From 495b2c86382a99130c9de146fe2ca3fc64574836 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 16:00:06 +0100
Subject: [PATCH 1/9] refactor(claude-code-hermit): make apply-settings the
 sole owner of hermit permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The allow-list lived in three places — apply-settings.ts's sealed array, a copied
JSON block in hatch/SKILL.md, and a prose list in hermit-evolve/reference.md that
had already drifted to 15 of 33 entries. Nothing could remove a stale entry either:
scrubbing was hand-written prose the model executed, so a deleted script's
permission lingered in every hatched hermit forever.

apply-settings.ts gains permissions-plan (read-only diff) and permissions-sync
(apply it). Removal is filtered through a sealed HERMIT_OBSOLETE registry, so an
operator's own rules can never be caught by it. hatch and hermit-evolve now call
the verbs; both copies of the list are gone, and future script deletions reach
installed hermits by appending one registry line.

next-prop-id.ts goes with it — no production caller, since proposal.ts create
claims IDs atomically via exclusive create. Its prediction-only helpers
(nextPropId, resolveSuffix, PropIdParts) are deleted too; the slug and numbering
cases they covered move to direct lib unit tests.

A no-op sync deliberately skips the write so an upgrade never reformats a settings
file it had nothing to change.
---
 plugins/claude-code-hermit/CHANGELOG.md       |   9 +-
 .../scripts/apply-settings.ts                 |  96 ++++++++++--
 .../claude-code-hermit/scripts/lib/prop-id.ts |  45 +-----
 .../scripts/next-prop-id.ts                   |  48 ------
 .../claude-code-hermit/skills/hatch/SKILL.md  |  69 ++-------
 .../skills/hermit-evolve/reference.md         |  15 +-
 .../tests/apply-settings-permissions.test.ts  | 144 ++++++++++++++++++
 .../tests/contracts.test.ts                   |  29 ++--
 .../tests/proposal-lib.test.ts                |  81 ++++++----
 .../claude-code-hermit/tests/scripts.test.ts  |  78 ----------
 .../tests/template-skill-sync.test.ts         |  36 +++--
 11 files changed, 345 insertions(+), 305 deletions(-)
 delete mode 100644 plugins/claude-code-hermit/scripts/next-prop-id.ts
 create mode 100644 plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts

diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 544035a4..82ff39cb 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -7,6 +7,7 @@
 - `config.effort` — passed as `--effort` on every `hermit-start`, mirroring `config.model`, so a channel effort change reverts on restart instead of persisting. Ships `null` (no flag, model default); set it to opt into the revert-on-restart guarantee. Not the same lever as `config.env.CLAUDE_CODE_EFFORT_LEVEL`, which pins the session and makes a runtime `/effort` a no-op.
 - `micro-proposal.ts brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
 - Two `Bash(.claude-code-hermit/bin/hermit-run <script> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
+- `apply-settings.ts permissions-plan` and `permissions-sync` — the script now owns hermit's permission list end to end. `permissions-plan` prints `{"missing":[],"obsolete":[]}` without writing; `permissions-sync` applies it, adding sealed entries and removing only entries a previous plugin version shipped and has since retired. Operator-authored rules are never removed — deletion is filtered by a sealed registry, not by shape.
 
 ### Fixed
 - A `/clear` reaching the pane outside the watchdog no longer skips the hermit's own reset bookkeeping. The runtime stamp, `SHELL.md` breadcrumb, and status-cache clear moved to `lib/context-reset.ts`; skipping the cache clear previously let the watchdog fire a spurious `/compact` against a freshly-cleared context.
@@ -26,18 +27,20 @@
 - `hermit-evolve`'s sibling upgrade now applies `local > project` scope precedence when the same sibling is installed at both scopes in one project, matching `resolve-siblings.ts` and Claude Code's own settings layering — it previously read the project-scope install's version and changelog while the session was running the local-scope one.
 - `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches `micro-proposal.ts` via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
 
+### Removed
+- `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
+
 ### Changed
 - Proactive operator notifications unified onto `channel-send.ts --notice`; `weekly-review`, `cost-reflect`, and (via § Operator Notification) `heartbeat`/`brief`/`capability-brainstorm` are tier-aware, so spend and technical detail no longer reach the client chat. On a `non-technical` install with no `maintainer_channel_id`, routine spend reports now land in `SHELL.md` Findings instead of the primary chat.
+- `hatch` Step 8 and `hermit-evolve` Step 8 no longer restate the permission list — both call the new verbs. Two copies of the list are gone, along with the hand-maintained stale-entry list in `hermit-evolve/reference.md`, which had drifted to 15 of the canonical entries and told the model to add a `Write` rule the writer deliberately strips. The delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - The core CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-hermit: Session Discipline -->`), matching `claude-code-homeassistant-hermit`/`claude-code-fitness-hermit`/`feed-hermit`/`laravel-forge-hermit`. Bounds detection still falls back correctly for already-installed blocks that predate the marker.
-- `hermit-evolve` Step 8 now delegates the permission merge to `bun scripts/apply-settings.ts <settings-file> allow` instead of maintaining a hand-enumerated script list in prose. The prose list had drifted to 15 of the canonical 28 entries and told the model to add a `Write` rule the writer deliberately strips; the delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
-2. Re-run `/claude-code-hermit:hatch` (or the settings refresh) on existing installs so `Bash(bun */scripts/channel-send.ts*)` lands in the operator's settings allow-list — without it, the proactive notify path prompts/denies in unattended sessions.
+2. Run `bun <plugin_root>/scripts/apply-settings.ts <settings-file> permissions-sync` against the install's settings file (`.claude/settings.local.json` for a `local` hatch target, `.claude/settings.json` for `committed`). This is now the one step that reconciles permissions: it adds every sealed entry the install is missing — including `channel-send.ts` and `micro-proposal.ts`, both new this version — and scrubs entries from retired plugin versions, `next-prop-id.ts` among them. It replaces the per-entry "re-run hatch so X lands in the allow-list" instructions.
 3. If `claude-code-dev-hermit` is installed and its CLAUDE.md/CLAUDE.local.md contains the literal string `<!-- mode:standard-only -->`, a prior version of `hermit-evolve` hit the marker-discovery bug above and appended the raw, un-rendered dev-hermit template. Remove the entire stray block (from the first `<!-- mode:standard-only -->` or `<!-- mode:safety-only -->` line it introduced through the end of that appended region) — the correctly-rendered `<!-- claude-code-dev-hermit: Development Workflow -->` block elsewhere in the file is unaffected and should be left in place.
 4. If an operator customized their CLAUDE-APPEND block in place (core, `hermit-scribe`, or `claude-code-dev-hermit`), note that the next version-gap sync for that plugin will replace it with the shipped template now that closing markers make the block bounds authoritative — re-apply any customization after that sync.
-3. Re-run `/claude-code-hermit:hatch` (or the settings refresh) on existing installs so `Bash(bun */scripts/micro-proposal.ts*)` lands in the operator's settings allow-list — without it, micro-approval resolve/expire/nudge is functionally denied in unattended sessions.
 
 ## [1.2.33] - 2026-07-24
 
diff --git a/plugins/claude-code-hermit/scripts/apply-settings.ts b/plugins/claude-code-hermit/scripts/apply-settings.ts
index 45c91888..38e69a47 100644
--- a/plugins/claude-code-hermit/scripts/apply-settings.ts
+++ b/plugins/claude-code-hermit/scripts/apply-settings.ts
@@ -6,6 +6,14 @@
  * Operations:
  *   task-id <id>             Merge env.CLAUDE_CODE_TASK_LIST_ID
  *   allow                    Merge hermit's fixed permissions.allow list
+ *   permissions-plan         Print {"missing":[],"obsolete":[]} for the target — read-only,
+ *                            writes nothing. `missing` is the sealed HERMIT_ALLOW entries the
+ *                            target lacks; `obsolete` is the sealed HERMIT_OBSOLETE entries it
+ *                            still carries. Callers (hatch, hermit-evolve) show this diff.
+ *   permissions-sync         Apply that plan: add every missing HERMIT_ALLOW entry and remove
+ *                            only entries listed in HERMIT_OBSOLETE. Prints the applied plan.
+ *                            Operator-authored entries are structurally untouchable — removal
+ *                            is filtered by the sealed registry, never by shape or heuristic.
  *   artifact-allow           Merge just ["Artifact"] into permissions.allow — kept as its
  *                            own op (not folded into `allow`) so declining the Artifact
  *                            publish-authorization ask never touches hook permissions.
@@ -19,7 +27,9 @@
  *
  * Rules:
  * - Never removes existing keys or array entries — except channel-env, which strips
- *   any *_BOT_TOKEN from the env block (tokens must live only in .env, never settings).
+ *   any *_BOT_TOKEN from the env block (tokens must live only in .env, never settings),
+ *   and permissions-sync, which removes only entries named in the sealed HERMIT_OBSOLETE
+ *   registry below (scripts this plugin itself shipped and has since deleted).
  * - Permission sets are read from state-templates — callers cannot inject arbitrary JSON.
  * - Safe to call under AGENT_HOOK_PROFILE=strict: writes via fs, not the Edit/Write tools.
  */
@@ -29,8 +39,9 @@ import path from 'node:path';
 
 const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(import.meta.dir, '..');
 
-// Fixed allow-list — sealed here; cannot be extended by callers.
-// Keep in sync with the "Required permissions" list in skills/hatch/SKILL.md Step 8.
+// Fixed allow-list — sealed here; cannot be extended by callers. This array is the
+// single source of truth: hatch and hermit-evolve reach it through permissions-plan /
+// permissions-sync rather than restating it, so there is nothing to keep in sync.
 const HERMIT_ALLOW = [
   'Bash(git diff:*)',
   'Bash(git status:*)',
@@ -42,7 +53,6 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/evaluate-session.ts*)',
   'Bash(bun */scripts/append-metrics.ts*)',
   'Bash(bun */scripts/resolve-prop.ts*)',
-  'Bash(bun */scripts/next-prop-id.ts*)',
   'Bash(bun */scripts/proposal.ts*)',
   'Bash(bun */scripts/record-gate.ts*)',
   'Bash(bun */scripts/queue-micro-proposal.ts*)',
@@ -73,6 +83,21 @@ const HERMIT_ALLOW = [
   'Edit(.claude-code-hermit/**)',
 ];
 
+// Entries this plugin itself shipped in an earlier version and has since retired.
+// permissions-sync removes these from an operator's settings; nothing else is ever
+// removed, so an operator's own rules cannot be caught by a shape or prefix match.
+// Append here in the same change that deletes a permissioned script — this registry
+// is what makes a deletion reach already-hatched hermits.
+const HERMIT_OBSOLETE = [
+  'Bash(python3:*)',
+  'Bash(node:*)',
+  'Edit(.claude/.claude-code-hermit/**)',
+  'Write(.claude/.claude-code-hermit/**)',
+  'Bash(bun */scripts/run-with-profile.ts*)',
+  'Bash(bun */scripts/suggest-compact.ts*)',
+  'Bash(bun */scripts/next-prop-id.ts*)',
+];
+
 // Sealed autoMode entries — operator-owned policy seeded at attended hatch and
 // re-ensured by hermit-start at boot. Declarative, no persuasion prose (a live
 // probe model flags over-argued entries as planted justification). Keep in sync
@@ -157,6 +182,28 @@ function mergeAllow(settings: Json, entries: string[]): string[] {
   return added;
 }
 
+interface PermissionsPlan {
+  missing: string[];
+  obsolete: string[];
+}
+
+// Read-only diff of the target against the two sealed registries above.
+function planPermissions(settings: Json): PermissionsPlan {
+  const allow: string[] = Array.isArray(settings?.permissions?.allow) ? settings.permissions.allow : [];
+  const existing = new Set<string>(allow);
+  return {
+    missing: HERMIT_ALLOW.filter((e) => !existing.has(e)),
+    obsolete: HERMIT_OBSOLETE.filter((e) => existing.has(e)),
+  };
+}
+
+// Removes exactly the entries handed in — always a subset of HERMIT_OBSOLETE.
+function removeAllow(settings: Json, entries: string[]): void {
+  if (entries.length === 0 || !Array.isArray(settings?.permissions?.allow)) return;
+  const drop = new Set(entries);
+  settings.permissions.allow = settings.permissions.allow.filter((e: string) => !drop.has(e));
+}
+
 function mergeAutoModeList(settings: Json, key: 'allow' | 'environment', entries: string[]): void {
   settings.autoMode ??= {};
   const block = settings.autoMode as Record<string, unknown>;
@@ -203,7 +250,10 @@ if (!targetFile || !op) {
 }
 
 const settings = readTargetJson(targetFile);
-let addedAllow: string[] = [];
+
+// permissions-plan reports without touching the file; every other op falls through
+// to the write below.
+let readOnly = false;
 
 switch (op) {
   case 'task-id': {
@@ -214,8 +264,33 @@ switch (op) {
     break;
   }
 
