 // `available` is the contract callers branch on, not `cost_usd === 0` — a session
 // with a real opened_at but zero matching cost-log rows is a MEASURED zero and must
diff --git a/plugins/claude-code-hermit/scripts/lib/spend-status.ts b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
index 60fd8659..251d586d 100644
--- a/plugins/claude-code-hermit/scripts/lib/spend-status.ts
+++ b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
@@ -1,5 +1,5 @@
-// Operator-language cap-status composition, shared by channel-status-responder.ts
-// (the deterministic `status` hook) and cost-reflect.ts (the --plain channel mode)
+// Operator-language cap-status composition, shared by lib/prompt-stages/channel-status-responder.ts
+// (the deterministic `status` hook) and cost-report.ts's reflect verb (the --plain channel mode)
 // so the two surfaces can't drift on how a spend cap is phrased. Lives here rather
 // than in lib/budget.ts (which is pure evaluation, no I/O) because budgetLine reads
 // the cost index.
diff --git a/plugins/claude-code-hermit/scripts/lib/time.ts b/plugins/claude-code-hermit/scripts/lib/time.ts
index b518391c..217d67ab 100644
--- a/plugins/claude-code-hermit/scripts/lib/time.ts
+++ b/plugins/claude-code-hermit/scripts/lib/time.ts
@@ -206,7 +206,7 @@ function elapsedSinceHHMM(nowHHMM: string, stampHHMM: string): number {
 
 // Parse the minute/hour fields of a simple numeric 5-field cron schedule
 // (e.g. "0 0 * * *"). Shared by hermit-watchdog.ts (daily-auto-close proximity)
-// and channel-status-responder.ts (next-routine line) — both only need the
+// and the channel-status-responder stage (next-routine line) — both only need the
 // fixed-time case, not full cron range/step/list support.
 function parseSimpleCronTime(schedule: string): { hour: number; minute: number } | null {
   const parts = String(schedule).trim().split(/\s+/);
@@ -230,7 +230,7 @@ function friendlyBoundary(iso: string, timezone: string): string {
 
 // Resolves "now" as epoch ms: real wall-clock, overridable by HERMIT_NOW for
 // deterministic tests. Same override convention as archive-shell.ts/
-// session-archive.ts/routine-due.ts (which return Date) — centralized here so
+// session-archive.ts/lib/routines/due.ts (which return Date) — centralized here so
 // a caller wanting an epoch number doesn't need its own inline copy.
 function resolveHermitNowMs(): number {
   if (process.env.HERMIT_NOW) {
diff --git a/plugins/claude-code-hermit/scripts/lib/tmux.ts b/plugins/claude-code-hermit/scripts/lib/tmux.ts
index 0fbff07d..c7b74198 100644
--- a/plugins/claude-code-hermit/scripts/lib/tmux.ts
+++ b/plugins/claude-code-hermit/scripts/lib/tmux.ts
@@ -28,7 +28,7 @@ export function getSessionName(config: Json): string {
  * punctuation — existing callers send prose ("/compact focus on unfinished work,
  * pending operator items, and in-flight decisions") and an allow-list would silently
  * break them. Callers handling UNTRUSTED input apply their own strict grammar on top
- * (see harness-command-keyword.ts).
+ * (see lib/prompt-stages/harness-command.ts).
  */
 function hasControlChars(text: string): boolean {
   for (let i = 0; i < text.length; i++) {
diff --git a/plugins/claude-code-hermit/scripts/lib/trigger-source.ts b/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
index 2206afbc..d62cc2c6 100644
--- a/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
+++ b/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
@@ -39,8 +39,10 @@ function classifySource(triggerText: string): string {
   const routineMatch = triggerText.match(/\[hermit-routine:([A-Za-z0-9._-]+)\]/);
   // Length-cap to 64 chars so ids can't overflow markdown table cells
   if (routineMatch) return `routine:${routineMatch[1].slice(0, 64)}`;
-  // log-routine-event.sh fallback: present in tool_result when the skill fires the marker
-  const logMatch = triggerText.match(/log-routine-event\.sh\s+([A-Za-z0-9._-]+)/);
+  // log-event fallback: present in tool_result when the skill fires the marker.
+  // Both spellings are matched — the old `log-routine-event.sh <id>` form still
+  // appears in historic transcripts that cost attribution replays.
+  const logMatch = triggerText.match(/(?:log-routine-event\.sh|routines\.ts log-event)\s+([A-Za-z0-9._-]+)/);
   if (logMatch) return `routine:${logMatch[1].slice(0, 64)}`;
   // Inbound-channel envelope (see lib/channel-envelope.ts): source is plugin-qualified
   // on the wire (e.g. `plugin:discord:discord`, `plugin:voice:voice`). Bucket by the
diff --git a/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts b/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts
new file mode 100644
index 00000000..c19a1be0
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts
@@ -0,0 +1,22 @@
+// Weekly-review artifact source: finds the latest compiled/review-weekly-*.md and
+// strips its YAML frontmatter (rendered raw it's an ugly wall of metrics; every
+// field is already legible in the report body's evolution block and the
+// dashboard's weekly section). The Artifact tool renders .md directly — no HTML
+// renderer needed for this page, so unlike lib/dashboard.ts and
+// lib/proposals-page.ts this one has no render step, only a body extraction.
+//
+// Driven by `artifact.ts render weekly`. Throws on no-source/unreadable; the
+// caller turns that into the shared exit-1 path.
+
+import path from 'node:path';
+import { readFileWithFrontmatter, globDir } from './frontmatter';
+import { sha256 } from './hash';
+
+export function renderWeeklyArtifact(hermitDir: string): { content: string; hash: string } {
+  const compiledDir = path.join(hermitDir, 'compiled');
+  const files = globDir(compiledDir, /^review-weekly-.*\.md$/); // YYYY-Wnn sorts chronologically by name
+  if (files.length === 0) throw new Error('no compiled/review-weekly-*.md found');
+  const latest = readFileWithFrontmatter(files[files.length - 1]);
+  if (!latest) throw new Error('latest weekly review file unreadable');
+  return { content: latest.body, hash: sha256(latest.body) };
+}
diff --git a/plugins/claude-code-hermit/scripts/log-routine-event.sh b/plugins/claude-code-hermit/scripts/log-routine-event.sh
deleted file mode 100755
index 2119da7a..00000000
--- a/plugins/claude-code-hermit/scripts/log-routine-event.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-# Append one event line to .claude-code-hermit/state/routine-metrics.jsonl
-# Usage: log-routine-event.sh <routine-id> <event> [delivery]
-# Events: fired | skipped-waiting | skipped-paused | started
-# delivery: cron-create (default) | monitor
-set -euo pipefail
-
-id="$1"
-event="$2"
-delivery="${3:-cron-create}"
-
-# CronCreate prompts fire with $PWD set to the session's primary working
-# directory, which may be a subdirectory of the hermit project root. Walk up
-# to the nearest ancestor containing .claude-code-hermit/ so the relative path
-# resolves correctly regardless of launch CWD.
-dir="$PWD"
-while [[ "$dir" != "/" ]]; do
-  [[ -d "$dir/.claude-code-hermit" ]] && break
-  dir="$(dirname "$dir")"
-done
-if [[ "$dir" == "/" ]]; then
-  echo "log-routine-event.sh: could not find .claude-code-hermit/ in any parent of $PWD" >&2
-  exit 1
-fi
-
-metrics="$dir/.claude-code-hermit/state/routine-metrics.jsonl"
-
-# Dedup guard (issue #464): heartbeat-restart re-invokes `hermit-routines load`
-# at its own prompt tail, which can re-trigger the cron and emit a second
-# `fired` with no intervening `started`. The prompt always logs `started`
-# immediately before `fired`, so a `fired` whose latest same-routine event is
-# already `fired` can only be the spurious re-trigger. Portable; no date math.
-if [[ "$event" == "fired" && -f "$metrics" ]]; then
-  last="$(grep -F "\"routine_id\":\"$id\"" "$metrics" | tail -n 1 || true)"
-  [[ "$last" == *'"event":"fired"'* ]] && exit 0
-fi
-
-ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-printf '{"ts":"%s","routine_id":"%s","event":"%s","delivery":"%s"}\n' \
-  "$ts" "$id" "$event" "$delivery" \
-  >> "$metrics"
diff --git a/plugins/claude-code-hermit/scripts/next-prop-id.ts b/plugins/claude-code-hermit/scripts/next-prop-id.ts
deleted file mode 100644
index 4f464895..00000000
--- a/plugins/claude-code-hermit/scripts/next-prop-id.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-// next-prop-id.ts — generates the next canonical proposal ID + filename stem.
-// Usage (argv):  bun next-prop-id.ts <hermit-state-dir> '<title>'
-// Usage (stdin): bun next-prop-id.ts <hermit-state-dir> <<'HERMIT_TITLE'
-//                <title>
-//                HERMIT_TITLE
-//   — stdin required when the title contains an apostrophe (dual-mode convention,
-//     matches append-metrics.ts).
-// Output (stdout, one line): PROP-NNN-<slug>-HHMMSS
-// Exit 1 (+ stderr) on a missing state dir, or on exhausting the same-second
-// collision-suffix range — creation should never proceed with a guessed ID.
-// Implements proposal-create/SKILL.md § How to Create steps 1-2 (ID + slug +
-// same-second collision guard).
-//
-// Thin CLI wrapper — the ID logic lives in lib/prop-id.ts, shared with
-// proposal.ts's create verb (which claims the ID atomically alongside the file
-// write, rather than assigning it in a separate step).
-
-import fs from 'node:fs';
-import { readStdin } from './lib/cli';
-import { nextPropId } from './lib/prop-id';
-
-const stateDir = process.argv[2];
-
-if (!stateDir) {
-  console.error("Usage: bun next-prop-id.ts <hermit-state-dir> '<title>'");
-  process.exit(1);
-}
-
-function readTitle(): Promise<string> {
-  if (process.argv[3] !== undefined) return Promise.resolve(process.argv[3]);
-  return readStdin().then(s => s.trim());
-}
-
-(async () => {
-  if (!fs.existsSync(stateDir)) {
-    console.error(`Error: state dir not found: ${stateDir}`);
-    process.exit(1);
-  }
-
-  const title = await readTitle();
-  const parts = nextPropId(stateDir, title);
-  if (!parts) {
-    console.error('Error: exhausted same-second collision suffixes (a-z)');
-    process.exit(1);
-  }
-  process.stdout.write(parts.id + '\n');
-  process.exit(0);
-})();
diff --git a/plugins/claude-code-hermit/scripts/prompt-context.ts b/plugins/claude-code-hermit/scripts/prompt-context.ts
deleted file mode 100644
index c6f00267..00000000
--- a/plugins/claude-code-hermit/scripts/prompt-context.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — injects per-prompt context so the model never anchors to stale state.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { hermitDir } from './lib/cc-compat';
-
-type Json = any;
-
-const AGENT_DIR = hermitDir();
-
-// Drain stdin (fail-open contract — broken pipe if unread)
-process.stdin.resume();
-process.stdin.on('data', () => {});
-process.stdin.on('error', () => {});
-
-function main() {
-  let config: Json = {};
-  try {
-    config = JSON.parse(fs.readFileSync(path.resolve(AGENT_DIR, 'config.json'), 'utf-8'));
-  } catch {
-    // No config or unreadable — use defaults
-  }
-
-  const tz = (typeof config.timezone === 'string' && config.timezone) ? config.timezone : 'UTC';
-
-  try {
-    const fmt = new Intl.DateTimeFormat('en-US', {
-      timeZone: tz,
-      weekday: 'long',
-      year: 'numeric',
-      month: '2-digit',
-      day: '2-digit',
-      hour: '2-digit',
-      minute: '2-digit',
-      timeZoneName: 'short',
-      hour12: false,
-    });
-
-    const parts = Object.fromEntries(fmt.formatToParts(new Date()).map(p => [p.type, p.value]));
-    const formatted = `${parts.weekday}, ${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute} ${parts.timeZoneName}`;
-    process.stdout.write(`[Now: ${formatted}]\n`);
-  } catch {
-    // Invalid TZ or Intl unavailable — emit nothing; CC's currentDate remains
-  }
-}
-
-try {
-  main();
-} catch {
-  // Fail open — never block a prompt
-}
-process.exit(0);
diff --git a/plugins/claude-code-hermit/scripts/proposal.ts b/plugins/claude-code-hermit/scripts/proposal.ts
index 2dd8fd86..025e2678 100644
--- a/plugins/claude-code-hermit/scripts/proposal.ts
+++ b/plugins/claude-code-hermit/scripts/proposal.ts
@@ -44,19 +44,41 @@
 //     Upserts by `id` into config.json's routines array. Output:
 //     `OK|added` / `OK|updated` or `ERROR|<reason>`.
 //
-// Exit 0 always; only a missing verb/state-dir argv exits 1 (creation should
-// never proceed on a mis-invocation, but a resolved, validated failure is
-// always a verdict line, not a crash).
+// The verbs below are the proposal-lifecycle *readers and satellites*, absorbed
+// from what used to be one top-level script each. They keep their own stdout
+// grammars and exit codes rather than being forced into `ok()`/`fail()` —
+// callers branch on those, and rewriting them would be a behavior change:
+//
+//   resolve-id <stateDir> <operator-input>       MATCH|… AMBIGUOUS|… NONE|…
+//   gate <stateDir> --gate … --caller …          PROCEED|… DROP|… GATE_FAILED
+//   queue-micro <stateDir>                       QUEUED|<MP-id> / DUPLICATE|<id>
+//   micro <stateDir> resolve|nudge|brief-cycle   RESOLVED|… NUDGED|… NONE|… / JSON
+//   index <stateDir>                             OK|<n> proposals / SKIP|…
+//   metrics [<stateDir>] [--source=<key>]        markdown table / one-line verdict
+//   success-signal --validate "<predicate>"      OK (exit 0) / reason (exit 1)
+//   success-signal <stateDir> <date> <sess> <p>  one JSON verdict line
+//
+// Exit 0 always, EXCEPT: a missing verb/state-dir argv exits 1 (creation should
+// never proceed on a mis-invocation, but a resolved, validated failure is always
+// a verdict line, not a crash), and `queue-micro` / `micro` / `success-signal
+// --validate` exit 1 on malformed input — a silent queue-drop or a silently
+// accepted bad predicate is the failure mode those three exist to remove.
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { readStdin, readJson } from './lib/cli';
+import { readStdin, readJson, flagValue } from './lib/cli';
 import { appendJsonlLine } from './lib/append-jsonl';
 import { writeFileAtomic, patchFrontmatter, appendToSection, appendShellLine, findSection, PATCH_KEY_RE } from './lib/md-write';
 import { computeBase, readTimezone, SUFFIX_LETTERS } from './lib/prop-id';
 import { zonedISOStamp, utcISOStamp } from './lib/time';
-import { rebuildIndex } from './proposals-index';
+import { rebuildIndex, run as runIndex } from './lib/proposals/index-rebuild';
 import { run as regenerateSummary } from './generate-summary';
+import { run as runResolveId } from './lib/proposals/resolve';
+import { run as runGate } from './lib/proposals/gate';
+import { run as runQueueMicro } from './lib/proposals/queue-micro';
+import { run as runMicro } from './lib/proposals/micro';
+import { run as runMetrics } from './lib/proposals/metrics';
+import { run as runSuccessSignal } from './lib/proposals/success-signal';
 
 type Json = any;
 
@@ -81,11 +103,6 @@ function regenTail(stateDir: string): void {
   try { regenerateSummary(path.join(stateDir, 'state')); } catch (e: any) { warn(`summary regen failed: ${e.message}`); }
 }
 
-function flagValue(argv: string[], flag: string): string | undefined {
-  const i = argv.indexOf(flag);
-  return i === -1 ? undefined : argv[i + 1];
-}
-
 // ---------------------------------------------------------------- create ---
 
 const VALID_CATEGORIES = new Set(['improvement', 'routine', 'capability', 'constraint', 'bug']);
@@ -395,12 +412,31 @@ async function verbRoutine(stateDir: string): Promise<void> {
 
 // ------------------------------------------------------------------- main --
 
+const VERBS = 'create|patch|shell-append|next-task|routine|resolve-id|gate|queue-micro|micro|index|metrics|success-signal';
+
 async function main(): Promise<void> {
   const verb = process.argv[2];
   const stateDir = process.argv[3];
 
+  // `metrics` defaults its state dir, and `success-signal --validate` is a pure
+  // grammar check that reads no state at all — for those two, argv[3] is not a
+  // state dir and the guard below must not demand one. Both take the whole tail
+  // (argv[3] onward) so their own arg parsing is unchanged from when they were
+  // standalone scripts.
+  const tail = process.argv.slice(3);
+  if (verb === 'metrics') return runMetrics(tail);
+  if (verb === 'success-signal') return runSuccessSignal(tail);
+  // `index` was fail-open before it was absorbed: a missing state dir answered
+  // `SKIP|no state dir` on stdout at exit 0, never a usage error. Preserve that —
+  // it is a derived-cache rebuild, and its callers treat a non-zero exit as a
+  // real failure rather than "nothing to do".
+  if (verb === 'index' && !stateDir) {
+    process.stdout.write('SKIP|no state dir\n');
+    process.exit(0);
+  }
+
   if (!verb || !stateDir) {
-    console.error('Usage: bun proposal.ts <create|patch|shell-append|next-task|routine> <hermit-state-dir> [args...]');
+    console.error(`Usage: bun proposal.ts <${VERBS}> <hermit-state-dir> [args...]`);
     process.exit(1);
   }
 
@@ -411,6 +447,11 @@ async function main(): Promise<void> {
     case 'shell-append': return verbShellAppend(stateDir, rest);
     case 'next-task': return verbNextTask(stateDir);
     case 'routine': return verbRoutine(stateDir);
+    case 'resolve-id': return runResolveId(stateDir, rest[0]);
+    case 'gate': return runGate(stateDir, rest);
+    case 'queue-micro': return runQueueMicro(stateDir);
+    case 'micro': return runMicro(stateDir, rest);
+    case 'index': return runIndex(stateDir);
     default:
       fail('unknown-verb');
   }
diff --git a/plugins/claude-code-hermit/scripts/record-operator-action.ts b/plugins/claude-code-hermit/scripts/record-operator-action.ts
index 1a09d587..ef8b28ed 100644
--- a/plugins/claude-code-hermit/scripts/record-operator-action.ts
+++ b/plugins/claude-code-hermit/scripts/record-operator-action.ts
@@ -1,10 +1,10 @@
 process.stdout.on('error', () => {});
 
 // UserPromptSubmit + SessionStart hook — records when an operator prompt is received.
-// Writes state/last-operator-action.json so heartbeat-precheck.ts can gate AUTO_CLOSE
+// Writes state/last-operator-action.json so `heartbeat.ts precheck` can gate AUTO_CLOSE
 // on genuine operator silence rather than SHELL.md mtime (which routine writes reset).
 // Also opens state/operator-turn-open.json on the same kept prompts (plus --force) so
-// routine-due.ts can defer monitor-mode routines only while a real operator turn is in
+// `routines.ts due` can defer monitor-mode routines only while a real operator turn is in
 // flight; stop-pipeline.ts clears it at Stop (issue #617 — session_state alone starved
 // routines indefinitely because it never resets on its own).
 //
@@ -21,7 +21,7 @@ process.stdout.on('error', () => {});
 //   <channel…           — unauthorized DMs arrive here before channel-responder's allowlist
 //                          check; recording them would let bot traffic suppress AUTO_CLOSE
 //   HEARTBEAT_EVALUATE/HEARTBEAT_ERROR/ROUTINE_DUE/ROUTINE_MONITOR_ERROR — Monitor-delivered
-//                          scheduler wake notifications (heartbeat-monitor.sh, routine-due.ts,
+//                          scheduler wake notifications (heartbeat-monitor.sh, routines.ts due,
 //                          routine-monitor.sh) — see isRoutinePrompt below
 //   hermit's own tmux-injected slash commands — see INJECTED_EXACT below. Every
 //   other bare `/…` prompt counts as operator activity (see isRoutinePrompt).
@@ -48,8 +48,8 @@ function write() {
   writeMarker(TMP_PATH, STATE_PATH);
 }
 
-// Marks "an operator turn is in flight" for routine-due.ts's defer gate. Cleared by
-// stop-pipeline.ts at Stop; routine-due.ts applies a 60-min TTL as an orphaned-marker
+// Marks "an operator turn is in flight" for `routines.ts due`'s defer gate. Cleared by
+// stop-pipeline.ts at Stop; `routines.ts due` applies a 60-min TTL as an orphaned-marker
 // backstop (a failed Stop must not starve routines forever).
 function openTurnMarker() {
   writeMarker(TURN_TMP, TURN_PATH);
@@ -84,7 +84,7 @@ function isRoutinePrompt(prompt: string): boolean {
   // UserPromptSubmit hook fired at all in scratch tmux sessions; revisit if a
   // future probe contradicts this):
   //   heartbeat-monitor.sh:26-34 → "HEARTBEAT_EVALUATE" (bare) | "HEARTBEAT_ERROR: <detail>"
-  //   routine-due.ts:219         → "ROUTINE_DUE [hermit-routine:<id>] ..."
+  //   lib/routines/due.ts             → "ROUTINE_DUE [hermit-routine:<id>] ..."
   //   routine-monitor.sh:26      → "ROUTINE_MONITOR_ERROR: <detail>"
   // tests/auto-close.test.ts monitor-emission drift guard re-derives this list
   // from the emitters' source — extend both together.
@@ -139,6 +139,20 @@ function appendSkillUsage(name: string): void {
   } catch { /* fail-open */ }
 }
 
+// The UserPromptSubmit half, callable in-process by user-prompt-pipeline.ts.
+export function run(prompt: string): void {
+  if (!isRoutinePrompt(prompt)) {
+    // Skill-usage capture is operator-activity only — hermit's own injected
+    // slash commands (INJECTED_EXACT) are routine prompts, so gating on the
+    // same filter keeps automated heartbeat/session-close/routines fires out
+    // of the usage ledger (they'd otherwise log as source:'prompt' skill use).
+    const skillName = extractSkillName(prompt);
+    if (skillName) appendSkillUsage(skillName);
+    write();
+    openTurnMarker();
+  }
+}
+
 function main(raw: string): void {
   let prompt: string | null = null;
   try {
@@ -151,33 +165,28 @@ function main(raw: string): void {
     return;
   }
 
-  if (!isRoutinePrompt(prompt)) {
-    // Skill-usage capture is operator-activity only — hermit's own injected
-    // slash commands (INJECTED_EXACT) are routine prompts, so gating on the
-    // same filter keeps automated heartbeat/session-close/routines fires out
-    // of the usage ledger (they'd otherwise log as source:'prompt' skill use).
-    const skillName = extractSkillName(prompt);
-    if (skillName) appendSkillUsage(skillName);
+  run(prompt);
+}
+
+// Entry shell only when executed directly — importing this module (the pipeline
+// does, for run()) must not consume stdin or act on the caller's argv.
+if (import.meta.main) {
+  if (process.argv.includes('--force')) {
     write();
     openTurnMarker();
+    process.exit(0);
   }
-}
-
-if (process.argv.includes('--force')) {
-  write();
-  openTurnMarker();
-  process.exit(0);
-}
 
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
+  try {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', chunk => { buf += chunk; });
+    process.stdin.on('error', () => {});
+    process.stdin.on('end', () => {
+      try { main(buf); } catch { /* fail-open */ }
+      process.exit(0);
+    });
+  } catch {
     process.exit(0);
-  });
-} catch {
-  process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/render-dashboard.ts b/plugins/claude-code-hermit/scripts/render-dashboard.ts
deleted file mode 100644
index 225c8e39..00000000
--- a/plugins/claude-code-hermit/scripts/render-dashboard.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-// render-dashboard.ts — renders the Hermit Dashboard artifact fragment to disk.
-// Usage: bun render-dashboard.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the Dashboard Refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { loadDashboardState, renderDashboard } from './lib/dashboard';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-dashboard.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'dashboard.html');
-
-try {
-  const state = loadDashboardState(hermitDir);
-  const { html, hash } = renderDashboard(state);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, html, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(html), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-dashboard: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/scripts/render-proposals-page.ts b/plugins/claude-code-hermit/scripts/render-proposals-page.ts
deleted file mode 100644
index 03c95d35..00000000
--- a/plugins/claude-code-hermit/scripts/render-proposals-page.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-// render-proposals-page.ts — renders the Hermit Proposals-page artifact fragment to disk.
-// Usage: bun render-proposals-page.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the artifacts.md refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { loadProposalsPageState, renderProposalsPage } from './lib/proposals-page';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-proposals-page.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'proposals-page.html');
-
-try {
-  const state = loadProposalsPageState(hermitDir);
-  const { html, hash } = renderProposalsPage(state);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, html, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(html), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-proposals-page: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts b/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts
deleted file mode 100644
index ac1d4df6..00000000
--- a/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-// render-weekly-artifact.ts — finds the latest compiled/review-weekly-*.md and
-// strips its YAML frontmatter (rendered raw it's an ugly wall of metrics; every
-// field is already legible in the report body's evolution block and the
-// dashboard's weekly section), writing the plain markdown body to disk. The
-// Artifact tool renders .md directly — no HTML renderer needed for this page.
-// Usage: bun render-weekly-artifact.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the artifacts.md refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { readFileWithFrontmatter, globDir } from './lib/frontmatter';
-import { sha256 } from './lib/hash';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-weekly-artifact.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'weekly-review-artifact.md');
-
-try {
-  const compiledDir = path.join(hermitDir, 'compiled');
-  const files = globDir(compiledDir, /^review-weekly-.*\.md$/); // YYYY-Wnn sorts chronologically by name
-  if (files.length === 0) {
-    console.error('render-weekly-artifact: no compiled/review-weekly-*.md found');
-    process.exit(1);
-  }
-  const latest = readFileWithFrontmatter(files[files.length - 1]);
-  if (!latest) {
-    console.error('render-weekly-artifact: latest weekly review file unreadable');
-    process.exit(1);
-  }
-  const body = latest.body;
-  const hash = sha256(body);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, body, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(body), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-weekly-artifact: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/scripts/resolve-prop.ts b/plugins/claude-code-hermit/scripts/resolve-prop.ts
deleted file mode 100644
index 1bcdfd96..00000000
--- a/plugins/claude-code-hermit/scripts/resolve-prop.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-// resolve-prop.ts — resolves an operator's PROP-id input to a proposal filename.
-// Usage: bun resolve-prop.ts <hermit-state-dir> <operator-input>
-// Output (stdout, one line):
-//   MATCH|<filename>
-//   AMBIGUOUS|<json array of {file, title}>
-//   NONE|not-a-prop-id
-//   NONE|no-match
-// Exit 0 always — resolution failures are reported via the verdict token, not exit code.
-// Implements proposal-act/SKILL.md § Resolving a Proposal ID. Glob matching is
-// case-insensitive: step 1 uppercases the whole input (including any slug suffix),
-// while real proposal filenames carry a lowercase slug — case-insensitive matching
-// is required for the suffix form to ever match a real file.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { readFrontmatter } from './lib/frontmatter';
-import { emit } from './lib/cli';
-
-const stateDir = process.argv[2];
-const rawInput = process.argv[3];
-
-if (!stateDir || rawInput === undefined) emit('NONE|not-a-prop-id');
-
-const input = rawInput.trim().toUpperCase();
-const m = input.match(/^PROP-(\d+)(?:-(.+))?$/);
-if (!m) emit('NONE|not-a-prop-id');
-
-const num = m![1].padStart(3, '0');
-const suffix = m![2];
-
-const proposalsDir = path.join(stateDir, 'proposals');
-let files: string[] = [];
-try {
-  files = fs.readdirSync(proposalsDir).filter(f => f.endsWith('.md')).sort();
-} catch {
-  emit('NONE|no-match');
-}
-
-// Anchored glob → regex. Never a bare `PROP-NNN*` — that collides with 4-digit NNN
-// filenames (e.g. `PROP-0061.md`) once proposal counts cross 1000.
-function globToRegExp(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
-  return new RegExp(`^${escaped}$`, 'i');
-}
-
-let matches: string[];
-if (!suffix) {
-  const legacy = globToRegExp(`PROP-${num}.md`);
-  const newFormat = globToRegExp(`PROP-${num}-*.md`);
-  matches = files.filter(f => legacy.test(f) || newFormat.test(f));
-} else {
-  const pattern = globToRegExp(`PROP-${num}-*${suffix}*.md`);
-  matches = files.filter(f => pattern.test(f));
-}
-
-if (matches.length === 0) emit('NONE|no-match');
-if (matches.length === 1) emit(`MATCH|${matches[0]}`);
-
-const payload = matches.map(f => ({
-  file: f,
-  title: readFrontmatter(path.join(proposalsDir, f))?.title ?? null,
-}));
-emit(`AMBIGUOUS|${JSON.stringify(payload)}`);
diff --git a/plugins/claude-code-hermit/scripts/routine-monitor.sh b/plugins/claude-code-hermit/scripts/routine-monitor.sh
index 5db07e2a..22ca4aa3 100755
--- a/plugins/claude-code-hermit/scripts/routine-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/routine-monitor.sh
@@ -1,26 +1,33 @@
 #!/usr/bin/env bash
 # Usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>
 # Env: ROUTINE_MONITOR_ONCE=1    → run one iteration and exit (tests)
-#      ROUTINE_DUE_SCRIPT=<path> → override routine-due path (tests)
-# Polls routine-due.ts, which owns all gating/state/liveness writes and prints a
+#      ROUTINE_DUE_SCRIPT=<path> → override routine-due path (tests). Still a bare
+#                                  script path called with `<dir>`; the default
+#                                  now prepends routines.ts's verb.
+# Polls `routines.ts due`, which owns all gating/state/liveness writes and prints a
 # ROUTINE_DUE line only when eligible routines are due. No first-iteration
 # suppression needed: routine-due initializes unseen routines to "now" and fires
 # nothing on a fresh baseline.
 #
-# routine-due.ts always exits 0, so the error branch only fires on a hard spawn
+# `routines.ts due` always exits 0, so the error branch only fires on a hard spawn
 # failure (bun missing, script renamed). To avoid a wake-notification storm, the
 # ROUTINE_MONITOR_ERROR line is throttled: emitted on the 1st failure and every
 # 60th consecutive failure thereafter; any success resets the counter.
 set -u
 INTERVAL="${1:?usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>}"
 RT_DIR="${2:?usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>}"
-DUE="${ROUTINE_DUE_SCRIPT:-$(dirname "$0")/routine-due.ts}"
+# Array, not a string — see heartbeat-monitor.sh for why.
+if [[ -n "${ROUTINE_DUE_SCRIPT:-}" ]]; then
+  DUE=("$ROUTINE_DUE_SCRIPT")
+else
+  DUE=("$(dirname "$0")/routines.ts" due)
+fi
 fail_count=0
 # Emission grammar (this line's "$out" and the ROUTINE_MONITOR_ERROR line below) is
 # load-bearing: record-operator-action.ts isRoutinePrompt() drops these lines;
 # tests/auto-close.test.ts drift guard syncs them.
 while true; do
-  if out="$(bun "$DUE" "$RT_DIR" 2>/dev/null)"; then
+  if out="$(bun "${DUE[@]}" "$RT_DIR" 2>/dev/null)"; then
     fail_count=0
     [[ -n "$out" ]] && echo "$out"
   else
diff --git a/plugins/claude-code-hermit/scripts/routines.ts b/plugins/claude-code-hermit/scripts/routines.ts
new file mode 100644
index 00000000..7ae7d4a6
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/routines.ts
@@ -0,0 +1,70 @@
+// routines.ts — single CLI for the routine mechanics, over lib/routines/.
+//
+// Usage:
+//   bun routines.ts due <hermit-state-dir>
+//     The monitor's poll. Owns all gating/state/liveness writes and prints a
+//     `ROUTINE_DUE [hermit-routine:<id>] …` line only when routines are due.
+//     That line is load-bearing: record-operator-action.ts's isRoutinePrompt()
+//     matches it, and tests/auto-close.test.ts guards it against drift.
+//
+//   bun routines.ts precheck <id> <rdw> [delivery]
+//     Per-routine gate at fire time. Prints PROCEED or a SKIP verdict.
+//
+//   bun routines.ts cron-registry <mode> <hermit-state-dir> [plugin-root] [--ids …]
+//     Reconciles the CronCreate registry against config.json.
+//
+//   bun routines.ts tz-shift "<cron-expr>" "<from-tz>"
+//     Rewrites a cron expression into the machine's local timezone.
+//
+//   bun routines.ts log-event <routine-id> <event> [delivery]
+//     Appends one line to state/routine-metrics.jsonl.
+//
+// Verb dispatch is lazy, and for the first three the verb is spliced out of
+// process.argv so each module keeps the argv indices it used as a standalone
+// script — ~650 lines of scheduling, cron matching and registry reconciliation
+// stay byte-for-byte unchanged rather than being rethreaded through a
+// parameter. `due` runs on every monitor interval, so it has no business
+// loading the registry or tz-shift graphs to do it.
+
+export {}; // module scope: every import here is dynamic, and top-level await needs it
+
+const USAGE = 'Usage: bun routines.ts <due|precheck|cron-registry|tz-shift|log-event> [args...]';
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+
+switch (verb) {
+  // argv-index-preserving verbs: drop the verb, then let the module run.
+  case 'due':
+    process.argv.splice(2, 1);
+    await import('./lib/routines/due');
+    break;
+  case 'precheck':
+    process.argv.splice(2, 1);
+    await import('./lib/routines/precheck');
+    break;
+  // registry.ts exports pure helpers that tests import, so its CLI cannot run at
+  // module scope; it is a named export instead.
+  case 'cron-registry': {
+    process.argv.splice(2, 1);
+    const { runCli } = await import('./lib/routines/registry');
+    runCli();
+    break;
+  }
+
+  // Already parameterized — pass the tail directly.
+  case 'tz-shift': {
+    const { run } = await import('./lib/routines/tz-shift');
+    run(rest);
+    break;
+  }
+  case 'log-event': {
+    const { run } = await import('./lib/routines/event');
+    run(rest);
+    break;
+  }
+
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/session-cost.ts b/plugins/claude-code-hermit/scripts/session-cost.ts
deleted file mode 100644
index a920dde2..00000000
--- a/plugins/claude-code-hermit/scripts/session-cost.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-// Sums cost-log.jsonl entries for the current logical session and prints the result.
-// Usage: bun session-cost.ts <session_id> [--opened-at <iso>] [--closed-at <iso>]
-// Output: JSON {"cost_usd": <number>, "tokens": <number>}
-//
-// Primary mode: window-delta. cost-log.jsonl rows are tagged with the transcript's
-// process session_id (a UUID), never the logical S-NNN id (assigned only at close),
-// and one long-lived transcript holds many logical sessions — so an exact session_id
-// match against S-NNN always misses. Instead, sum every row whose timestamp falls in
-// the arc window [opened_at, closed_at]. Both bounds are read from state/runtime.json
-// (maintained by cost-tracker.ts: opened_at re-stamped per arc keyed on the transcript
-// id, closed_at stamped on the idle transition) unless overridden via --opened-at /
-// --closed-at. A live arc has no closed_at yet, so the window ends at now.
-//
-// Fallback mode: when no opened_at is available (older runtime.json, or none yet),
-// fail open to the legacy exact session_id sum — same zeros-for-unknown-id behavior
-// as before.
-// Fails open throughout: missing log or unreadable state prints {"cost_usd": 0, "tokens": 0}.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { costLogPath, hermitDir } from './lib/cc-compat';
-import { readRuntimeJson } from './lib/runtime';
-import { computeSessionCost } from './lib/session-cost';
-
-const ROOT = hermitDir();
-const COST_LOG = costLogPath(ROOT);
-
-const argv = process.argv.slice(2);
-let sessionId = '';
-let openedAtOverride: string | undefined;
-let closedAtOverride: string | undefined;
-for (let i = 0; i < argv.length; i++) {
-  const a = argv[i];
-  if (a === '--opened-at') { openedAtOverride = argv[++i]; continue; }
-  if (a === '--closed-at') { closedAtOverride = argv[++i]; continue; }
-  if (!sessionId) sessionId = a;
-}
-
-// Arc-window rationale is in the file header above; this just applies the
-// --opened-at / --closed-at overrides on top of runtime.json's values.
-function readWindow(): { openedAt?: string; closedAt?: string } {
-  const rt = readRuntimeJson(path.join(ROOT, 'state')) || {};
-  return {
-    openedAt: openedAtOverride ?? (typeof rt.opened_at === 'string' ? rt.opened_at : undefined),
-    closedAt: closedAtOverride ?? (typeof rt.closed_at === 'string' ? rt.closed_at : undefined),
-  };
-}
-
-function sumMatching(predicate: (e: any) => boolean): { cost: number; tokens: number } {
-  let cost = 0;
-  let tokens = 0;
-  try {
-    for (const line of fs.readFileSync(COST_LOG, 'utf8').split('\n')) {
-      if (!line.trim()) continue;
-      try {
-        const e = JSON.parse(line);
-        if (predicate(e)) {
-          cost += e.estimated_cost_usd || 0;
-          tokens += e.total_tokens || 0;
-        }
-      } catch {}
-    }
-  } catch {}
-  return { cost, tokens };
-}
-
-const { openedAt, closedAt } = readWindow();
-const measured = computeSessionCost({ logPath: COST_LOG, openedAt, closedAt });
-
-// Window mode unavailable (no opened_at) — fall back to the legacy exact-match sum.
-const result = measured.available
-  ? { cost: measured.cost_usd, tokens: measured.tokens }
-  : sumMatching(e => e.session_id === sessionId);
-
-process.stdout.write(JSON.stringify({ cost_usd: Math.round(result.cost * 10000) / 10000, tokens: result.tokens }) + '\n');
diff --git a/plugins/claude-code-hermit/scripts/setup-token-mint.ts b/plugins/claude-code-hermit/scripts/setup-token-mint.ts
index 1933ea61..bccd2f74 100644
--- a/plugins/claude-code-hermit/scripts/setup-token-mint.ts
+++ b/plugins/claude-code-hermit/scripts/setup-token-mint.ts
@@ -28,6 +28,8 @@
  *   await-token-and-install   capture the token, install it, print the digest
  *   finish                    restart the session so the new token takes effect
  *   abort                     tear down a running mint
+ *   probe [hermitDir]         doctor's expiry probe — one line: OK | EXPIRED |
+ *                             EXPIRES:<iso8601> (see hermit-meta.json)
  */
 
 import fs from 'node:fs';
@@ -511,9 +513,32 @@ async function main(): Promise<void> {
       break;
     }
 
+    case 'probe': {
+      // Expiry probe for core's own setup-token credential, declared in
+      // .claude-plugin/hermit-meta.json and run by doctor's credential-expiry
+      // check. Protocol (doctor-check.ts runExpiryProbe): exactly one line of
+      // stdout — OK | EXPIRED | EXPIRES:<iso8601>.
+      //
+      // A hermit not using token auth has no record and prints OK: there is
+      // nothing to check, which is materially different from "expired". Note
+      // this never reads the token file itself — expiry lives in the record.
+      //
+      // Takes an optional dir positionally so the declared probe command can
+      // stay argument-free while tests can point it at a fixture.
+      try {
+        const record = readTokenRecord(process.argv[3] || HERMIT_DIR);
+        console.log(record ? `EXPIRES:${record.expires_at}` : 'OK');
+      } catch {
+        // Never let a probe failure read as a credential problem; doctor
+        // reports an unparseable line as "probe failed" on its own.
+        console.log('OK');
+      }
+      break;
+    }
+
     default:
       process.stderr.write(
-        'Usage: setup-token-mint.ts <terminal|relay|start|await-url|submit-code|await-token-and-install|finish|abort|status>\n'
+        'Usage: setup-token-mint.ts <terminal|relay|start|await-url|submit-code|await-token-and-install|finish|abort|status|probe>\n'
       );
       code = 1;
   }
diff --git a/plugins/claude-code-hermit/scripts/setup-token-probe.ts b/plugins/claude-code-hermit/scripts/setup-token-probe.ts
deleted file mode 100644
index ad6cdb78..00000000
--- a/plugins/claude-code-hermit/scripts/setup-token-probe.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Expiry probe for core's own setup-token credential, declared in
- * .claude-plugin/hermit-meta.json and run by doctor's credential-expiry check.
- *
- * Protocol (doctor-check.ts runExpiryProbe): exactly one line of stdout —
- * OK | EXPIRED | EXPIRES:<iso8601>.
- *
- * A hermit not using token auth has no record and prints OK: there is nothing
- * to check, which is materially different from "expired". Note this probe never
- * reads the token file itself — expiry lives entirely in the record.
- *
- * Usage: bun scripts/setup-token-probe.ts [hermitDir]
- */
-
-import { readTokenRecord } from './lib/setup-token';
-
-const hermitDir = process.argv[2] || '.claude-code-hermit';
-
-try {
-  const record = readTokenRecord(hermitDir);
-  if (!record) {
-    console.log('OK');
-  } else {
-    console.log(`EXPIRES:${record.expires_at}`);
-  }
-} catch {
-  // Never let a probe failure read as a credential problem; doctor reports an
-  // unparseable line as "probe failed" on its own.
-  console.log('OK');
-}
diff --git a/plugins/claude-code-hermit/scripts/transcript-digest.ts b/plugins/claude-code-hermit/scripts/transcript-digest.ts
index 3e1886b0..e8ed8c3d 100644
--- a/plugins/claude-code-hermit/scripts/transcript-digest.ts
+++ b/plugins/claude-code-hermit/scripts/transcript-digest.ts
@@ -54,7 +54,7 @@ const DEFAULT_SESSIONS = 10;
 const DAY_MS = 86_400_000;
 
 // v1 excludes Bash from productive-wake detection deliberately: every heartbeat
-// wake runs heartbeat-precheck.ts via Bash by construction, so counting any Bash
+// wake runs `heartbeat.ts precheck` via Bash by construction, so counting any Bash
 // call would peg productive_wakes/wakes at 100% and kill the defer-loop signal.
 // Undercount (a wake that only mutates state through a hermit script reads as
 // unproductive) is accepted for v1; a hermit-script allowlist is a v1.1 option.
diff --git a/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
new file mode 100644
index 00000000..6fc892e6
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
@@ -0,0 +1,161 @@
+// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
+process.stdout.on('error', () => {});
+
+// UserPromptSubmit hook — the single process for the whole prompt path.
+//
+// Replaces seven separately-registered hooks. Each of those re-read stdin,
+// re-parsed the channel envelope, and re-read config; the operator paid all
+// seven process launches on every message they sent. This reads stdin once,
+// parses once, and runs the stages in an order that is now explicit in code
+// rather than implied by their order in hooks.json.
+//
+// Two behaviors that the multi-process shape could not express:
+//
+//   1. Shutdown is terminal. While a shutdown is pending, the audit/context
+//      stages still run, then the shutdown stage answers and the pipeline
+//      ends — whether or not its send succeeded. Previously a failed shutdown
+//      send fell through, and an exact `status` message could then send and
+//      block on its own, discarding the shutdown-relay instruction the model
+//      was supposed to act on. Pause/resume and harness commands are skipped
+//      for the same reason: mutating session state mid-shutdown answers a
+//      message the shutdown reply has already answered.
+//
+//   2. One disposition per prompt. Output is buffered and emitted once at the
+//      end: a confirmed block prints the decision JSON *alone*, because mixed
+//      plain text and JSON on stdout does not parse as a decision and the
+//      block would be silently lost.
+//
+// Contract preserved from the scripts this replaces: always exit 0, never
+// block on a failed send, and per-stage errors are isolated — a throwing stage
+// is logged to stderr and the rest still run (the stop-pipeline.ts pattern).
+
+import { hermitDir } from './lib/cc-compat';
+import { parseChannelEnvelope } from './lib/channel-envelope';
+import { loadConfig } from './lib/channel-auth';
+import { readRuntimeJson } from './lib/runtime';
+import type { StageContext, StageResult } from './lib/prompt-stages/types';
+
+import { run as recordOperatorAction } from './record-operator-action';
+import { run as promptContext } from './lib/prompt-stages/prompt-context';
+import { run as channelReplyReminder } from './lib/prompt-stages/channel-reply-reminder';
+import { run as pauseKeyword } from './lib/prompt-stages/pause-keyword';
+import { run as harnessCommand } from './lib/prompt-stages/harness-command';
+import { run as shutdownGate } from './lib/prompt-stages/shutdown-gate';
+import { run as channelStatusResponder } from './lib/prompt-stages/channel-status-responder';
+
+// Matches stop-pipeline.ts — a prompt payload far past this is not something a
+// stage can act on, and reading it unbounded is the only way this hook can hang.
+const MAX_STDIN_BYTES = 1024 * 1024;
+
+const out: string[] = [];
+let blockReason: string | null = null;
+
+async function stage(name: string, fn: (ctx: StageContext) => any, ctx: StageContext): Promise<void> {
+  if (blockReason) return; // a disposition is already settled
+  try {
+    const result: StageResult | void = await fn(ctx);
+    if (!result) return;
+    if (result.context) out.push(result.context);
+    if (result.block) blockReason = result.block;
+  } catch (e: any) {
+    process.stderr.write(`[user-prompt-pipeline] ${name}: ${e?.message || e}\n`);
+  }
+}
+
+async function main(raw: string): Promise<void> {
+  // Defensive parse: stages that don't need the payload still run on bad input,
+  // exactly as stop-pipeline.ts does.
+  let prompt: string | null = null;
+  try {
+    const payload = JSON.parse(raw);
+    prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
+  } catch {
+    process.stderr.write('[user-prompt-pipeline] malformed stdin — continuing with an empty prompt\n');
+    // A parse failure on non-empty stdin means a prompt did arrive and was
+    // mangled — MAX_STDIN_BYTES truncation cuts mid-JSON. Carry on with an empty
+    // prompt rather than returning: the audit and timestamp stages don't need the
+    // text, and every prompt-matching stage below fails closed on ''. Returning
+    // here would leave the turn unrecorded and let heartbeat's AUTO_CLOSE gate
+    // read the operator as silent.
+    if (raw.length === 0) return;
+    prompt = '';
+  }
+  if (prompt === null) return; // parsed, but no prompt for the stages to act on
+
+  const dir = hermitDir();
+
+  let configCache: any;
+  let configRead = false;
+  let runtimeCache: any;
+  let runtimeRead = false;
+
+  const ctx: StageContext = {
+    dir,
+    prompt,
+    envelope: parseChannelEnvelope(prompt),
+    config() {
+      if (!configRead) { configRead = true; try { configCache = loadConfig(dir); } catch { configCache = null; } }
+      return configCache;
+    },
+    runtime() {
+      if (!runtimeRead) { runtimeRead = true; try { runtimeCache = readRuntimeJson(); } catch { runtimeCache = null; } }
+      return runtimeCache;
+    },
+  };
+
+  // 1-3. Audit and context. These run on every prompt, including during a
+  // shutdown — the operator's message is still recorded and the reply reminder
+  // still names the chat to answer on.
+  await stage('record-operator-action', () => { recordOperatorAction(prompt); }, ctx);
+  await stage('prompt-context', promptContext, ctx);
+  await stage('channel-reply-reminder', channelReplyReminder, ctx);
+
+  const rt = ctx.runtime();
+  const shutdownPending = !!rt && !!rt.shutdown_requested_at && !rt.shutdown_completed_at;
+
+  if (shutdownPending) {
+    // Terminal: answer the shutdown and stop. Nothing below runs — not pause,
+    // not a harness command, not status.
+    await stage('shutdown-gate', shutdownGate, ctx);
+    return;
+  }
+
+  // 4-5. State writers. Both land before any network send, so an outer-timeout
+  // kill can lose a send but never a state write.
+  await stage('pause-keyword', pauseKeyword, ctx);
+  await stage('harness-command', harnessCommand, ctx);
+
+  // 6. Deterministic status.
+  await stage('channel-status-responder', channelStatusResponder, ctx);
+}
+
+function emit(): void {
+  // A block must be the only thing on stdout: Claude Code parses stdout as a
+  // decision object, and any leading context text makes that parse fail, which
+  // would drop the block and deliver the prompt anyway. The accumulated context
+  // is moot on a blocked prompt — the model never sees that turn.
+  if (blockReason) {
+    console.log(JSON.stringify({ decision: 'block', reason: blockReason }));
+    return;
+  }
+  for (const chunk of out) process.stdout.write(chunk.endsWith('\n') ? chunk : `${chunk}\n`);
+}
+
+try {
+  let buf = '';
+  let truncated = false;
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk) => {
+    if (truncated) return;
+    buf += chunk;
+    if (buf.length > MAX_STDIN_BYTES) { buf = buf.slice(0, MAX_STDIN_BYTES); truncated = true; }
+  });
+  process.stdin.on('error', () => {});
+  process.stdin.on('end', () => {
+    main(buf)
+      .catch((e: any) => process.stderr.write(`[user-prompt-pipeline] ${e?.message || e}\n`))
+      .finally(() => { try { emit(); } catch { /* fail open */ } process.exit(0); });
+  });
+} catch {
+  process.exit(0);
+}
diff --git a/plugins/claude-code-hermit/scripts/validate-config.ts b/plugins/claude-code-hermit/scripts/validate-config.ts
index b6165895..241e5f51 100644
--- a/plugins/claude-code-hermit/scripts/validate-config.ts
+++ b/plugins/claude-code-hermit/scripts/validate-config.ts
@@ -33,7 +33,7 @@ const VALID_BUDGET_ACTION = ['alert', 'pause'];
 const VALID_TELEMETRY_DEST = ['webhook'];
 const TIME_RE = /^\d{2}:\d{2}$/;
 const ENV_VAR_RE = /^[A-Z_][A-Z0-9_]*$/;
-// Routine ids travel in bracket markers, --ids CSVs, and JSONL output — shared with routine-due.ts.
+// Routine ids travel in bracket markers, --ids CSVs, and JSONL output — shared with lib/routines/due.ts.
 const ROUTINE_ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
 
 /** True for loopback hosts (localhost/127.0.0.1/::1) where a plaintext bearer token stays on-box. */
diff --git a/plugins/claude-code-hermit/skills/brief/SKILL.md b/plugins/claude-code-hermit/skills/brief/SKILL.md
index bf5afe34..99e337bc 100644
--- a/plugins/claude-code-hermit/skills/brief/SKILL.md
+++ b/plugins/claude-code-hermit/skills/brief/SKILL.md
@@ -29,7 +29,7 @@ For dispatching modes: invoke `claude-code-hermit:skill-eval-runner` pointed at
 
 **Boundary rule:** `sessions/SHELL.md` is the live session document — it stays in main, never goes to the runner. Archived `sessions/S-*-REPORT.md` bodies, `cost-summary.md`, `proposals/*.md` frontmatter, `OPERATOR.md`, and `NEXT-TASK.md` go to the runner.
 
-**Failure policy:** if the runner returns null or malformed JSON, fail-open — compose the brief from whatever live data main holds (TaskList, SHELL.md, `today-cost.ts` output) and skip the runner-derived lines. Note nothing fatal to the operator.
+**Failure policy:** if the runner returns null or malformed JSON, fail-open — compose the brief from whatever live data main holds (TaskList, SHELL.md, `cost-report.ts today` output) and skip the runner-derived lines. Note nothing fatal to the operator.
 
 **Eval runner return schema** — the runner returns a JSON object conforming to this block. The schema is byte-identical in `reference.md` (producer) and here (consumer); a contract test asserts this.
 
@@ -67,7 +67,7 @@ Emphasize forward-looking content. Compose from runner JSON (see Dispatch above)
 - If `config.always_on` is `true`: run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/check-upgrade.sh" "${CLAUDE_PLUGIN_ROOT}"` from the project root. If it emits an `---Upgrade Available---` section, append a final line to the brief: `⚠ Plugin update available: <the version line>` (pass the directive verbatim). Output nothing if the script is silent. (Interactive operators already see this notice at session-start step 2; the gate avoids double-notification.)
 
 <!-- keep in sync with plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md step 9a — same MP lifecycle protocol -->
-After composing the morning brief, age the micro-proposal queue in one pass: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit brief-cycle`. It reads `state/micro-proposals.json`, runs the whole lifecycle atomically (re-nudges `follow_up_count` 1 entries, expires `follow_up_count` ≥2 entries and records each expiry), and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}` — never hand-edit the file or read it separately. Render straight from that verdict:
+After composing the morning brief, age the micro-proposal queue in one pass: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit brief-cycle`. It reads `state/micro-proposals.json`, runs the whole lifecycle atomically (re-nudges `follow_up_count` 1 entries, expires `follow_up_count` ≥2 entries and records each expiry), and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}` — never hand-edit the file or read it separately. Render straight from that verdict:
 - Each `new` entry (first display): append as a final line. Without `options`: `MP-YYYYMMDD-N (tier N): [question]` — Reply `"MP-YYYYMMDD-N yes"` or `"MP-YYYYMMDD-N no"`. (Bare `yes`/`no` accepted when only one pending.) With `options`: render them numbered under the question and reply hint `Reply "MP-YYYYMMDD-N <number or label>"` (bare accepted when only one pending).
 - Each `renudged` entry: append with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] — ignore again to drop it" (if it carries `options`, re-render them numbered beneath it so the choices aren't lost on the re-nudge).
 - `expired` entries were dropped this cycle — do not surface them, and do not resurrect unless fresh evidence accumulates from scratch.
@@ -79,7 +79,7 @@ After composing the morning brief, age the micro-proposal queue in one pass: run
 
 Emphasize backward-looking content. Compose from runner JSON (see Dispatch above) and live main-session data:
 - **Sessions today:** use `runner.sessions_today`; also note any progress in the current SHELL.md progress log (read SHELL.md in main **(fresh read — re-read the file(s) now; do not reuse a value cached in context from before compaction)**).
-- **Today's cost:** run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/today-cost.ts"` (live, in main) — do not use `cost-summary.md` for today's figure; it is only updated once per day and will be stale in always-on deployments.
+- **Today's cost:** run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts today"` (live, in main) — do not use `cost-summary.md` for today's figure; it is only updated once per day and will be stale in always-on deployments.
 - **Key findings:** use `runner.findings`
 - **Tomorrow:** use `runner.tomorrow`
 - After generating summary: if `runtime.json session_state` is `in_progress` or SHELL.md has progress entries since last report, note it in the brief (e.g., "Session still open — run /session-close to archive.") and let the operator close explicitly. Exception: if `config.always_on` is `true` AND `config.routines` contains an enabled entry with `id` `daily-auto-close` (the midnight routine, which invokes `/claude-code-hermit:session-close --scheduled`), suppress the note — the auto-close routine archives it at midnight. Idle transitions are owned by the `session` skill and `scripts/session-archive.ts`; brief does not trigger them.
@@ -130,4 +130,4 @@ Next: description of next action (or "Session complete" if all done)
 
 When invoked with "brief today", "daily summary", or "what happened today":
 
-Compose from runner JSON (mode: `daily`). For today's cost and token total, run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/today-cost.ts"` (live, in main). Use `runner.cost_context.week` and `runner.cost_context.all_time` for aggregates from `cost-summary.md`. Use `runner.sessions_today`, `runner.findings`, and `runner.tomorrow` for the day narrative. Format as a day-level summary covering: work done, cost, and proposals created/resolved.
+Compose from runner JSON (mode: `daily`). For today's cost and token total, run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts today"` (live, in main). Use `runner.cost_context.week` and `runner.cost_context.all_time` for aggregates from `cost-summary.md`. Use `runner.sessions_today`, `runner.findings`, and `runner.tomorrow` for the day narrative. Format as a day-level summary covering: work done, cost, and proposals created/resolved.
diff --git a/plugins/claude-code-hermit/skills/brief/reference.md b/plugins/claude-code-hermit/skills/brief/reference.md
index b2665d89..2b941a3c 100644
--- a/plugins/claude-code-hermit/skills/brief/reference.md
+++ b/plugins/claude-code-hermit/skills/brief/reference.md
@@ -71,7 +71,7 @@ The calling skill passes the following scalars in the dispatch prompt (do not re
    Sessions values and the already magnitude-suffixed Tokens figure from the `## This Week` and
    `## All Time` sections **verbatim** (e.g. `"$1189.14 (532M tokens) across 44 sessions"`) — do
    not reformat or rescale the token count. Set `cost_context.yesterday` to `null` (today's live
-   cost runs in the calling main session via `today-cost.ts`).
+   cost runs in the calling main session via `cost-report.ts today`).
 3. Set `report_summary: null`, `pending_proposals: []`, `operator_priorities: []`, `queued_work: []`.
 