+  // Legacy alias for permissions-sync's additive half. No in-repo caller since
+  // hatch and hermit-evolve moved to the verbs — kept for already-hatched hermits
+  // still running older skill text.
   case 'allow': {
-    addedAllow = mergeAllow(settings, HERMIT_ALLOW);
+    mergeAllow(settings, HERMIT_ALLOW);
+    break;
+  }
+
+  case 'permissions-plan': {
+    console.log(JSON.stringify(planPermissions(settings)));
+    readOnly = true;
+    break;
+  }
+
+  case 'permissions-sync': {
+    // Plan first: the diff is computed against the pre-merge state, so the printed
+    // result is exactly what this run changed.
+    const plan = planPermissions(settings);
+    // Nothing to do — don't rewrite the file. hermit-evolve runs this on every
+    // upgrade, and a target that is already current must not come back reformatted
+    // (or with a fresh mtime) just for having been checked.
+    if (plan.missing.length === 0 && plan.obsolete.length === 0) readOnly = true;
+    else {
+      mergeAllow(settings, HERMIT_ALLOW);
+      removeAllow(settings, plan.obsolete);
+    }
+    console.log(JSON.stringify(plan));
     break;
   }
 
@@ -269,14 +344,9 @@ switch (op) {
   }
 
   default: {
-    console.error(`Unknown operation: ${op}. Valid ops: task-id, allow, artifact-allow, automode-seed, deny, channel-env`);
+    console.error(`Unknown operation: ${op}. Valid ops: task-id, allow, permissions-plan, permissions-sync, artifact-allow, automode-seed, deny, channel-env`);
     process.exit(1);
   }
 }
 
-writeJson(targetFile, settings);
-
-// After the write lands, report each newly-granted allow entry (one per line) so
-// hermit-evolve's Step 8 can list what it added in its run report. Silent when
-// nothing was added.
-for (const e of addedAllow) console.log(`allow: ${e}`);
+if (!readOnly) writeJson(targetFile, settings);
diff --git a/plugins/claude-code-hermit/scripts/lib/prop-id.ts b/plugins/claude-code-hermit/scripts/lib/prop-id.ts
index cecc0370..b64af7b1 100644
--- a/plugins/claude-code-hermit/scripts/lib/prop-id.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prop-id.ts
@@ -1,7 +1,7 @@
-// lib/prop-id.ts — proposal ID assignment (number + slug + timestamp + collision
-// suffix). Extracted from next-prop-id.ts so proposal.ts's create verb can claim
-// an ID and write the file as one atomic operation (next-prop-id.ts's separate
-// assign-then-write flow allows a half-created state: a burned ID with no file).
+// lib/prop-id.ts — proposal ID assignment (number + slug + timestamp). The pieces
+// here are un-claimed: proposal.ts's create verb combines them and then claims the
+// ID atomically with the file write (exclusive create, looping SUFFIX_LETTERS on
+// EEXIST), so no caller can burn an ID without producing the file it names.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -42,14 +42,6 @@ export function slugify(title: string): string {
   return slug || 'proposal';
 }
 
-export interface PropIdParts {
-  id: string;
-  num: string;
-  slug: string;
-  hhmmss: string;
-  suffix: string;
-}
-
 export const SUFFIX_LETTERS = 'abcdefghijklmnopqrstuvwxyz';
 
 export function readTimezone(stateDir: string): string {
@@ -81,32 +73,3 @@ export function computeBase(
   };
 }
 
-// existsSync suffix walk over a FIXED base — separated from computeBase so
-// the collision-suffix branch is unit-testable without the num recomputation
-// that a fresh computeBase call would trigger (any pre-seeded collision file
-// also matches computeBase's own NNN scan, which would shift `num` before
-// the walk ever runs). Returns null once the a-z suffix range is exhausted.
-export function resolveSuffix(proposalsDir: string, base: BaseId): PropIdParts | null {
-  let suffix = '';
-  let i = -1;
-  while (true) {
-    const candidateId = `PROP-${base.num}-${base.slug}-${base.hhmmss}${suffix}`;
-    if (!fs.existsSync(path.join(proposalsDir, `${candidateId}.md`))) {
-      return { id: candidateId, num: base.num, slug: base.slug, hhmmss: base.hhmmss, suffix };
-    }
-    i++;
-    if (i >= SUFFIX_LETTERS.length) return null;
-    suffix = SUFFIX_LETTERS[i];
-  }
-}
-
-// Predicts the next canonical ID — used only by next-prop-id.ts, which hands
-// the ID to a separate caller that writes the file later (a TOCTOU gap this
-// script's own callers no longer have). The create verb in proposal.ts does
-// NOT use this: it claims the ID atomically via exclusive file create (see
-// proposal.ts), looping the same suffix alphabet against write failures
-// (EEXIST) rather than a pre-check.
-export function nextPropId(stateDir: string, title: string, now: Date = new Date()): PropIdParts | null {
-  const proposalsDir = path.join(stateDir, 'proposals');
-  return resolveSuffix(proposalsDir, computeBase(stateDir, title, now));
-}
diff --git a/plugins/claude-code-hermit/scripts/next-prop-id.ts b/plugins/claude-code-hermit/scripts/next-prop-id.ts
deleted file mode 100644
index 4f464895..00000000
--- a/plugins/claude-code-hermit/scripts/next-prop-id.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-// next-prop-id.ts — generates the next canonical proposal ID + filename stem.
-// Usage (argv):  bun next-prop-id.ts <hermit-state-dir> '<title>'
-// Usage (stdin): bun next-prop-id.ts <hermit-state-dir> <<'HERMIT_TITLE'
-//                <title>
-//                HERMIT_TITLE
-//   — stdin required when the title contains an apostrophe (dual-mode convention,
-//     matches append-metrics.ts).
-// Output (stdout, one line): PROP-NNN-<slug>-HHMMSS
-// Exit 1 (+ stderr) on a missing state dir, or on exhausting the same-second
-// collision-suffix range — creation should never proceed with a guessed ID.
-// Implements proposal-create/SKILL.md § How to Create steps 1-2 (ID + slug +
-// same-second collision guard).
-//
-// Thin CLI wrapper — the ID logic lives in lib/prop-id.ts, shared with
-// proposal.ts's create verb (which claims the ID atomically alongside the file
-// write, rather than assigning it in a separate step).
-
-import fs from 'node:fs';
-import { readStdin } from './lib/cli';
-import { nextPropId } from './lib/prop-id';
-
-const stateDir = process.argv[2];
-
-if (!stateDir) {
-  console.error("Usage: bun next-prop-id.ts <hermit-state-dir> '<title>'");
-  process.exit(1);
-}
-
-function readTitle(): Promise<string> {
-  if (process.argv[3] !== undefined) return Promise.resolve(process.argv[3]);
-  return readStdin().then(s => s.trim());
-}
-
-(async () => {
-  if (!fs.existsSync(stateDir)) {
-    console.error(`Error: state dir not found: ${stateDir}`);
-    process.exit(1);
-  }
-
-  const title = await readTitle();
-  const parts = nextPropId(stateDir, title);
-  if (!parts) {
-    console.error('Error: exhausted same-second collision suffixes (a-z)');
-    process.exit(1);
-  }
-  process.stdout.write(parts.id + '\n');
-  process.exit(0);
-})();
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index ec2caff4..742d31e8 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -539,72 +539,33 @@ The plugin's hooks and boot scripts require specific Bash permissions to run wit
 - `hatch_target == "local"` → merge into `.claude/settings.local.json` (gitignored)
 - `hatch_target == "committed"` → merge into `.claude/settings.json` (committed, current behavior)
 
-Merge these into the target file:
+**Do not restate the permission list here or anywhere else.** `apply-settings.ts` holds the
+only copy (its sealed `HERMIT_ALLOW`); ask it what the target file is missing:
 
-**Required permissions:**
-
-```json
-{
-  "permissions": {
-    "allow": [
-      "Bash(git diff:*)",
-      "Bash(git status:*)",
-      "Bash(git log:*)",
-      "Bash(bun */scripts/cost-tracker.ts*)",
-      "Bash(bun */scripts/heartbeat-precheck.ts*)",
-      "Bash(bun */scripts/reflect-precheck.ts*)",
-      "Bash(bun */scripts/archive-shell.ts*)",
-      "Bash(bun */scripts/evaluate-session.ts*)",
-      "Bash(bun */scripts/append-metrics.ts*)",
-      "Bash(bun */scripts/resolve-prop.ts*)",
-      "Bash(bun */scripts/next-prop-id.ts*)",
-      "Bash(bun */scripts/proposal.ts*)",
-      "Bash(bun */scripts/record-gate.ts*)",
-      "Bash(bun */scripts/queue-micro-proposal.ts*)",
-      "Bash(bun */scripts/micro-proposal.ts*)",
-      "Bash(bun */scripts/generate-summary.ts*)",
-      "Bash(bun */scripts/proposals-index.ts*)",
-      "Bash(bun */scripts/update-reflection-state.ts*)",
-      "Bash(bun */scripts/apply-reflection-actions.ts*)",
-      "Bash(bun */scripts/transcript-digest.ts*)",
-      "Bash(bun */scripts/setup-token-mint.ts*)",
-      "Bash(bun */scripts/cron-tz-shift.ts*)",
-      "Bash(bun */scripts/evolve-plan.ts*)",
-      "Bash(bun */scripts/evolve-finalize.ts*)",
-      "Bash(bun */scripts/manifest-seed.ts*)",
-      "Bash(bun */scripts/apply-settings.ts*)",
-      "Bash(bun */scripts/channel-log.ts*)",
-      "Bash(bun */scripts/channel-send.ts*)",
-      "Bash(bun */scripts/session-archive.ts*)",
-      "Bash(bun */scripts/routine-precheck.ts*)",
-      "Bash(bun */scripts/cron-registry.ts*)",
-      "Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)",
-      "Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)",
-      "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
-      "Edit(.claude-code-hermit/**)"
-    ]
-  }
-}
 ```
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> permissions-plan
+```
+
+It writes nothing and prints one JSON line: `{"missing":[...],"obsolete":[...]}` — the sealed
+entries the target lacks, and any entries from retired plugin versions it still carries.
 
-**Why each one:**
+**What the permissions buy:**
 
 - `git diff`, `git status`, `git log` — session-diff.ts hook auto-populates `## Changed` in SHELL.md
-- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `next-prop-id.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, ID generation, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via `.claude-code-hermit/bin/hermit-run`) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via `.claude-code-hermit/bin/hermit-run`) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
 - `.claude-code-hermit/bin/hermit-run micro-proposal *` / `proposal-metrics-report *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. The space before `*` is a word boundary — matches `micro-proposal brief-cycle`, not a `micro-proposal…`-prefixed name — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
 - `bash -c 'AGENT_DIR=...` — SessionStart hook that loads session context on every startup
 - `Edit` on `.claude-code-hermit/**` — heartbeat appends to SHELL.md, increments config.json tick counter, and skills update session state without prompting (Edit rules cover all file-editing tools, including Write)
 
 **Steps:**
 
-1. If the target settings file exists: read it and identify which required permissions are missing from `permissions.allow`
-2. If the target settings file does not exist: all permissions are missing
-3. If no permissions are missing: skip silently
-4. If permissions need to be added: show the operator the list of permissions to add and ask with `AskUserQuestion` (header: "Hook perms") — options: **Yes — add** (merge so hooks run without prompting, default) / **No — skip** (you'll be prompted during sessions).
-5. If the operator confirms: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> allow`
-   (Merges the full allow-list additively; never removes existing entries.)
+1. Run `permissions-plan` (command above) against the resolved settings file and parse the JSON line.
+2. If both `missing` and `obsolete` are empty: skip silently.
+3. Otherwise show the operator the entries — what will be added, and what retired entries will be removed — and ask with `AskUserQuestion` (header: "Hook perms") — options: **Yes — add** (merge so hooks run without prompting, default) / **No — skip** (you'll be prompted during sessions).
+4. If the operator confirms: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts <resolved-settings-file> permissions-sync`
+   (Adds every missing sealed entry and removes only entries from retired plugin versions. Operator-authored rules are never touched.)
    Then run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/apply-settings.ts .claude/settings.local.json automode-seed` — **always `.claude/settings.local.json`, regardless of `hatch_target`**: the auto-mode classifier reads `autoMode` config only from local/user scope, never a committed project `.claude/settings.json`, so seeding anywhere else would be a silent no-op. Tell the operator in one line: "Also recorded an auto-mode exception and environment context in `.claude/settings.local.json` so unattended upgrade migrations can run the plugin's sealed settings ops."
-6. If the operator declines: skip (including the auto-mode seed above — an operator who wants prompts should not get a standing classifier exception), and note: "You may be prompted to approve hook commands during sessions. Run `/claude-code-hermit:hermit-settings permissions` to add them later."
+5. If the operator declines: skip (including the auto-mode seed above — an operator who wants prompts should not get a standing classifier exception), and note: "You may be prompted to approve hook commands during sessions. Run `/claude-code-hermit:hermit-settings permissions` to add them later."
 
 **Seed `state/template-manifest.json`** (deferred from Step 2 — now that the `bun */scripts/manifest-seed.ts*` permission is in place). It records the sha256 pristine-baseline that the `hermit-evolve` drift signals depend on. **Do not hand-compute the hashes** (an LLM cannot sha256 reliably; the script makes them correct by construction). Read the current plugin version from `${CLAUDE_SKILL_DIR}/../../.claude-plugin/plugin.json`, then run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/manifest-seed.ts .claude-code-hermit` with this JSON on stdin:
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
index 8bbdaa0f..f3b30dff 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolve/reference.md
@@ -226,18 +226,17 @@ Same logic as init step 8, but target the file determined by `hatch_target` (res
 - `hatch_target == "local"` → `.claude/settings.local.json`
 - `hatch_target == "committed"` → `.claude/settings.json`
 
-Delegate the additive permission merge to core's sealed writer rather than hand-enumerating the list here — `apply-settings.ts` holds the canonical `HERMIT_ALLOW` (so it can't drift from what `hatch` installs), writes via `fs` (so it works even under the strict hook profile, where an `Edit`/`Write` to `.claude/settings*.json` is denied), and is idempotent:
+Run the sync verb — it is the single owner of this list, so do not restate the entries here or diff them by hand. It holds the canonical `HERMIT_ALLOW` (so it can't drift from what `hatch` installs), writes via `fs` (so it works even under the strict hook profile, where an `Edit`/`Write` to `.claude/settings*.json` is denied), and is idempotent:
 
-```bash
-bun ${plugin_root}/scripts/apply-settings.ts <resolved-settings-file> allow
 ```
+bun <plugin_root>/scripts/apply-settings.ts <resolved-settings-file> permissions-sync
+```
+
+where `<resolved-settings-file>` is `.claude/settings.local.json` (local) or `.claude/settings.json` (committed) per `hatch_target`, and `<plugin_root>` is the baked absolute plugin root.
 