 ### default-no-session
diff --git a/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md b/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
index e663be10..6df5c0f6 100644
--- a/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
+++ b/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
@@ -10,7 +10,7 @@ description: On-demand hermit-voice brainstorm — synthesizes memory, capabilit
 After ≥8 invocations, run:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal-metrics-report.ts .claude-code-hermit --source=capability-brainstorm
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts metrics .claude-code-hermit --source=capability-brainstorm
 ```
 
 Triage-survival < 25% or acceptance < 30% → cut this skill rather than tune it — the signal-to-noise ratio isn't there. `INSUFFICIENT` output means the ≥8-verdict sample hasn't been reached yet; wait and re-check.
diff --git a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
index f6a426cb..d6297d5d 100644
--- a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
+++ b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
@@ -103,7 +103,7 @@ This is how the agent learns the DM channel ID for proactive outbound notificati
 Before running any heavy sub-step — an archive traversal, a multi-file search, or a delegated execution step — apply the **Context-hygiene & delegation** rule: delegate when its criteria hold and keep only the verdict.
 
 - **Harness command** (exactly `/compact`, `/clear`, `/model <arg>`, or `/effort <arg>`)
-  - Intercepted by the `harness-command-keyword.ts` `UserPromptSubmit` hook **before this skill runs** — the request is already recorded, and the `Stop` hook types it into the session when this turn ends. There is nothing for you to do; acknowledge briefly via the channel if you like.
+  - Intercepted by the `user-prompt-pipeline.ts` `UserPromptSubmit` hook's harness-command stage **before this skill runs** — the request is already recorded, and the `Stop` hook types it into the session when this turn ends. There is nothing for you to do; acknowledge briefly via the channel if you like.
   - Do **not** try to run it yourself, and do not treat it as a skill invocation.
   - It applies to *this* session only: the next `hermit-start` re-asserts `config.model` / `config.effort`. If Claude Code rejects the argument, that shows in the terminal, not in chat — so don't promise it took effect.
   - A near-miss (`/model` with no argument, a bare `clear`, or prose mentioning one) is **not** intercepted — classify it under the categories below instead.
@@ -135,27 +135,27 @@ Before running any heavy sub-step — an archive traversal, a multi-file search,
   - **Parsing the answer against the target entry:**
     - Entry has no `options` (plain yes/no entry): the answer must be `yes` or `no` (case-insensitive). Anything else on this entry → ambiguous, ask for clarification once, do not resolve.
     - Entry has `options` (2-4 labels): a bare number `k` within range (1 through the option count) selects `options[k-1]`; a number outside that range is ambiguous. Otherwise, case-insensitive prefix match the answer against the labels; a unique match resolves, no match or a multi-label prefix match is ambiguous. A bare `yes`/`no` against an options entry is ambiguous — reply with the numbered options and ask once, do not resolve.
-  - **Suggestion escape hatch:** when a bare `yes`/`no`/`later` can't be cleanly resolved here (ambiguous against an options entry, or multiple pending entries), run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit` (validates the index against disk — one bounded output line) and check the refreshed `state/proposals-index.json`. If it has a `status: "proposed"` proposal, append to the clarification reply: "…or reply 'YES #N' to act on an open suggestion instead." Precedence is unchanged — this only hands a bare reply meant for a Suggestion card a way out of the micro-proposal loop.
+  - **Suggestion escape hatch:** when a bare `yes`/`no`/`later` can't be cleanly resolved here (ambiguous against an options entry, or multiple pending entries), run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit` (validates the index against disk — one bounded output line) and check the refreshed `state/proposals-index.json`. If it has a `status: "proposed"` proposal, append to the clarification reply: "…or reply 'YES #N' to act on an open suggestion instead." Precedence is unchanged — this only hands a bare reply meant for a Suggestion card a way out of the micro-proposal loop.
   - **On resolved entry:** every branch below resolves the entry via one script call — never hand-edit `state/micro-proposals.json` (issue 649: a stray trailing comma from a hand-edit removal corrupted the file and every reader silently treated it as an empty queue).
     - **Entry has `on_resolve`** → **resolve on disk FIRST, then invoke.** Run:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action answered --answer "<selected label>"
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action answered --answer "<selected label>"
       ```
       This removes the entry from `pending`, writes the file, and appends the `micro-resolved` event (`"action":"answered"`) in one atomic call — *before* invoking the command. The `on_resolve` command can run a long implementation (e.g. `proposal-act … --answer "implement now"` runs the falsification gate + full implementation); if the durable-queue removal were left until after that, a crash or compaction mid-implementation would leave the entry pending and heartbeat would keep re-nudging a question already acted on. Then substitute the selected label into the `on_resolve` `{answer}` placeholder — **wrap it in double quotes** so a multi-word label (e.g. `session task`) stays a single `--answer` argument — and invoke the resulting skill command. This is how a channel-bridged ask (e.g. a 3-option proposal-act entry) re-enters the asking skill at the right branch — the invoked command itself detects it's a re-entry and skips straight to acting on the answer. The `answered` event is audit-only (neither an approval nor a rejection, so it's outside the micro approval-rate metrics). See § Channel-safe ask bridge below.
     - **No `on_resolve`, "yes" on tier 1** → execute the change at next idle, log outcome in SHELL.md, then:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action approved
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action approved
       ```
     - **No `on_resolve`, "yes" on tier 2** → create PROP-NNN via `/claude-code-hermit:proposal-create`, queue for next idle, then run the same `resolve <id> --action approved` call.
     - **No `on_resolve`, "no"** → run:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action rejected
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action rejected
       ```
   - If no pending micro-proposals: classify as normal message (fall through to categories below).
 
 - **Proposal approval** ("accept PROP-", "go ahead with PROP-", "approve PROP-", referencing proposal numbers, `#N`, or a bare/`#N`-qualified `YES`/`LATER`/`NO` reply to a Suggestion card — only when no pending micro-proposal claimed the reply first, per Micro-approval response above)
   - **Map the reply to an action** (case-insensitive): `YES` / "go ahead" / "accept" → `accept`; `LATER` / "hold" / "defer" → `defer`; `NO` / "drop" / "dismiss" → `dismiss`. `accept PROP-`/`approve PROP-` phrasing maps to `accept` directly; the operator can also spell the action out instead of YES/LATER/NO.
-  - **Resolve the target proposal:** first run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit` to validate the index against disk (one bounded output line — catches out-of-band file renames/moves that never went through Write/Edit). Then, for an explicit `#N` or `PROP-NNN` reference — confirm it matches a proposal in the refreshed `state/proposals-index.json`; if it doesn't, reply in plain voice ("I don't see a Suggestion #N — reply with one of the open numbers") rather than routing to `proposal-act` (whose no-match error is terminal-voice and names a slash command). On a match, route through `/claude-code-hermit:proposal-act <action> PROP-N` (`proposal-act` zero-pads the integer itself). A bare `YES`/`LATER`/`NO` with no `#N`: read the refreshed `state/proposals-index.json`, filter to `status: "proposed"`. Exactly one → apply to it. Zero or 2+ → reply listing the open Suggestion numbers and ask the operator to specify (e.g. "Reply 'YES #14'").
+  - **Resolve the target proposal:** first run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit` to validate the index against disk (one bounded output line — catches out-of-band file renames/moves that never went through Write/Edit). Then, for an explicit `#N` or `PROP-NNN` reference — confirm it matches a proposal in the refreshed `state/proposals-index.json`; if it doesn't, reply in plain voice ("I don't see a Suggestion #N — reply with one of the open numbers") rather than routing to `proposal-act` (whose no-match error is terminal-voice and names a slash command). On a match, route through `/claude-code-hermit:proposal-act <action> PROP-N` (`proposal-act` zero-pads the integer itself). A bare `YES`/`LATER`/`NO` with no `#N`: read the refreshed `state/proposals-index.json`, filter to `status: "proposed"`. Exactly one → apply to it. Zero or 2+ → reply listing the open Suggestion numbers and ask the operator to specify (e.g. "Reply 'YES #14'").
   - Never surface internal proposal fields back to the channel (the exact list and `#N` derivation are canonical in `proposal-list` §4a) — confirm using the Suggestion number (see `proposal-act`'s channel-tagged notify).
 
 - **New instruction** ("work on X", "switch to Y", "prioritize Z")
@@ -169,7 +169,7 @@ Before running any heavy sub-step — an archive traversal, a multi-file search,
   - Reference specific files or decisions from SHELL.md when relevant
 
 - **Pause / resume / snooze** (bare, exact-match "pause", "stop", "resume", or "snooze <duration>")
-  - These exact messages are intercepted by the `pause-keyword.ts` `UserPromptSubmit` hook (PROP-015) **before this skill ever runs** — `state/pause.json` is already set or cleared by the time you see the prompt. There is nothing left for you to do for the state change itself; if you want to acknowledge it, reply via the channel.
+  - These exact messages are intercepted by the `user-prompt-pipeline.ts` `UserPromptSubmit` hook's pause stage (PROP-015) **before this skill ever runs** — `state/pause.json` is already set or cleared by the time you see the prompt. There is nothing left for you to do for the state change itself; if you want to acknowledge it, reply via the channel.
   - A sentence that merely mentions "pause" or "stop" (not an exact match) is not intercepted — classify it under Emergency below instead.
   - **Never attempt to resume yourself while paused.** The PreToolUse gate (`pause-gate.ts`) denies every tool call except the channel reply tool while paused — including a Bash call running `hermit-pause.ts off` — and returns the pause reason in the denial. Resume can only come from an exact "resume" message (the deterministic hook above) or the operator's own `.claude-code-hermit/bin/hermit-pause off`.
 
@@ -265,7 +265,7 @@ Canonical protocol for proactively notifying the operator (referenced from `CLAU
 Canonical dual-delivery rule for any skill that hits a decision point on a channel-tagged turn (inbound prompt contains a `<channel source="...">` tag) — referenced from `proposal-act` and `hermit-settings` (and any future skill that needs to ask a bounded question over a channel).
 
 - **(a) Conversational side**: send the question via the channel reply tool, same as any other response — the operator is usually right there.
-- **(b) Durable side, bounded asks only**: a bounded ask (2-4 discrete options, including plain yes/no) ALSO gets queued as a pending entry via `queue-micro-proposal.ts` (see reflect's § Micro-approval queuing) — `options` set to the labels (omit for plain yes/no), `tier: 1`, and `on_resolve` set to the skill invocation that should run once an answer is picked, with `{answer}` as the placeholder for the selected label. Free-form asks (no bounded set of answers) are reply-tool only — no entry is queued for those.
+- **(b) Durable side, bounded asks only**: a bounded ask (2-4 discrete options, including plain yes/no) ALSO gets queued as a pending entry via `proposal.ts queue-micro` (see reflect's § Micro-approval queuing) — `options` set to the labels (omit for plain yes/no), `tier: 1`, and `on_resolve` set to the skill invocation that should run once an answer is picked, with `{answer}` as the placeholder for the selected label. Free-form asks (no bounded set of answers) are reply-tool only — no entry is queued for those.
 - **Whichever surface answers first resolves it.** If the operator answers in the same live turn (interactive-style, still within the asking skill's own flow), the asking skill acts on it directly AND resolves the MP entry itself — remove it from `pending`, write the file, and append the same `micro-resolved` `"action":"answered"` event as § Micro-approval response above — so the entry doesn't dangle waiting for a reply that already happened. If the operator answers later (new turn, possibly a new session), the § Micro-approval response resolver above handles it via `on_resolve`.
 - **Never call `AskUserQuestion` on a channel-tagged turn.** It renders in the terminal/transcript, which is invisible to a remote operator — exactly the strand this bridge exists to prevent.
 
diff --git a/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md b/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
index e84a8c0f..bb7add52 100644
--- a/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
+++ b/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
@@ -15,13 +15,13 @@ If this skill was invoked from a channel-arrived message (the inbound prompt con
 On a channel-tagged turn (Step 0 detected a `<channel source="...">` tag), run the plain-language mode instead of the full breakdown — a channel operator asking "why is my bill high" shouldn't get raw token-category jargon:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-reflect.ts .claude-code-hermit --plain
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts reflect .claude-code-hermit --plain
 ```
 
 Otherwise (terminal/dev use), run the full breakdown:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-reflect.ts .claude-code-hermit
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts reflect .claude-code-hermit
 ```
 
 Capture stdout. If the output starts with "No cost data" or "No spend recorded yet", report that message and stop — there's nothing to send.
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index ec2caff4..24fe39d9 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -378,7 +378,7 @@ The script-rendered Artifact pages (dashboard, proposals) read their fixed UI ch
 
 Run **only** when the chosen `language` is set and is not `en`:
 
-1. Emit the English scaffold: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact-strings-scaffold.ts <language> <current-ISO-timestamp>`.
+1. Emit the English scaffold: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts scaffold-strings <language> <current-ISO-timestamp>`.
 2. Translate every value inside the `strings` object into the operator's language. Leave the keys and any `{placeholder}` tokens **verbatim** (word order may move around a token, but the token text must not change or be translated). Leave the `language` and `generated` fields as emitted.
 3. Write the result to `.claude-code-hermit/state/artifact-strings.json`.
 
@@ -539,72 +539,33 @@ The plugin's hooks and boot scripts require specific Bash permissions to run wit
 - `hatch_target == "local"` → merge into `.claude/settings.local.json` (gitignored)
 - `hatch_target == "committed"` → merge into `.claude/settings.json` (committed, current behavior)
 
-Merge these into the target file:
+**Do not restate the permission list here or anywhere else.** `apply-settings.ts` holds the
+only copy (its sealed `HERMIT_ALLOW`); ask it what the target file is missing:
 
-**Required permissions:**
-
-```json
-{
-  "permissions": {
-    "allow": [
-      "Bash(git diff:*)",
-      "Bash(git status:*)",
-      "Bash(git log:*)",
-      "Bash(bun */scripts/cost-tracker.ts*)",
-      "Bash(bun */scripts/heartbeat-precheck.ts*)",
-      "Bash(bun */scripts/reflect-precheck.ts*)",
-      "Bash(bun */scripts/archive-shell.ts*)",
-      "Bash(bun */scripts/evaluate-session.ts*)",
-      "Bash(bun */scripts/append-metrics.ts*)",
-      "Bash(bun */scripts/resolve-prop.ts*)",
-      "Bash(bun */scripts/next-prop-id.ts*)",
-      "Bash(bun */scripts/proposal.ts*)",
-      "Bash(bun */scripts/record-gate.ts*)",
-      "Bash(bun */scripts/queue-micro-proposal.ts*)",
-      "Bash(bun */scripts/micro-proposal.ts*)",
-      "Bash(bun */scripts/generate-summary.ts*)",
-      "Bash(bun */scripts/proposals-index.ts*)",
-      "Bash(bun */scripts/update-reflection-state.ts*)",
-      "Bash(bun */scripts/apply-reflection-actions.ts*)",
-      "Bash(bun */scripts/transcript-digest.ts*)",
-      "Bash(bun */scripts/setup-token-mint.ts*)",
-      "Bash(bun */scripts/cron-tz-shift.ts*)",
-      "Bash(bun */scripts/evolve-plan.ts*)",
-      "Bash(bun */scripts/evolve-finalize.ts*)",
-      "Bash(bun */scripts/manifest-seed.ts*)",
-      "Bash(bun */scripts/apply-settings.ts*)",
-      "Bash(bun */scripts/channel-log.ts*)",
-      "Bash(bun */scripts/channel-send.ts*)",
-      "Bash(bun */scripts/session-archive.ts*)",
-      "Bash(bun */scripts/routine-precheck.ts*)",
-      "Bash(bun */scripts/cron-registry.ts*)",
-      "Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)",
-      "Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)",
-      "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
-      "Edit(.claude-code-hermit/**)"
-    ]
-  }
-}
 ```
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> permissions-plan
+```
+
+It writes nothing and prints one JSON line: `{"missing":[...],"obsolete":[...]}` — the sealed
+entries the target lacks, and any entries from retired plugin versions it still carries.
 
-**Why each one:**
+**What the permissions buy:**
 
 - `git diff`, `git status`, `git log` — session-diff.ts hook auto-populates `## Changed` in SHELL.md
-- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `next-prop-id.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, ID generation, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via `.claude-code-hermit/bin/hermit-run`) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
-- `.claude-code-hermit/bin/hermit-run micro-proposal *` / `proposal-metrics-report *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. The space before `*` is a word boundary — matches `micro-proposal brief-cycle`, not a `micro-proposal…`-prefixed name — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
+- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (`heartbeat.ts precheck`, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `proposal.ts` — the single proposal CLI. Its create/patch/shell-append/next-task/routine verbs perform every `.claude-code-hermit/` state-dir write proposal-create and proposal-act make; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Its resolve-id/gate/queue-micro/micro/index/metrics/success-signal verbs are the proposal-act/proposal-create/reflect mechanics; without them, ID resolution, gate-verdict routing, and micro-approval queuing would all be functionally denied headlessly. Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `.claude-code-hermit/bin/hermit-run proposal micro *` / `proposal metrics *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. Each grant is pinned to the one verb that plugin needs, never a bare `hermit-run proposal *` — that would also expose `create`, `patch`, `shell-append`, `next-task` and `routine`, i.e. arbitrary state-dir writes. The space before `*` is a word boundary — matches `proposal micro .claude-code-hermit brief-cycle`, not a `micro…`-prefixed verb — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
 - `bash -c 'AGENT_DIR=...` — SessionStart hook that loads session context on every startup
 - `Edit` on `.claude-code-hermit/**` — heartbeat appends to SHELL.md, increments config.json tick counter, and skills update session state without prompting (Edit rules cover all file-editing tools, including Write)
 
 **Steps:**
 
-1. If the target settings file exists: read it and identify which required permissions are missing from `permissions.allow`
-2. If the target settings file does not exist: all permissions are missing
-3. If no permissions are missing: skip silently
-4. If permissions need to be added: show the operator the list of permissions to add and ask with `AskUserQuestion` (header: "Hook perms") — options: **Yes — add** (merge so hooks run without prompting, default) / **No — skip** (you'll be prompted during sessions).
-5. If the operator confirms: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> allow`
-   (Merges the full allow-list additively; never removes existing entries.)
+1. Run `permissions-plan` (command above) against the resolved settings file and parse the JSON line.
+2. If both `missing` and `obsolete` are empty: skip silently.
+3. Otherwise show the operator the entries — what will be added, and what retired entries will be removed — and ask with `AskUserQuestion` (header: "Hook perms") — options: **Yes — add** (merge so hooks run without prompting, default) / **No — skip** (you'll be prompted during sessions).
+4. If the operator confirms: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> permissions-sync`
+   (Adds every missing sealed entry and removes only entries from retired plugin versions. Operator-authored rules are never touched.)
    Then run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts .claude/settings.local.json automode-seed` — **always `.claude/settings.local.json`, regardless of `hatch_target`**: the auto-mode classifier reads `autoMode` config only from local/user scope, never a committed project `.claude/settings.json`, so seeding anywhere else would be a silent no-op. Tell the operator in one line: "Also recorded an auto-mode exception and environment context in `.claude/settings.local.json` so unattended upgrade migrations can run the plugin's sealed settings ops."
-6. If the operator declines: skip (including the auto-mode seed above — an operator who wants prompts should not get a standing classifier exception), and note: "You may be prompted to approve hook commands during sessions. Run `/claude-code-hermit:hermit-settings permissions` to add them later."
+5. If the operator declines: skip (including the auto-mode seed above — an operator who wants prompts should not get a standing classifier exception), and note: "You may be prompted to approve hook commands during sessions. Run `/claude-code-hermit:hermit-settings permissions` to add them later."
 
 **Seed `state/template-manifest.json`** (deferred from Step 2 — now that the `bun */scripts/manifest-seed.ts*` permission is in place). It records the sha256 pristine-baseline that the `hermit-evolve` drift signals depend on. **Do not hand-compute the hashes** (an LLM cannot sha256 reliably; the script makes them correct by construction). Read the current plugin version from `${CLAUDE_SKILL_DIR}/../../.claude-plugin/plugin.json`, then run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/manifest-seed.ts .claude-code-hermit` with this JSON on stdin:
 
diff --git a/plugins/claude-code-hermit/skills/heartbeat/SKILL.md b/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
index 956f2d9b..e8969ee1 100644
--- a/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
+++ b/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
@@ -28,7 +28,7 @@ This subcommand is the handler for `HEARTBEAT_EVALUATE` notifications emitted by
 
 1. Run the precheck:
    ```
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat-precheck.ts .claude-code-hermit
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts precheck .claude-code-hermit
    ```
 2. Read the verdict (first line of output):
    - Starts with `SKIP|` → emit `HEARTBEAT_SKIP (<reason>)`. No channel notification. No SHELL.md write. Stop.
@@ -61,7 +61,7 @@ This subcommand is the handler for `HEARTBEAT_EVALUATE` notifications emitted by
 5. **Apply writes** in the main session (to preserve cost attribution and channel/file access). First, validate the subagent return: if it cannot be parsed as JSON, or is missing either required **key** (`firing`, `self_eval_updates`), **skip all writes and emit `HEARTBEAT_OK`** — fail-open, never corrupt persistent state. Otherwise:
    - Pass the subagent return to the dedicated script on **stdin** via a quoted heredoc so free-text `text` / `self_eval` values (which may contain apostrophes) can't break the command:
      ```
-     bun ${CLAUDE_PLUGIN_ROOT}/scripts/update-alert-state.ts .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
+     bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts alert-state .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
      <subagent-return-json>
      HERMIT_ALERT_JSON
      ```
diff --git a/plugins/claude-code-hermit/skills/heartbeat/reference.md b/plugins/claude-code-hermit/skills/heartbeat/reference.md
index e027da90..b5899efc 100644
--- a/plugins/claude-code-hermit/skills/heartbeat/reference.md
+++ b/plugins/claude-code-hermit/skills/heartbeat/reference.md
@@ -4,7 +4,7 @@ This file is the instruction spec for the isolated-context subagent dispatched b
 The subagent reads only files (no inherited session context) and returns **judgment only** — which items
 are currently firing, and a human-readable label for each. All bookkeeping (dedup, suppression,
 resolution, the daily digest, monitoring lines, operator notifications, `last_clean_eval_at`, and
-`heartbeat_result`) is derived deterministically by `update-alert-state.ts` from the returned firing set —
+`heartbeat_result`) is derived deterministically by `heartbeat.ts alert-state` from the returned firing set —
 the subagent never authors any of it. This split exists because a small model (`heartbeat.model`,
 haiku by default) intermittently fabricated that bookkeeping when it was asked to author it directly
 (issue #594): inventing schema fields, garbling keys, and marking a still-pending micro-proposal
@@ -20,7 +20,7 @@ This file is read only on the EVALUATE path, once the precheck determines a full
 
 **2. Per-item evaluation.** For each item in HEARTBEAT.md:
 - **Default proposals item** (text references `proposals/` and `status: proposed`): skip it entirely.
-  `update-alert-state.ts` derives its live state directly from `proposals/` frontmatter every tick,
+  `heartbeat.ts alert-state` derives its live state directly from `proposals/` frontmatter every tick,
   independent of anything returned here — there is nothing for you to evaluate or report.
 - **Custom items** (disk thresholds, SQL checks, file patterns, etc.): apply LLM judgment using
   available project files and context needed to evaluate the condition. Produce a semantic key per
@@ -45,7 +45,7 @@ Produce one semantic key per firing item:
 Normalise: lowercase, remove non-alphanumeric characters, truncate at the listed limit.
 
 **Never** emit a `micro-proposal-pending:*` or `proposal-pending:*` key, or the `stale-session` key.
-Those are derived and owned entirely by `update-alert-state.ts` — the two prefixes from
+Those are derived and owned entirely by `heartbeat.ts alert-state` — the two prefixes from
 `state/micro-proposals.json` and `proposals/*.md` frontmatter, `stale-session` from `runtime.json` +
 the bottom-most SHELL.md Progress Log timestamp — an entry you emit under any of them is dropped as
 a phantom and has no effect.
diff --git a/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md b/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
index 76a2ef7c..d8977e57 100644
--- a/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
@@ -46,7 +46,7 @@ to run at any time. Produces no side effects beyond writing
    Do not touch heartbeat-owned fields (`self_eval_updates`, `last_clean_eval_at`). If either
    `new_entries` or `resolved_keys` is non-empty, persist via the same stdin API heartbeat uses:
    ```bash
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/update-alert-state.ts .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts alert-state .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
    {"new_entries": {...}, "updated_entries": {}, "resolved_keys": [...]}
    HERMIT_ALERT_JSON
    ```
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
index 7e72b003..5a007282 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
@@ -12,7 +12,7 @@ If this skill was invoked from a channel-arrived message (the inbound prompt con
 
 ## Step 1 — Dispatch the eval runner
 
-Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal-metrics-report.ts` and `cost-reflect.ts` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
+Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal.ts metrics` and `cost-report.ts reflect` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
 
 Pass `plugin_root: ${CLAUDE_PLUGIN_ROOT}` in the dispatch prompt — the runner reads `reference.md` as file content, where `${CLAUDE_PLUGIN_ROOT}` is never substituted, so it needs the resolved absolute path to run the scripts and read template/skill paths.
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
index 6a9c706c..6dc6c6d3 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
@@ -20,9 +20,9 @@ Steps are independent — read files and run scripts concurrently where possible
    week if the review file for it doesn't exist yet.
 3. `.claude-code-hermit/state/proposal-metrics.jsonl` — scan from the end (most recent first); stop
    at entries older than 30 days. Use `resolved_at` and `created_at` to compute resolution days.
-4. Run `bun <plugin_root>/scripts/proposal-metrics-report.ts .claude-code-hermit` and
+4. Run `bun <plugin_root>/scripts/proposal.ts metrics .claude-code-hermit` and
    capture stdout. Skip gracefully if unavailable. (Steps 4 and 5 may run concurrently.)
-5. Run `bun <plugin_root>/scripts/cost-reflect.ts .claude-code-hermit 30` and capture
+5. Run `bun <plugin_root>/scripts/cost-report.ts reflect .claude-code-hermit 30` and capture
    stdout. This produces a 30-day cost breakdown including a `### Cost by source` section. Skip
    gracefully if unavailable.
 6. `.claude-code-hermit/config.json` — read `routines[]` (id, schedule, enabled), `monitors[]`
diff --git a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
index 8bbdaa0f..f3b30dff 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
@@ -226,18 +226,17 @@ Same logic as init step 8, but target the file determined by `hatch_target` (res
 - `hatch_target == "local"` → `.claude/settings.local.json`
 - `hatch_target == "committed"` → `.claude/settings.json`
 
-Delegate the additive permission merge to core's sealed writer rather than hand-enumerating the list here — `apply-settings.ts` holds the canonical `HERMIT_ALLOW` (so it can't drift from what `hatch` installs), writes via `fs` (so it works even under the strict hook profile, where an `Edit`/`Write` to `.claude/settings*.json` is denied), and is idempotent:
+Run the sync verb — it is the single owner of this list, so do not restate the entries here or diff them by hand. It holds the canonical `HERMIT_ALLOW` (so it can't drift from what `hatch` installs), writes via `fs` (so it works even under the strict hook profile, where an `Edit`/`Write` to `.claude/settings*.json` is denied), and is idempotent:
 