-where `<resolved-settings-file>` is `.claude/settings.local.json` (local) or `.claude/settings.json` (committed) per `hatch_target`, and `${plugin_root}` is the baked absolute plugin root. It prints one `allow: <entry>` line per newly-added permission (silent when everything is already present) — collect those for the step-10 report; if it prints nothing, the report notes no permission changes. **Delegated mode: run it without asking** (a missing `bun` permission breaks hooks, so this is non-optional); it only ever adds, never removes. (On a hermit whose allow-list predates `apply-settings.ts` itself, this command may hit a permission gate inside this subagent, which can't prompt — relay that to the step-10 report so the operator can add `Bash(bun */scripts/apply-settings.ts*)` and re-run, rather than wedging.) Separately, remove stale permissions from previous versions if found in the target file:
+**Delegated mode: run it without asking** (a missing `bun` permission breaks hooks, so this is non-optional). It adds every sealed entry the target lacks and removes only entries this plugin shipped in a previous version and has since retired — an operator's own rules are never touched, and a target that is already current is not rewritten at all. Parse its one JSON line, `{"missing":[...],"obsolete":[...]}`, and report the two counts in the step-10 report. Both empty means the target was already current; say nothing.
 
-- `Bash(python3:*)`, `Bash(node:*)` — replaced by scoped bun entries
-- `Edit(.claude/.claude-code-hermit/**)`, `Write(.claude/.claude-code-hermit/**)` — replaced by `.claude-code-hermit/**` (v0.0.6 path change)
-- `Bash(bun */scripts/run-with-profile.ts*)` — the run-with-profile wrapper was removed; profile-gated hooks now self-gate on `AGENT_HOOK_PROFILE`
-- `Bash(bun */scripts/suggest-compact.ts*)` — the suggest-compact Stop-hook stage was removed; compaction is owned by native autocompact, the watchdog backstop, and emergency clear
+(On a hermit whose allow-list predates `apply-settings.ts` itself, this command may hit a permission gate inside this subagent, which can't prompt — relay that to the step-10 report so the operator can add `Bash(bun */scripts/apply-settings.ts*)` and re-run, rather than wedging.)
 
 ### 9. Write updated config
 
diff --git a/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts b/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts
new file mode 100644
index 00000000..2f68364b
--- /dev/null
+++ b/plugins/claude-code-hermit/tests/apply-settings-permissions.test.ts
@@ -0,0 +1,144 @@
+// Contract tests for apply-settings.ts's permissions-plan / permissions-sync verbs.
+//
+// These two verbs are the single owner of an operator's hermit permissions: hatch
+// and hermit-evolve call them instead of carrying their own copies of the list.
+// The property that makes that safe is narrow removal — sync deletes only entries
+// named in the sealed HERMIT_OBSOLETE registry, never anything the operator wrote.
+// Spawning is intentional (see tests/helpers/run.ts): the process boundary is what
+// the skills actually invoke.
+
+import { describe, test, expect } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { runScript } from './helpers/run';
+
+const SCRIPT_SRC = fs.readFileSync(
+  path.join(import.meta.dir, '..', 'scripts', 'apply-settings.ts'),
+  'utf-8',
+);
+
+function sealedArray(name: string): string[] {
+  const m = SCRIPT_SRC.match(new RegExp(`const ${name}\\s*=\\s*(\\[[\\s\\S]*?\\]);`));
+  if (!m) throw new Error(`${name} not found in apply-settings.ts`);
+  return eval(m[1]) as string[];
+}
+
+const HERMIT_ALLOW = sealedArray('HERMIT_ALLOW');
+const HERMIT_OBSOLETE = sealedArray('HERMIT_OBSOLETE');
+
+function withTarget(fn: (target: string) => Promise<void>) {
+  return async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'apply-settings-'));
+    try {
+      await fn(path.join(dir, 'settings.json'));
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  };
+}
+
+function seed(target: string, settings: unknown) {
+  fs.writeFileSync(target, JSON.stringify(settings, null, 2));
+}
+
+function readAllow(target: string): string[] {
+  return JSON.parse(fs.readFileSync(target, 'utf-8')).permissions.allow;
+}
+
+async function run(target: string, op: string) {
+  const r = await runScript('apply-settings.ts', { args: [target, op] });
+  expect(r.exitCode).toBe(0);
+  return JSON.parse(r.stdout.trim());
+}
+
+describe('apply-settings permissions-plan', () => {
+  test('reports every canonical entry as missing for an absent target', withTarget(async (target) => {
+    const plan = await run(target, 'permissions-plan');
+    expect(plan.missing).toEqual(HERMIT_ALLOW);
+    expect(plan.obsolete).toEqual([]);
+  }));
+
+  test('writes nothing — the target stays absent', withTarget(async (target) => {
+    await run(target, 'permissions-plan');
+    expect(fs.existsSync(target)).toBe(false);
+  }));
+
+  test('reports an empty plan once the target is in sync', withTarget(async (target) => {
+    seed(target, { permissions: { allow: HERMIT_ALLOW } });
+    const plan = await run(target, 'permissions-plan');
+    expect(plan).toEqual({ missing: [], obsolete: [] });
+  }));
+
+  test('names retired entries the target still carries', withTarget(async (target) => {
+    const stale = HERMIT_OBSOLETE[0];
+    seed(target, { permissions: { allow: [...HERMIT_ALLOW, stale] } });
+    const plan = await run(target, 'permissions-plan');
+    expect(plan.obsolete).toEqual([stale]);
+    expect(plan.missing).toEqual([]);
+  }));
+});
+
+describe('apply-settings permissions-sync', () => {
+  test('adds every missing canonical entry', withTarget(async (target) => {
+    seed(target, {});
+    await run(target, 'permissions-sync');
+    expect(readAllow(target)).toEqual(HERMIT_ALLOW);
+  }));
+
+  test('removes retired entries and keeps the operator\'s own', withTarget(async (target) => {
+    const custom = 'Bash(my-own-tool:*)';
+    seed(target, { permissions: { allow: [custom, ...HERMIT_OBSOLETE] } });
+
+    const plan = await run(target, 'permissions-sync');
+    const allow = readAllow(target);
+
+    expect(plan.obsolete).toEqual(HERMIT_OBSOLETE);
+    expect(allow).toContain(custom);
+    for (const stale of HERMIT_OBSOLETE) expect(allow).not.toContain(stale);
+    for (const entry of HERMIT_ALLOW) expect(allow).toContain(entry);
+  }));
+
+  test('leaves unrelated settings untouched', withTarget(async (target) => {
+    seed(target, { env: { FOO: 'bar' }, permissions: { deny: ['Bash(rm:*)'] } });
+    await run(target, 'permissions-sync');
+
+    const settings = JSON.parse(fs.readFileSync(target, 'utf-8'));
+    expect(settings.env).toEqual({ FOO: 'bar' });
+    expect(settings.permissions.deny).toEqual(['Bash(rm:*)']);
+  }));
+
+  test('is idempotent — a second run reports nothing to do', withTarget(async (target) => {
+    seed(target, {});
+    await run(target, 'permissions-sync');
+    const second = await run(target, 'permissions-sync');
+    expect(second).toEqual({ missing: [], obsolete: [] });
+  }));
+
+  test('a no-op sync does not rewrite the file', withTarget(async (target) => {
+    // Deliberately hand-formatted: hermit-evolve runs sync on every upgrade, so a
+    // target that is already current must come back untouched, not reformatted.
+    const original = JSON.stringify({ permissions: { allow: HERMIT_ALLOW } }, null, 4);
+    fs.writeFileSync(target, original);
+
+    const plan = await run(target, 'permissions-sync');
+
+    expect(plan).toEqual({ missing: [], obsolete: [] });
+    expect(fs.readFileSync(target, 'utf-8')).toBe(original);
+  }));
+
+  test('refuses to overwrite a malformed target', withTarget(async (target) => {
+    fs.writeFileSync(target, '{ not json');
+    const r = await runScript('apply-settings.ts', { args: [target, 'permissions-sync'] });
+    expect(r.exitCode).toBe(1);
+    expect(fs.readFileSync(target, 'utf-8')).toBe('{ not json');
+  }));
+});
+
+describe('sealed registries', () => {
+  test('no entry is both canonical and retired', () => {
+    const canonical = new Set(HERMIT_ALLOW);
+    for (const stale of HERMIT_OBSOLETE) expect(canonical.has(stale)).toBe(false);
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/contracts.test.ts b/plugins/claude-code-hermit/tests/contracts.test.ts
index af9d61dd..02d2ca73 100644
--- a/plugins/claude-code-hermit/tests/contracts.test.ts
+++ b/plugins/claude-code-hermit/tests/contracts.test.ts
@@ -2823,14 +2823,21 @@ describe('proposal lifecycle: no tool-mediated state writes', () => {
   });
 });
 
-// hermit-evolve Step 8 must delegate the permission merge to apply-settings.ts
-// rather than re-enumerate the allow-list in prose — the hand-maintained list had
-// already drifted (15 of 28 entries) and instructed a Write rule the writer strips.
+// hermit-evolve Step 8 must delegate the whole permission reconciliation to
+// apply-settings.ts rather than restate it in prose — both halves. The additive
+// list had already drifted (15 of the canonical entries) and instructed a Write
+// rule the writer strips; the removal half was a hand-grown bullet list that only
+// ever got a new line when someone remembered, which is why it now lives in the
+// script's sealed HERMIT_OBSOLETE registry instead.
 describe('hermit-evolve permission delegation contract', () => {
   const evolveRef = fs.readFileSync(path.join(SKILLS, 'hermit-evolve', 'reference.md'), 'utf-8');
+  const step8 = evolveRef.slice(
+    evolveRef.indexOf('### 8. Ensure plugin permissions'),
+    evolveRef.indexOf('### 9. Write updated config'),
+  );
 
-  test('Step 8 delegates to apply-settings.ts allow', () => {
-    expect(evolveRef).toMatch(/apply-settings\.ts <resolved-settings-file> allow/);
+  test('Step 8 delegates to apply-settings.ts permissions-sync', () => {
+    expect(evolveRef).toMatch(/apply-settings\.ts <resolved-settings-file> permissions-sync/);
   });
 
   test('Step 8 no longer hand-enumerates the per-script allow-list', () => {
@@ -2838,10 +2845,14 @@ describe('hermit-evolve permission delegation contract', () => {
     expect(evolveRef).not.toContain('The required entries are:');
     // A couple of the previously-enumerated script names must not reappear as an
     // inline permission list (they may still appear elsewhere in the file).
-    const step8 = evolveRef.slice(
-      evolveRef.indexOf('### 8. Ensure plugin permissions'),
-      evolveRef.indexOf('### 9. Write updated config'),
-    );
     expect(step8).not.toContain('`queue-micro-proposal.ts`, `micro-proposal.ts`');
   });
+
+  test('Step 8 no longer hand-maintains the stale-entry removal list', () => {
+    // These were bullets the model was told to scrub by hand; HERMIT_OBSOLETE owns
+    // them now, so a new script deletion reaches operators without editing prose.
+    for (const stale of ['run-with-profile.ts', 'suggest-compact.ts', 'Bash(python3:*)']) {
+      expect(step8).not.toContain(stale);
+    }
+  });
 });
diff --git a/plugins/claude-code-hermit/tests/proposal-lib.test.ts b/plugins/claude-code-hermit/tests/proposal-lib.test.ts
index f2f01032..0bf3e477 100644
--- a/plugins/claude-code-hermit/tests/proposal-lib.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-lib.test.ts
@@ -7,54 +7,71 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { computeBase, resolveSuffix, slugify, SUFFIX_LETTERS } from '../scripts/lib/prop-id';
+import { computeBase, nextNumber, slugify } from '../scripts/lib/prop-id';
 import { zonedISOStamp } from '../scripts/lib/time';
 import { serializeValue, appendToSection, patchFrontmatter } from '../scripts/lib/md-write';
 
-describe('lib/prop-id: collision suffix', () => {
-  // resolveSuffix takes a FIXED base (num/slug/hhmmss already computed) so the
-  // suffix walk is tested in isolation from nextNumber's own NNN scan — any
-  // pre-seeded collision file also matches that scan and would otherwise shift
-  // `num` before the walk ever runs (nextPropId's own num recomputation).
-  test('walks a -> b when both the unsuffixed and -a candidates already exist', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
-    const proposalsDir = path.join(dir, 'proposals');
-    fs.mkdirSync(proposalsDir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
-    const now = new Date('2026-07-20T22:00:00Z');
+// Slug and number behavior formerly exercised through the next-prop-id.ts CLI.
+// That wrapper is gone; proposal.ts's create verb reaches the same code through
+// computeBase, so the cases live here as direct unit tests.
+describe('lib/prop-id: slugify', () => {
+  test('drops stopwords and truncates at a word boundary', () => {
+    expect(slugify('Fix the thing for real')).toBe('fix-thing-real');
+    expect(slugify('   ')).toBe('proposal');
+  });
 
-    const base = computeBase(dir, 'Collision test', now);
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}.md`), 'x');
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}a.md`), 'x');
+  test('a stopword-only title falls back to the pre-filter tokens', () => {
+    expect(slugify('the a of and')).toBe('the-a-of-and');
+  });
 
-    const result = resolveSuffix(proposalsDir, base);
-    expect(result?.suffix).toBe('b');
-    expect(result?.id).toBe(`PROP-${base.num}-${base.slug}-${base.hhmmss}b`);
+  test('an all-punctuation title falls back to the literal "proposal"', () => {
+    expect(slugify('!!!???...')).toBe('proposal');
+  });
 
-    fs.rmSync(dir, { recursive: true, force: true });
+  test('a single token longer than 40 chars is hard-cut to 40', () => {
+    const slug = slugify('supercalifragilisticexpialidocioussupercalifragilisticexpialidocious');
+    expect(slug.length).toBe(40);
   });
 
-  test('exhausts the a-z suffix range and returns null', () => {
+  test('an apostrophe becomes a separator, never a double dash', () => {
+    expect(slugify("bob's widget")).toBe('bob-s-widget');
+  });
+});
+
+describe('lib/prop-id: nextNumber', () => {
+  function withProposals(files: string[], fn: (proposalsDir: string) => void) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
     const proposalsDir = path.join(dir, 'proposals');
     fs.mkdirSync(proposalsDir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
-    const now = new Date('2026-07-20T22:00:00Z');
+    for (const f of files) fs.writeFileSync(path.join(proposalsDir, f), 'x');
+    try { fn(proposalsDir); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  }
 
-    const base = computeBase(dir, 'Exhaust test', now);
-    fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}.md`), 'x');
-    for (const letter of SUFFIX_LETTERS) {
-      fs.writeFileSync(path.join(proposalsDir, `PROP-${base.num}-${base.slug}-${base.hhmmss}${letter}.md`), 'x');
-    }
+  test('starts at 001 on an empty proposals dir', () => {
+    withProposals([], (d) => expect(nextNumber(d)).toBe('001'));
+  });
 
-    expect(resolveSuffix(proposalsDir, base)).toBeNull();
+  test('is max + 1, zero-padded', () => {
+    withProposals(['PROP-005-foo-100000.md', 'PROP-006-bar-110000.md'], (d) => {
+      expect(nextNumber(d)).toBe('007');
+    });
+  });
 
-    fs.rmSync(dir, { recursive: true, force: true });
+  test('a missing proposals dir reads as empty', () => {
+    expect(nextNumber(path.join(os.tmpdir(), 'prop-id-does-not-exist'))).toBe('001');
   });
+});
 
-  test('slugify drops stopwords and truncates at a word boundary', () => {
-    expect(slugify('Fix the thing for real')).toBe('fix-thing-real');
-    expect(slugify('   ')).toBe('proposal');
+describe('lib/prop-id: computeBase', () => {
+  test('combines number, slug, and zoned HHMMSS from one instant', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'prop-id-'));
+    fs.mkdirSync(path.join(dir, 'proposals'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const base = computeBase(dir, 'First Proposal Ever', new Date('2026-07-20T22:00:00Z'));
+    expect(base).toEqual({ num: '001', slug: 'first-proposal-ever', hhmmss: '220000' });
+
+    fs.rmSync(dir, { recursive: true, force: true });
   });
 });
 
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index 80ec425b..5ddeea05 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -1390,84 +1390,6 @@ describe('resolve-prop', () => {
   }));
 });
 
-// -------------------------------------------------------
-// next-prop-id.ts (subprocess — ID + slug + collision-guard generation)
-// -------------------------------------------------------
-
-describe('next-prop-id', () => {
-  function seedConfig(dir: string, timezone = 'UTC') {
-    write(hermit(dir, 'config.json'), JSON.stringify({ timezone }));
-    fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
-  }
-  async function nextId(dir: string, title: string) {
-    const r = await runScript('next-prop-id.ts', { args: [hermit(dir)], stdin: title });
-    expect(r.exitCode).toBe(0);
-    return r.stdout.trim();
-  }
-
-  test('next-prop-id (starts at 001 on an empty proposals dir)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, 'First Proposal Ever')).toMatch(/^PROP-001-first-proposal-ever-\d{6}$/);
-  }));
-
-  test('next-prop-id (max + 1, zero-padded)', withDir(async (dir) => {
-    seedConfig(dir);
-    write(hermit(dir, 'proposals', 'PROP-005-foo-100000.md'), 'x');
-    write(hermit(dir, 'proposals', 'PROP-006-bar-110000.md'), 'x');
-    expect(await nextId(dir, 'Next One')).toMatch(/^PROP-007-next-one-\d{6}$/);
-  }));
-
-  test('next-prop-id (stopword-only title falls back to pre-filter tokens)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, 'the a of and')).toMatch(/^PROP-001-the-a-of-and-\d{6}$/);
-  }));
-
-  test('next-prop-id (long single token hard-cut to 40 chars)', withDir(async (dir) => {
-    seedConfig(dir);
-    const id = await nextId(dir, 'supercalifragilisticexpialidocioussupercalifragilisticexpialidocious');
-    const slug = id.replace(/^PROP-001-/, '').replace(/-\d{6}$/, '');
-    expect(slug.length).toBe(40);
-  }));
-
-  test('next-prop-id (all-punctuation title falls back to literal "proposal")', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, '!!!???...')).toMatch(/^PROP-001-proposal-\d{6}$/);
-  }));
-
-  test('next-prop-id (apostrophe survives via stdin)', withDir(async (dir) => {
-    seedConfig(dir);
-    expect(await nextId(dir, "bob's widget")).toMatch(/^PROP-001-bob-s-widget-\d{6}$/);
-  }));
-
-  test('next-prop-id (argv mode works for apostrophe-free titles)', withDir(async (dir) => {
-    seedConfig(dir);
-    const r = await runScript('next-prop-id.ts', { args: [hermit(dir), 'Argv Title'] });
-    expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toMatch(/^PROP-001-argv-title-\d{6}$/);
-  }));
-
-  // No test for the letter-suffix collision branch itself: `num` is always freshly
-  // computed as max(existing NNNs)+1 from the same directory the collision check
-  // scans, so no sequential call can ever see a pre-existing file at its own freshly
-  // computed NNN — the branch guards a genuine concurrent-read race (two invocations
-  // sharing one pre-race directory snapshot), which isn't reproducible via sequential
-  // black-box CLI calls. The repeated-title test above already confirms sequential
-  // calls always get distinct, monotonically increasing ids without ever needing it.
-  test('next-prop-id (repeated same-title calls always get distinct, incrementing ids)', withDir(async (dir) => {
-    seedConfig(dir);
-    const id1 = await nextId(dir, 'Repeat Title');
-    write(hermit(dir, 'proposals', `${id1}.md`), 'placeholder');
-    const id2 = await nextId(dir, 'Repeat Title');
-    expect(id2).not.toBe(id1);
-    expect(id2).toMatch(/^PROP-002-repeat-title-\d{6}$/);
-  }));
-
-  test('next-prop-id (missing state dir exits 1)', async () => {
-    const r = await runScript('next-prop-id.ts', { args: ['/nonexistent/hermit/state/dir', 'Title'] });
-    expect(r.exitCode).toBe(1);
-  });
-});
-
 // -------------------------------------------------------
 // record-gate.ts (subprocess — gate-verdict parsing + metric append + routing)
 // -------------------------------------------------------
diff --git a/plugins/claude-code-hermit/tests/template-skill-sync.test.ts b/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
index a950a228..5bcb52a8 100644
--- a/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
+++ b/plugins/claude-code-hermit/tests/template-skill-sync.test.ts
@@ -131,32 +131,30 @@ describe('.worktreeinclude template', () => {
 });
 
 // -------------------------------------------------------
-// apply-settings.ts HERMIT_ALLOW <-> hatch/SKILL.md Step 8 allow-list
+// hatch no longer restates the allow-list — apply-settings.ts owns it, and hatch
+// reaches it through permissions-plan / permissions-sync. There is no second copy
+// to keep in sync; tests/apply-settings-permissions.test.ts covers the behavior.
 // -------------------------------------------------------
-describe('hatch allow-list sync', () => {
-  const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'apply-settings.ts');
-
-  function extractHermitAllow(): string[] {
-    const src = fs.readFileSync(SCRIPT_PATH, 'utf-8');
-    const m = src.match(/const HERMIT_ALLOW\s*=\s*(\[[\s\S]*?\]);/);
-    if (!m) throw new Error('HERMIT_ALLOW not found in apply-settings.ts');
-    return eval(m[1]) as string[];
-  }
-
-  function extractSkillAllow(): string[] {
+describe('hatch permission delegation', () => {
+  test('hatch/SKILL.md carries no copied allow-list JSON block', () => {
+    const allowBlocks: unknown[] = [];
     for (const block of skillContent.matchAll(/```json\n([\s\S]*?)```/g)) {
+      let parsed: any;
       try {
-        const parsed = JSON.parse(block[1]);
-        if (parsed?.permissions?.allow) return parsed.permissions.allow as string[];
+        parsed = JSON.parse(block[1]);
       } catch {
-        // non-JSON or unrelated JSON block — keep scanning
+        continue; // non-JSON or unrelated block — keep scanning
       }
+      // Collect, never assert inside the loop: an expect() thrown here would be
+      // caught by the parse guard above and silently pass the test.
+      if (parsed?.permissions?.allow) allowBlocks.push(parsed.permissions.allow);
     }
-    throw new Error('Step 8 allow-list JSON block not found in hatch/SKILL.md');
-  }
+    expect(allowBlocks).toEqual([]);
+  });
 
-  test('HERMIT_ALLOW matches hatch/SKILL.md Step 8 allow-list', () => {
-    expect(extractHermitAllow()).toEqual(extractSkillAllow());
+  test('hatch/SKILL.md Step 8 delegates to the permissions verbs', () => {
+    expect(skillContent).toContain('permissions-plan');
+    expect(skillContent).toContain('permissions-sync');
   });
 });
 

From 02364de8dee6eb07474067ebf472d4474ce3623f Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 17:37:43 +0100
Subject: [PATCH 2/9] refactor(claude-code-hermit): one UserPromptSubmit
 process, with shutdown terminal over it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seven hooks fired on every submitted prompt, each re-reading stdin, re-parsing
the channel envelope and re-reading config. The operator paid all seven process
launches per message, and precedence between them was implied by their order in
hooks.json rather than stated anywhere.

user-prompt-pipeline.ts reads stdin once and runs the former hooks as stages;
six move to scripts/lib/prompt-stages/ and stop being independently invokable.
record-operator-action.ts stays a top-level executable — it is also a
SessionStart hook and takes --force — so its entry shell is now behind
import.meta.main, otherwise importing it would steal the pipeline's stdin.

Two behaviors the multi-process shape could not express:

  Shutdown is terminal. A failed shutdown send used to fall through, and an
  exact `status` could then send and block on its own, discarding the shutdown
  relay instruction the model was told to act on; pause/resume and harness
  commands could mutate session state mid-shutdown. Both were reachable by
  construction — no hook could see what another had already done.

  One disposition per prompt. Output is buffered and a block emits its JSON
  alone: mixed context text does not parse as a decision, so the block would
  be silently dropped and the prompt delivered anyway.

lib/cron-shift.ts is extracted now rather than in the heartbeat/routines commit
so the status stage never imports a file a later commit deletes, keeping the
commits revertible in any order.