-```bash
-bun ${plugin_root}/scripts/apply-settings.ts <resolved-settings-file> allow
 ```
+bun <plugin_root>/scripts/apply-settings.ts <resolved-settings-file> permissions-sync
+```
+
+where `<resolved-settings-file>` is `.claude/settings.local.json` (local) or `.claude/settings.json` (committed) per `hatch_target`, and `<plugin_root>` is the baked absolute plugin root.
 
-where `<resolved-settings-file>` is `.claude/settings.local.json` (local) or `.claude/settings.json` (committed) per `hatch_target`, and `${plugin_root}` is the baked absolute plugin root. It prints one `allow: <entry>` line per newly-added permission (silent when everything is already present) — collect those for the step-10 report; if it prints nothing, the report notes no permission changes. **Delegated mode: run it without asking** (a missing `bun` permission breaks hooks, so this is non-optional); it only ever adds, never removes. (On a hermit whose allow-list predates `apply-settings.ts` itself, this command may hit a permission gate inside this subagent, which can't prompt — relay that to the step-10 report so the operator can add `Bash(bun */scripts/apply-settings.ts*)` and re-run, rather than wedging.) Separately, remove stale permissions from previous versions if found in the target file:
+**Delegated mode: run it without asking** (a missing `bun` permission breaks hooks, so this is non-optional). It adds every sealed entry the target lacks and removes only entries this plugin shipped in a previous version and has since retired — an operator's own rules are never touched, and a target that is already current is not rewritten at all. Parse its one JSON line, `{"missing":[...],"obsolete":[...]}`, and report the two counts in the step-10 report. Both empty means the target was already current; say nothing.
 
-- `Bash(python3:*)`, `Bash(node:*)` — replaced by scoped bun entries
-- `Edit(.claude/.claude-code-hermit/**)`, `Write(.claude/.claude-code-hermit/**)` — replaced by `.claude-code-hermit/**` (v0.0.6 path change)
-- `Bash(bun */scripts/run-with-profile.ts*)` — the run-with-profile wrapper was removed; profile-gated hooks now self-gate on `AGENT_HOOK_PROFILE`
-- `Bash(bun */scripts/suggest-compact.ts*)` — the suggest-compact Stop-hook stage was removed; compaction is owned by native autocompact, the watchdog backstop, and emergency clear
+(On a hermit whose allow-list predates `apply-settings.ts` itself, this command may hit a permission gate inside this subagent, which can't prompt — relay that to the step-10 report so the operator can add `Bash(bun */scripts/apply-settings.ts*)` and re-run, rather than wedging.)
 
 ### 9. Write updated config
 
diff --git a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
index 929290b4..4528be96 100644
--- a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
@@ -26,7 +26,7 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
 
 1. Resolve the plugin root path: derive it from this skill's **Base directory**, which the harness injects into the invocation context as `<plugin_root>/skills/hermit-routines`. Strip the trailing `/skills/hermit-routines` to get `pluginRoot`. This works in both installed and `--plugin-dir` modes. (`$CLAUDE_PLUGIN_ROOT` is NOT a Bash env var at runtime — evaluating it in Bash always returns empty. The braced `${CLAUDE_PLUGIN_ROOT}` form is text-substituted in skill markdown only in installed mode. Neither is reliable here — always use the Base-directory derivation.) The resolved `pluginRoot` must be baked into the Monitor `command` and into any CronCreate-delivered prompt at registration — it is not available inside either subprocess or cron-delivered prompts.
 
-   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or any of `<pluginRoot>/scripts/log-routine-event.sh`, `<pluginRoot>/scripts/routine-precheck.ts`, `<pluginRoot>/scripts/routine-monitor.sh`, `<pluginRoot>/scripts/cron-registry.ts` does not exist (`test -f`), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
+   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or either of `<pluginRoot>/scripts/routines.ts` (the `log-event`/`precheck`/`cron-registry` verbs all live in it) or `<pluginRoot>/scripts/routine-monitor.sh` does not exist (`test -f` — pass the bare file path, never a path with a verb appended), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
 2. Read `config.routines`, filter `enabled: true`, split into the anchor (`id === "heartbeat-restart"`) and everyone else ("scheduled routines").
 
    **Empty scheduled-routine set does not early-exit** — an operator disabling every routine mid-session must not leave a live monitor/anchor/crons behind. Reconcile: TaskStop any `routine-monitor` task (ignore not-found), delete `state/routine-monitor-liveness.json` and `state/routine-monitor.runtime.json`, run the anchor-only planner leg (Step 3's `--ids heartbeat-restart`, which with nothing else enabled emits `DELETE:` for every tracked id including the anchor if it too is disabled) and execute its deletes, then log "No enabled routines in config." and stop.
@@ -35,18 +35,18 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
    - **Register:** call the Monitor tool — `description: "routine-monitor"` (reserved slot), `command: "bash <pluginRoot>/scripts/routine-monitor.sh 60 $PWD/.claude-code-hermit"`, `timeout_ms: 86400000` (schema-required boilerplate on a persistent monitor — it does not expire on this deadline; the daily anchor re-arm exists to recover from monitor *death* and session restarts, not a timeout), `persistent: true`.
    - **Liveness-verify:** wait 5s, then check `state/routine-monitor-liveness.json` exists. Absent → the subprocess likely failed to spawn (seccomp/nested-userns) — `TaskStop` the task just registered and go to Step 3-F.
    - On success: write `state/routine-monitor.runtime.json`: `{"description":"routine-monitor","task_id":"<id>","command":"<cmd>","interval":60,"started_at":"<ISO now>","mode":"monitor"}`. If there are zero scheduled routines but the anchor is enabled, skip registering the Monitor and record `"routines":0` in the runtime file instead — go straight to anchor registration below.
-   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/cron-registry.ts plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `... cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
+   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `bun <pluginRoot>/scripts/routines.ts cron-registry commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
    - **First-transition sweep only** (runtime file was absent, or `mode` just changed to `monitor`): also call `CronList` and `CronDelete` every entry whose prompt contains `[hermit-routine:` except `[hermit-routine:heartbeat-restart]` — covers live crons from an in-process upgrade that the mirror no longer tracks (duplicate-fire hazard).
    - Log: `Routines: monitor registered (<N> scheduled), anchor re-armed.` or the `routines:0`/first-transition variants.
 4. **Step 3-F — fallback** (Monitor unavailable, registration failed, or liveness-verify failed): run the **CronCreate flow** below against the full enabled set (scheduled routines + anchor), then write `state/routine-monitor.runtime.json`: `{"mode":"croncreate-fallback","started_at":"<ISO now>"}`.
 
    **CronCreate flow** (also used verbatim by `load --reset`'s fallback branch):
-   1. Run the diff planner: `bun <pluginRoot>/scripts/cron-registry.ts plan .claude-code-hermit <pluginRoot>` (append ` --force` for `load --reset`). Parse stdout: `DELETE:<id>`, `CREATE:<id>|<schedule>`, `WARN:<id>|<reason>`, `KEEP:<n>`, optional trailing `WAKESPREAD:<distinct>|<max>|<loneliest>`.
+   1. Run the diff planner: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot>` (append ` --force` for `load --reset`). Parse stdout: `DELETE:<id>`, `CREATE:<id>|<schedule>`, `WARN:<id>|<reason>`, `KEEP:<n>`, optional trailing `WAKESPREAD:<distinct>|<max>|<loneliest>`.
       - First line `SKIP|<reason>` (planner fell open, e.g. corrupt `config.json`): abort, log `Routine load aborted: cron planner failed — <reason>. No routines registered.`
       - No `DELETE:`/`CREATE:` lines (only `KEEP:<n>`, optional `WAKESPREAD:`): already current — log `Routines unchanged: <n> current, 0 registered.` (plus the wake-spread line if present); stop. No `CronList`, no `CronCreate`, no `CronDelete` this run.
       - Otherwise, if any `DELETE:` lines: call `CronList` once, `CronDelete` each entry whose prompt contains `[hermit-routine:<id>]` (skip silently if absent).
    2. For each `CREATE:<id>|<schedule>` line, build the prompt (Shared execution semantics, below) using `<schedule>` as-is (already tz-shifted). Call `CronCreate`: `cron: <schedule>`, `recurring: true`, `durable: false`, `prompt: <resolved>`. **Per-routine error isolation:** if `CronCreate` throws for one routine, record the failure and continue — track which ids succeeded.
-   3. Commit: `bun <pluginRoot>/scripts/cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>"` (append ` --force` for `load --reset`).
+   3. Commit: `bun <pluginRoot>/scripts/routines.ts cron-registry commit .claude-code-hermit <pluginRoot> "<succeeded-csv>"` (append ` --force` for `load --reset`).
    4. Log: `Routines registered: <N> ok, <M> failed, <K> kept[, <W> tz-warned]`. List failures/warnings on their own lines. If `WAKESPREAD:<distinct>|<max>|<loneliest>` was present: `WARN: wake spread — <distinct> distinct 30-min wake windows (max <max>); consider clustering: <loneliest>` (advisory only).
 
 **`load --reset`:** the unconditional escape hatch for suspected drift. **Monitor mode:** unconditionally `TaskStop`/orphan-sweep any `routine-monitor` task, `CronList` → `CronDelete` every live `[hermit-routine:*]` entry (anchor included), delete `state/routine-schedule.json` (deliberate baseline reset — the ordinary re-arm's "preserve the cursor" rule doesn't apply here), then re-register per Step 3 with `--force` appended to **both** the anchor `plan` and `commit` calls. **Fallback mode:** Step 3's planner call gets `--force` (every enabled routine becomes `CREATE`, no `DELETE`s) — `--reset` also sweeps unconditionally first: `CronList`, then `CronDelete` every `[hermit-routine:` entry. Step 3's `commit` call gets `--force` too. Both modes need `--force` on `commit` as well as `plan`: an unforced `commit` replan would carry stale `registered_at` forward, undoing the reset's clock.
@@ -55,15 +55,15 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
 
 Used both by the fallback CronCreate prompt (built at `CREATE:` time) and by the `run <ids>` handler (below) — one definition, two callers.
 
-One shared template for both `run_during_waiting` (rdw) values — `routine-precheck.ts` takes `rdw` as an argument and consults the waiting-check and the binding pause flag internally. Default `run_during_waiting` is `false` when the field is absent.
+One shared template for both `run_during_waiting` (rdw) values — `routines.ts precheck` takes `rdw` as an argument and consults the waiting-check and the binding pause flag internally. Default `run_during_waiting` is `false` when the field is absent.
 
 **Model-override substitution.** Read the routine's optional `model` field. First, if `id === "heartbeat-restart"`, treat `model` as absent regardless of its value — its re-arm append must run in the session, so it is never dispatched to a subagent. Then: if `model` is absent/null, invoke `/<skill>` directly. If set to a non-null `<model>`, dispatch instead: resolve `<abs-project-dir>` as the session's current absolute working directory (the project root) and `dispatch the skill via the Agent tool: subagent_type "general-purpose", model "<model>", prompt "The hermit project is at <abs-project-dir>; its state lives in <abs-project-dir>/.claude-code-hermit/. Invoke the skill /<skill> to completion, following its instructions exactly, and resolve any project-relative .claude-code-hermit/ reads/writes against <abs-project-dir> — pass the absolute <abs-project-dir>/.claude-code-hermit path to any hermit script the skill runs rather than relying on your cwd. Return only a one-line status."` **Language clause:** when `config.language` is set, append one more sentence to that prompt — `All operator-facing prose you produce (channel messages, push notifications, report text) must be written in <language>.` — substituting the configured language; append nothing when it is null. No script call: the dispatching session already holds the language in its Operator Preferences context. This anchors the subagent's own project-relative state paths without constraining where else it may work — a dispatched skill that legitimately changes directory for unrelated work (e.g. a custom routine touching a sibling repo) is unaffected, since `.claude-code-hermit/` always lives under `<abs-project-dir>` regardless of the subagent's cwd at invocation time. The Agent runs in isolated context and returns only a one-line status; the precheck call, the `fired` log line, and any `heartbeat-restart`/`reflect_after` appends stay in the session turn at the session model.
 
 Base execution, one routine, `<delivery>` = `cron-create` (fallback prompt) or `monitor` (`run` handler):
 ```
-Run: bun <pluginRoot>/scripts/routine-precheck.ts <id> <rdw> <delivery>
+Run: bun <pluginRoot>/scripts/routines.ts precheck <id> <rdw> <delivery>
 If the output is SKIP, stop. If PROCEED, then invoke /<skill> (or dispatch per the model-override rule above). After it completes, run:
-<pluginRoot>/scripts/log-routine-event.sh <id> fired <delivery>
+bun <pluginRoot>/scripts/routines.ts log-event <id> fired <delivery>
 ```
 Replace `<pluginRoot>`, `<id>`, `<rdw>` (`true`/`false`; default `false`), and `<skill>` (passed verbatim to the slash invocation — `claude-code-hermit:brief --morning` becomes `/claude-code-hermit:brief --morning`).
 
@@ -71,7 +71,7 @@ Replace `<pluginRoot>`, `<id>`, `<rdw>` (`true`/`false`; default `false`), and `
 
 **`reflect_after: true`:** append after the trailing `fired` log line (and after the `heartbeat-restart` append if both apply). Skip when `skill` is `claude-code-hermit:reflect` — chaining reflect after reflect is a config foot-gun.
 ```
-Then, only if routine-precheck returned PROCEED (not SKIP), run <pluginRoot>/scripts/reflect-precheck.ts .claude-code-hermit <pluginRoot> --quick. If its first output line is exactly `EMPTY`, do not invoke reflect. Otherwise (a `RUN|<hash>` line) invoke /claude-code-hermit:reflect --quick --precheck-verdict '<that full line>'.
+Then, only if `routines.ts precheck` returned PROCEED (not SKIP), run <pluginRoot>/scripts/reflect-precheck.ts .claude-code-hermit <pluginRoot> --quick. If its first output line is exactly `EMPTY`, do not invoke reflect. Otherwise (a `RUN|<hash>` line) invoke /claude-code-hermit:reflect --quick --precheck-verdict '<that full line>'.
 ```
 
 **Special case — `skill` is exactly `claude-code-hermit:reflect`:** reflect's body should not load on days with nothing to reflect on. Replace the invoke clause with:
@@ -134,7 +134,7 @@ Routines (config.json):
 
 ### CronCreate fallback details
 
-- **Timezone.** CronCreate flow shifts each cron from `config.timezone` to machine-local (CronCreate only knows machine time) at minute granularity — half-hour/45-minute zones (Kolkata, Adelaide, Kathmandu) work. Null `config.timezone` passes through unchanged. Monitor mode needs no shift — `routine-due.ts` evaluates directly in `config.timezone`.
+- **Timezone.** CronCreate flow shifts each cron from `config.timezone` to machine-local (CronCreate only knows machine time) at minute granularity — half-hour/45-minute zones (Kolkata, Adelaide, Kathmandu) work. Null `config.timezone` passes through unchanged. Monitor mode needs no shift — `routines.ts due` evaluates directly in `config.timezone`.
 - **DST.** Recomputed every `load`; `heartbeat-restart`'s daily reload self-corrects within 24h. On the transition day, one fallback-mode fire may land at the wrong hour. Inexpressible-after-shift schedules pass through unchanged with a `WARN:` line.
 - **`durable: false`.** CronCreates die with the session; re-registered on every always-on launch.
 - **7-day auto-expiry depends on `heartbeat-restart`.** CC's recurring-task expiry is a hard 7-day cliff, reset only by re-creating. The diff planner re-registers any routine whose age crosses a conservative threshold even with unchanged config; `heartbeat-restart`'s daily `load` is what crosses it. Disable it in fallback mode and routine CronCreates expire after 7 days.
diff --git a/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md b/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
index 2d9ad29a..653640a2 100644
--- a/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
@@ -120,7 +120,7 @@ Auto-detect the system locale via Bash as a default suggestion.
 Ask: "Preferred language? (e.g., pt, en, es, fr) [current value or auto-detected]"
 Run `settings-edit ... set language <value>`.
 Then re-sync the artifact-chrome translation table (the dashboard/proposals pages overlay `.claude-code-hermit/state/artifact-strings.json` per key over the English defaults):
-- New value is **not** `en`: emit `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact-strings-scaffold.ts <value> <current-ISO-timestamp>`, translate every `strings` value into that language (keep keys and `{placeholder}` tokens verbatim), and write `.claude-code-hermit/state/artifact-strings.json`.
+- New value is **not** `en`: emit `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts scaffold-strings <value> <current-ISO-timestamp>`, translate every `strings` value into that language (keep keys and `{placeholder}` tokens verbatim), and write `.claude-code-hermit/state/artifact-strings.json`.
 - New value is `en`: delete `.claude-code-hermit/state/artifact-strings.json` if it exists (absent file ⇒ English chrome).
 
 **If argument is "timezone":**
diff --git a/plugins/claude-code-hermit/skills/proposal-act/SKILL.md b/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
index e76d2f28..ce516512 100644
--- a/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
@@ -8,7 +8,7 @@ Take action on a proposal: accept, defer, dismiss, or resolve.
 
 ## Step 0 — Channel reply
 
-If this skill was invoked from a channel-arrived message (the inbound prompt contains a `<channel source="...">` tag), reply via that channel's reply tool. Otherwise emit to conversation. On a channel-tagged turn, step 4's bounded ask (below) also queues a durable micro-proposal entry via `queue-micro-proposal.ts` — see `channel-responder` § Channel-safe ask bridge — so it survives compaction or a session restart.
+If this skill was invoked from a channel-arrived message (the inbound prompt contains a `<channel source="...">` tag), reply via that channel's reply tool. Otherwise emit to conversation. On a channel-tagged turn, step 4's bounded ask (below) also queues a durable micro-proposal entry via `proposal.ts queue-micro` — see `channel-responder` § Channel-safe ask bridge — so it survives compaction or a session restart.
 
 ## Usage
 
@@ -28,7 +28,7 @@ If no action or ID is provided, ask the operator which proposal and action.
 
 Before reading any proposal file, resolve the operator's input to a filename:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/resolve-prop.ts .claude-code-hermit "<operator input>"
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts resolve-id .claude-code-hermit "<operator input>"
 ```
 - `MATCH|<filename>` — proceed with that file.
 - `NONE|not-a-prop-id` — error "Not a PROP id."
@@ -65,7 +65,7 @@ When the operator accepts a proposal:
    - `accepted_in_session`: if `session_id` is non-null, plan `--set accepted_in_session=<session_id>`. If no session is active (`session_id` is null), leave it unset (frontmatter default `null` stays).
    - `success_signal` (optional): check whether the body has a `## Success Signal` section with a non-empty predicate line (ignore comment lines starting with `<!--`). If found, validate it:
      ```
-     bun ${CLAUDE_PLUGIN_ROOT}/scripts/eval-success-signal.ts --validate "<predicate line>"
+     bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts success-signal --validate "<predicate line>"
      ```
      Exit 0 → plan a stdin `Set: success_signal=<predicate line>` line for the patch call (free text — never argv `--set`). Exit non-zero → plan a `proposal.ts shell-append` warning: `PROP-NNN success_signal ignored: <reason printed by the script>`. No section, or empty/comment-only → leave `success_signal` unset. Never block accept regardless of outcome.
 
@@ -95,7 +95,7 @@ When the operator accepts a proposal:
 
    **Channel-tagged turn:** do not wait interactively for a reply in this turn. Send the question via the channel reply tool in plain voice with the three options numbered — "Suggestion #N — start now, queue it as a task, or leave it to you?" (derive `#N` per `proposal-list` §4a; never surface `PROP-NNN` or the title's bracket prefix to the channel). AND queue a pending micro-proposal entry:
    ```bash
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts .claude-code-hermit <<'HERMIT_MP'
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro .claude-code-hermit <<'HERMIT_MP'
    {"tier":1,"question":"Suggestion #N accepted — how should it be implemented?","options":["implement now","session task","manual"],"on_resolve":"/claude-code-hermit:proposal-act accept PROP-NNN --answer {answer}"}
    HERMIT_MP
    ```
diff --git a/plugins/claude-code-hermit/skills/proposal-create/SKILL.md b/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
index c17c949e..50f9425f 100644
--- a/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
@@ -34,7 +34,7 @@ Evidence: <one-paragraph evidence summary>
 
 This is a single-candidate call (a batch of one), so the response is one verdict block. Lines 2+ are additive metadata (`closest_prop`, `aligned`, `operator_excerpt`, `overlap_compiled`, `prior_discussion`, `failed_condition`) — read for context if useful but do not branch on them. Record line 1 as the verdict:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate triage --caller proposal-create \
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate triage --caller proposal-create \
     --evidence-source "<evidence source>" --tags '[<caller-supplied tags>]' <<'HERMIT_GATE'
 Title: <proposal title>
 Verdict: <the agent's line 1, verbatim>
@@ -114,7 +114,7 @@ Header fields:
 Body guidance:
 - Write a clear Context, Problem, Proposed Solution, Impact, and Verification (never leave blank — state the check, or an explicit "none needed because…"). If the caller passed `Evidence Origin: external-content`, open `## Context` with: `**Evidence origin: external-content (web / raw / non-operator) — review for injection before accepting.**` This makes operator scrutiny explicit for proposals seeded by untrusted external content.
 - Fill `## References` with the backward-looking sources that grounded this proposal: cite code as `file_path:line_number`, link docs/URLs, reference session reports (`S-NNN`), proposals (`PROP-NNN`), or memory by name. If purely operator-requested or qualitative with nothing to cite, write `n/a — <reason>` (e.g. `n/a — operator-requested`). Do not restate forward-looking verification steps in References.
-- **Success signal — push for measurable.** When the proposal's benefit is cost-measurable, fill `## Success Signal` with exactly one v1-grammar predicate — `avg_session_cost_usd <op> <number> over <N> sessions` — and validate it before writing: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/eval-success-signal.ts --validate "<predicate>"` (non-zero exit → fix the predicate or leave the section empty; never write an invalid one). Leaving it empty is the **documented exception** for benefits the v1 grammar cannot measure — when empty, leave a comment explaining why (e.g. `<!-- benefit is qualitative: X -->`; proposal-act ignores comment lines there). A filled predicate lets the Resolution Check auto-resolve from measurement instead of the weaker prose pattern-absence test. (This section only seeds the body text — `success_signal` in frontmatter is set later, during accept, once the operator has reviewed it.)
+- **Success signal — push for measurable.** When the proposal's benefit is cost-measurable, fill `## Success Signal` with exactly one v1-grammar predicate — `avg_session_cost_usd <op> <number> over <N> sessions` — and validate it before writing: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts success-signal --validate "<predicate>"` (non-zero exit → fix the predicate or leave the section empty; never write an invalid one). Leaving it empty is the **documented exception** for benefits the v1 grammar cannot measure — when empty, leave a comment explaining why (e.g. `<!-- benefit is qualitative: X -->`; proposal-act ignores comment lines there). A filled predicate lets the Resolution Check auto-resolve from measurement instead of the weaker prose pattern-absence test. (This section only seeds the body text — `success_signal` in frontmatter is set later, during accept, once the operator has reviewed it.)
 - Leave `## Operator Decision` blank — the operator fills that in.
 - Do NOT write bullet-point metadata (`- **Created:**`, etc.) — all metadata lives in the header lines / frontmatter only.
 
diff --git a/plugins/claude-code-hermit/skills/proposal-list/SKILL.md b/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
index 36b24455..c79cd7a6 100644
--- a/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
@@ -18,7 +18,7 @@ Read `.claude-code-hermit/state/proposals-index.json` — a derived cache of eve
 