Behavior note beyond the two fixes above: a payload carrying no `prompt` now
produces no output at all, where prompt-context.ts previously emitted its
`[Now: …]` line regardless. Claude Code always sends a prompt on this event, so
the path is unreachable outside tests.
---
 plugins/claude-code-hermit/CHANGELOG.md       |   2 +
 .../claude-code-hermit/docs/architecture.md   |   4 +-
 plugins/claude-code-hermit/docs/security.md   |   6 +-
 plugins/claude-code-hermit/hooks/hooks.json   |  77 +--------
 .../scripts/channel-reply-reminder.ts         | 106 ------------
 .../scripts/channel-send.ts                   |   2 +-
 .../scripts/cron-registry.ts                  |   2 +-
 .../scripts/cron-tz-shift.ts                  | 132 +-------------
 .../scripts/hermit-pause.ts                   |   2 +-
 .../scripts/hermit-watchdog.ts                |   2 +-
 .../scripts/lib/channel-auth.ts               |   3 +-
 .../scripts/lib/channel-envelope.ts           |   3 +-
 .../scripts/lib/channel-log.ts                |   5 +-
 .../scripts/lib/cron-shift.ts                 | 134 ++++++++++++++
 .../scripts/lib/harness-command.ts            |   2 +-
 .../scripts/lib/messages.ts                   |   2 +-
 .../prompt-stages/channel-reply-reminder.ts   |  84 +++++++++
 .../channel-status-responder.ts               |  66 +++----
 .../prompt-stages/harness-command.ts}         |  56 ++----
 .../{ => lib/prompt-stages}/pause-keyword.ts  |  64 ++-----
 .../lib/prompt-stages/prompt-context.ts       |  29 ++++
 .../{ => lib/prompt-stages}/shutdown-gate.ts  |  63 ++-----
 .../scripts/lib/prompt-stages/types.ts        |  42 +++++
 .../scripts/lib/spend-status.ts               |   2 +-
 .../claude-code-hermit/scripts/lib/time.ts    |   2 +-
 .../claude-code-hermit/scripts/lib/tmux.ts    |   2 +-
 .../scripts/prompt-context.ts                 |  55 ------
 .../scripts/record-operator-action.ts         |  57 +++---
 .../scripts/user-prompt-pipeline.ts           | 154 +++++++++++++++++
 .../skills/channel-responder/SKILL.md         |   4 +-
 .../tests/channel-reply-reminder.test.ts      |  12 +-
 .../channel-responder-reply-rule.test.ts      |   8 +-
 .../channel-status-responder-wiring.test.ts   |   4 +-
 .../tests/channel-status-responder.test.ts    |  33 ++--
 .../tests/cron-registry.test.ts               |   2 +-
 .../tests/hooks.contract.test.ts              |  55 +++---
 .../tests/pause-keyword.test.ts               |  35 ++--
 .../tests/shutdown-gate.test.ts               |  24 ++-
 .../tests/user-prompt-pipeline.test.ts        | 163 ++++++++++++++++++
 39 files changed, 846 insertions(+), 654 deletions(-)
 delete mode 100644 plugins/claude-code-hermit/scripts/channel-reply-reminder.ts
 create mode 100644 plugins/claude-code-hermit/scripts/lib/cron-shift.ts
 create mode 100644 plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts
 rename plugins/claude-code-hermit/scripts/{ => lib/prompt-stages}/channel-status-responder.ts (83%)
 rename plugins/claude-code-hermit/scripts/{harness-command-keyword.ts => lib/prompt-stages/harness-command.ts} (63%)
 rename plugins/claude-code-hermit/scripts/{ => lib/prompt-stages}/pause-keyword.ts (62%)
 create mode 100644 plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts
 rename plugins/claude-code-hermit/scripts/{ => lib/prompt-stages}/shutdown-gate.ts (56%)
 create mode 100644 plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts
 delete mode 100644 plugins/claude-code-hermit/scripts/prompt-context.ts
 create mode 100644 plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
 create mode 100644 plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts

diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 82ff39cb..f86819e7 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -10,6 +10,7 @@
 - `apply-settings.ts permissions-plan` and `permissions-sync` — the script now owns hermit's permission list end to end. `permissions-plan` prints `{"missing":[],"obsolete":[]}` without writing; `permissions-sync` applies it, adding sealed entries and removing only entries a previous plugin version shipped and has since retired. Operator-authored rules are never removed — deletion is filtered by a sealed registry, not by shape.
 
 ### Fixed
+- A pending shutdown is now terminal for the whole prompt path. When a shutdown send failed, the prompt used to fall through and an exact `status` message could still send and block on its own — discarding the shutdown relay instruction the model was supposed to act on. `pause`/`resume`/`snooze` and channel harness commands could likewise mutate session state mid-shutdown and get only a shutdown reply. Both were possible by construction in the seven-process shape, where no hook could see what another had done; the pipeline now answers the shutdown and stops.
 - A `/clear` reaching the pane outside the watchdog no longer skips the hermit's own reset bookkeeping. The runtime stamp, `SHELL.md` breadcrumb, and status-cache clear moved to `lib/context-reset.ts`; skipping the cache clear previously let the watchdog fire a spurious `/compact` against a freshly-cleared context.
 - Turn cost is attributed from the delivered prompt alone, not the whole turn's text. A routine id appearing in a turn's own tool output no longer captures that turn's cost — `heartbeat-restart`'s re-arm, whose `CronList`/`CronDelete` output names concrete routine ids, was billing $3-7 turns to unrelated routines. Corrects `cost-reflect` and cost exports too, not just `hermit-doctor`.
 - Subagent-completion turns are attributed to the routine that dispatched the agent, resolved through the notification's task/tool-use id, instead of falling to `other`. The hop matches the assistant entry that emitted the `tool_use` block, so a repeat notification for the same agent no longer shadows the dispatch and drops the turn to `other`.
@@ -31,6 +32,7 @@
 - `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
 
 ### Changed
+- One `UserPromptSubmit` process per submitted prompt instead of seven. `user-prompt-pipeline.ts` reads stdin once, parses the channel envelope once, and reads `config.json` and `runtime.json` at most once each, then runs the former hooks as ordered stages (six now live in `scripts/lib/prompt-stages/`). Stage precedence is explicit in code rather than implied by entry order in `hooks.json`, and a blocked prompt emits the decision JSON alone — mixed context text alongside it does not parse as a decision, which would silently drop the block.
 - Proactive operator notifications unified onto `channel-send.ts --notice`; `weekly-review`, `cost-reflect`, and (via § Operator Notification) `heartbeat`/`brief`/`capability-brainstorm` are tier-aware, so spend and technical detail no longer reach the client chat. On a `non-technical` install with no `maintainer_channel_id`, routine spend reports now land in `SHELL.md` Findings instead of the primary chat.
 - `hatch` Step 8 and `hermit-evolve` Step 8 no longer restate the permission list — both call the new verbs. Two copies of the list are gone, along with the hand-maintained stale-entry list in `hermit-evolve/reference.md`, which had drifted to 15 of the canonical entries and told the model to add a `Write` rule the writer deliberately strips. The delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - The core CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-hermit: Session Discipline -->`), matching `claude-code-homeassistant-hermit`/`claude-code-fitness-hermit`/`feed-hermit`/`laravel-forge-hermit`. Bounds detection still falls back correctly for already-installed blocks that predate the marker.
diff --git a/plugins/claude-code-hermit/docs/architecture.md b/plugins/claude-code-hermit/docs/architecture.md
index ce058de6..c0f91f6a 100644
--- a/plugins/claude-code-hermit/docs/architecture.md
+++ b/plugins/claude-code-hermit/docs/architecture.md
@@ -156,7 +156,7 @@ your-project/
 │   │   ├── micro-proposals.json      # Pending micro-approvals list (reflect + channel-bridged asks + channel-responder)
 │   │   ├── state-summary.md          # Auto-generated health snapshot (generate-summary.ts)
 │   │   ├── monitors.runtime.json     # Active watch registry, cleared on session start (watch-owned)
-│   │   ├── operator-pause.json       # Operator/watchdog pause (pause-keyword.ts/watchdog-owned)
+│   │   ├── operator-pause.json       # Operator/watchdog pause (pause stage/watchdog-owned)
 │   │   ├── auto-pause.json           # Budget-breach auto-pause (cost-tracker-owned)
 │   │   ├── budget-alerts.json        # Budget alert dedup (cost-tracker-owned)
 │   │   ├── telemetry-alert.json      # Telemetry export-failure alert dedup (telemetry-export-owned)
@@ -184,7 +184,7 @@ One writer per state file. No shared mutation bus. (Exception: `state/micro-prop
 | `state/reflection-state.json`  | reflect + session (non-overlapping phases)          | heartbeat (debounce), hermit-settings (scheduled-checks display) |
 | `state/channel-activity.json`  | channel-hook.ts only                                | channel-responder, heartbeat                                  |
 | `state/channel-replies.jsonl`  | channel-hook.ts (append only)                       | reflect (routine-ROI engagement join)                         |
-| `state/channel-log.sqlite`     | channel-reply-reminder.ts + channel-hook.ts (append, via `lib/channel-log.ts`); weekly-review marks/prunes | search.ts (recall, fourth source); weekly-review consolidation |
+| `state/channel-log.sqlite`     | channel-reply-reminder stage + channel-hook.ts (append, via `lib/channel-log.ts`); weekly-review marks/prunes | search.ts (recall, fourth source); weekly-review consolidation |
 | `state/session-diff.json`      | session-diff.ts only                                | session-close (display)                                       |
 | `state/observations.jsonl`     | reflect + reflect-precheck + session-close + channel-responder (append only; `source` values: `cost-spike`, `quick-deferral`, `reflect-noticed`, `startup-drift`, `skill-correction`) | reflect (step 3b graduation), reflection-judge (§1.4 ledger verification) |
 | `state/proposal-metrics.jsonl` | proposal-create + proposal-act (append only)        | generate-summary.ts, proposal-metrics-report.ts (read-only)   |
diff --git a/plugins/claude-code-hermit/docs/security.md b/plugins/claude-code-hermit/docs/security.md
index 733592e7..218e53ad 100644
--- a/plugins/claude-code-hermit/docs/security.md
+++ b/plugins/claude-code-hermit/docs/security.md
@@ -222,15 +222,15 @@ Beyond the always-on baseline above, `/claude-code-hermit:docker-security` is an
 
 ### Known limitations
 
-- **`hermit-doctor`'s `channel-liveness` check and the deterministic channel-send path (`lib/channel-send.ts`) are two of core's direct outward egress paths.** Doctor's liveness call (Telegram `getMe`, Discord `/users/@me`) sends no message content, 5s timeout, fail-soft. `channel-send.ts` does send message content — it is the mechanism behind the watchdog's lifecycle pushes (restart/wedge/forced-pause), `cost-tracker`'s budget-cap alerts, and the `channel-status-responder.ts` reply — reading the bot token straight from the already-configured channel's `state_dir/.env` (the same token the channel MCP plugin uses), a plain-text POST with an explicit 10s timeout, and no retry on failure (fail-open: the caller falls back to its existing model-mediated path). Every other doctor check is a local filesystem read. The docker-security DNS allowlist already covers both platform hosts (`telegram.org`, `discord.com`) — no allowlist change needed. Disabling a channel disables both its liveness probe and any push through it; there is no separate per-check opt-out in v1.
-- **Remote control and status disclosure trust the operator DM when no `allowed_users` is set.** A plain channel *reply* still follows the documented accept-all default when `channels.<channel>.allowed_users` is absent — but the two paths that either *mutate state* (`pause`/`resume`/`snooze` via `pause-keyword.ts`) or *disclose operator state* (the deterministic `status` reply) do **not**. With no allowlist configured they trust only the operator's own DM (`chat_id === channels.<channel>.dm_channel_id`); any other sender's control keyword is a silent no-op, and any other accepted sender gets a redacted, coarse status (no spend figures, task text, or pending-approval IDs). `<channel>` here is the normalized bare server name (`lib/channel-envelope.ts`'s `normalizeChannelSource`) — the harness injects a plugin-qualified `source` on the wire (`plugin:discord:discord`), but config keys channels by the bare name, so this gate resolves the qualified source back to it before every lookup. **Caveat:** if a channel's primary chat *is* a group/server channel, its `dm_channel_id` equals that shared chat, so every member matches the DM binding — those installs must set `allowed_users` explicitly to restrict control and full status to named operators. This is a flat trust list, not RBAC (an RBAC pass on `allowed_users` is a deliberately-deferred enterprise gap).
+- **`hermit-doctor`'s `channel-liveness` check and the deterministic channel-send path (`lib/channel-send.ts`) are two of core's direct outward egress paths.** Doctor's liveness call (Telegram `getMe`, Discord `/users/@me`) sends no message content, 5s timeout, fail-soft. `channel-send.ts` does send message content — it is the mechanism behind the watchdog's lifecycle pushes (restart/wedge/forced-pause), `cost-tracker`'s budget-cap alerts, and the `lib/prompt-stages/channel-status-responder.ts` reply — reading the bot token straight from the already-configured channel's `state_dir/.env` (the same token the channel MCP plugin uses), a plain-text POST with an explicit 10s timeout, and no retry on failure (fail-open: the caller falls back to its existing model-mediated path). Every other doctor check is a local filesystem read. The docker-security DNS allowlist already covers both platform hosts (`telegram.org`, `discord.com`) — no allowlist change needed. Disabling a channel disables both its liveness probe and any push through it; there is no separate per-check opt-out in v1.
+- **Remote control and status disclosure trust the operator DM when no `allowed_users` is set.** A plain channel *reply* still follows the documented accept-all default when `channels.<channel>.allowed_users` is absent — but the two paths that either *mutate state* (`pause`/`resume`/`snooze` via `lib/prompt-stages/pause-keyword.ts`) or *disclose operator state* (the deterministic `status` reply) do **not**. With no allowlist configured they trust only the operator's own DM (`chat_id === channels.<channel>.dm_channel_id`); any other sender's control keyword is a silent no-op, and any other accepted sender gets a redacted, coarse status (no spend figures, task text, or pending-approval IDs). `<channel>` here is the normalized bare server name (`lib/channel-envelope.ts`'s `normalizeChannelSource`) — the harness injects a plugin-qualified `source` on the wire (`plugin:discord:discord`), but config keys channels by the bare name, so this gate resolves the qualified source back to it before every lookup. **Caveat:** if a channel's primary chat *is* a group/server channel, its `dm_channel_id` equals that shared chat, so every member matches the DM binding — those installs must set `allowed_users` explicitly to restrict control and full status to named operators. This is a flat trust list, not RBAC (an RBAC pass on `allowed_users` is a deliberately-deferred enterprise gap).
 - **Telemetry export is another direct outward egress — opt-in, off by default.** `config.telemetry_export` (absent or `enabled: false` = nothing ever leaves the box) periodically POSTs a versioned health/cost bundle to an operator-configured webhook from the watchdog tick. The bundle is allowlist-built: only named numerics/enums/counts are copied in by default (cost totals, doctor check statuses, alert counts, session cost/duration, watchdog event counts); free text (task descriptions, error messages, alert detail strings) is included only when the operator explicitly sets `redact_operator_text: false`. The bearer token comes from an env var named in config, never from `config.json` itself, and neither the webhook URL nor the token ever appear in logs or error output. Under docker-security, the webhook's host must be added to the DNS allowlist or exports fail (and spool) inside the hardened container.
 - **Three artifact pages publish session-derived content to claude.ai — default on, per-page opt-out.** `config.artifacts.dashboard`/`proposals`/`weekly_review` (default `true`) each publish a rendered page — status/latest-brief/proposals/weekly-evolution, open-proposal full text, and the compiled weekly review, respectively — via Claude Code's built-in Artifacts feature, not a hermit-authored HTTP call. Same publish path as any other Artifact a session creates, so it's governed by Claude Code's own controls (`disableArtifact`, `CLAUDE_CODE_DISABLE_ARTIFACT`, `permissions.deny`), not the docker-security DNS allowlist. Private to the publishing account on Pro/Max; Team/Enterprise can additionally Share within the org, never across it. Every automatic publish is a deterministic render of enumerated state files — with one caveat: the dashboard's latest-brief section embeds `state/last-brief.json`, whose `text` field is itself model-composed by the `brief` skill, so that one section is not exclusively machine-generated content. On-demand publish of a compiled doc or proposal (operator-initiated, no config gate) is likewise a direct file publish, no model authorship. See `docs/config-reference.md#artifacts` and `docs/artifacts.md`.
 - **`permissions.allow: ["Artifact"]` is a sanctioned pre-approval of an outward-publishing tool for autonomous use.** Applied via the `artifacts.publish_authorized` config flag (§ Auto-mode Classifier above) so unattended sessions don't stall on the first-publish permission ask (a headless "ask" is an effective deny) — a channel reply sets the flag only, and `hermit-start`'s boot-time grant, running outside any session, is what actually writes the permission (needed because the classifier blocks a session from widening its own `permissions.allow`, even attended-seeded). Re-ensured every boot, so a hand-wiped entry heals itself; revoke via `/hermit-settings artifact-authorization`. Assessment: on Pro/Max, artifacts are private to the publishing account with no share option, so a prompt-injected publish is persistence/noise, not exfiltration — the attacker cannot view the page, and `channel-send.ts` (above) remains the materially riskier egress. The real cost is losing the human checkpoint before irreversible external persistence: there is no tool-side delete, and published content may be cached even after removal from the gallery, so a mistaken publish (e.g. a render that embeds a secret that leaked into state) can't be fully recalled. Mitigation: every automatic-path publish is a deterministic render of enumerated state files (no free-form model-authored pages on the automatic path — see the brief-text caveat above); operators who decline the flag get the same outcome via setup-time banking (first publish happens inline, attended, at hatch/evolve time) instead of a standing grant.
 - **Egress filtering is opt-in.** Bridge networking isolates from localhost but the container can still reach the internet by default. A successful prompt injection can exfiltrate data to external hosts. **Mitigation available**: `/claude-code-hermit:docker-security` adds LAN containment + DNS policy via a firewall sidecar with kernel-level port-53 redirect for real enforcement. **Remaining gap**: direct public-IP egress (hardcoded IPs, no DNS) is not blocked even with the wizard — v1.1 may add nftset-driven IP allowlisting. See [Docker Security](docker-security.md).
 - **No input sanitization for fetched content.** Content fetched from external APIs enters Claude's context unsanitized. Deny patterns cannot catch injection via fetched content — that's an instruction-following boundary, not a mechanical one. **The scheduled-wake surface is now scanned.** HEARTBEAT.md is model-editable and feeds the autonomous evaluation subagent verbatim, so a poisoned checklist item written in one session could steer every future wake. `heartbeat-precheck.ts` scans it pre-wake for three pattern classes (instruction-override phrases, context-marker tags, decode-pipes); a hit converts the tick into an operator alert and suspends checklist evaluation until the file is edited. The suspension is scoped to checklist evaluation only — deterministic operator-safety notifications still fire (a pending budget alert pierces the announced-damper; a due stale auto-close still runs), since neither reads HEARTBEAT.md. This breaks the self-persistence path but is defense-in-depth, not a boundary — the PreToolUse/permissions chokepoint remains the actual guard during any wake turn.
 - **Deny patterns are a blocklist.** They catch commands you anticipated. Equivalent commands not on the list execute normally. Bind mount scope and network isolation are stronger defenses for novel attacks. The runtime hook (`enforce-deny-patterns.ts`) additionally normalizes each Bash candidate (whole command and every compound segment) before matching — collapsing horizontal whitespace runs, backslash-newline continuations, and unquoted `$IFS`/`${IFS}` — so a pattern like `rm -rf` also catches `rm  -rf`, `rm${IFS}-rf`, and the same hidden behind `&&`/`;`/`|`. Deliberately **not** implemented: Unicode normalization (NFKC), ANSI/NUL stripping, base64/decode-pipe detection, or general flag-order canonicalization. Bash does not treat those as equivalent to the canonical spelling — e.g. a fullwidth `ｓudo` is a distinct token that fails with "command not found," not an executable bypass — so folding them would close a non-threat while adding false-positive surface on legitimate unicode/binary arguments. This mirrors a full deobfuscation pipeline (as competitor agents implement as their *only* execution boundary) being disproportionate here: it sits behind the bash sandbox and container hardening layers above, not in front of an unsandboxed process.
-- **Episodic channel-log (PROP-010) stores raw DM text locally.** `state/channel-log.sqlite` holds the operator's Discord/Telegram DM text verbatim — capture is gated by the same `channels.<channel>.allowed_users` allowlist channel-responder enforces (envelope source normalized to the bare channel key, same as above; unauthorized senders are never logged), but authorized senders' full message text is retained until weekly-review consolidation and its retention window prune it. Storage is deliberately unsanitized (fidelity for consolidation), but the `/recall` read path (`search.ts`) runs recalled text through `safeForLLM` — the same control-char/tag-impersonation defusal `channel-reply-reminder.ts` already applies to the envelope's `source`/`chat_id` — before it reaches model context. Treat it as untrusted external input regardless: it's the operator's own words, but unreviewed. The file is local-only, covered by the standard `state/` gitignore, and never committed. Disable capture with `knowledge.channel_log_enabled: false` if this tradeoff isn't wanted.
+- **Episodic channel-log (PROP-010) stores raw DM text locally.** `state/channel-log.sqlite` holds the operator's Discord/Telegram DM text verbatim — capture is gated by the same `channels.<channel>.allowed_users` allowlist channel-responder enforces (envelope source normalized to the bare channel key, same as above; unauthorized senders are never logged), but authorized senders' full message text is retained until weekly-review consolidation and its retention window prune it. Storage is deliberately unsanitized (fidelity for consolidation), but the `/recall` read path (`search.ts`) runs recalled text through `safeForLLM` — the same control-char/tag-impersonation defusal `lib/prompt-stages/channel-reply-reminder.ts` already applies to the envelope's `source`/`chat_id` — before it reaches model context. Treat it as untrusted external input regardless: it's the operator's own words, but unreviewed. The file is local-only, covered by the standard `state/` gitignore, and never committed. Disable capture with `knowledge.channel_log_enabled: false` if this tradeoff isn't wanted.
 
 ---
 
diff --git a/plugins/claude-code-hermit/hooks/hooks.json b/plugins/claude-code-hermit/hooks/hooks.json
index e145ebec..ad0a8815 100644
--- a/plugins/claude-code-hermit/hooks/hooks.json
+++ b/plugins/claude-code-hermit/hooks/hooks.json
@@ -133,82 +133,11 @@
           {
             "type": "command",
             "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/prompt-context.ts"]
-          }
-        ],
-        "description": "Inject current local time before every prompt so the model never anchors to a stale 'now'"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/channel-reply-reminder.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Inject reply-tool reminder when inbound prompt starts with a <channel source=...> envelope"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/record-operator-action.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Record last operator-action timestamp; skips routine/loop/channel prompts"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/pause-keyword.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Deterministic pause/resume/snooze keyword writer — writes state/pause.json before any model turn, gated by the channel's allowed_users"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/harness-command-keyword.ts"],
-            "timeout": 3
-          }
-        ],
-        "description": "Record an exact channel /model|/effort|/compact|/clear request to state/pending-harness-command.json, gated by isTrustedController; the Stop hook types it into the pane once the turn ends"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/shutdown-gate.ts"],
-            "timeout": 8
-          }
-        ],
-        "description": "Deterministic shutdown gate — while a shutdown is pending, send-then-block channel messages from allowed senders so the hermit takes no new work"
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bun",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/channel-status-responder.ts"],
-            "timeout": 12
+            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/user-prompt-pipeline.ts"],
+            "timeout": 15
           }
         ],
-        "description": "Deterministic status responder — send-then-block reply to an exact idle 'status' message, gated by the channel's allowed_users; never fires on a near-miss or mid-turn arrival"
+        "description": "Single prompt pipeline: records operator action, injects time + channel reply reminder, then applies pause / harness-command / shutdown / status in explicit precedence (shutdown is terminal)"
       }
     ],
     "SessionStart": [
diff --git a/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts b/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts
deleted file mode 100644
index 941ade19..00000000
--- a/plugins/claude-code-hermit/scripts/channel-reply-reminder.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — when the inbound prompt starts with a <channel>
-// envelope, injects an additionalContext reminder naming the exact reply tool
-// and chat_id. Operators on Discord/Telegram read the channel, not the
-// transcript; this reminder fires right before the model's next turn.
-//
-// Also captures the inbound message into the episodic channel log (PROP-010)
-// — see scripts/lib/channel-log.ts. Capture is best-effort and strictly
-// secondary to the reminder: it runs after the reminder is written, in its
-// own try/catch, and a logging failure never affects the reminder.
-
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { logMessage, isLoggingEnabled } from './lib/channel-log';
-import { loadConfig, isAllowedSender } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-
-type Json = any;
-
-// Known channel sources → exact MCP reply tool name.
-// Unknown sources fall back to a generic phrase so future channel plugins
-// still benefit from the reminder without a code change.
-const REPLY_TOOLS: Record<string, string> = {
-  discord: 'mcp__plugin_discord_discord__reply',
-  telegram: 'mcp__plugin_telegram_telegram__reply',
-  imessage: 'mcp__plugin_imessage_imessage__reply',
-};
-
-const MAX_SOURCE_LEN = 32;
-const MAX_CHAT_ID_LEN = 128;
-
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
-  if (!envelope) return;
-
-  const sourceKey = envelope.sourceKey;
-  const chatIdRaw = envelope.chatId;
-
-  const source = safeForLLM(sourceKey.slice(0, MAX_SOURCE_LEN));
-  const chatId = safeForLLM(chatIdRaw.slice(0, MAX_CHAT_ID_LEN));
-
-  const tool = REPLY_TOOLS[source];
-  const toolLine = tool
-    ? `\`${tool}\` with chat_id="${chatId}"`
-    : `the channel's \`reply\` tool with chat_id="${chatId}"`;
-
-  process.stdout.write(
-    `[channel reply reminder] Inbound message arrived on the \`${source || 'unknown'}\` channel` +
-    ` (chat_id=\`${chatId}\`). Substantive reply must go through ${toolLine}.` +
-    ` Transcript/terminal output does not reach the operator.\n`
-  );
-
-  // Episodic capture — best-effort, never affects the reminder above.
-  try {
-    if (!envelope.body) return;
-
-    const dir = hermitDir();
-    const config = loadConfig(dir);
-    if (!isLoggingEnabled(config)) return;
-
-    // Raw source (not sourceKey): channelEntry normalizes it internally, and
-    // pause-keyword.ts and channel-status-responder.ts feed the same raw source
-    // into this gate — one convention across every caller.
-    if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
-
-    const result = logMessage(dir, {
-      source: sourceKey,
-      chat_id: chatIdRaw,
-      direction: 'in',
-      sender: envelope.userId,
-      message_id: envelope.messageId,
-      text: envelope.body,
-      ts: envelope.ts ?? undefined,
-    });
-    if (!result.ok) {
-      process.stderr.write(`[channel-log] inbound capture failed: ${result.error}\n`);
-    }
-  } catch (e: any) {
-    process.stderr.write(`[channel-log] inbound capture failed: ${e?.message || e}\n`);
-  }
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
-}
diff --git a/plugins/claude-code-hermit/scripts/channel-send.ts b/plugins/claude-code-hermit/scripts/channel-send.ts
index 22ebe990..3abb10ec 100644
--- a/plugins/claude-code-hermit/scripts/channel-send.ts
+++ b/plugins/claude-code-hermit/scripts/channel-send.ts
@@ -3,7 +3,7 @@
 // seam synchronous callers (hermit-watchdog.ts, single-shot, no async conversion)
 // reach the deterministic channel send through via spawnSync, instead of
 // importing the lib directly the way async callers (cost-tracker.ts,
-// channel-status-responder.ts) do.
+// lib/prompt-stages/channel-status-responder.ts) do.
 //
 // Usage: bun channel-send.ts <hermit-dir> [--tier client|maintainer] <text|- >
 //   --tier     client (default) sends to the primary chat as today; maintainer
diff --git a/plugins/claude-code-hermit/scripts/cron-registry.ts b/plugins/claude-code-hermit/scripts/cron-registry.ts
index 04eb2396..5da587b5 100644
--- a/plugins/claude-code-hermit/scripts/cron-registry.ts
+++ b/plugins/claude-code-hermit/scripts/cron-registry.ts
@@ -35,7 +35,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { sha256 } from './lib/hash';
-import { shiftCron } from './cron-tz-shift';
+import { shiftCron } from './lib/cron-shift';
 import { parseCronField } from './validate-config';
 