 Rebuild the index first, then read it:
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit
 ```
 The rebuild reads frontmatter off disk — idempotent, no LLM/token cost — so run it unconditionally rather than trusting an mtime heuristic: it also catches out-of-band proposal writes and **deletions** that the `generate-summary` hook (which fires only on `Edit`/`Write` tool payloads) never sees. The script prints `SKIP|no proposals dir` when there are no proposals — in that case respond "No proposals found." and stop. If the index's `count` is 0, also respond "No proposals found." and stop.
 
diff --git a/plugins/claude-code-hermit/skills/reflect/branches.md b/plugins/claude-code-hermit/skills/reflect/branches.md
index e100c270..cdbce227 100644
--- a/plugins/claude-code-hermit/skills/reflect/branches.md
+++ b/plugins/claude-code-hermit/skills/reflect/branches.md
@@ -20,7 +20,7 @@ Invoked from SKILL.md § Scheduled-checks mode. Run at most one due check, then
      Evidence: <one-paragraph summary>
      Sessions: none
      ```
-     Pass it to § Candidate processing → Evidence Validation (`claude-code-hermit:reflection-judge`). On a `PROCEED` token, gate with the Proposal triage gate (`claude-code-hermit:proposal-triage`, a batch of one here — single candidate; pass `--caller scheduled-checks` to `record-gate.ts`). On triage `PROCEED|CREATE`: Tier 1/2 → Micro-approval queuing; Tier 3 → `/claude-code-hermit:proposal-create`. A `DROP|...` token from either gate → drop silently (note in the Progress Log). `GATE_FAILED` from either gate → fail closed per § Gate failure handling; the candidate re-surfaces on the next scheduled-checks run.
+     Pass it to § Candidate processing → Evidence Validation (`claude-code-hermit:reflection-judge`). On a `PROCEED` token, gate with the Proposal triage gate (`claude-code-hermit:proposal-triage`, a batch of one here — single candidate; pass `--caller scheduled-checks` to the `gate` verb). On triage `PROCEED|CREATE`: Tier 1/2 → Micro-approval queuing; Tier 3 → `/claude-code-hermit:proposal-create`. A `DROP|...` token from either gate → drop silently (note in the Progress Log). `GATE_FAILED` from either gate → fail closed per § Gate failure handling; the candidate re-surfaces on the next scheduled-checks run.
    - **`empty`:** no candidate. `consecutive_empty += 1` (persisted in step 7). Check the interval-adjustment rule below.
    - **`unavailable`:** note in SHELL.md `## Findings`: `Scheduled check skipped: <id> — skill unavailable (cooldown 4h)`. No candidate.
    - **`error`:** note in SHELL.md `## Findings`: `Scheduled check error: <id> — retrying after interval_days`. No candidate.
@@ -114,7 +114,7 @@ Artifact: <machine-written state file> — <cited value/pattern>   (optional)
 
 The judge returns one verdict line per candidate, matched by `<title>`. For each candidate, record its line:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate judge --caller reflect <<'HERMIT_GATE'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate judge --caller reflect <<'HERMIT_GATE'
 Title: <title>
 Verdict: <the judge's line for this candidate, verbatim>
 HERMIT_GATE
@@ -126,7 +126,7 @@ HERMIT_GATE
 
 ### Gate failure handling
 
-`record-gate.ts` fails closed by construction: an unrecognized, malformed, or empty verdict line always returns `GATE_FAILED` and appends the `gate-failed` metric itself (agent tagged via `--gate triage|judge`) — no separate append needed at the call site. On `GATE_FAILED`: do not create or queue the candidate. Note `gate-failed: <agent> — <title>` in the SHELL.md Progress Log. The candidate re-surfaces on the next reflect cycle.
+The `gate` verb fails closed by construction: an unrecognized, malformed, or empty verdict line always returns `GATE_FAILED` and appends the `gate-failed` metric itself (agent tagged via `--gate triage|judge`) — no separate append needed at the call site. On `GATE_FAILED`: do not create or queue the candidate. Note `gate-failed: <agent> — <title>` in the SHELL.md Progress Log. The candidate re-surfaces on the next reflect cycle.
 
 ### Component Health signal ladder
 
@@ -155,7 +155,7 @@ Evidence: <one-paragraph evidence summary>
 
 The gate returns one verdict block per candidate, matched by `<title>`. Line 1 of each block is that candidate's verdict; lines 2+ are additive metadata (`closest_prop`, `aligned`, `operator_excerpt`, `overlap_compiled`, `prior_discussion`, `failed_condition`) — read for context if useful, but do not treat as part of the verdict for branching. For each candidate, record its verdict line (use `"caller":"reflect"` on a normal reflect run, or `"caller":"scheduled-checks"` when invoked via § Scheduled checks):
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate triage --caller reflect <<'HERMIT_GATE'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate triage --caller reflect <<'HERMIT_GATE'
 Title: <title>
 Verdict: <that candidate's line 1, verbatim>
 HERMIT_GATE
@@ -195,7 +195,7 @@ Every micro-proposal question must include: **[observed pattern + duration] + [c
 Queuing procedure:
 
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts .claude-code-hermit <<'HERMIT_MP'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro .claude-code-hermit <<'HERMIT_MP'
 {"tier":<1|2>,"question":"<full question text>","options":["<label>", ...],"on_resolve":"<full skill invocation with an {answer} placeholder>"}
 HERMIT_MP
 ```
@@ -215,7 +215,7 @@ Component Health improves existing components. This subsection is the symmetric
 After ≥8 procedure-capture candidates surfaced, run:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal-metrics-report.ts .claude-code-hermit --source=procedure-capture
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts metrics .claude-code-hermit --source=procedure-capture
 ```
 
 Triage-survival < 25% or acceptance < 30% → disable procedure capture rather than tune it. `INSUFFICIENT` output means the ≥8-verdict sample hasn't been reached yet; do not read thresholds until it does.
diff --git a/plugins/claude-code-hermit/skills/reflect/reference.md b/plugins/claude-code-hermit/skills/reflect/reference.md
index 19735a7b..b42a9c40 100644
--- a/plugins/claude-code-hermit/skills/reflect/reference.md
+++ b/plugins/claude-code-hermit/skills/reflect/reference.md
@@ -38,7 +38,7 @@ Run this step only if `resolution_check` is listed in `phases_json`.
 
    **If `success_signal` is non-null** — run the predicate:
    ```
-   bun <plugin_root>/scripts/eval-success-signal.ts .claude-code-hermit "<accepted_date>" "<accepted_in_session|null>" "<success_signal>"
+   bun <plugin_root>/scripts/proposal.ts success-signal .claude-code-hermit "<accepted_date>" "<accepted_in_session|null>" "<success_signal>"
    ```
    Parse the one JSON line on stdout. Branch on `verdict`:
    - `INSUFFICIENT_DATA` → skip; add nothing to `resolution_actions` for this proposal.
diff --git a/plugins/claude-code-hermit/skills/session-close/SKILL.md b/plugins/claude-code-hermit/skills/session-close/SKILL.md
index e31988f0..da0d19e4 100644
--- a/plugins/claude-code-hermit/skills/session-close/SKILL.md
+++ b/plugins/claude-code-hermit/skills/session-close/SKILL.md
@@ -54,7 +54,7 @@ Invoked by the `daily-auto-close` routine at `0 0 * * *` (local) — the midnigh
    The verb owns the whole branch table: it reads `session_state` and the operator-action clock, deletes a stale `pending-close.json` itself when there is nothing to close, writes a fresh queue flag itself when the operator is active, and fails open to close-now when the clock is missing or invalid (operator idle indefinitely). A corrupt or unreadable `runtime.json` maps to `noop`, not close-now — closing a session whose state is unknowable would be fail-destructive.
 2. Branch on the returned `decision`:
    - **`noop`** — stop: do not notify the operator, do not write to `routine-metrics.jsonl`.
-   - **`queued`** — stop. The heartbeat-precheck drain block emits `AUTO_CLOSE` on the next tick where the operator has been idle >10 minutes.
+   - **`queued`** — stop. The `heartbeat.ts precheck` drain block emits `AUTO_CLOSE` on the next tick where the operator has been idle >10 minutes.
    - **`close-now`** — close directly by proceeding through the Auto-close path (`--auto`) above (steps 6–8, `Closed Via: auto`). Stop.
    - **`ok === false`** — append the returned `reason` to SHELL.md `## Findings` and stop; the routine retries next midnight.
 
diff --git a/plugins/claude-code-hermit/skills/smoke-test/SKILL.md b/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
index f79d4ecb..f188043b 100644
--- a/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
+++ b/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
@@ -43,12 +43,12 @@ Track `passed`, `warnings`, `failures` counts. Collect output lines for the fina
   - Found: **PASS** `scheduled_checks[N]: <plugin>:<skill-name> loaded`
   - Not found: **WARN** `scheduled_checks[N]: <plugin>:<skill-name> not loaded — install the plugin or remove the entry`
 
-### 4b. Verify cron-tz-shift helper
+### 4b. Verify the tz-shift helper
 
-Run: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/cron-tz-shift.ts "0 4 * * *" "UTC"`
+Run: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/routines.ts tz-shift "0 4 * * *" "UTC"`
 
-- Exit 0 and stdout is `0 4 * * *`: **PASS** `cron-tz-shift helper available`
-- Exit non-zero or wrong stdout: **FAIL** `cron-tz-shift helper missing or broken — run /hermit-evolve`
+- Exit 0 and stdout is `0 4 * * *`: **PASS** `routines.ts tz-shift helper available`
+- Exit non-zero or wrong stdout: **FAIL** `routines.ts tz-shift helper missing or broken — run /hermit-evolve`
 
 ### 5. Routine validation (static)
 
diff --git a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
index 370fa58b..ea6a7fc4 100644
--- a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
+++ b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
@@ -1,5 +1,5 @@
 // Durability of alert-state.json against interrupted/concurrent writes (issue #463).
-// Both writers (heartbeat-precheck.ts, update-alert-state.ts) must (a) write atomically
+// Both writers (lib/heartbeat/precheck.ts, lib/heartbeat/alert-update.ts) must (a) write atomically
 // via temp+rename so a killed write never leaves a truncated file, and (b) never reinit
 // the skill-owned alerts{}/self_eval{} over a file that exists — a present-but-unparseable
 // file is quarantined to alert-state.json.corrupt-<ts>, not silently overwritten.
@@ -41,8 +41,8 @@ function withTmp(fn: (dir: string) => Promise<void> | void) {
 
 /** Run heartbeat-precheck from inside the workdir, return verdict. */
 async function precheck(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
@@ -51,8 +51,8 @@ async function precheck(dir: string, peek = false): Promise<string> {
 
 /** Run update-alert-state against the workdir's alert-state.json with a stdin payload. */
 async function updateAlertState(dir: string, payload: object): Promise<void> {
-  await runScript('update-alert-state.ts', {
-    args: [alertPath(dir)],
+  await runScript('heartbeat.ts', {
+    args: ['alert-state', alertPath(dir)],
     stdin: JSON.stringify(payload),
   });
 }
diff --git a/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts b/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts
new file mode 100644
index 00000000..2f68364b
--- /dev/null
+++ b/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts
@@ -0,0 +1,144 @@
+// Contract tests for apply-settings.ts's permissions-plan / permissions-sync verbs.
+//
+// These two verbs are the single owner of an operator's hermit permissions: hatch
+// and hermit-evolve call them instead of carrying their own copies of the list.
+// The property that makes that safe is narrow removal — sync deletes only entries
+// named in the sealed HERMIT_OBSOLETE registry, never anything the operator wrote.
+// Spawning is intentional (see tests/helpers/run.ts): the process boundary is what
+// the skills actually invoke.
+
+import { describe, test, expect } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { runScript } from './helpers/run';
+
+const SCRIPT_SRC = fs.readFileSync(
+  path.join(import.meta.dir, '..', 'scripts', 'apply-settings.ts'),
+  'utf-8',
+);
+
+function sealedArray(name: string): string[] {
+  const m = SCRIPT_SRC.match(new RegExp(`const ${name}\\s*=\\s*(\\[[\\s\\S]*?\\]);`));
+  if (!m) throw new Error(`${name} not found in apply-settings.ts`);
+  return eval(m[1]) as string[];
+}
+
+const HERMIT_ALLOW = sealedArray('HERMIT_ALLOW');
+const HERMIT_OBSOLETE = sealedArray('HERMIT_OBSOLETE');
+
+function withTarget(fn: (target: string) => Promise<void>) {
+  return async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'apply-settings-'));
+    try {
+      await fn(path.join(dir, 'settings.json'));
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  };
+}
+
+function seed(target: string, settings: unknown) {
+  fs.writeFileSync(target, JSON.stringify(settings, null, 2));
+}
+
+function readAllow(target: string): string[] {
+  return JSON.parse(fs.readFileSync(target, 'utf-8')).permissions.allow;
+}
+
+async function run(target: string, op: string) {
+  const r = await runScript('apply-settings.ts', { args: [target, op] });
+  expect(r.exitCode).toBe(0);
+  return JSON.parse(r.stdout.trim());
+}
+
+describe('apply-settings permissions-plan', () => {
+  test('reports every canonical entry as missing for an absent target', withTarget(async (target) => {
+    const plan = await run(target, 'permissions-plan');
+    expect(plan.missing).toEqual(HERMIT_ALLOW);
+    expect(plan.obsolete).toEqual([]);
+  }));
+
+  test('writes nothing — the target stays absent', withTarget(async (target) => {
+    await run(target, 'permissions-plan');
+    expect(fs.existsSync(target)).toBe(false);
+  }));
+
+  test('reports an empty plan once the target is in sync', withTarget(async (target) => {
+    seed(target, { permissions: { allow: HERMIT_ALLOW } });
+    const plan = await run(target, 'permissions-plan');
+    expect(plan).toEqual({ missing: [], obsolete: [] });
+  }));
+
+  test('names retired entries the target still carries', withTarget(async (target) => {
+    const stale = HERMIT_OBSOLETE[0];
+    seed(target, { permissions: { allow: [...HERMIT_ALLOW, stale] } });
+    const plan = await run(target, 'permissions-plan');
+    expect(plan.obsolete).toEqual([stale]);
+    expect(plan.missing).toEqual([]);
+  }));
+});
+
+describe('apply-settings permissions-sync', () => {
+  test('adds every missing canonical entry', withTarget(async (target) => {
+    seed(target, {});
+    await run(target, 'permissions-sync');
+    expect(readAllow(target)).toEqual(HERMIT_ALLOW);
+  }));
+
+  test('removes retired entries and keeps the operator\'s own', withTarget(async (target) => {
+    const custom = 'Bash(my-own-tool:*)';
+    seed(target, { permissions: { allow: [custom, ...HERMIT_OBSOLETE] } });
+
+    const plan = await run(target, 'permissions-sync');
+    const allow = readAllow(target);
+
+    expect(plan.obsolete).toEqual(HERMIT_OBSOLETE);
+    expect(allow).toContain(custom);
+    for (const stale of HERMIT_OBSOLETE) expect(allow).not.toContain(stale);
+    for (const entry of HERMIT_ALLOW) expect(allow).toContain(entry);
+  }));
+
+  test('leaves unrelated settings untouched', withTarget(async (target) => {
+    seed(target, { env: { FOO: 'bar' }, permissions: { deny: ['Bash(rm:*)'] } });
+    await run(target, 'permissions-sync');
+
+    const settings = JSON.parse(fs.readFileSync(target, 'utf-8'));
+    expect(settings.env).toEqual({ FOO: 'bar' });
+    expect(settings.permissions.deny).toEqual(['Bash(rm:*)']);
+  }));
+
+  test('is idempotent — a second run reports nothing to do', withTarget(async (target) => {
+    seed(target, {});
+    await run(target, 'permissions-sync');
+    const second = await run(target, 'permissions-sync');
+    expect(second).toEqual({ missing: [], obsolete: [] });
+  }));
+
+  test('a no-op sync does not rewrite the file', withTarget(async (target) => {
+    // Deliberately hand-formatted: hermit-evolve runs sync on every upgrade, so a
+    // target that is already current must come back untouched, not reformatted.
+    const original = JSON.stringify({ permissions: { allow: HERMIT_ALLOW } }, null, 4);
+    fs.writeFileSync(target, original);
+
+    const plan = await run(target, 'permissions-sync');
+
+    expect(plan).toEqual({ missing: [], obsolete: [] });
+    expect(fs.readFileSync(target, 'utf-8')).toBe(original);
+  }));
+
+  test('refuses to overwrite a malformed target', withTarget(async (target) => {
+    fs.writeFileSync(target, '{ not json');
+    const r = await runScript('apply-settings.ts', { args: [target, 'permissions-sync'] });
+    expect(r.exitCode).toBe(1);
+    expect(fs.readFileSync(target, 'utf-8')).toBe('{ not json');
+  }));
+});
+
+describe('sealed registries', () => {
+  test('no entry is both canonical and retired', () => {
+    const canonical = new Set(HERMIT_ALLOW);
+    for (const stale of HERMIT_OBSOLETE) expect(canonical.has(stale)).toBe(false);
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts b/plugins/claude-code-hermit/tests/artifact-render.test.ts
similarity index 76%
rename from plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts
rename to plugins/claude-code-hermit/tests/artifact-render.test.ts
index 2e807ddc..d5ffea1f 100644
--- a/plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts
+++ b/plugins/claude-code-hermit/tests/artifact-render.test.ts
@@ -1,5 +1,5 @@
-// bun test for scripts/render-weekly-artifact.ts — weekly-review passthrough CLI.
-// Usage: bun test tests/render-weekly-artifact.test.ts   (from the plugin root)
+// bun test for artifact.ts's weekly render verb — weekly-review passthrough.
+// Usage: bun test tests/artifact-render.test.ts   (from the plugin root)
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -27,10 +27,10 @@ function writeWeekly(hermitDir: string, week: string, fm: Record<string, string>
   fs.writeFileSync(path.join(hermitDir, 'compiled', `review-weekly-${week}.md`), `---\n${yaml}\n---\n${body}\n`);
 }
 
-describe('render-weekly-artifact.ts', () => {
+describe('artifact.ts render weekly', () => {
   test('strips frontmatter, keeps the body intact', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27', total_cost_usd: '3.21' }, '# Weekly Review — 2026-W27\n\nBody content here.');
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(0);
     const outPath = path.join(hermitDir, 'state', 'weekly-review-artifact.md');
     const written = fs.readFileSync(outPath, 'utf8');
@@ -43,7 +43,7 @@ describe('render-weekly-artifact.ts', () => {
   test('picks the latest week by filename sort', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W26', { week: '2026-W26' }, 'Older body.');
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Newer body.');
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(0);
     const written = fs.readFileSync(path.join(hermitDir, 'state', 'weekly-review-artifact.md'), 'utf8');
     expect(written).toContain('Newer body.');
@@ -52,8 +52,8 @@ describe('render-weekly-artifact.ts', () => {
 
   test('hash is stable for identical content across runs', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Stable body.');
-    const a = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
-    const b = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const a = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
+    const b = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     const hashA = JSON.parse(a.stdout).hash;
     const hashB = JSON.parse(b.stdout).hash;
     expect(hashA).toBe(hashB);
@@ -61,14 +61,14 @@ describe('render-weekly-artifact.ts', () => {
 
   test('hash changes when the compiled report changes', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Version one.');
-    const before = JSON.parse((await runScript('render-weekly-artifact.ts', { args: [hermitDir] })).stdout);
+    const before = JSON.parse((await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] })).stdout);
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Version two.');
-    const after = JSON.parse((await runScript('render-weekly-artifact.ts', { args: [hermitDir] })).stdout);
+    const after = JSON.parse((await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] })).stdout);
     expect(before.hash).not.toBe(after.hash);
   }));
 
   test('exits non-zero when no compiled weekly review exists', withHermitDir(async (hermitDir) => {
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(1);
   }));
 });
diff --git a/plugins/claude-code-hermit/tests/auto-close.test.ts b/plugins/claude-code-hermit/tests/auto-close.test.ts
index f71526c0..dde32527 100644
--- a/plugins/claude-code-hermit/tests/auto-close.test.ts
+++ b/plugins/claude-code-hermit/tests/auto-close.test.ts
@@ -57,8 +57,8 @@ function touchAgo(p: string, hours: number): void {
 
 /** Run heartbeat-precheck from inside the workdir and return its verdict. */
 async function precheck(dir: string, opts: { now?: string; peek?: boolean } = {}): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(opts.peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(opts.peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: opts.now ? { HERMIT_NOW: opts.now } : {},
   });
@@ -547,7 +547,7 @@ describe('record-operator-action: monitor emission strings stay in sync', () =>
   // routine-due.ts builds its line from a template literal rather than a bare echo —
   // assert the grammar anchor is still present in source.
   test('routine-due.ts still emits the ROUTINE_DUE [hermit-routine: grammar', () => {
-    const src = fs.readFileSync(path.join(SCRIPTS_DIR, 'routine-due.ts'), 'utf-8');
+    const src = fs.readFileSync(path.join(SCRIPTS_DIR, 'lib', 'routines', 'due.ts'), 'utf-8');
     expect(src).toContain('ROUTINE_DUE ');
     expect(src).toContain('[hermit-routine:');
   });
@@ -1149,9 +1149,12 @@ describe('auto-close-decision verb', () => {
   // constant — both the precheck drain and the decision verb import it from
   // lib/auto-close, so they can never disagree on the boundary.
   test('heartbeat-precheck and session-archive both import the lull from lib/auto-close', () => {
-    const precheckSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'heartbeat-precheck.ts'), 'utf-8');
+    const precheckSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'lib', 'heartbeat', 'precheck.ts'), 'utf-8');
     const archiveSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'session-archive.ts'), 'utf-8');
-    expect(precheckSrc).toContain('lib/auto-close');
-    expect(archiveSrc).toContain('lib/auto-close');
+    // Assert the imported symbol, not the import path: precheck.ts now lives in
+    // lib/heartbeat/ and reaches the same module as '../auto-close'. The
+    // invariant is that neither hardcodes the lull.
+    expect(precheckSrc).toContain('AUTO_CLOSE_LULL_MINUTES');
+    expect(archiveSrc).toContain('AUTO_CLOSE_LULL_MINUTES');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/budget-precheck.test.ts b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
index 6538ed16..d742f725 100644
--- a/plugins/claude-code-hermit/tests/budget-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
@@ -1,4 +1,4 @@
-// PROP-016 budget-gate contract for heartbeat-precheck.ts.
+// PROP-016 budget-gate contract for `heartbeat.ts precheck`.
 //
 // Two mechanisms under test:
 //  1. The pause-escape gate: a budget-reason pause (action:"pause") would normally
@@ -70,8 +70,8 @@ const budgetEntry = (notified: boolean) => ({
 });
 
 async function precheck(dir: string): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: ['.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
diff --git a/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts b/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
index 03e79646..1643c63b 100644
--- a/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
@@ -1,7 +1,9 @@
-// Behavioral tests for scripts/channel-reply-reminder.ts — the UserPromptSubmit
-// hook that reminds the model which reply tool to use, and captures inbound
-// messages into the episodic channel log. Exercised as a subprocess (stdin in,
-// stdout out), the boundary Claude Code sees — mirrors tests/pause-keyword.test.ts.
+// Behavioral tests for scripts/lib/prompt-stages/channel-reply-reminder.ts —
+// the stage that reminds the model which reply tool to use, and captures
+// inbound messages into the episodic channel log. Driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts, as a subprocess
+// (stdin in, stdout out) — the boundary Claude Code sees. Mirrors
+// tests/pause-keyword.test.ts.
 //
 // tests/channel-responder-reply-rule.test.ts is a separate, static wiring
 // check (skill text / hooks.json / script presence) — it does not run this
@@ -29,7 +31,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (prompt: string, dir: string) =>
-  runScript('channel-reply-reminder.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
+  runScript('user-prompt-pipeline.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
 
 describe('channel-reply-reminder', () => {
   test('bare source — names the exact reply tool', withDir(async (dir) => {
diff --git a/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts b/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
index c180cb78..3e4043a5 100644
--- a/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
@@ -16,7 +16,11 @@ import { PLUGIN_ROOT } from './helpers/run';
 
 const SKILL_PATH = path.join(PLUGIN_ROOT, 'skills', 'channel-responder', 'SKILL.md');
 const HOOKS_PATH = path.join(PLUGIN_ROOT, 'hooks', 'hooks.json');
-const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'channel-reply-reminder.ts');
+// The reminder is now a stage of scripts/user-prompt-pipeline.ts, not a
+// separately-registered hook script — the file moved, the registration is the
+// pipeline's. Test names below still say "channel-reply-reminder" because the
+// guarantee they pin is unchanged.
+const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'prompt-stages', 'channel-reply-reminder.ts');
 
 const skill = fs.readFileSync(SKILL_PATH, 'utf-8');
 
@@ -37,7 +41,7 @@ test('skill §0 names generic reply tool pattern', () => {
 });
 
 test('hooks.json has channel-reply-reminder entry', () => {
-  expect(fs.readFileSync(HOOKS_PATH, 'utf-8')).toContain('channel-reply-reminder.ts');
+  expect(fs.readFileSync(HOOKS_PATH, 'utf-8')).toContain('user-prompt-pipeline.ts');
 });
 
 test('channel-reply-reminder.ts exists and is non-empty', () => {
diff --git a/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts b/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
index b2b9563b..fb5fa24e 100644
--- a/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
@@ -9,7 +9,7 @@ import path from 'node:path';
 import { PLUGIN_ROOT } from './helpers/run';
 
 const HOOKS_PATH = path.join(PLUGIN_ROOT, 'hooks', 'hooks.json');
-const RESPONDER_SCRIPT = path.join(PLUGIN_ROOT, 'scripts', 'channel-status-responder.ts');
+const RESPONDER_SCRIPT = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'prompt-stages', 'channel-status-responder.ts');
 const SEND_LIB = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'channel-send.ts');
 const SEND_CLI = path.join(PLUGIN_ROOT, 'scripts', 'channel-send.ts');
 
@@ -32,7 +32,7 @@ test('hooks.json registers channel-status-responder.ts on UserPromptSubmit', ()
   const hooks = JSON.parse(fs.readFileSync(HOOKS_PATH, 'utf-8'));
   const entries = hooks.hooks.UserPromptSubmit ?? [];
   const registered = entries.some((e: any) =>
-    (e.hooks ?? []).some((h: any) => (h.args ?? []).some((a: string) => a.includes('channel-status-responder.ts')))
+    (e.hooks ?? []).some((h: any) => (h.args ?? []).some((a: string) => a.includes('user-prompt-pipeline.ts')))
   );
   expect(registered).toBe(true);
 });
diff --git a/plugins/claude-code-hermit/tests/channel-status-responder.test.ts b/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
index 839aefe3..7384df9c 100644
--- a/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
@@ -1,11 +1,18 @@
-// Contract tests for scripts/channel-status-responder.ts — the deterministic
-// send-then-block status responder. Exercised as a subprocess against a local
-// HTTP stub (HERMIT_TELEGRAM_API_URL override) standing in for the platform.
+// Contract tests for the deterministic send-then-block status responder —
+// scripts/lib/prompt-stages/channel-status-responder.ts, driven through the
+// single UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Exercised
+// as a subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL override)
+// standing in for the platform.
 //
 // Covers the probe-verified constraints this hook rests on: exact-match gate
 // (near-misses fall through), allowed_users enforcement, and send-then-block
 // (only emit {"decision":"block"} after a confirmed send; a failed send must
 // never leave both a blocked prompt and a silent operator).
+//
+// Pipeline note: a block prints the decision JSON alone, while a fall-through
+// carries the other stages' context (a `[Now: …]` line, the channel reply
+// reminder). "No block, no send" is therefore asserted as the absence of the
+// `[status]` marker rather than as empty stdout.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -39,7 +46,7 @@ function setupChannelWorkdir(configExtra: object = {}): Workdir {
 }
 
 async function run(wd: Workdir, body: string, stubUrl: string, user = 'u1') {
-  return runScript('channel-status-responder.ts', {
+  return runScript('user-prompt-pipeline.ts', {
     stdin: payload(body, user),
     cwd: wd.dir,
     env: { HERMIT_TELEGRAM_API_URL: stubUrl },
@@ -69,7 +76,7 @@ describe('channel-status-responder', () => {
     try {
       // Asked in a Telegram group: chat_id is the group id, distinct from dm_channel_id (12345).
       const groupPayload = JSON.stringify({ prompt: envelope('status', 'u1', '-1001234567890') });
-      const r = await runScript('channel-status-responder.ts', {
+      const r = await runScript('user-prompt-pipeline.ts', {
         stdin: groupPayload,
         cwd: wd.dir,
         env: { HERMIT_TELEGRAM_API_URL: stub.url },
@@ -103,7 +110,7 @@ describe('channel-status-responder', () => {
     try {
       const r = await run(wd, 'what is the status of the task you are working on?', stub.url);
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -117,7 +124,7 @@ describe('channel-status-responder', () => {
     try {
       const r = await run(wd, 'status', stub.url, 'not-allowed');
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -146,13 +153,13 @@ describe('channel-status-responder', () => {
     const stub = startHttpStub();
     const wd = setupChannelWorkdir();
     try {
-      const r = await runScript('channel-status-responder.ts', {
+      const r = await runScript('user-prompt-pipeline.ts', {
         stdin: JSON.stringify({ prompt: 'status' }),
         cwd: wd.dir,
         env: { HERMIT_TELEGRAM_API_URL: stub.url },
       });
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -161,7 +168,7 @@ describe('channel-status-responder', () => {
   });
 
   test('empty stdin -> fail open, exit 0', async () => {
-    const r = await runScript('channel-status-responder.ts', { stdin: '' });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '' });
     expect(r.exitCode).toBe(0);
   });
 
@@ -250,7 +257,7 @@ describe('channel-status-responder', () => {
       write(hermit(wd.dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending: [{ id: 'MP-20260705-0', status: 'pending', tier: 1, question: 'ok?' }] }));
 
       const stranger = JSON.stringify({ prompt: '<channel source="telegram" chat_id="999" user="stranger">status</channel>' });
-      const r = await runScript('channel-status-responder.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+      const r = await runScript('user-prompt-pipeline.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
       expect(r.exitCode).toBe(0);
       const text = stub.requests[0].body.text;
       expect(text).not.toContain('secret-migration'); // task text withheld
@@ -317,7 +324,7 @@ describe('channel-status-responder', () => {
       try {
         fs.writeFileSync(hermit(wd.dir, 'sessions', '.status.json'), JSON.stringify({ status: 'in_progress', task: 'segredo' }));
         const stranger = JSON.stringify({ prompt: '<channel source="telegram" chat_id="999" user="stranger">status</channel>' });
-        const r = await runScript('channel-status-responder.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+        const r = await runScript('user-prompt-pipeline.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
         expect(r.exitCode).toBe(0);
         const text = stub.requests[0].body.text as string;
         expect(text).not.toContain('segredo'); // task text withheld
@@ -339,7 +346,7 @@ describe('channel-status-responder', () => {
     try {
       fs.writeFileSync(hermit(wd.dir, 'sessions', '.status.json'), JSON.stringify({ status: 'in_progress', task: 'writing the plan' }));
       const qualified = JSON.stringify({ prompt: '<channel source="plugin:telegram:telegram" chat_id="12345" user="u1">status</channel>' });
-      const r = await runScript('channel-status-responder.ts', { stdin: qualified, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+      const r = await runScript('user-prompt-pipeline.ts', { stdin: qualified, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
       expect(r.exitCode).toBe(0);
       expect(JSON.parse(r.stdout.trim())).toMatchObject({ decision: 'block' });
       // A raw qualified target.id would miss lib/channel-send's SENDERS lookup entirely (zero requests).
diff --git a/plugins/claude-code-hermit/tests/contracts.test.ts b/plugins/claude-code-hermit/tests/contracts.test.ts
index af9d61dd..a3b59a39 100644
--- a/plugins/claude-code-hermit/tests/contracts.test.ts
+++ b/plugins/claude-code-hermit/tests/contracts.test.ts
@@ -951,7 +951,7 @@ describe('kill metrics contract', () => {
   const proposalTemplate = read(path.join(TEMPLATES, 'PROPOSAL.md.template'));
   const proposalCreate = read(path.join(SKILLS, 'proposal-create', 'SKILL.md'));
   const capabilityBrainstorm = read(path.join(SKILLS, 'capability-brainstorm', 'SKILL.md'));
-  const reportScriptPath = path.join(SCRIPTS, 'proposal-metrics-report.ts');
+  const reportScriptPath = path.join(SCRIPTS, 'lib', 'proposals', 'metrics.ts');
   const reportScript = fs.existsSync(reportScriptPath) ? read(reportScriptPath) : '';
 
   test('PROPOSAL.md.template must declare a tags field so proposal-create can write it', () => {
@@ -971,7 +971,7 @@ describe('kill metrics contract', () => {
 
   test('proposal-create triage-verdict event must include evidence_source', () => {
     // missing → triage-survival rate cannot be segmented by brainstorm origin.
-    // record-gate.ts (tests/scripts.test.ts describe('record-gate')) guards that the
+    // the gate verb (tests/scripts.test.ts describe('proposal gate')) guards that the
     // flag actually lands in the appended event; this guards the call site passes it.
     expect(proposalCreate).toContain('--evidence-source "<evidence source>"');
   });
@@ -990,14 +990,14 @@ describe('kill metrics contract', () => {
     expect(proposalScript).toMatch(/type:\s*'created'[\s\S]{0,80}\btags\b/);
   });
 