 type Json = any;
diff --git a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts b/plugins/claude-code-hermit/scripts/cron-tz-shift.ts
index def6f705..600dc525 100644
--- a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts
+++ b/plugins/claude-code-hermit/scripts/cron-tz-shift.ts
@@ -3,139 +3,17 @@
 // Stdout: shifted cron (or original on unsupported/fail-open paths)
 // Stderr: WARN: <reason>  (when passing through unchanged due to unsupported pattern)
 // Exit 0 always except: malformed cron that fails validateCronSchedule, or unparseable HERMIT_CRON_TZ_SHIFT_NOW
+//
+// The shift logic itself lives in lib/cron-shift.ts; this file is its CLI.
 
-import { parseCronField, validateCronSchedule } from './validate-config';
-import { currentHHMM } from './lib/time';
-
-function wallMinutes(tz: string, ref: Date): number | null {
-  const hhmm = currentHHMM(tz, ref);
-  if (!hhmm) return null;
-  const [h, m] = hhmm.split(':').map(Number);
-  return h * 60 + m;
-}
+import { validateCronSchedule } from './validate-config';
+import { shiftCron, wallMinutes } from './lib/cron-shift';
 
 function resolveMachineTz() {
   try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }
   catch { return null; }
 }
 
-// Collapse a sorted array of integers back to a compact cron field token.
-function collapseField(vals: number[], lo: number, hi: number): string | null {
-  if (!vals || vals.length === 0) return null;
-  if (vals.length === 1) return String(vals[0]);
-  if (vals.length === hi - lo + 1) return '*';
-  const step = vals[1] - vals[0];
-  const isArithmetic = step > 0 && vals.every((v, i) => i === 0 || v === vals[i - 1] + step);
-  if (isArithmetic) {
-    const first = vals[0], last = vals[vals.length - 1];
-    if (step === 1) return vals.length >= 3 ? `${first}-${last}` : vals.join(',');
-    if (vals.length < 3) return vals.join(',');
-    const endsAtHi = last + step > hi;
-    if (first === lo && endsAtHi) return `*/${step}`;
-    if (endsAtHi) return `${first}-${hi}/${step}`;
-    return `${first}-${last}/${step}`;
-  }
-  return vals.join(',');
-}
-
-// Core shift logic. Returns { result, shifted, warn }.
-// shifted=true means the cron was actually changed.
-// warn is set when passing through unchanged due to an unsupported pattern.
-function shiftCron(cronExpr: string, fromTz: string, machineTz: string, ref: Date): { result: string; shifted?: boolean; warn?: string } {
-  const cleanFrom = (fromTz || '').trim();
-  if (!cleanFrom || cleanFrom === machineTz) return { result: cronExpr, shifted: false };
-
-  const fields = cronExpr.trim().split(/\s+/);
-  const [minF, hourF, domF, monF, dowF] = fields;
-
-  if (domF !== '*') {
-    return { result: cronExpr, warn: 'DOM-restricted schedules are not shifted; machine-local time used' };
-  }
-
-  // hour=* fires every hour — no per-hour shift possible
-  if (hourF === '*') return { result: cronExpr, shifted: false };
-
-  const fromMin = wallMinutes(cleanFrom, ref);
-  if (fromMin === null) return { result: cronExpr, warn: `invalid from-tz "${cleanFrom}"` };
-  const machMin = wallMinutes(machineTz, ref);
-  if (machMin === null) return { result: cronExpr, warn: 'could not resolve machine timezone' };
-
-  let offsetMin = machMin - fromMin;
-  if (offsetMin > 720) offsetMin -= 1440;
-  if (offsetMin <= -720) offsetMin += 1440;
-  if (offsetMin === 0) return { result: cronExpr, shifted: false };
-
-  let minVals: number[], hourVals: number[];
-  try {
-    minVals = [...parseCronField(minF, 0, 59)].sort((a, b) => a - b);
-    hourVals = [...parseCronField(hourF, 0, 23)].sort((a, b) => a - b);
-  } catch (e: any) {
-    return { result: cronExpr, warn: `cannot expand fields: ${e.message}` };
-  }
-
-  // Compute shifted (newM, newH, dayDelta) for every (m, h) pair
-  const shiftedPairs: { newM: number; newH: number; dayDelta: number }[] = [];
-  for (const h of hourVals) {
-    for (const m of minVals) {
-      const total = h * 60 + m + offsetMin;
-      const dayDelta = total < 0 ? -1 : total >= 1440 ? 1 : 0;
-      const wrapped = ((total % 1440) + 1440) % 1440;
-      shiftedPairs.push({ newM: wrapped % 60, newH: Math.floor(wrapped / 60), dayDelta });
-    }
-  }
-
-  // Group by shifted hour; collect sorted min arrays once for both outer-product check and newMinVals
-  const byHour = new Map<number, Set<number>>();
-  for (const { newM, newH } of shiftedPairs) {
-    if (!byHour.has(newH)) byHour.set(newH, new Set());
-    byHour.get(newH)!.add(newM);
-  }
-  if (byHour.size === 0) return { result: cronExpr, shifted: false };
-
-  const minArrays = [...byHour.values()].map(s => [...s].sort((a, b) => a - b));
-  const refKey = minArrays[0].join(',');
-  if (!minArrays.every(a => a.join(',') === refKey)) {
-    return { result: cronExpr, warn: 'shifted (minute, hour) set is not an outer product, cannot be expressed as a single cron' };
-  }
-
-  const allDeltas = new Set(shiftedPairs.map(p => p.dayDelta));
-  const dowRestricted = dowF !== '*';
-  if (dowRestricted && allDeltas.size > 1) {
-    return { result: cronExpr, warn: 'cron has mixed day-wrap after shift, cannot be expressed as a single cron' };
-  }
-
-  const newHourVals = [...byHour.keys()].sort((a, b) => a - b);
-  const newMinVals = minArrays[0];
-
-  // If original hour field was a step, verify the step structure survives the shift
-  const hourIsStep = /^(\*|\d+(-\d+)?)\/\d+$/.test(hourF);
-  if (hourIsStep && newHourVals.length > 1) {
-    const collapsed = collapseField(newHourVals, 0, 23);
-    if (!collapsed!.includes('/')) {
-      return { result: cronExpr, warn: 'hour step pattern loses its structure after timezone shift; split into fixed-time routines instead' };
-    }
-  }
-
-  const newMinF = collapseField(newMinVals, 0, 59);
-  const newHourF = collapseField(newHourVals, 0, 23);
-
-  let newDowF = dowF;
-  if (dowRestricted) {
-    const delta = [...allDeltas][0];
-    if (delta !== 0) {
-      try {
-        const dowVals = [...parseCronField(dowF, 0, 7)].map(v => v === 7 ? 0 : v);
-        const shiftedDow = [...new Set(dowVals.map(v => ((v + delta) % 7 + 7) % 7))].sort((a, b) => a - b);
-        newDowF = collapseField(shiftedDow, 0, 6)!;
-      } catch (e: any) {
-        return { result: cronExpr, warn: `cannot shift DOW field: ${e.message}` };
-      }
-    }
-  }
-
-  return { result: `${newMinF} ${newHourF} ${domF} ${monF} ${newDowF}`, shifted: true };
-}
-
 function main() {
   const [,, cronExpr, fromTz] = process.argv;
 
@@ -173,8 +51,6 @@ function main() {
   if (warn) process.stderr.write(`WARN: ${warn}\n`);
 }
 
-export { shiftCron, wallMinutes };
-
 if (import.meta.main) {
   main();
 }
diff --git a/plugins/claude-code-hermit/scripts/hermit-pause.ts b/plugins/claude-code-hermit/scripts/hermit-pause.ts
index d913b80c..9a93b84c 100644
--- a/plugins/claude-code-hermit/scripts/hermit-pause.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-pause.ts
@@ -12,7 +12,7 @@
 import { setPause, clearPause, isPaused, parseSnoozeDuration } from './lib/pause';
 import { hermitDir } from './lib/cc-compat';
 
-// Resolve the hermit root the same way the writer (pause-keyword.ts) does —
+// Resolve the hermit root the same way the writer (lib/prompt-stages/pause-keyword.ts) does —
 // hermitDir() honors CLAUDE_PROJECT_DIR then walks up for config.json, so the
 // CLI targets the real flag even when run from a subdirectory. A hardcoded
 // relative '.claude-code-hermit' would resolve against the caller's cwd; run
diff --git a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
index b01aeead..26d9c4c1 100644
--- a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
@@ -33,7 +33,7 @@ import { tmuxSessionAlive, getSessionName as deriveSessionName, sendKeys } from
 import { paneRootPids, collectTree, terminateSurvivors } from './lib/proc';
 import { sharedLivenessAgeSecs, LIVENESS_FRESH_SECS } from './lib/liveness';
 import { costLogPath } from './lib/cc-compat';
-import { wallMinutes } from './cron-tz-shift';
+import { wallMinutes } from './lib/cron-shift';
 import { isPaused, pauseReasonLabel } from './lib/pause';
 import { WATCHDOG, resolveLocale, type Locale } from './lib/messages';
 import { defaultConfigDir, msUntilExpiry, tokenModeActive } from './lib/setup-token';
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-auth.ts b/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
index 3330aabd..a913a26e 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-auth.ts
@@ -1,6 +1,7 @@
 // Shared channel `allowed_users` allowlist gating — used by every
 // UserPromptSubmit hook that reacts to an inbound <channel> envelope
-// (channel-reply-reminder.ts, pause-keyword.ts, channel-status-responder.ts).
+// (the channel-reply-reminder, pause-keyword and channel-status-responder
+// stages in lib/prompt-stages/).
 // A single copy so the allowlist rule can't drift out of sync between callers.
 
 import fs from 'node:fs';
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts b/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
index 30d4cf5e..d54717a7 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-envelope.ts
@@ -1,6 +1,7 @@
 // Shared <channel ...>body</channel> envelope parser — used by every
 // UserPromptSubmit hook that reacts to an inbound channel message
-// (channel-reply-reminder.ts, channel-status-responder.ts, pause-keyword.ts).
+// (the channel-reply-reminder, channel-status-responder and pause-keyword
+// stages in lib/prompt-stages/).
 // A single copy so the attribute regex and body-extraction rule can't drift
 // out of sync between callers.
 //
diff --git a/plugins/claude-code-hermit/scripts/lib/channel-log.ts b/plugins/claude-code-hermit/scripts/lib/channel-log.ts
index 62c2c7fc..34b4ad87 100644
--- a/plugins/claude-code-hermit/scripts/lib/channel-log.ts
+++ b/plugins/claude-code-hermit/scripts/lib/channel-log.ts
@@ -63,7 +63,8 @@ function dbExists(hermitDir: string): boolean {
 }
 