-  test('capability-brainstorm kill criteria must invoke proposal-metrics-report.ts', () => {
+  test('capability-brainstorm kill criteria must invoke the metrics verb', () => {
     const parts = capabilityBrainstorm.split('## Kill criteria');
     expect(parts.length).toBeGreaterThan(1); // Kill criteria section missing
     const killSection = parts[1].split('## ')[0];
-    expect(killSection).toContain('proposal-metrics-report.ts');
+    expect(killSection).toContain('proposal.ts metrics');
   });
 
-  test('proposal-metrics-report.ts segment registry must discriminate capability-brainstorm', () => {
+  test('proposal.ts metrics segment registry must discriminate capability-brainstorm', () => {
     // The contract between the emitter (proposal-create) and the consumer
     // (brainstorm kill criteria) holds via evidence_source (triage) and tags (acceptance).
     expect(fs.existsSync(reportScriptPath)).toBe(true);
@@ -1032,8 +1032,8 @@ describe('procedure capture contract', () => {
     return killParts[1].split('**Detection')[0];
   }
 
-  test('reflect procedure-capture kill criteria must invoke proposal-metrics-report.ts', () => {
-    expect(procedureCaptureKillSection()).toContain('proposal-metrics-report.ts');
+  test('reflect procedure-capture kill criteria must invoke the metrics verb', () => {
+    expect(procedureCaptureKillSection()).toContain('proposal.ts metrics');
   });
 
   test('reflect kill criteria must document the 25%/30% kill thresholds', () => {
@@ -1259,8 +1259,8 @@ describe('hermit-routines diff-registration contract', () => {
   const skillContent = read(path.join(SKILLS, 'hermit-routines', 'SKILL.md'));
 
   test('SKILL.md wires the diff planner into load\'s success path', () => {
-    expect(skillContent).toContain('cron-registry.ts plan');
-    expect(skillContent).toContain('cron-registry.ts commit');
+    expect(skillContent).toContain('routines.ts cron-registry plan');
+    expect(skillContent).toContain('routines.ts cron-registry commit');
   });
 
   test('load\'s default success path is no longer an unconditional CronList sweep', () => {
@@ -2626,9 +2626,9 @@ describe('proposal-triage batch contract', () => {
   });
 
   test('reflect/branches.md parses the title-tagged triage verdict grammar', () => {
-    // Routed via record-gate.ts's PROCEED/DROP tokens rather than the raw agent
+    // Routed via the gate verb's PROCEED/DROP tokens rather than the raw agent
     // grammar directly — the raw `CREATE: <title>` line still flows into the
-    // script's stdin (see the record-gate.ts invocation just above these lines).
+    // script's stdin (see the gate-verb invocation just above these lines).
     expect(branches).toContain('PROCEED|CREATE');
     expect(branches).toContain('DROP|DUPLICATE:<PROP-ID>');
     expect(branches).toContain('DROP|SUPPRESS:<code>');
@@ -2823,25 +2823,42 @@ describe('proposal lifecycle: no tool-mediated state writes', () => {
   });
 });
 
-// hermit-evolve Step 8 must delegate the permission merge to apply-settings.ts
-// rather than re-enumerate the allow-list in prose — the hand-maintained list had
-// already drifted (15 of 28 entries) and instructed a Write rule the writer strips.
+// hermit-evolve Step 8 must delegate the whole permission reconciliation to
+// apply-settings.ts rather than restate it in prose — both halves. The additive
+// list had already drifted (15 of the canonical entries) and instructed a Write
+// rule the writer strips; the removal half was a hand-grown bullet list that only
+// ever got a new line when someone remembered, which is why it now lives in the
+// script's sealed HERMIT_OBSOLETE registry instead.
 describe('hermit-evolve permission delegation contract', () => {
   const evolveRef = fs.readFileSync(path.join(SKILLS, 'hermit-evolve', 'reference.md'), 'utf-8');
+  const step8 = evolveRef.slice(
+    evolveRef.indexOf('### 8. Ensure plugin permissions'),
+    evolveRef.indexOf('### 9. Write updated config'),
+  );
 
-  test('Step 8 delegates to apply-settings.ts allow', () => {
-    expect(evolveRef).toMatch(/apply-settings\.ts <resolved-settings-file> allow/);
+  test('Step 8 delegates to apply-settings.ts permissions-sync', () => {
+    expect(evolveRef).toMatch(/apply-settings\.ts <resolved-settings-file> permissions-sync/);
   });
 
   test('Step 8 no longer hand-enumerates the per-script allow-list', () => {
     // The removed prose opened with this phrase before listing scripts by name.
     expect(evolveRef).not.toContain('The required entries are:');
-    // A couple of the previously-enumerated script names must not reappear as an
-    // inline permission list (they may still appear elsewhere in the file).
-    const step8 = evolveRef.slice(
-      evolveRef.indexOf('### 8. Ensure plugin permissions'),
-      evolveRef.indexOf('### 9. Write updated config'),
-    );
-    expect(step8).not.toContain('`queue-micro-proposal.ts`, `micro-proposal.ts`');
+    // Structural, not name-based: an enumeration is *many* `Bash(bun */scripts/…)`
+    // patterns written out in Step 8. Exactly one is expected and allowed — the
+    // bootstrap caveat naming apply-settings.ts's own grant, for a hermit whose
+    // allow-list predates the script that would add it. Naming two example scripts
+    // here (the previous form) went stale the moment those scripts were absorbed
+    // into proposal.ts verbs: the assertion still passed, but against nothing.
+    const inlineGrants = step8.match(/Bash\(bun \*\/scripts\//g) ?? [];
+    expect(inlineGrants.length).toBe(1);
+    expect(step8).toContain('Bash(bun */scripts/apply-settings.ts*)');
+  });
+
+  test('Step 8 no longer hand-maintains the stale-entry removal list', () => {
+    // These were bullets the model was told to scrub by hand; HERMIT_OBSOLETE owns
+    // them now, so a new script deletion reaches operators without editing prose.
+    for (const stale of ['run-with-profile.ts', 'suggest-compact.ts', 'Bash(python3:*)']) {
+      expect(step8).not.toContain(stale);
+    }
   });
 });
diff --git a/plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
similarity index 95%
rename from plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
index 6a196765..de4664d4 100644
--- a/plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
@@ -1,10 +1,10 @@
-// cost-reflect.ts --plain mode: the channel-safe "why is my bill high" answer
+// cost-report.ts reflect --plain mode: the channel-safe "why is my bill high" answer
 // (audit's "plain spend statement" PR). Verifies composition (total vs typical,
 // drivers named by work, cap status, notional caveat) and — the load-bearing
 // property — that the output never leaks the raw token-category vocabulary the
 // table mode uses (cache_read/cache_write, raw source strings, session ids).
 //
-// Subprocess test (via runScript): cost-reflect.ts is invoked as a standalone
+// Subprocess test (via runScript): the reflect verb is invoked as a standalone
 // script, exactly how the SKILL.md Step 1 command runs it.
 
 import { describe, test, expect, afterAll } from 'bun:test';
@@ -66,7 +66,7 @@ function setup(budget: object | null, entries: LogEntry[]): { dir: string; cchDi
 }
 
 async function runPlain(cchDir: string): Promise<string> {
-  const result = await runScript('cost-reflect.ts', { args: [cchDir, '--plain'] });
+  const result = await runScript('cost-report.ts', { args: ['reflect', cchDir, '--plain'] });
   expect(result.exitCode).toBe(0);
   return result.stdout;
 }
@@ -172,7 +172,7 @@ describe('cost-reflect --plain: no-jargon invariant', () => {
 describe('cost-reflect table mode: unaffected by --plain', () => {
   test('default invocation still returns the raw breakdown', async () => {
     const { cchDir } = setup(null, [{ daysAgo: 0, source: 'other' }]);
-    const result = await runScript('cost-reflect.ts', { args: [cchDir, '7'] });
+    const result = await runScript('cost-report.ts', { args: ['reflect', cchDir, '7'] });
     expect(result.exitCode).toBe(0);
     expect(result.stdout).toContain('### Cost by token type');
     expect(result.stdout).toContain('cache_read');
diff --git a/plugins/claude-code-hermit/tests/session-cost.test.ts b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
similarity index 85%
rename from plugins/claude-code-hermit/tests/session-cost.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-session.test.ts
index 91d020d9..6f9308e6 100644
--- a/plugins/claude-code-hermit/tests/session-cost.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/session-cost.ts: per-session cost summation from cost-log.jsonl.
+// Tests for cost-report.ts's session verb: per-session cost summation from cost-log.jsonl.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -43,7 +43,7 @@ function seedRuntime(dir: string, data: object): string {
   return runtimePath;
 }
 
-describe('session-cost.ts', () => {
+describe('cost-report.ts session', () => {
   test('sums cost and tokens for the target session_id only', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.1234, total_tokens: 10000, source: 'other', model: 'sonnet' },
@@ -51,8 +51,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'S-002', estimated_cost_usd: 0.9999, total_tokens: 99999, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -65,8 +64,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.5, total_tokens: 50000, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-999'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-999'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -76,8 +74,7 @@ describe('session-cost.ts', () => {
 
   test('returns zeros when cost-log is absent', withTmpdir(async (dir) => {
     // no cost-log seeded
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -91,8 +88,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.25, total_tokens: 25000, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -109,7 +105,7 @@ describe('session-cost.ts', () => {
 // .claude-code-hermit/compiled/audit-live-harness-token-efficiency-2026-07-09.md.
 // -------------------------------------------------------
 
-describe('session-cost.ts: window-delta mode', () => {
+describe('cost-report.ts session: window-delta mode', () => {
   test('sums rows within [opened_at, closed_at], ignoring session_id, boundaries inclusive', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: '2026-06-01T09:59:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.50, total_tokens: 5000, source: 'other' }, // before window
@@ -118,8 +114,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.30, total_tokens: 3000, source: 'other' }, // == closed_at (inclusive)
       { timestamp: '2026-06-01T11:00:01Z', session_id: 'uuid-1', estimated_cost_usd: 0.99, total_tokens: 9999, source: 'other' }, // after window
     ]);
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', '2026-06-01T11:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', '2026-06-01T11:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -134,7 +129,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.50, total_tokens: 500, source: 'other' },  // after opened_at
     ]);
     seedRuntime(dir, { opened_at: '2026-06-01T10:00:00Z' });
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.50, 4);
@@ -147,8 +142,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T09:05:00Z', session_id: 'uuid-shared', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // arc 1
       { timestamp: '2026-06-01T14:00:00Z', session_id: 'uuid-shared', estimated_cost_usd: 0.30, total_tokens: 300, source: 'other' }, // arc 2
     ]);
-    const r = await runScript('session-cost.ts', {
-      args: ['S-YYY', '--opened-at', '2026-06-01T13:00:00Z', '--closed-at', '2026-06-01T15:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-YYY', '--opened-at', '2026-06-01T13:00:00Z', '--closed-at', '2026-06-01T15:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -163,7 +157,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'S-002', estimated_cost_usd: 0.9999, total_tokens: 99999, source: 'other' },
     ]);
     seedRuntime(dir, { session_state: 'in_progress' }); // no opened_at key
-    const r = await runScript('session-cost.ts', { args: ['S-001'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.1234, 4);
@@ -175,7 +169,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.5, total_tokens: 500, source: 'other' },
     ]);
     seedRuntime(dir, { opened_at: 'not-a-date' });
-    const r = await runScript('session-cost.ts', { args: ['S-001'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.5, 4);
@@ -188,8 +182,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00.000Z', session_id: 'uuid-1', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // after
     ]);
     // 2026-06-01T12:00:00+02:00 == 2026-06-01T10:00:00Z
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T12:00:00+0200'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T12:00:00+0200'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -200,8 +193,7 @@ describe('session-cost.ts: window-delta mode', () => {
 
   test('missing/absent cost-log in window mode fails open to zeros', withTmpdir(async (dir) => {
     // no cost-log seeded
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -216,7 +208,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T14:00:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.99, total_tokens: 999, source: 'routine:reflect' }, // autonomous, after closed_at → excluded
     ]);
     seedRuntime(dir, { opened_at: '2026-06-01T10:00:00Z', closed_at: '2026-06-01T11:00:00Z' });
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.20, 4);
@@ -228,8 +220,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // inside [opened, now]
     ]);
     // Unparseable --closed-at previously → closedMs NaN → `ts <= NaN` false for every row → false 0.
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', 'not-a-date'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', 'not-a-date'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -247,7 +238,7 @@ describe('session-cost.ts: window-delta mode', () => {
     const hermitRoot = path.join(dir, '.claude-code-hermit');
     fs.writeFileSync(path.join(hermitRoot, 'config.json'), '{}');
     const drifted = path.join(hermitRoot, 'state');
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: drifted, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: drifted, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.50, 4);
diff --git a/plugins/claude-code-hermit/tests/today-cost.test.ts b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
similarity index 86%
rename from plugins/claude-code-hermit/tests/today-cost.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-today.test.ts
index d3949ef7..6841261a 100644
--- a/plugins/claude-code-hermit/tests/today-cost.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/today-cost.ts: today's spend summary from cost-log.jsonl.
+// Tests for cost-report.ts's today verb: today's spend summary from cost-log.jsonl.
 // Cost-path resolution must be anchored to the hermit root, not process.cwd() —
 // the calling shell (brief, invoked inline in main) persists cd across calls,
 // so a drifted cwd must not silently misreport $0.00.
@@ -42,7 +42,7 @@ function baseEnv(projectDir: string) {
 
 const today = new Date().toISOString().slice(0, 10);
 
-describe('today-cost.ts', () => {
+describe('cost-report.ts today', () => {
   test('drift regression: reports the real total when cwd has drifted into a subdir', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: `${today}T10:00:00Z`, session_id: 'S-001', estimated_cost_usd: 14.91, total_tokens: 28500000, source: 'other' },
@@ -51,7 +51,7 @@ describe('today-cost.ts', () => {
     const drifted = path.join(dir, '.claude-code-hermit', 'proposals');
     fs.mkdirSync(drifted, { recursive: true });
 
-    const r = await runScript('today-cost.ts', { cwd: drifted, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: drifted, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('$14.91 (28.5M tokens) across 1 session(s)');
   }));
@@ -64,7 +64,7 @@ describe('today-cost.ts', () => {
     const drifted = path.join(dir, '.claude-code-hermit', 'proposals');
     fs.mkdirSync(drifted, { recursive: true });
 
-    const r = await runScript('today-cost.ts', {
+    const r = await runScript('cost-report.ts', { args: ['today'],
       cwd: drifted,
       env: { CLAUDE_PLUGIN_ROOT: PLUGIN_ROOT, CLAUDE_PROJECT_DIR: '', AGENT_DIR: '' },
     });
@@ -74,7 +74,7 @@ describe('today-cost.ts', () => {
 
   test('unavailable: cost log absent', withTmpdir(async (dir) => {
     seedHermitRoot(dir);
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('cost data unavailable');
   }));
@@ -82,7 +82,7 @@ describe('today-cost.ts', () => {
   test('unavailable: cost log path is a directory (non-ENOENT read failure)', withTmpdir(async (dir) => {
     seedHermitRoot(dir);
     fs.mkdirSync(path.join(dir, '.claude', 'cost-log.jsonl'), { recursive: true });
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('cost data unavailable');
   }));
@@ -92,7 +92,7 @@ describe('today-cost.ts', () => {
       { timestamp: '2020-01-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 5, total_tokens: 5000, source: 'other' },
     ]);
     seedHermitRoot(dir);
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('$0.00 (0 tokens) across 0 session(s)');
   }));
diff --git a/plugins/claude-code-hermit/tests/cost-tracker.test.ts b/plugins/claude-code-hermit/tests/cost-tracker.test.ts
index 1198c07e..16e02ec6 100644
--- a/plugins/claude-code-hermit/tests/cost-tracker.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-tracker.test.ts
@@ -376,7 +376,7 @@ describe('cost-tracker: max_prompt_tokens (real context size vs per-turn sum)',
 
 // ---------------------------------------------------------------------------
 // Subprocess: cost-tracker stamps/clears runtime.json's opened_at (PR-6 part b —
-// session-cost.ts's window-delta mode reads this field). See maintainOpenedAt in
+// cost-report.ts session's window-delta mode reads this field). See maintainOpenedAt in
 // cost-tracker.ts.
 // ---------------------------------------------------------------------------
 
diff --git a/plugins/claude-code-hermit/tests/cron-registry.test.ts b/plugins/claude-code-hermit/tests/cron-registry.test.ts
index af4caaf6..8284cd47 100644
--- a/plugins/claude-code-hermit/tests/cron-registry.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-registry.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/cron-registry.ts — the diff-based plan/commit planner behind
+// Tests for `routines.ts cron-registry` — the diff-based plan/commit planner behind
 // hermit-routines `load`. planCron/commitCron are pure (no fs, no Date.now()), so
 // these are in-process unit tests, not subprocess runs — the real boundary
 // (reading config.json/the mirror file, writing the mirror) is exercised by the
@@ -14,8 +14,8 @@
 // never silently ride a routine past CC's real 7-day auto-expiry cliff.
 
 import { describe, test, expect } from 'bun:test';
-import { planCron, commitCron, computeWakeSpread, promptHash, REREGISTER_AGE_MS, filterRoutinesByIds } from '../scripts/cron-registry';
-import { shiftCron } from '../scripts/cron-tz-shift';
+import { planCron, commitCron, computeWakeSpread, promptHash, REREGISTER_AGE_MS, filterRoutinesByIds } from '../scripts/lib/routines/registry';
+import { shiftCron } from '../scripts/lib/cron-shift';
 
 const PLUGIN_ROOT = '/plugin';
 const BOOT_A = 'boot-aaa';
diff --git a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
index 521da9c7..b76e5c28 100644
--- a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/cron-tz-shift.ts — timezone-aware cron shifting
+// Tests for `routines.ts tz-shift` — timezone-aware cron shifting
 // (bun test port of cron-tz-shift.test.sh).
 //
 // Exercised as a subprocess (runScript): the machine timezone (TZ env, resolved
@@ -17,8 +17,8 @@ const W = '2026-01-15T12:00:00Z'; // winter reference (Lisbon=UTC+0)
 const S = '2026-07-15T12:00:00Z'; // summer reference (Lisbon=UTC+1)
 
 const shift = (tz: string, now: string, cron: string, fromTz: string) =>
-  runScript('cron-tz-shift.ts', {
-    args: [cron, fromTz],
+  runScript('routines.ts', {
+    args: ['tz-shift', cron, fromTz],
     env: { TZ: tz, HERMIT_CRON_TZ_SHIFT_NOW: now },
   });
 
diff --git a/plugins/claude-code-hermit/tests/eval-success-signal.test.ts b/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
index 841f0b90..2918d3a2 100644
--- a/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
+++ b/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
@@ -1,4 +1,4 @@
-// Unit tests for scripts/eval-success-signal.ts (bun test port of test-eval-success-signal.sh).
+// Unit tests for proposal.ts's success-signal verb (bun test port of test-eval-success-signal.sh).
 // Validate mode (grammar) and evaluate mode (MET / UNMET / INSUFFICIENT_DATA).
 //
 // The script is a CLI contract (argv in, process.exit + one-line JSON on stdout,
@@ -17,7 +17,7 @@ import { runScript } from './helpers/run';
 // ---------- helpers ----------
 
 const validate = (predicate: string) =>
-  runScript('eval-success-signal.ts', { args: ['--validate', predicate] });
+  runScript('proposal.ts', { args: ['success-signal', '--validate', predicate] });
 
 /** Run a test body with a throwaway .claude-code-hermit state dir (sessions/ pre-made). */
 function withStateDir(fn: (sdir: string) => Promise<void> | void, subdir = 'sessions') {
@@ -56,8 +56,8 @@ Test.
 
 /** Evaluate-mode run; asserts exit 0 and returns the parsed JSON verdict line. */
 async function evaluate(sdir: string, acceptedDate: string, acceptedInSession: string, predicate: string) {
-  const r = await runScript('eval-success-signal.ts', {
-    args: [sdir, acceptedDate, acceptedInSession, predicate],
+  const r = await runScript('proposal.ts', {
+    args: ['success-signal', sdir, acceptedDate, acceptedInSession, predicate],
   });
   expect(r.exitCode).toBe(0);
   return JSON.parse(r.stdout);
diff --git a/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts b/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
index e48a3e49..58b01fda 100644
--- a/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
+++ b/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
@@ -85,8 +85,8 @@ function build(fix: Fixture): string {
 }
 
 async function verdict(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
diff --git a/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts b/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
index 59fa596f..d513b5a6 100644
--- a/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
+++ b/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
@@ -74,8 +74,8 @@ function contentHash(text: string): string {
 }
 
 async function verdict(dir: string, peek = false, env?: Record<string, string>): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env,
   });
diff --git a/plugins/claude-code-hermit/tests/hermit-run.test.ts b/plugins/claude-code-hermit/tests/hermit-run.test.ts
index 3c9a53ae..f5e0614e 100644
--- a/plugins/claude-code-hermit/tests/hermit-run.test.ts
+++ b/plugins/claude-code-hermit/tests/hermit-run.test.ts
@@ -128,10 +128,10 @@ describe('hermit-exec.sh name guard', () => {
   });
 
   test('a real script name dispatches to bun', async () => {
-    // micro-proposal.ts with no args prints its own usage and exits 1 — proof the
-    // name resolved to scripts/micro-proposal.ts and bun ran it.
-    const r = await bash(HERMIT_EXEC, ['micro-proposal'], {});
+    // proposal.ts with no verb prints its own usage and exits 1 — proof the
+    // name resolved to scripts/proposal.ts and bun ran it.
+    const r = await bash(HERMIT_EXEC, ['proposal'], {});
     expect(r.exitCode).toBe(1);
-    expect(r.stdout + r.stderr).toContain('micro-proposal.ts');
+    expect(r.stdout + r.stderr).toContain('proposal.ts');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/hooks.contract.test.ts b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
index d3cdbf63..f00f4a35 100644
--- a/plugins/claude-code-hermit/tests/hooks.contract.test.ts
+++ b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
@@ -1358,13 +1358,20 @@ describe('generate-summary', () => {
 });
 
 // -------------------------------------------------------
-// prompt-context (UserPromptSubmit hook)
+// prompt-context (a stage of the UserPromptSubmit pipeline)
+//
+// The stage lives in scripts/lib/prompt-stages/prompt-context.ts and is driven
+// through scripts/user-prompt-pipeline.ts. The pipeline only runs stages for a
+// payload that actually carries a prompt, so these pass a minimal one where the
+// old standalone script emitted on any stdin.
 // -------------------------------------------------------
 
+const PROMPT_CONTEXT_STDIN = JSON.stringify({ prompt: 'hello' });
+
 describe('prompt-context', () => {
   test('prompt-context (UTC fallback)', withDir(async (dir) => {
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toMatch(/^\[Now: .+ UTC\]/m);
@@ -1372,8 +1379,8 @@ describe('prompt-context', () => {
 
   test('prompt-context (configured TZ)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"America/New_York"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toMatch(/^\[Now: .+ (EST|EDT)\]/m);
@@ -1381,24 +1388,24 @@ describe('prompt-context', () => {
 
   test('prompt-context (invalid TZ, exits 0)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"Bogus/Zone"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
   }));
 
   test('prompt-context (invalid TZ, no [Now:] line)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"Bogus/Zone"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[Now:');
   }));
 
   test('prompt-context (malformed config, exits 0)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), 'not json');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
   }));
@@ -1476,12 +1483,20 @@ describe('record-operator-action (usage capture)', () => {
 });
 
 // -------------------------------------------------------
-// channel-reply-reminder (UserPromptSubmit hook)
+// channel-reply-reminder (a stage of the UserPromptSubmit pipeline)
+//
+// The stage lives in scripts/lib/prompt-stages/channel-reply-reminder.ts and is
+// driven through scripts/user-prompt-pipeline.ts. prompt-context also runs on
+// every prompt, so "no reminder" is the absence of the reminder marker, not
+// empty stdout (empty stdout only survives where the payload carries no prompt
+// at all).
 // -------------------------------------------------------
 
+const NO_REMINDER = '[channel reply reminder]';
+
 describe('channel-reply-reminder', () => {
   const run = (prompt: string, dir: string) =>
-    runScript('channel-reply-reminder.ts', {
+    runScript('user-prompt-pipeline.ts', {
       stdin: JSON.stringify({ prompt }), cwd: dir,
     });
 
@@ -1511,25 +1526,25 @@ describe('channel-reply-reminder', () => {
   }));
 
   test('channel-reply-reminder (empty stdin)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', { stdin: '', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   }));
 
   test('channel-reply-reminder (malformed JSON)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', { stdin: '{broken', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: dir });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (no envelope)', withDir(async (dir) => {
     const r = await run('hello world', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (envelope mid-prompt, no output)', withDir(async (dir) => {
     const r = await run('see <channel source="discord" chat_id="x">...', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (adversarial control char in chat_id)', withDir(async (dir) => {
@@ -1585,11 +1600,11 @@ describe('channel-reply-reminder', () => {
   }));
 
   test('channel-reply-reminder (capture: malformed envelope -> reminder skipped, exit 0, no throw)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', {
+    const r = await runScript('user-prompt-pipeline.ts', {
       stdin: JSON.stringify({ prompt: 'not a channel envelope at all' }), cwd: dir,
     });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 });
 
diff --git a/plugins/claude-code-hermit/tests/pause-keyword.test.ts b/plugins/claude-code-hermit/tests/pause-keyword.test.ts
index 0025976d..edf7f00e 100644
--- a/plugins/claude-code-hermit/tests/pause-keyword.test.ts
+++ b/plugins/claude-code-hermit/tests/pause-keyword.test.ts
@@ -1,8 +1,13 @@
-// Contract tests for scripts/pause-keyword.ts — the deterministic
-// pause/resume/snooze keyword writer (PROP-015). A UserPromptSubmit hook:
-// writes state/pause.json directly from an inbound <channel> envelope,
-// before any model turn. Exercised as a subprocess (stdin in, exit code/
-// stdout out), the boundary Claude Code sees.
+// Contract tests for the pause/resume/snooze keyword writer (PROP-015) —
+// scripts/lib/prompt-stages/pause-keyword.ts, driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Writes
+// state/pause.json directly from an inbound <channel> envelope, before any
+// model turn. Exercised as a subprocess (stdin in, exit code/stdout out),
+// the boundary Claude Code sees.
+//
+// Pipeline note: prompt-context runs on every prompt, so stdout always carries
+// a `[Now: …]` line. A "silent no-op" is therefore asserted as the absence of
+// the `[pause]` marker, not as empty stdout.
 //
 // Usage: bun test tests/pause-keyword.test.ts   (from the plugin root)
 
@@ -29,7 +34,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (prompt: string, dir: string) =>
-  runScript('pause-keyword.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
+  runScript('user-prompt-pipeline.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
 
 describe('pause-keyword', () => {
   test('"pause" from the operator DM (no allowlist, chat_id matches dm_channel_id) — sets flag, exit 0', withDir(async (dir) => {
@@ -47,7 +52,7 @@ describe('pause-keyword', () => {
   test('no allowlist, message from a non-DM chat — silent no-op (cannot freeze)', withDir(async (dir) => {
     const r = await run('<channel source="discord" chat_id="99" user="STRANGER">stop</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
@@ -85,7 +90,7 @@ describe('pause-keyword', () => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
     const r = await run('<channel source="discord" chat_id="1" user="INTRUDER">pause</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
@@ -99,37 +104,37 @@ describe('pause-keyword', () => {
   test('allowed_users=[] lockdown — silent no-op even with a user id', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":[]}}}');
     const r = await run('<channel source="discord" chat_id="1" user="ANYONE">pause</channel>', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('no user attribute, allowlist configured — rejected (unverifiable identity)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
     const r = await run('<channel source="discord" chat_id="1">pause</channel>', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('ordinary conversational text — no accidental trigger', withDir(async (dir) => {
     const r = await run('<channel source="discord" chat_id="1" user="U1">please pause and think about this</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('no envelope — no-op', withDir(async (dir) => {
     const r = await run('hello world', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('empty stdin — fail-open, exit 0', withDir(async (dir) => {
-    const r = await runScript('pause-keyword.ts', { stdin: '', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: dir });
     expect(r.exitCode).toBe(0);
   }));
 
   test('malformed JSON stdin — fail-open, exit 0', withDir(async (dir) => {
-    const r = await runScript('pause-keyword.ts', { stdin: '{broken', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: dir });
     expect(r.exitCode).toBe(0);
   }));
 
@@ -160,7 +165,7 @@ describe('pause-keyword', () => {
       write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
       const r = await run('<channel source="plugin:discord:discord" chat_id="1" user="INTRUDER">pause</channel>', dir);
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[pause]');
       expect(isPaused(hermit(dir)).paused).toBe(false);
     }));
 
diff --git a/plugins/claude-code-hermit/tests/procedure-capture.test.ts b/plugins/claude-code-hermit/tests/procedure-capture.test.ts
index 7de0d77e..ab4a2e0f 100644
--- a/plugins/claude-code-hermit/tests/procedure-capture.test.ts
+++ b/plugins/claude-code-hermit/tests/procedure-capture.test.ts
@@ -119,8 +119,8 @@ describe('reflect: kill criteria', () => {
     expect(reflect).toContain('30%');
   });
 
-  test('reflect: kill criteria invokes proposal-metrics-report.ts for procedure-capture', () => {
-    expect(reflect).toContain('proposal-metrics-report.ts');
+  test('reflect: kill criteria invokes the metrics verb for procedure-capture', () => {
+    expect(reflect).toContain('proposal.ts metrics');
   });
 
   test('reflect: kill criteria passes --source=procedure-capture to report script', () => {
@@ -164,7 +164,7 @@ describe('proposal-create: ## Skill Draft variant', () => {
   });
 
   test('proposal-create: triage-verdict emission carries tags (segments triage-survival)', () => {
-    // Emitted by record-gate.ts (tests/scripts.test.ts describe('record-gate') guards
+    // Emitted by the gate verb (tests/scripts.test.ts describe('proposal gate') guards
     // the field lands in the actual event); this guards the call site passes `--tags`.
     expect(proposalCreate).toContain("--tags '[<caller-supplied tags>]'");
   });
diff --git a/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts b/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
index 2686b678..07671e8c 100644
--- a/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
@@ -125,7 +125,7 @@ test("frontmatter description mentions 'start implementing now'", () => {
 });
 
 // Step 2's success_signal bullet: capture and validation.
-// Guards that the step exists, references eval-success-signal.ts, and never blocks accept.
+// Guards that the step exists, references the success-signal verb, and never blocks accept.
 // (Folded from a standalone numbered step 3c into step 2's "determine what to
 // set" bullet list when the accept flow consolidated onto proposal.ts patch —
 // same behavior, new anchor.)
@@ -134,8 +134,8 @@ describe('step 3c: success_signal', () => {
     expect(skill).toContain('`success_signal` (optional)');
   });
 
-  test('step 3c: references eval-success-signal.ts', () => {
-    expect(skill).toContain('eval-success-signal.ts');
+  test('step 3c: references the success-signal verb', () => {
+    expect(skill).toContain('proposal.ts success-signal');
   });
 
   test('step 3c: never blocks accept', () => {
diff --git a/plugins/claude-code-hermit/tests/proposal-lib.test.ts b/plugins/claude-code-hermit/tests/proposal-lib.test.ts
index f2f01032..0bf3e477 100644
--- a/plugins/claude-code-hermit/tests/proposal-lib.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-lib.test.ts
@@ -7,54 +7,71 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { computeBase, resolveSuffix, slugify, SUFFIX_LETTERS } from '../scripts/lib/prop-id';
+import { computeBase, nextNumber, slugify } from '../scripts/lib/prop-id';
 import { zonedISOStamp } from '../scripts/lib/time';
 import { serializeValue, appendToSection, patchFrontmatter } from '../scripts/lib/md-write';
 
-describe('lib/prop-id: collision suffix', () => {
-  // resolveSuffix takes a FIXED base (num/slug/hhmmss already computed) so the
-  // suffix walk is tested in isolation from nextNumber's own NNN scan — any
-  // pre-seeded collision file also matches that scan and would otherwise shift
-  // `num` before the walk ever runs (nextPropId's own num recomputation).
-  test('walks a -> b when both the unsuffixed and -a candidates already exist', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
-    const proposalsDir = path.join(dir, 'proposals');
-    fs.mkdirSync(proposalsDir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
-    const now = new Date('2026-07-20T22:00:00Z');
+// Slug and number behavior formerly exercised through the next-prop-id.ts CLI.
+// That wrapper is gone; proposal.ts's create verb reaches the same code through
+// computeBase, so the cases live here as direct unit tests.
+describe('lib/prop-id: slugify', () => {
+  test('drops stopwords and truncates at a word boundary', () => {
+    expect(slugify('Fix the thing for real')).toBe('fix-thing-real');
+    expect(slugify('   ')).toBe('proposal');
+  });
 
-    const base = computeBase(dir, 'Collision test', now);
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}.md`), 'x');
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}a.md`), 'x');
+  test('a stopword-only title falls back to the pre-filter tokens', () => {
+    expect(slugify('the a of and')).toBe('the-a-of-and');
+  });
 
-    const result = resolveSuffix(proposalsDir, base);
-    expect(result?.suffix).toBe('b');
-    expect(result?.id).toBe(`PROP-${base.num}-${base.slug}-${base.hhmmss}b`);
+  test('an all-punctuation title falls back to the literal "proposal"', () => {
+    expect(slugify('!!!???...')).toBe('proposal');
+  });
 
-    fs.rmSync(dir, { recursive: true, force: true });
+  test('a single token longer than 40 chars is hard-cut to 40', () => {
+    const slug = slugify('supercalifragilisticexpialidocioussupercalifragilisticexpialidocious');
+    expect(slug.length).toBe(40);
   });
 
-  test('exhausts the a-z suffix range and returns null', () => {
+  test('an apostrophe becomes a separator, never a double dash', () => {
+    expect(slugify("bob's widget")).toBe('bob-s-widget');
+  });
+});
+
+describe('lib/prop-id: nextNumber', () => {
+  function withProposals(files: string[], fn: (proposalsDir: string) => void) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
     const proposalsDir = path.join(dir, 'proposals');
     fs.mkdirSync(proposalsDir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
-    const now = new Date('2026-07-20T22:00:00Z');
+    for (const f of files) fs.writeFileSync(path.join(proposalsDir, f), 'x');
+    try { fn(proposalsDir); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  }
 
-    const base = computeBase(dir, 'Exhaust test', now);
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}.md`), 'x');
-    for (const letter of SUFFIX_LETTERS) {
-      fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}${letter}.md`), 'x');
-    }
+  test('starts at 001 on an empty proposals dir', () => {
+    withProposals([], (d) => expect(nextNumber(d)).toBe('001'));
+  });
 
-    expect(resolveSuffix(proposalsDir, base)).toBeNull();
+  test('is max + 1, zero-padded', () => {
+    withProposals(['PROP-005-foo-100000.md', 'PROP-006-bar-110000.md'], (d) => {
+      expect(nextNumber(d)).toBe('007');
+    });
+  });
 
-    fs.rmSync(dir, { recursive: true, force: true });
+  test('a missing proposals dir reads as empty', () => {
+    expect(nextNumber(path.join(os.tmpdir(), 'prop-id-does-not-exist'))).toBe('001');
   });
+});
 
-  test('slugify drops stopwords and truncates at a word boundary', () => {
-    expect(slugify('Fix the thing for real')).toBe('fix-thing-real');
-    expect(slugify('   ')).toBe('proposal');
+describe('lib/prop-id: computeBase', () => {
+  test('combines number, slug, and zoned HHMMSS from one instant', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
+    fs.mkdirSync(path.join(dir, 'proposals'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const base = computeBase(dir, 'First Proposal Ever', new Date('2026-07-20T22:00:00Z'));
+    expect(base).toEqual({ num: '001', slug: 'first-proposal-ever', hhmmss: '220000' });
+
+    fs.rmSync(dir, { recursive: true, force: true });
   });
 });
 
diff --git a/plugins/claude-code-hermit/tests/proposal-write.test.ts b/plugins/claude-code-hermit/tests/proposal-write.test.ts
index 83ddc140..28953412 100644
--- a/plugins/claude-code-hermit/tests/proposal-write.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-write.test.ts
@@ -470,3 +470,55 @@ describe('proposal.ts routine', () => {
     expect(fs.readFileSync(path.join(stateArg(dir), 'config.json'), 'utf-8')).toBe(before);
   }));
 });
+
+// -------------------------------------------------------
+// Dispatch gate — the two absorbed verbs that legitimately take no state dir
+// -------------------------------------------------------
+//
+// Every other verb is refused without one (`!verb || !stateDir` → exit 1), which
+// is what stops a mis-invocation from creating anything. These two are carved
+// out ahead of that guard: `success-signal --validate` is a pure grammar check
+// that reads no state, and `metrics` defaults the state dir. If the carve-out
+// regressed, both would exit 1 with a usage line and their callers — a
+// proposal-create predicate check, a domain brainstorm's kill-criteria check —
+// would read that as a failure verdict.
+
+describe('proposal.ts dispatch gate', () => {
+  test('success-signal --validate needs no state dir; exit code still carries the verdict', async () => {
+    const ok = await runScript('proposal.ts', {
+      args: ['success-signal', '--validate', 'avg_session_cost_usd < 1.5 over 5 sessions'],
+    });
+    expect(ok.exitCode).toBe(0);
+    expect(ok.stdout.trim()).toBe('OK');
+
+    // Non-zero on a bad predicate is load-bearing: proposal-create branches on it.
+    const bad = await runScript('proposal.ts', { args: ['success-signal', '--validate', 'nonsense'] });
+    expect(bad.exitCode).toBe(1);
+    expect(bad.stdout).toContain('invalid grammar');
+  });
+
+  test('metrics needs no state dir — it defaults to .claude-code-hermit', withDir(async (dir) => {
+    const r = await runScript('proposal.ts', { args: ['metrics'], cwd: dir });
+    expect(r.exitCode).toBe(0);
+    // No ledger under the default dir → the fail-open line, not a usage error.
+    expect(r.stdout).toContain('No proposal metrics yet.');
+    expect(r.stderr).not.toContain('Usage:');
+  }));
+
+  test('a verb that does need a state dir is still refused without one', async () => {
+    const r = await runScript('proposal.ts', { args: ['create'] });
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('Usage: bun proposal.ts');
+  });
+});
+
+// `index` is the third carve-out: it was a fail-open derived-cache rebuild before
+// absorption (`SKIP|no state dir`, exit 0) and stays one. Falling through to the
+// generic exit-1 usage guard would read as a real failure to its callers.
+describe('proposal.ts index fail-open contract', () => {
+  test('index with no state dir → SKIP on stdout, exit 0', async () => {
+    const r = await runScript('proposal.ts', { args: ['index'] });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout.trim()).toBe('SKIP|no state dir');
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/proposals-index.test.ts b/plugins/claude-code-hermit/tests/proposals-index.test.ts
index 46a2d927..b001c926 100644
--- a/plugins/claude-code-hermit/tests/proposals-index.test.ts
+++ b/plugins/claude-code-hermit/tests/proposals-index.test.ts
@@ -1,4 +1,4 @@
-// proposals-index.ts — derived-cache correctness + hook-dispatch wiring.
+// proposal.ts index / lib/proposals/index-rebuild.ts — derived-cache correctness + hook-dispatch wiring.
 // The index replaces reading every PROP-*.md body (~22K tokens) with a single
 // frontmatter mirror, and becomes the single source of proposal counts.
 //
@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { rebuildIndex } from '../scripts/proposals-index';
+import { rebuildIndex } from '../scripts/lib/proposals/index-rebuild';
 import { runScript } from './helpers/run';
 
 const hermit = (dir: string, ...p: string[]) => path.join(dir, '.claude-code-hermit', ...p);
@@ -93,14 +93,14 @@ describe('CLI verdict', () => {
   test('OK|<n> proposals with a proposals dir', async () => {
     const dir = makeDir();
     writeProposal(dir, 'PROP-001-a-120000.md', fm({ status: 'proposed' }) + '# Proposal: PROP-001 — A\n');
-    const r = await runScript('proposals-index.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('proposal.ts', { args: ['index', '.claude-code-hermit'], cwd: dir });
     expect(r.stdout.trim()).toBe('OK|1 proposals');
   });
 
   test('SKIP|no proposals dir when absent', async () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hermit-noprop-'));
     fs.mkdirSync(hermit(dir, 'state'), { recursive: true });
-    const r = await runScript('proposals-index.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('proposal.ts', { args: ['index', '.claude-code-hermit'], cwd: dir });
     expect(r.stdout.trim()).toBe('SKIP|no proposals dir');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/routine-due.test.ts b/plugins/claude-code-hermit/tests/routine-due.test.ts
index 85f35403..d7e47395 100644
--- a/plugins/claude-code-hermit/tests/routine-due.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-due.test.ts
@@ -1,4 +1,4 @@
-// Contract tests for scripts/routine-due.ts — the monitor-mode deterministic
+// Contract tests for `routines.ts due` — the monitor-mode deterministic
 // scheduler. Exercised as a subprocess (argv/stdout/exit-code/file writes), same
 // convention as tests/routine-precheck.test.ts.
 //
@@ -53,7 +53,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (dir: string, now: string) =>
-  runScript('routine-due.ts', { args: [hermit(dir)], env: { HERMIT_NOW: now } });
+  runScript('routines.ts', { args: ['due', hermit(dir)], env: { HERMIT_NOW: now } });
 
 describe('routine-due', () => {
   test('no schedule file + due-now mark → init-to-now, NO emission, entry created', withDir(async (dir) => {
@@ -218,8 +218,8 @@ describe('routine-due', () => {
 
     // Force the schedule persist to fail via the test seam — the deferred skip stamp must
     // not be written and the cursor must not advance (persist-before-stamp ordering).
-    const rFail = await runScript('routine-due.ts', {
-      args: [hermit(dir)],
+    const rFail = await runScript('routines.ts', {
+      args: ['due', hermit(dir)],
       env: { HERMIT_NOW: '2026-07-15T09:00:00Z', HERMIT_DUE_FORCE_PERSIST_FAIL: '1' },
     });
     expect(rFail.exitCode).toBe(0);
@@ -310,7 +310,7 @@ describe('routine-due', () => {
   }));
 
   test('missing hermit-dir arg → exit 0, no crash, no output', withDir(async (dir) => {
-    const r = await runScript('routine-due.ts', { args: [] });
+    const r = await runScript('routines.ts', { args: ['due', ] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   }));
diff --git a/plugins/claude-code-hermit/tests/routine-precheck.test.ts b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
index ef8eaf06..ee85ec2d 100644
--- a/plugins/claude-code-hermit/tests/routine-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
@@ -1,4 +1,4 @@
-// Contract tests for scripts/routine-precheck.ts — consolidates a routine fire's
+// Contract tests for `routines.ts precheck` — consolidates a routine fire's
 // pre-dispatch gate (waiting-check + pause-check) and the `started` stamp into one
 // script call. Exercised as a subprocess (argv/stdout/exit-code/file writes), the same
 // way tests/hermit-pause.test.ts exercises hermit-pause.ts (both resolve the hermit
@@ -35,7 +35,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (id: string, rdw: 'true' | 'false', dir: string) =>
-  runScript('routine-precheck.ts', { args: [id, rdw], cwd: dir });
+  runScript('routines.ts', { args: ['precheck', id, rdw], cwd: dir });
 
 describe('routine-precheck', () => {
   test('idle, unpaused, rdw=false → PROCEED + one started row', withDir(async (dir) => {
@@ -98,7 +98,7 @@ describe('routine-precheck', () => {
   }));
 
   test('missing routine id → fail-open PROCEED, no metrics row written', withDir(async (dir) => {
-    const r = await runScript('routine-precheck.ts', { args: [], cwd: dir });
+    const r = await runScript('routines.ts', { args: ['precheck', ], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('PROCEED');
     expect(readMetricsRows(dir)).toHaveLength(0);
@@ -110,8 +110,8 @@ describe('routine-precheck', () => {
     // the root-cwd cases above rely on the fail-open branch instead — see file header).
     fs.writeFileSync(hermit(dir, 'config.json'), '{}');
     fs.mkdirSync(path.join(dir, 'app', 'sub'), { recursive: true });
-    const r = await runScript('routine-precheck.ts', {
-      args: ['nested-routine', 'false'],
+    const r = await runScript('routines.ts', {
+      args: ['precheck', 'nested-routine', 'false'],
       cwd: path.join(dir, 'app', 'sub'),
     });
     expect(r.exitCode).toBe(0);
@@ -128,7 +128,7 @@ describe('routine-precheck', () => {
   }));
 
   test('explicit delivery arg "monitor" serializes delivery: monitor', withDir(async (dir) => {
-    const r = await runScript('routine-precheck.ts', { args: ['test-routine', 'false', 'monitor'], cwd: dir });
+    const r = await runScript('routines.ts', { args: ['precheck', 'test-routine', 'false', 'monitor'], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('PROCEED');
     const rows = readMetricsRows(dir);
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index 80ec425b..2164aa0e 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -676,7 +676,7 @@ describe('archive-raw', () => {
 });
 
 // -------------------------------------------------------
-// update-alert-state.ts (subprocess — stdin payload + file-write CLI contract)
+// heartbeat.ts alert-state (subprocess — stdin payload + file-write CLI contract)
 // -------------------------------------------------------
 
 describe('update-alert-state', () => {
@@ -684,7 +684,7 @@ describe('update-alert-state', () => {
 
   async function updateAlertState(dir: string, payload: string, env: Record<string, string> = { HERMIT_NOW: NOW }) {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: payload, env });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: payload, env });
     expect(r.exitCode).toBe(0);
     return {
       state: fs.existsSync(stateFile) ? readJson(stateFile) : null,
@@ -784,8 +784,8 @@ describe('update-alert-state', () => {
 
   test('update-alert-state (missing state file — fail-open, seeds default, exits 0)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', {
-      args: [stateFile], stdin: firingPayload([{ key: 'custom:x', text: 'k fired' }]), env: { HERMIT_NOW: NOW },
+    const r = await runScript('heartbeat.ts', {
+      args: ['alert-state', stateFile], stdin: firingPayload([{ key: 'custom:x', text: 'k fired' }]), env: { HERMIT_NOW: NOW },
     });
     expect(r.exitCode).toBe(0);
     const d = readJson(stateFile);
@@ -794,7 +794,7 @@ describe('update-alert-state', () => {
 
   test('update-alert-state (bad JSON payload — exits 1, no write)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: 'not-json' });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: 'not-json' });
     expect(r.exitCode).toBe(1);
     expect(fs.existsSync(stateFile)).toBe(false);
   }));
@@ -804,13 +804,13 @@ describe('update-alert-state', () => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
 
     write(stateFile, before);
-    let r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: JSON.stringify({ firing: 'not-an-array', self_eval_updates: {} }), env: { HERMIT_NOW: NOW } });
+    let r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: JSON.stringify({ firing: 'not-an-array', self_eval_updates: {} }), env: { HERMIT_NOW: NOW } });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(readJson(stateFile)).toEqual(JSON.parse(before)); // untouched — never coerced to empty and aged
 
     write(stateFile, before);
-    r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: JSON.stringify({ firing: [{ key: 'checklist:x' }], self_eval_updates: {} }), env: { HERMIT_NOW: NOW } }); // missing text
+    r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: JSON.stringify({ firing: [{ key: 'checklist:x' }], self_eval_updates: {} }), env: { HERMIT_NOW: NOW } }); // missing text
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(readJson(stateFile)).toEqual(JSON.parse(before));
@@ -829,7 +829,7 @@ describe('update-alert-state', () => {
   test('update-alert-state (write failure — no stdout, no side effects)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
     fs.mkdirSync(stateFile); // path is a directory → write throws EISDIR
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: firingPayload([{ key: 'stale-session', text: 'x' }]), env: { HERMIT_NOW: NOW } });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: firingPayload([{ key: 'stale-session', text: 'x' }]), env: { HERMIT_NOW: NOW } });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(fs.statSync(stateFile).isDirectory()).toBe(true); // untouched
@@ -1326,58 +1326,58 @@ describe('append-metrics (dual-mode)', () => {
 });
 
 // -------------------------------------------------------
-// resolve-prop.ts (subprocess — PROP-id fuzzy resolution)
+// proposal.ts resolve-id (subprocess — PROP-id fuzzy resolution)
 // -------------------------------------------------------
 
-describe('resolve-prop', () => {
+describe('proposal resolve-id', () => {
   function seedProposal(dir: string, filename: string, title: string) {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     write(hermit(dir, 'proposals', filename), `---\ntitle: ${title}\n---\nbody\n`);
   }
   async function resolveProp(dir: string, input: string) {
-    const r = await runScript('resolve-prop.ts', { args: [hermit(dir), input] });
+    const r = await runScript('proposal.ts', { args: ['resolve-id', hermit(dir), input] });
     expect(r.exitCode).toBe(0);
     return r.stdout.trimEnd();
   }
 
-  test('resolve-prop (legacy exact match)', withDir(async (dir) => {
+  test('resolve-id (legacy exact match)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-007.md', 'Legacy');
     expect(await resolveProp(dir, 'prop-7')).toBe('MATCH|PROP-007.md');
   }));
 
-  test('resolve-prop (new-format bare-id match)', withDir(async (dir) => {
+  test('resolve-id (new-format bare-id match)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'PROP-6')).toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (suffix match, lowercase input against lowercase slug)', withDir(async (dir) => {
+  test('resolve-id (suffix match, lowercase input against lowercase slug)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'prop-006-capability-brainstorm-103612'))
       .toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (suffix match, timestamp-only input)', withDir(async (dir) => {
+  test('resolve-id (suffix match, timestamp-only input)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'PROP-006-103612')).toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (4-digit NNN never collides with 3-digit bare id)', withDir(async (dir) => {
+  test('resolve-id (4-digit NNN never collides with 3-digit bare id)', withDir(async (dir) => {
     // PROP-006 must not match PROP-0061.md once proposal counts cross 1000.
     seedProposal(dir, 'PROP-0061.md', 'Collision');
     expect(await resolveProp(dir, 'PROP-6')).toBe('NONE|no-match');
   }));
 
-  test('resolve-prop (0 matches)', withDir(async (dir) => {
+  test('resolve-id (0 matches)', withDir(async (dir) => {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     expect(await resolveProp(dir, 'PROP-999')).toBe('NONE|no-match');
   }));
 
-  test('resolve-prop (not a PROP id)', withDir(async (dir) => {
+  test('resolve-id (not a PROP id)', withDir(async (dir) => {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     expect(await resolveProp(dir, 'hello')).toBe('NONE|not-a-prop-id');
   }));
 
-  test('resolve-prop (2+ matches — AMBIGUOUS carries file + title)', withDir(async (dir) => {
+  test('resolve-id (2+ matches — AMBIGUOUS carries file + title)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     seedProposal(dir, 'PROP-006-something-else-110000.md', 'Bar');
     const out = await resolveProp(dir, 'PROP-6');
@@ -1391,93 +1391,15 @@ describe('resolve-prop', () => {
 });
 
 // -------------------------------------------------------
-// next-prop-id.ts (subprocess — ID + slug + collision-guard generation)
+// proposal.ts gate (subprocess — gate-verdict parsing + metric append + routing)
 // -------------------------------------------------------
 
-describe('next-prop-id', () => {
-  function seedConfig(dir: string, timezone = 'UTC') {
-    write(hermit(dir, 'config.json'), JSON.stringify({ timezone }));
-    fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
-  }
-  async function nextId(dir: string, title: string) {
-    const r = await runScript('next-prop-id.ts', { args: [hermit(dir)], stdin: title });
-    expect(r.exitCode).toBe(0);
-    return r.stdout.trim();
-  }
-
-  test('next-prop-id (starts at 001 on an empty proposals dir)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, 'First Proposal Ever')).toMatch(/^PROP-001-first-proposal-ever-\d{6}$/);
-  }));
-
-  test('next-prop-id (max + 1, zero-padded)', withDir(async (dir) => {
-    seedConfig(dir);
-    write(hermit(dir, 'proposals', 'PROP-005-foo-100000.md'), 'x');
-    write(hermit(dir, 'proposals', 'PROP-006-bar-110000.md'), 'x');
-    expect(await nextId(dir, 'Next One')).toMatch(/^PROP-007-next-one-\d{6}$/);
-  }));
-
-  test('next-prop-id (stopword-only title falls back to pre-filter tokens)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, 'the a of and')).toMatch(/^PROP-001-the-a-of-and-\d{6}$/);
-  }));
-
-  test('next-prop-id (long single token hard-cut to 40 chars)', withDir(async (dir) => {
-    seedConfig(dir);
-    const id = await nextId(dir, 'supercalifragilisticexpialidocioussupercalifragilisticexpialidocious');
-    const slug = id.replace(/^PROP-001-/, '').replace(/-\d{6}$/, '');
-    expect(slug.length).toBe(40);
-  }));
-
-  test('next-prop-id (all-punctuation title falls back to literal "proposal")', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, '!!!???...')).toMatch(/^PROP-001-proposal-\d{6}$/);
-  }));
-
-  test('next-prop-id (apostrophe survives via stdin)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, "bob's widget")).toMatch(/^PROP-001-bob-s-widget-\d{6}$/);
-  }));
-
-  test('next-prop-id (argv mode works for apostrophe-free titles)', withDir(async (dir) => {
-    seedConfig(dir);
-    const r = await runScript('next-prop-id.ts', { args: [hermit(dir), 'Argv Title'] });
-    expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toMatch(/^PROP-001-argv-title-\d{6}$/);
-  }));
-
-  // No test for the letter-suffix collision branch itself: `num` is always freshly
-  // computed as max(existing NNNs)+1 from the same directory the collision check
-  // scans, so no sequential call can ever see a pre-existing file at its own freshly
-  // computed NNN — the branch guards a genuine concurrent-read race (two invocations
-  // sharing one pre-race directory snapshot), which isn't reproducible via sequential
-  // black-box CLI calls. The repeated-title test above already confirms sequential
-  // calls always get distinct, monotonically increasing ids without ever needing it.
-  test('next-prop-id (repeated same-title calls always get distinct, incrementing ids)', withDir(async (dir) => {
-    seedConfig(dir);
-    const id1 = await nextId(dir, 'Repeat Title');
-    write(hermit(dir, 'proposals', `${id1}.md`), 'placeholder');
-    const id2 = await nextId(dir, 'Repeat Title');
-    expect(id2).not.toBe(id1);
-    expect(id2).toMatch(/^PROP-002-repeat-title-\d{6}$/);
-  }));
-
-  test('next-prop-id (missing state dir exits 1)', async () => {
-    const r = await runScript('next-prop-id.ts', { args: ['/nonexistent/hermit/state/dir', 'Title'] });
-    expect(r.exitCode).toBe(1);
-  });
-});
-
-// -------------------------------------------------------
-// record-gate.ts (subprocess — gate-verdict parsing + metric append + routing)
-// -------------------------------------------------------
-
-describe('record-gate', () => {
+describe('proposal gate', () => {
   async function gate(dir: string, opts: { gate: 'triage' | 'judge'; caller?: string; evidenceSource?: string; tags?: string[] }, title: string, verdict: string) {
-    const args = [hermit(dir), '--gate', opts.gate, '--caller', opts.caller ?? 'reflect'];
+    const args = ['gate', hermit(dir), '--gate', opts.gate, '--caller', opts.caller ?? 'reflect'];
     if (opts.evidenceSource) args.push('--evidence-source', opts.evidenceSource);
     if (opts.tags) args.push('--tags', JSON.stringify(opts.tags));
-    const r = await runScript('record-gate.ts', { args, stdin: `Title: ${title}\nVerdict: ${verdict}\n` });
+    const r = await runScript('proposal.ts', { args, stdin: `Title: ${title}\nVerdict: ${verdict}\n` });
     expect(r.exitCode).toBe(0);
     return r.stdout.trim();
   }
@@ -1487,7 +1409,7 @@ describe('record-gate', () => {
     return fs.readFileSync(p, 'utf-8').trim().split('\n').filter(Boolean).map(l => JSON.parse(l));
   }
 
-  test('record-gate (triage CREATE -> PROCEED + triage-verdict event)', withDir(async (dir) => {
+  test('gate (triage CREATE -> PROCEED + triage-verdict event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage', caller: 'proposal-create', evidenceSource: 'capability-brainstorm', tags: ['capability-brainstorm'] }, 'Foo', 'CREATE: Foo');
     expect(out).toBe('PROCEED|CREATE');
     const lines = ledgerLines(dir);
@@ -1495,68 +1417,68 @@ describe('record-gate', () => {
     expect(lines[0]).toMatchObject({ type: 'triage-verdict', verdict: 'CREATE', caller: 'proposal-create', evidence_source: 'capability-brainstorm', tags: ['capability-brainstorm'] });
   }));
 
-  test('record-gate (triage SUPPRESS -> DROP with code)', withDir(async (dir) => {
+  test('gate (triage SUPPRESS -> DROP with code)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'SUPPRESS: Foo — weak-recurrence: one-off ("excerpt")');
     expect(out).toBe('DROP|SUPPRESS:weak-recurrence');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'triage-verdict', verdict: 'SUPPRESS' });
   }));
 
-  test('record-gate (triage DUPLICATE -> DROP with PROP-ID)', withDir(async (dir) => {
+  test('gate (triage DUPLICATE -> DROP with PROP-ID)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'DUPLICATE: Foo — PROP-019: same problem');
     expect(out).toBe('DROP|DUPLICATE:PROP-019');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'triage-verdict', verdict: 'DUPLICATE' });
   }));
 
-  test('record-gate (triage garbled verdict -> GATE_FAILED + gate-failed event)', withDir(async (dir) => {
+  test('gate (triage garbled verdict -> GATE_FAILED + gate-failed event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'garbled nonsense');
     expect(out).toBe('GATE_FAILED');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'gate-failed', agent: 'proposal-triage', title: 'Foo' });
   }));
 
-  test('record-gate (judge ACCEPT -> PROCEED, no ledger event)', withDir(async (dir) => {
+  test('gate (judge ACCEPT -> PROCEED, no ledger event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'ACCEPT: Bar');
     expect(out).toBe('PROCEED|ACCEPT');
     expect(ledgerLines(dir)).toHaveLength(0);
   }));
 
-  test('record-gate (judge ACCEPT with source tag)', withDir(async (dir) => {
+  test('gate (judge ACCEPT with source tag)', withDir(async (dir) => {
     expect(await gate(dir, { gate: 'judge' }, 'Bar', 'ACCEPT (current-session): Bar')).toBe('PROCEED|ACCEPT');
   }));
 
-  test('record-gate (judge DOWNGRADE -> PROCEED with tier)', withDir(async (dir) => {
+  test('gate (judge DOWNGRADE -> PROCEED with tier)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'DOWNGRADE:2: Bar — auto-closed-evidence');
     expect(out).toBe('PROCEED|DOWNGRADE:2');
   }));
 
-  test('record-gate (judge DOWNGRADE quarantine — tier passes through as-is)', withDir(async (dir) => {
+  test('gate (judge DOWNGRADE quarantine — tier passes through as-is)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'DOWNGRADE:3 (current-session): Bar — quarantine: external origin');
     expect(out).toBe('PROCEED|DOWNGRADE:3');
   }));
 
-  test('record-gate (judge SUPPRESS -> DROP with code, no ledger event)', withDir(async (dir) => {
+  test('gate (judge SUPPRESS -> DROP with code, no ledger event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'SUPPRESS: Bar — no-sessions: no cross-session evidence cited');
     expect(out).toBe('DROP|SUPPRESS:no-sessions');
     expect(ledgerLines(dir)).toHaveLength(0);
   }));
 
-  test('record-gate (judge empty verdict -> GATE_FAILED + gate-failed event tagged reflection-judge)', withDir(async (dir) => {
+  test('gate (judge empty verdict -> GATE_FAILED + gate-failed event tagged reflection-judge)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', '');
     expect(out).toBe('GATE_FAILED');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'gate-failed', agent: 'reflection-judge', title: 'Bar' });
   }));
 
-  test('record-gate (invalid --gate value -> GATE_FAILED)', withDir(async (dir) => {
+  test('gate (invalid --gate value -> GATE_FAILED)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'bogus' as any }, 'Foo', 'CREATE: Foo');
     expect(out).toBe('GATE_FAILED');
   }));
 
-  test('record-gate (missing state/ subdir does not crash — creates it before appending)', async () => {
+  test('gate (missing state/ subdir does not crash — creates it before appending)', async () => {
     // Regression: appendJsonlLine's fs.appendFileSync throws ENOENT if state/ doesn't
     // exist yet, which would violate this script's own "Exit 0 always" contract.
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'record-gate-nodir-'));
     try {
-      const r = await runScript('record-gate.ts', {
-        args: [dir, '--gate', 'triage', '--caller', 'test'],
+      const r = await runScript('proposal.ts', {
+        args: ['gate', dir, '--gate', 'triage', '--caller', 'test'],
         stdin: 'Title: Foo\nVerdict: CREATE: Foo\n',
       });
       expect(r.exitCode).toBe(0);
@@ -1570,16 +1492,16 @@ describe('record-gate', () => {
 });
 
 // -------------------------------------------------------
-// queue-micro-proposal.ts (subprocess — MP-id generation + dedup + queue write)
+// proposal.ts queue-micro (subprocess — MP-id generation + dedup + queue write)
 // -------------------------------------------------------
 
-describe('queue-micro-proposal', () => {
+describe('proposal queue-micro', () => {
   function seed(dir: string) {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[]}');
   }
   async function queue(dir: string, payload: any) {
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify(payload) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify(payload) });
     expect(r.exitCode).toBe(0);
     return r.stdout.trim();
   }
@@ -1587,7 +1509,7 @@ describe('queue-micro-proposal', () => {
     return readJson(hermit(dir, 'state', 'micro-proposals.json'));
   }
 
-  test('queue-micro-proposal (first entry of the day is N=0)', withDir(async (dir) => {
+  test('queue-micro (first entry of the day is N=0)', withDir(async (dir) => {
     seed(dir);
     const out = await queue(dir, { tier: 1, question: 'For 3 weeks I added the same hashtags. Automate it? Yes / No' });
     expect(out).toMatch(/^QUEUED\|MP-\d{8}-0$/);
@@ -1596,7 +1518,7 @@ describe('queue-micro-proposal', () => {
     expect(micro.pending[0]).toMatchObject({ tier: 1, status: 'pending', follow_up_count: 0 });
   }));
 
-  test('queue-micro-proposal (N increments within the same day)', withDir(async (dir) => {
+  test('queue-micro (N increments within the same day)', withDir(async (dir) => {
     seed(dir);
     const out1 = await queue(dir, { tier: 1, question: 'Question A' });
     const out2 = await queue(dir, { tier: 2, question: 'Question B' });
@@ -1605,7 +1527,7 @@ describe('queue-micro-proposal', () => {
     expect(n2).toBe(n1 + 1);
   }));
 
-  test('queue-micro-proposal (dedup by exact question match)', withDir(async (dir) => {
+  test('queue-micro (dedup by exact question match)', withDir(async (dir) => {
     seed(dir);
     const out1 = await queue(dir, { tier: 1, question: 'Same question here' });
     const id1 = out1.split('|')[1];
@@ -1614,7 +1536,7 @@ describe('queue-micro-proposal', () => {
     expect(microFile(dir).pending).toHaveLength(1);
   }));
 
-  test('queue-micro-proposal (on_resolve forces tier 1 and tags the event kind:ask)', withDir(async (dir) => {
+  test('queue-micro (on_resolve forces tier 1 and tags the event kind:ask)', withDir(async (dir) => {
     seed(dir);
     await queue(dir, { tier: 3, question: 'Bridged Q?', options: ['a', 'b'], on_resolve: '/skill accept {answer}' });
     const entry = microFile(dir).pending[0];
@@ -1625,7 +1547,7 @@ describe('queue-micro-proposal', () => {
     expect(ledger[0]).toMatchObject({ type: 'micro-queued', tier: 1, kind: 'ask' });
   }));
 
-  test('queue-micro-proposal (preserves existing pending entries on write)', withDir(async (dir) => {
+  test('queue-micro (preserves existing pending entries on write)', withDir(async (dir) => {
     seed(dir);
     write(hermit(dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending: [{ id: 'MP-20260101-0', tier: 1, status: 'pending', follow_up_count: 0, ts: '2026-01-01T00:00:00Z', question: 'Old question' }] }));
     await queue(dir, { tier: 1, question: 'New question' });
@@ -1634,31 +1556,31 @@ describe('queue-micro-proposal', () => {
     expect(pending[0].id).toBe('MP-20260101-0');
   }));
 
-  test('queue-micro-proposal (missing question -> exit 1, no write)', withDir(async (dir) => {
+  test('queue-micro (missing question -> exit 1, no write)', withDir(async (dir) => {
     seed(dir);
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1 }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1 }) });
     expect(r.exitCode).toBe(1);
   }));
 
-  test('queue-micro-proposal (invalid JSON -> exit 1, no write)', withDir(async (dir) => {
+  test('queue-micro (invalid JSON -> exit 1, no write)', withDir(async (dir) => {
     seed(dir);
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: 'not-json' });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: 'not-json' });
     expect(r.exitCode).toBe(1);
   }));
 
-  test('queue-micro-proposal (corrupt existing file -> exit 1, refuses to overwrite)', withDir(async (dir) => {
+  test('queue-micro (corrupt existing file -> exit 1, refuses to overwrite)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
 
-  test('queue-micro-proposal (parseable file with no `pending` key -> heals, other keys preserved)', withDir(async (dir) => {
+  test('queue-micro (parseable file with no `pending` key -> heals, other keys preserved)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"active":null}');
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
     expect(r.exitCode).toBe(0);
     const micro = readJson(hermit(dir, 'state', 'micro-proposals.json'));
     expect(micro.pending).toHaveLength(1);
@@ -1667,10 +1589,10 @@ describe('queue-micro-proposal', () => {
 });
 
 // -------------------------------------------------------
-// micro-proposal.ts (subprocess — resolve/nudge, issue 649 regression)
+// proposal.ts micro (subprocess — resolve/nudge, issue 649 regression)
 // -------------------------------------------------------
 
-describe('micro-proposal', () => {
+describe('proposal micro', () => {
   function seed(dir: string, pending: any[]) {
     write(hermit(dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending }));
   }
@@ -1685,7 +1607,7 @@ describe('micro-proposal', () => {
 
   test('resolve (issue 649 regression: file stays parseable and holds the surviving entry after removal)', withDir(async (dir) => {
     seed(dir, [entryA, entryB]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe(`RESOLVED|${entryA.id}|approved`);
     const raw = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
@@ -1697,7 +1619,7 @@ describe('micro-proposal', () => {
 
   test('nudge (increments follow_up_count, leaves other fields intact)', withDir(async (dir) => {
     seed(dir, [entryA]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'nudge', entryA.id] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'nudge', entryA.id] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe(`NUDGED|${entryA.id}|1`);
     const entry = microFile(dir).pending[0];
@@ -1708,7 +1630,7 @@ describe('micro-proposal', () => {
   test('resolve on a corrupt file -> exit 1, file byte-unchanged', withDir(async (dir) => {
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-1', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-1', '--action', 'approved'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1716,7 +1638,7 @@ describe('micro-proposal', () => {
   test('resolve unknown id -> NONE|no-match, exit 0, no write', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-does-not-exist', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-does-not-exist', '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('NONE|no-match');
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
@@ -1724,14 +1646,14 @@ describe('micro-proposal', () => {
 
   test('resolve --action answered --answer emits the ledger event shape', withDir(async (dir) => {
     seed(dir, [entryA]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'answered', '--answer', 'session task'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'answered', '--answer', 'session task'] });
     expect(r.exitCode).toBe(0);
     const events = ledger(dir);
     expect(events[0]).toMatchObject({ type: 'micro-resolved', micro_id: entryA.id, action: 'answered', answer: 'session task', question: entryA.question });
   }));
 
   test('resolve on absent file -> NONE|no-match, exit 0', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-anything', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-anything', '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('NONE|no-match');
   }));
@@ -1739,7 +1661,7 @@ describe('micro-proposal', () => {
   test('resolve with missing --action -> exit 1, file unchanged', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1747,14 +1669,14 @@ describe('micro-proposal', () => {
   test('resolve with the <MP-id> omitted -> exit 1, never a silent NONE|no-match', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', '--action', 'approved'] });
     expect(r.exitCode).toBe(1);
     expect(r.stdout).not.toContain('NONE|no-match');
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
 
   test('unknown verb -> exit 1 even when the file is absent', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'expire', 'MP-20260101-0'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'expire', 'MP-20260101-0'] });
     expect(r.exitCode).toBe(1);
     expect(r.stdout).not.toContain('NONE|no-match');
   }));
@@ -1762,7 +1684,7 @@ describe('micro-proposal', () => {
   test('resolve with invalid --action -> exit 1, file unchanged', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'bogus'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'bogus'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1772,7 +1694,7 @@ describe('micro-proposal', () => {
     const c1 = { id: 'MP-c1', tier: 1, status: 'pending', follow_up_count: 1, question: 'q1' };
     const c2 = { id: 'MP-c2', tier: 1, status: 'pending', follow_up_count: 2, question: 'q2' };
     seed(dir, [c0, c1, c2]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     const verdict = JSON.parse(r.stdout.trim());
     // `tier` is carried through — the brief renders "(tier N)" from the verdict alone.
@@ -1792,7 +1714,7 @@ describe('micro-proposal', () => {
   test('brief-cycle on an all-count-0 queue is a pure read (no write, no ledger)', withDir(async (dir) => {
     seed(dir, [entryA, entryB]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     const verdict = JSON.parse(r.stdout.trim());
     expect(verdict.new).toHaveLength(2);
@@ -1803,7 +1725,7 @@ describe('micro-proposal', () => {
   }));
 
   test('brief-cycle on an absent file -> empty verdict, exit 0, no write', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     expect(JSON.parse(r.stdout.trim())).toEqual({ new: [], renudged: [], expired: [] });
     expect(fs.existsSync(hermit(dir, 'state', 'micro-proposals.json'))).toBe(false);
@@ -1812,7 +1734,7 @@ describe('micro-proposal', () => {
   test('brief-cycle on a corrupt file -> exit 1, file byte-unchanged', withDir(async (dir) => {
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1920,7 +1842,7 @@ describe('update-reflection-state', () => {
 });
 
 // -------------------------------------------------------
-// heartbeat-precheck.ts (subprocess — argv/stdout/state-mutation CLI contract)
+// heartbeat.ts precheck (subprocess — argv/stdout/state-mutation CLI contract)
 // -------------------------------------------------------
 
 const DEFAULT_CHECKLIST = '# Heartbeat\n- Review proposals/ for any needing attention\n';
@@ -1942,8 +1864,8 @@ function seedHeartbeat(dir: string, opts: {
 }
 
 async function precheckOut(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: peek ? ['--peek', hermit(dir)] : [hermit(dir)],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek', hermit(dir)] : [hermit(dir)])],
   });
   expect(r.exitCode).toBe(0);
   return r.stdout.trimEnd();
@@ -2150,8 +2072,8 @@ function seedDamper(dir: string, opts: {
 }
 
 async function precheckWithNow(dir: string, nowIso: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: peek ? ['--peek', hermit(dir)] : [hermit(dir)],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek', hermit(dir)] : [hermit(dir)])],
     env: { HERMIT_NOW: nowIso },
   });
   expect(r.exitCode).toBe(0);
@@ -2690,11 +2612,10 @@ describe('reflect-precheck', () => {
 });
 
 // -------------------------------------------------------
-// log-routine-event.sh — resolves hermit root by walking up from CWD
+// routines.ts log-event — resolves hermit root by walking up from CWD
 // -------------------------------------------------------
 
-describe('log-routine-event', () => {
-  const SCRIPT = path.join(SCRIPTS_DIR, 'log-routine-event.sh');
+describe('routines.ts log-event', () => {
 
   // Empirically confirmed (bun 1.3.14): describe.serial does not reliably
   // force sequential execution of its own child tests under --concurrent —
@@ -2709,23 +2630,23 @@ describe('log-routine-event', () => {
     });
     afterAll(() => wd.cleanup());
 
-    test.serial('log-routine-event (subdir resolves to ancestor)', async () => {
+    test.serial('log-event (subdir resolves to ancestor)', async () => {
       // Fired from a subdirectory → appends to the ancestor's state file
-      await runBash(SCRIPT, { args: ['morning-brief', 'fired'], cwd: path.join(wd.dir, 'app', 'sub') });
+      await runScript('routines.ts', { args: ['log-event', 'morning-brief', 'fired'], cwd: path.join(wd.dir, 'app', 'sub') });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"morning-brief","event":"fired"');
     });
 
-    test.serial('log-routine-event (root resolves to state file)', async () => {
+    test.serial('log-event (root resolves to state file)', async () => {
       // Fired from the hermit root → unchanged behavior
-      await runBash(SCRIPT, { args: ['weekly-review', 'skipped-waiting'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'weekly-review', 'skipped-waiting'], cwd: wd.dir });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"weekly-review","event":"skipped-waiting"');
     });
 
-    test.serial('log-routine-event (started event serializes correctly)', async () => {
+    test.serial('log-event (started event serializes correctly)', async () => {
       // started marker emitted before skill invocation — must serialize like other events
-      await runBash(SCRIPT, { args: ['daily-brief', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'daily-brief', 'started'], cwd: wd.dir });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"daily-brief","event":"started"');
     });
@@ -2748,16 +2669,16 @@ describe('log-routine-event', () => {
     afterAll(() => wd.cleanup());
 
     test.serial('suppresses a fired that immediately follows another fired', async () => {
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'started'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
       expect(firedCount()).toBe(1);
     });
 
     test.serial('allows the next legitimate started→fired cycle', async () => {
       const before = firedCount();
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'started'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
       expect(firedCount()).toBe(before + 1);
     });
   });
@@ -2770,7 +2691,7 @@ describe('log-routine-event', () => {
     beforeAll(async () => {
       const nohermit = fs.mkdtempSync(path.join(os.tmpdir(), 'no-hermit-'));
       try {
-        const r = await runBash(SCRIPT, { args: ['x', 'fired'], cwd: nohermit });
+        const r = await runScript('routines.ts', { args: ['log-event', 'x', 'fired'], cwd: nohermit });
         exitCode = r.exitCode;
         stderr = r.stderr;
       } finally {
@@ -3110,11 +3031,11 @@ describe('pricing', () => {
 });
 
 // -------------------------------------------------------
-// cost-reflect.ts (subprocess — CWD-relative cost-log read, stdout report)
+// cost-report.ts reflect (subprocess — CWD-relative cost-log read, stdout report)
 // -------------------------------------------------------
 
 async function runCostReflect(dir: string): Promise<string> {
-  const r = await runScript('cost-reflect.ts', { args: ['.claude-code-hermit'], cwd: dir });
+  const r = await runScript('cost-report.ts', { args: ['reflect', '.claude-code-hermit'], cwd: dir });
   return r.stdout + r.stderr;
 }
 
@@ -3226,7 +3147,7 @@ describe('cost-reflect', () => {
 
   // Missing log: .claude/cost-log.jsonl does not exist
   test("cost-reflect: missing log → 'No cost data' (exit 0)", withDir(async (dir) => {
-    const r = await runScript('cost-reflect.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('cost-report.ts', { args: ['reflect', '.claude-code-hermit'], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout + r.stderr).toMatch(/no cost data/i);
   }));
@@ -3593,7 +3514,7 @@ describe('cost-tracker sumTurnUsage', () => {
 });
 
 // -------------------------------------------------------
-// cost-reflect.ts: source attribution tests (subprocess)
+// cost-report.ts reflect: source attribution tests (subprocess)
 // -------------------------------------------------------
 
 describe('cost-reflect source attribution', () => {
@@ -4076,29 +3997,29 @@ describe('channel-log', () => {
 });
 
 // -------------------------------------------------------
-// proposal-metrics-report.ts (subprocess — argv/stdout CLI contract)
+// proposal.ts metrics (subprocess — argv/stdout CLI contract)
 // -------------------------------------------------------
 
-describe('proposal-metrics-report', () => {
+describe('proposal metrics', () => {
   const runReport = async (dir: string, ...extra: string[]) => {
-    const r = await runScript('proposal-metrics-report.ts', { args: [hermit(dir), ...extra] });
+    const r = await runScript('proposal.ts', { args: ['metrics', hermit(dir), ...extra] });
     expect(r.exitCode).toBe(0);
     return r.stdout + r.stderr;
   };
   const metricsFile = (dir: string) => hermit(dir, 'state', 'proposal-metrics.jsonl');
 
   // Missing / empty file — fails open
-  test('proposal-metrics-report (missing file exits 0)', withDir(async (dir) => {
+  test('metrics (missing file exits 0)', withDir(async (dir) => {
     expect(await runReport(dir)).toContain('No proposal metrics');
   }));
 
-  test('proposal-metrics-report (empty file exits 0)', withDir(async (dir) => {
+  test('metrics (empty file exits 0)', withDir(async (dir) => {
     write(metricsFile(dir), '');
     expect(await runReport(dir)).toContain('No proposal metrics');
   }));
 
   // Insufficient sample (<8) — INSUFFICIENT output
-  test('proposal-metrics-report --source (INSUFFICIENT, n<8)', withDir(async (dir) => {
+  test('metrics --source (INSUFFICIENT, n<8)', withDir(async (dir) => {
     // 3 triage-verdicts from brainstorm + 2 created tagged brainstorm, 1 accepted
     write(metricsFile(dir), [
       '{"ts":"2026-01-01T00:00:00Z","type":"triage-verdict","verdict":"CREATE","caller":"proposal-create","evidence_source":"capability-brainstorm","tags":["capability-brainstorm"]}',
@@ -4133,20 +4054,20 @@ describe('proposal-metrics-report', () => {
       }
       lines.push('{"ts":"2026-01-01T02:00:00Z","type":"responded","proposal_id":"PROP-001","action":"accept"}');
       write(metricsFile(wd.dir), lines.join('\n') + '\n');
-      const r = await runScript('proposal-metrics-report.ts', {
-        args: [hermit(wd.dir), '--source=capability-brainstorm'],
+      const r = await runScript('proposal.ts', {
+        args: ['metrics', hermit(wd.dir), '--source=capability-brainstorm'],
       });
       out = r.stdout + r.stderr;
     });
     afterAll(() => wd.cleanup());
 
-    test('proposal-metrics-report --source (survival 40%)', () => {
+    test('metrics --source (survival 40%)', () => {
       expect(out).toContain('triage-survival 40%');
     });
-    test('proposal-metrics-report --source (acceptance 25%)', () => {
+    test('metrics --source (acceptance 25%)', () => {
       expect(out).toContain('acceptance 25%');
     });
-    test('proposal-metrics-report --source (KILL verdict)', () => {
+    test('metrics --source (KILL verdict)', () => {
       expect(out).toContain('KILL');
     });
   });
@@ -4165,24 +4086,24 @@ describe('proposal-metrics-report', () => {
         '{"ts":"2026-01-01T02:00:00Z","type":"responded","proposal_id":"PROP-R1","action":"accept"}',
         '',
       ].join('\n'));
-      const r = await runScript('proposal-metrics-report.ts', { args: [hermit(wd.dir)] });
+      const r = await runScript('proposal.ts', { args: ['metrics', hermit(wd.dir)] });
       out = r.stdout + r.stderr;
     });
     afterAll(() => wd.cleanup());
 
-    test('proposal-metrics-report table (header present)', () => {
+    test('metrics table (header present)', () => {
       expect(out).toContain('Proposal acceptance by source');
     });
-    test('proposal-metrics-report table (reflect row present)', () => {
+    test('metrics table (reflect row present)', () => {
       expect(out).toContain('| reflect |');
     });
-    test('proposal-metrics-report table (capability-brainstorm row present)', () => {
+    test('metrics table (capability-brainstorm row present)', () => {
       expect(out).toContain('| capability-brainstorm |');
     });
   });
 
   // Malformed line is skipped; valid events still counted
-  test('proposal-metrics-report (malformed line skipped)', withDir(async (dir) => {
+  test('metrics (malformed line skipped)', withDir(async (dir) => {
     write(metricsFile(dir), [
       'this is not json at all',
       '{"ts":"2026-01-01T00:01:00Z","type":"triage-verdict","verdict":"CREATE","caller":"reflect"}',
@@ -4192,7 +4113,7 @@ describe('proposal-metrics-report', () => {
   }));
 
   // --source with unknown key reports error gracefully
-  test('proposal-metrics-report (unknown --source key)', withDir(async (dir) => {
+  test('metrics (unknown --source key)', withDir(async (dir) => {
     write(metricsFile(dir),
       '{"ts":"2026-01-01T00:01:00Z","type":"triage-verdict","verdict":"CREATE","caller":"reflect"}\n');
     expect(await runReport(dir, '--source=nonexistent')).toContain('Unknown source key');
diff --git a/plugins/claude-code-hermit/tests/setup-token.test.ts b/plugins/claude-code-hermit/tests/setup-token.test.ts
index 8ced5881..ca7d3f2a 100644
--- a/plugins/claude-code-hermit/tests/setup-token.test.ts
+++ b/plugins/claude-code-hermit/tests/setup-token.test.ts
@@ -172,7 +172,7 @@ describe('auth-mode detection', () => {
 
 describe('doctor expiry probe', () => {
   const probe = async (hermitDir: string) =>
-    (await runScript('setup-token-probe.ts', { args: [hermitDir] })).stdout.trim();
+    (await runScript('setup-token-mint.ts', { args: ['probe', hermitDir] })).stdout.trim();
 
   test('no record → OK (not token mode is not a problem)', async () => {
     const root = tmpdir();
@@ -205,7 +205,7 @@ describe('doctor expiry probe', () => {
       fs.mkdirSync(hermitDir, { recursive: true });
       fs.mkdirSync(configDir, { recursive: true });
       installToken(hermitDir, configDir, VALID);
-      const out = (await runScript('setup-token-probe.ts', { args: [hermitDir] })).stdout;
+      const out = (await runScript('setup-token-mint.ts', { args: ['probe', hermitDir] })).stdout;
       expect(out.trim().split('\n')).toHaveLength(1);
       expect(out).not.toContain(VALID);
     } finally {
diff --git a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
index 80646f10..c6f334ed 100644
--- a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
+++ b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
@@ -1,6 +1,12 @@
-// Contract tests for scripts/shutdown-gate.ts — the deterministic shutdown gate.
-// Exercised as a subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL)
-// standing in for the platform, mirroring the channel-status-responder tests.
+// Contract tests for the deterministic shutdown gate —
+// scripts/lib/prompt-stages/shutdown-gate.ts, driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Exercised as a
+// subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL) standing in
+// for the platform, mirroring the channel-status-responder tests.
+//
+// Pipeline note: a block prints the decision JSON alone; a pass-through still
+// carries the earlier stages' context (`[Now: …]`, the reply reminder), so
+// "pass through" is asserted as the absence of the `[shutdown]` marker.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -36,7 +42,7 @@ function writeRuntime(wd: Workdir, patch: Record<string, unknown>): void {
 const PENDING = { shutdown_requested_at: '2026-07-24T09:00:00+0000', shutdown_completed_at: null };
 
 async function run(wd: Workdir, prompt: string, stubUrl: string) {
-  return runScript('shutdown-gate.ts', {
+  return runScript('user-prompt-pipeline.ts', {
     stdin: JSON.stringify({ prompt }),
     cwd: wd.dir,
     env: { HERMIT_TELEGRAM_API_URL: stubUrl },
@@ -64,7 +70,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, { shutdown_requested_at: null, shutdown_completed_at: null });
       const r = await run(wd, envelope('do something'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -77,7 +83,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, { shutdown_requested_at: '2026-07-24T09:00:00+0000', shutdown_completed_at: '2026-07-24T09:01:00+0000' });
       const r = await run(wd, envelope('do something'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -90,7 +96,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, PENDING);
       const r = await run(wd, 'just a normal operator prompt', stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -103,7 +109,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, PENDING);
       const r = await run(wd, envelope('do something', 'intruder'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -119,11 +125,15 @@ describe('shutdown-gate', () => {
     expect(r.stdout.toLowerCase()).toContain('shutdown is in progress');
   });
 
-  test('malformed stdin → exit 0, no output', async () => {
+  test('malformed stdin → exit 0, no relay and no block', async () => {
+    // The payload-independent stages still run (that is what emits `[Now:`), but
+    // with no parseable envelope the gate has no chat to answer on, so it stays
+    // silent rather than relaying into the void.
     const wd = setupChannelWorkdir();
     writeRuntime(wd, PENDING);
-    const r = await runScript('shutdown-gate.ts', { stdin: 'not json', cwd: wd.dir, env: {} });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: 'not json', cwd: wd.dir, env: {} });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('"decision":"block"');
+    expect(r.stdout.toLowerCase()).not.toContain('shutdown is in progress');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/template-skill-sync.test.ts b/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
index a950a228..5bcb52a8 100644
--- a/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
+++ b/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
@@ -131,32 +131,30 @@ describe('.worktreeinclude template', () => {
 });
 
 // -------------------------------------------------------
-// apply-settings.ts HERMIT_ALLOW <-> hatch/SKILL.md Step 8 allow-list
+// hatch no longer restates the allow-list — apply-settings.ts owns it, and hatch
+// reaches it through permissions-plan / permissions-sync. There is no second copy
+// to keep in sync; tests/apply-settings-permissions.test.ts covers the behavior.
 // -------------------------------------------------------
-describe('hatch allow-list sync', () => {
-  const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'apply-settings.ts');
-
-  function extractHermitAllow(): string[] {
-    const src = fs.readFileSync(SCRIPT_PATH, 'utf-8');
-    const m = src.match(/const HERMIT_ALLOW\s*=\s*(\[[\s\S]*?\]);/);
-    if (!m) throw new Error('HERMIT_ALLOW not found in apply-settings.ts');
-    return eval(m[1]) as string[];
-  }
-
-  function extractSkillAllow(): string[] {
+describe('hatch permission delegation', () => {
+  test('hatch/SKILL.md carries no copied allow-list JSON block', () => {
+    const allowBlocks: unknown[] = [];
     for (const block of skillContent.matchAll(/```json\n([\s\S]*?)```/g)) {
+      let parsed: any;
       try {
-        const parsed = JSON.parse(block[1]);
-        if (parsed?.permissions?.allow) return parsed.permissions.allow as string[];
+        parsed = JSON.parse(block[1]);
       } catch {
-        // non-JSON or unrelated JSON block — keep scanning
+        continue; // non-JSON or unrelated block — keep scanning
       }
+      // Collect, never assert inside the loop: an expect() thrown here would be
+      // caught by the parse guard above and silently pass the test.
+      if (parsed?.permissions?.allow) allowBlocks.push(parsed.permissions.allow);
     }
-    throw new Error('Step 8 allow-list JSON block not found in hatch/SKILL.md');
-  }
+    expect(allowBlocks).toEqual([]);
+  });
 
-  test('HERMIT_ALLOW matches hatch/SKILL.md Step 8 allow-list', () => {
-    expect(extractHermitAllow()).toEqual(extractSkillAllow());
+  test('hatch/SKILL.md Step 8 delegates to the permissions verbs', () => {
+    expect(skillContent).toContain('permissions-plan');
+    expect(skillContent).toContain('permissions-sync');
   });
 });
 
diff --git a/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
new file mode 100644
index 00000000..d487490d
--- /dev/null
+++ b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
@@ -0,0 +1,191 @@
+// Contract tests for scripts/user-prompt-pipeline.ts — the single UserPromptSubmit
+// process — covering the two things the seven-hook shape could not express.
+//
+// 1. Shutdown is terminal. While a shutdown is pending, no later stage runs: not
+//    status (which used to send and block on its own after a FAILED shutdown send,
+//    discarding the shutdown relay instruction), not pause/resume, not a harness
+//    command. Each of those was reachable by construction before, because no hook
+//    could see what another had already done.
+// 2. One disposition per prompt. A block prints the decision JSON alone — mixed
+//    context text alongside it does not parse as a decision and the block is lost.
+//
+// Driven as a subprocess against a local HTTP stub, mirroring shutdown-gate.test.ts
+// and channel-status-responder.test.ts.
+
+import { describe, test, expect } from 'bun:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { runScript } from './helpers/run';
+import { setupWorkdir, type Workdir } from './helpers/workdir';
+import { startHttpStub } from './helpers/http-stub';
+
+const hermit = (dir: string, ...p: string[]) => path.join(dir, '.claude-code-hermit', ...p);
+
+function envelope(body: string, user = 'u1', chatId = '12345'): string {
+  return `<channel source="telegram" chat_id="${chatId}" user="${user}">${body}</channel>`;
+}
+
+function setupChannelWorkdir(): Workdir {
+  const wd = setupWorkdir();
+  const stateDir = path.join(wd.dir, '.claude.local', 'channels', 'telegram');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, '.env'), 'TELEGRAM_BOT_TOKEN=test-token\n');
+  fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({
+    timezone: 'UTC',
+    channels: { telegram: { enabled: true, dm_channel_id: '12345', allowed_users: ['u1'], state_dir: '.claude.local/channels/telegram' } },
+  }));
+  return wd;
+}
+
+function writeRuntime(wd: Workdir, patch: Record<string, unknown>): void {
+  const p = hermit(wd.dir, 'state', 'runtime.json');
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify({ version: 1, session_state: 'in_progress', ...patch }));
+}
+
+// A shutdown in flight, plus the pane facts a harness command needs — so the
+// harness stage is refused for the shutdown, not for a missing tmux session.
+const PENDING_SHUTDOWN = {
+  shutdown_requested_at: '2026-07-24T09:00:00+0000',
+  shutdown_completed_at: null,
+  runtime_mode: 'headless',
+  tmux_session: 'hermit-test',
+};
+
+async function run(wd: Workdir, body: string, stubUrl: string) {
+  return runScript('user-prompt-pipeline.ts', {
+    stdin: JSON.stringify({ prompt: envelope(body) }),
+    cwd: wd.dir,
+    env: { HERMIT_TELEGRAM_API_URL: stubUrl },
+  });
+}
+
+describe('user-prompt-pipeline: shutdown is terminal', () => {
+  test('status during a pending shutdown → one send, one block, status never answers', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, 'status', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      expect(JSON.parse(r.stdout.trim())).toMatchObject({ decision: 'block' });
+      // Exactly one outbound message: the shutdown reply. Two would mean the
+      // status stage answered the same prompt.
+      expect(stub.requests.length).toBe(1);
+      // And the block is the ONLY thing on stdout — no [Now:], no reply reminder.
+      expect(r.stdout).not.toContain('[Now:');
+      expect(r.stdout).not.toContain('[status]');
+    } finally {
+      stub.stop();
+    }
+  });
+
+  test('status during a pending shutdown with a FAILED send → shutdown relay only, status never answers', async () => {
+    const wd = setupChannelWorkdir();
+    writeRuntime(wd, PENDING_SHUTDOWN);
+
+    // Dead listener: the shutdown send fails. Previously the prompt then fell
+    // through and the status stage composed its own relay, swallowing the
+    // shutdown instruction the model was supposed to act on. No stub here on
+    // purpose — both stages read the same HERMIT_TELEGRAM_API_URL, so a request
+    // count could not tell the two senders apart; the discriminator is that the
+    // `[status]` relay is absent while the `[shutdown]` one is present.
+    const r = await run(wd, 'status', 'http://127.0.0.1:1');
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[shutdown]');
+    expect(r.stdout).not.toContain('[status]');
+    expect(r.stdout).not.toContain('"decision"'); // a failed send must not block
+  });
+
+  test('a harness command during a pending shutdown is refused, not acknowledged', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, '/model opus', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      // The Stop-stage drain refuses to deliver a command during shutdown, so
+      // recording one here would acknowledge something that never lands.
+      expect(fs.existsSync(hermit(wd.dir, 'state', 'pending-harness-command.json'))).toBe(false);
+      expect(r.stdout).not.toContain('[harness-command]');
+    } finally {
+      stub.stop();
+    }
+  });
+
+  test('resume during a pending shutdown does not clear an existing pause', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      const pausePath = hermit(wd.dir, 'state', 'pause.json');
+      fs.mkdirSync(path.dirname(pausePath), { recursive: true });
+      fs.writeFileSync(pausePath, JSON.stringify({ paused: true, reason: 'operator', by: 'u1' }));
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, 'resume', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      expect(JSON.parse(fs.readFileSync(pausePath, 'utf-8')).paused).toBe(true);
+      expect(r.stdout).not.toContain('[pause]');
+    } finally {
+      stub.stop();
+    }
+  });
+});
+
+describe('user-prompt-pipeline: fail-open contract', () => {
+  test('malformed stdin exits 0 and still runs the payload-independent stages', async () => {
+    // A prompt did arrive — MAX_STDIN_BYTES truncation is what cuts it mid-JSON —
+    // so the turn must still be recorded and timestamped.
+    const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: wd.dir });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'operator-turn-open.json'))).toBe(true);
+  });
+
+  test('empty stdin exits 0 and emits nothing', async () => {
+    const wd = setupWorkdir();
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: wd.dir });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout.trim()).toBe('');
+  });
+
+  test('an over-cap prompt is truncated but still recorded', async () => {
+    const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: JSON.stringify({ prompt: 'x'.repeat(1024 * 1024 + 512) }),
+      cwd: wd.dir,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+  });
+
+  test('an ordinary prompt still records the operator-action markers', async () => {
+    const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: JSON.stringify({ prompt: 'do a thing' }),
+      cwd: wd.dir,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'operator-turn-open.json'))).toBe(true);
+  });
+});
diff --git a/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
index 549cfbf3..f621f912 100644
--- a/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
@@ -1,7 +1,7 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   },
   "hermit": {
     "boot_skill": "/claude-code-homeassistant-hermit:ha-boot"
diff --git a/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json b/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
index 428e6ad6..e2420f17 100644
--- a/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
@@ -18,7 +18,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ]
 }
diff --git a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
index 45dbd3cf..820ed425 100644
--- a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
+++ b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
@@ -8,9 +8,10 @@
 ### Fixed
 - `domain-brainstorm` no longer writes its own `brainstorm-emit` event — core's triage gate already records every verdict. Proposals now carry `tags: [capability-brainstorm]` instead of `[domain-brainstorm, ideation]`, so they count toward the brainstorm kill-criteria segment rather than `reflect`'s.
 - `ha-boot` and `SAFETY.md` no longer point the operator at a `.env.example` that does not ship; replaced with a direct "create `.env`" instruction.
-- `ha-morning-brief`'s micro-proposal lifecycle now runs in one `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle` call through core's writer (one atomic round-trip that re-nudges, expires, and records expiries), instead of two inline `bun -e` re-implementations of that writer — so a nudge, an expiry, or a crash mid-write can no longer corrupt the queue.
+- `ha-morning-brief`'s micro-proposal lifecycle now runs in one `.claude-code-hermit/bin/hermit-run proposal micro .claude-code-hermit brief-cycle` call through core's writer (one atomic round-trip that re-nudges, expires, and records expiries), instead of two inline `bun -e` re-implementations of that writer — so a nudge, an expiry, or a crash mid-write can no longer corrupt the queue.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal micro …` / `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 
 ### Changed
diff --git a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
index 6e46d658..82f62cec 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand HA-voice brainstorm — reads entity inventory, automatio
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
index f6520ed9..d007153e 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
@@ -55,7 +55,7 @@ When both `claude-code-hermit` and `claude-code-homeassistant-hermit` are instal
    - Read `.claude-code-hermit/cost-summary.md` if it exists — include yesterday's cost
 
 <!-- keep in sync with plugins/claude-code-hermit/skills/brief/SKILL.md — same MP lifecycle protocol -->
-9a. **Micro-proposals lifecycle** — age the queue in one call: `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle`. This runs core's writer through the project-resident `bin/hermit-run`, which resolves core's plugin root (a static `../claude-code-hermit/…` path can't — HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/` and the version segment isn't knowable from skill text). It performs the whole `follow_up_count` 0/1/2+ lifecycle atomically (re-nudges count-1 entries, expires count-2+ entries, records each expiry) and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}`. Never hand-edit `state/micro-proposals.json`. Render from that verdict:
+9a. **Micro-proposals lifecycle** — age the queue in one call: `.claude-code-hermit/bin/hermit-run proposal micro .claude-code-hermit brief-cycle`. This runs core's writer through the project-resident `bin/hermit-run`, which resolves core's plugin root (a static `../claude-code-hermit/…` path can't — HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/` and the version segment isn't knowable from skill text). It performs the whole `follow_up_count` 0/1/2+ lifecycle atomically (re-nudges count-1 entries, expires count-2+ entries, records each expiry) and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}`. Never hand-edit `state/micro-proposals.json`. Render from that verdict:
    - Each `new` entry: include in `Awaiting decision:` output (see Output Format).
    - Each `renudged` entry: include in `Awaiting decision:` with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)".
    - `expired` entries were dropped this cycle — do not surface them.