 // Busy-wait budgets. Capture runs inside hooks with their own enforced timeouts
-// (channel-reply-reminder.ts: 3s, channel-hook.ts: 5s in hooks.json), and
+// (user-prompt-pipeline.ts: 15s shared across all its stages, channel-hook.ts:
+// 5s in hooks.json), and
 // bun:sqlite blocks synchronously — so the hook path must fail fast rather than
 // stall past its budget and get killed. The weekly-review CLI writers aren't
 // timeout-bound, so they can wait out real contention.
@@ -84,7 +85,7 @@ function openDb(hermitDir: string, opts?: { readonly?: boolean; busyTimeoutMs?:
 
 /**
  * Default-on gate for episodic capture: config.knowledge.channel_log_enabled.
- * Shared by channel-hook.ts (outbound) and channel-reply-reminder.ts (inbound)
+ * Shared by channel-hook.ts (outbound) and the channel-reply-reminder stage (inbound)
  * so the "only an explicit false disables capture" rule lives in one place.
  */
 function isLoggingEnabled(config: Json): boolean {
diff --git a/plugins/claude-code-hermit/scripts/lib/cron-shift.ts b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
new file mode 100644
index 00000000..844e054b
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
@@ -0,0 +1,134 @@
+// Timezone-aware cron shifting — the pure logic behind scripts/cron-tz-shift.ts.
+//
+// Lives in lib/ so importers (cron-registry.ts, hermit-watchdog.ts, the
+// status-responder stage) don't pull in a top-level CLI script just to reach
+// two functions.
+
+import { parseCronField } from '../validate-config';
+import { currentHHMM } from './time';
+
+function wallMinutes(tz: string, ref: Date): number | null {
+  const hhmm = currentHHMM(tz, ref);
+  if (!hhmm) return null;
+  const [h, m] = hhmm.split(':').map(Number);
+  return h * 60 + m;
+}
+
+// Collapse a sorted array of integers back to a compact cron field token.
+function collapseField(vals: number[], lo: number, hi: number): string | null {
+  if (!vals || vals.length === 0) return null;
+  if (vals.length === 1) return String(vals[0]);
+  if (vals.length === hi - lo + 1) return '*';
+  const step = vals[1] - vals[0];
+  const isArithmetic = step > 0 && vals.every((v, i) => i === 0 || v === vals[i - 1] + step);
+  if (isArithmetic) {
+    const first = vals[0], last = vals[vals.length - 1];
+    if (step === 1) return vals.length >= 3 ? `${first}-${last}` : vals.join(',');
+    if (vals.length < 3) return vals.join(',');
+    const endsAtHi = last + step > hi;
+    if (first === lo && endsAtHi) return `*/${step}`;
+    if (endsAtHi) return `${first}-${hi}/${step}`;
+    return `${first}-${last}/${step}`;
+  }
+  return vals.join(',');
+}
+
+// Core shift logic. Returns { result, shifted, warn }.
+// shifted=true means the cron was actually changed.
+// warn is set when passing through unchanged due to an unsupported pattern.
+function shiftCron(cronExpr: string, fromTz: string, machineTz: string, ref: Date): { result: string; shifted?: boolean; warn?: string } {
+  const cleanFrom = (fromTz || '').trim();
+  if (!cleanFrom || cleanFrom === machineTz) return { result: cronExpr, shifted: false };
+
+  const fields = cronExpr.trim().split(/\s+/);
+  const [minF, hourF, domF, monF, dowF] = fields;
+
+  if (domF !== '*') {
+    return { result: cronExpr, warn: 'DOM-restricted schedules are not shifted; machine-local time used' };
+  }
+
+  // hour=* fires every hour — no per-hour shift possible
+  if (hourF === '*') return { result: cronExpr, shifted: false };
+
+  const fromMin = wallMinutes(cleanFrom, ref);
+  if (fromMin === null) return { result: cronExpr, warn: `invalid from-tz "${cleanFrom}"` };
+  const machMin = wallMinutes(machineTz, ref);
+  if (machMin === null) return { result: cronExpr, warn: 'could not resolve machine timezone' };
+
+  let offsetMin = machMin - fromMin;
+  if (offsetMin > 720) offsetMin -= 1440;
+  if (offsetMin <= -720) offsetMin += 1440;
+  if (offsetMin === 0) return { result: cronExpr, shifted: false };
+
+  let minVals: number[], hourVals: number[];
+  try {
+    minVals = [...parseCronField(minF, 0, 59)].sort((a, b) => a - b);
+    hourVals = [...parseCronField(hourF, 0, 23)].sort((a, b) => a - b);
+  } catch (e: any) {
+    return { result: cronExpr, warn: `cannot expand fields: ${e.message}` };
+  }
+
+  // Compute shifted (newM, newH, dayDelta) for every (m, h) pair
+  const shiftedPairs: { newM: number; newH: number; dayDelta: number }[] = [];
+  for (const h of hourVals) {
+    for (const m of minVals) {
+      const total = h * 60 + m + offsetMin;
+      const dayDelta = total < 0 ? -1 : total >= 1440 ? 1 : 0;
+      const wrapped = ((total % 1440) + 1440) % 1440;
+      shiftedPairs.push({ newM: wrapped % 60, newH: Math.floor(wrapped / 60), dayDelta });
+    }
+  }
+
+  // Group by shifted hour; collect sorted min arrays once for both outer-product check and newMinVals
+  const byHour = new Map<number, Set<number>>();
+  for (const { newM, newH } of shiftedPairs) {
+    if (!byHour.has(newH)) byHour.set(newH, new Set());
+    byHour.get(newH)!.add(newM);
+  }
+  if (byHour.size === 0) return { result: cronExpr, shifted: false };
+
+  const minArrays = [...byHour.values()].map(s => [...s].sort((a, b) => a - b));
+  const refKey = minArrays[0].join(',');
+  if (!minArrays.every(a => a.join(',') === refKey)) {
+    return { result: cronExpr, warn: 'shifted (minute, hour) set is not an outer product, cannot be expressed as a single cron' };
+  }
+
+  const allDeltas = new Set(shiftedPairs.map(p => p.dayDelta));
+  const dowRestricted = dowF !== '*';
+  if (dowRestricted && allDeltas.size > 1) {
+    return { result: cronExpr, warn: 'cron has mixed day-wrap after shift, cannot be expressed as a single cron' };
+  }
+
+  const newHourVals = [...byHour.keys()].sort((a, b) => a - b);
+  const newMinVals = minArrays[0];
+
+  // If original hour field was a step, verify the step structure survives the shift
+  const hourIsStep = /^(\*|\d+(-\d+)?)\/\d+$/.test(hourF);
+  if (hourIsStep && newHourVals.length > 1) {
+    const collapsed = collapseField(newHourVals, 0, 23);
+    if (!collapsed!.includes('/')) {
+      return { result: cronExpr, warn: 'hour step pattern loses its structure after timezone shift; split into fixed-time routines instead' };
+    }
+  }
+
+  const newMinF = collapseField(newMinVals, 0, 59);
+  const newHourF = collapseField(newHourVals, 0, 23);
+
+  let newDowF = dowF;
+  if (dowRestricted) {
+    const delta = [...allDeltas][0];
+    if (delta !== 0) {
+      try {
+        const dowVals = [...parseCronField(dowF, 0, 7)].map(v => v === 7 ? 0 : v);
+        const shiftedDow = [...new Set(dowVals.map(v => ((v + delta) % 7 + 7) % 7))].sort((a, b) => a - b);
+        newDowF = collapseField(shiftedDow, 0, 6)!;
+      } catch (e: any) {
+        return { result: cronExpr, warn: `cannot shift DOW field: ${e.message}` };
+      }
+    }
+  }
+
+  return { result: `${newMinF} ${newHourF} ${domF} ${monF} ${newDowF}`, shifted: true };
+}
+
+export { shiftCron, wallMinutes };
diff --git a/plugins/claude-code-hermit/scripts/lib/harness-command.ts b/plugins/claude-code-hermit/scripts/lib/harness-command.ts
index 3afd8f8e..f2c15bb1 100644
--- a/plugins/claude-code-hermit/scripts/lib/harness-command.ts
+++ b/plugins/claude-code-hermit/scripts/lib/harness-command.ts
@@ -1,5 +1,5 @@
 // Pending harness-command marker — written by the UserPromptSubmit hook
-// (harness-command-keyword.ts), consumed by the Stop hook (stop-pipeline.ts).
+// (lib/prompt-stages/harness-command.ts), consumed by the Stop hook (stop-pipeline.ts).
 //
 // Singleton by design, matching the existing marker files in state/. Two commands
 // arriving inside one turn therefore collapse to the last one; that is accepted rather
diff --git a/plugins/claude-code-hermit/scripts/lib/messages.ts b/plugins/claude-code-hermit/scripts/lib/messages.ts
index 2234e1af..2e8d9117 100644
--- a/plugins/claude-code-hermit/scripts/lib/messages.ts
+++ b/plugins/claude-code-hermit/scripts/lib/messages.ts
@@ -267,7 +267,7 @@ export const WATCHDOG: Localized<WatchdogMessages> = {
   },
 };
 
-// ---------- deterministic shutdown gate (shutdown-gate.ts) ----------
+// ---------- deterministic shutdown gate (lib/prompt-stages/shutdown-gate.ts) ----------
 
 export interface ShutdownMessages {
   inProgress(): string;
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts
new file mode 100644
index 00000000..d9536711
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-reply-reminder.ts
@@ -0,0 +1,84 @@
+// UserPromptSubmit stage — when the inbound prompt starts with a <channel>
+// envelope, injects an additionalContext reminder naming the exact reply tool
+// and chat_id. Operators on Discord/Telegram read the channel, not the
+// transcript; this reminder fires right before the model's next turn.
+//
+// Also captures the inbound message into the episodic channel log (PROP-010)
+// — see scripts/lib/channel-log.ts. Capture is best-effort and strictly
+// secondary to the reminder: it runs after the reminder is composed, in its
+// own try/catch, and a logging failure never affects the reminder.
+
+import { safeForLLM } from '../sanitize';
+import { logMessage, isLoggingEnabled } from '../channel-log';
+import { isAllowedSender } from '../channel-auth';
+import type { ChannelEnvelope, StageContext, StageResult } from './types';
+
+// Known channel sources → exact MCP reply tool name.
+// Unknown sources fall back to a generic phrase so future channel plugins
+// still benefit from the reminder without a code change.
+const REPLY_TOOLS: Record<string, string> = {
+  discord: 'mcp__plugin_discord_discord__reply',
+  telegram: 'mcp__plugin_telegram_telegram__reply',
+  imessage: 'mcp__plugin_imessage_imessage__reply',
+};
+
+const MAX_SOURCE_LEN = 32;
+const MAX_CHAT_ID_LEN = 128;
+
+// Episodic capture — best-effort, never affects the reminder. Its guards are
+// early returns from this helper, so none of them can swallow the reminder the
+// caller is about to return.
+function capture(ctx: StageContext, envelope: ChannelEnvelope): void {
+  if (!envelope.body) return;
+
+  const dir = ctx.dir;
+  const config = ctx.config();
+  if (!isLoggingEnabled(config)) return;
+
+  // Raw source (not sourceKey): channelEntry normalizes it internally, and
+  // pause-keyword.ts and channel-status-responder.ts feed the same raw source
+  // into this gate — one convention across every caller.
+  if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
+
+  const result = logMessage(dir, {
+    source: envelope.sourceKey,
+    chat_id: envelope.chatId,
+    direction: 'in',
+    sender: envelope.userId,
+    message_id: envelope.messageId,
+    text: envelope.body,
+    ts: envelope.ts ?? undefined,
+  });
+  if (!result.ok) {
+    process.stderr.write(`[channel-log] inbound capture failed: ${result.error}\n`);
+  }
+}
+
+export function run(ctx: StageContext): StageResult | void {
+  const envelope = ctx.envelope;
+  if (!envelope) return;
+
+  const sourceKey = envelope.sourceKey;
+  const chatIdRaw = envelope.chatId;
+
+  const source = safeForLLM(sourceKey.slice(0, MAX_SOURCE_LEN));
+  const chatId = safeForLLM(chatIdRaw.slice(0, MAX_CHAT_ID_LEN));
+
+  const tool = REPLY_TOOLS[source];
+  const toolLine = tool
+    ? `\`${tool}\` with chat_id="${chatId}"`
+    : `the channel's \`reply\` tool with chat_id="${chatId}"`;
+
+  const reminder =
+    `[channel reply reminder] Inbound message arrived on the \`${source || 'unknown'}\` channel` +
+    ` (chat_id=\`${chatId}\`). Substantive reply must go through ${toolLine}.` +
+    ` Transcript/terminal output does not reach the operator.\n`;
+
+  try {
+    capture(ctx, envelope);
+  } catch (e: any) {
+    process.stderr.write(`[channel-log] inbound capture failed: ${e?.message || e}\n`);
+  }
+
+  return { context: reminder };
+}
diff --git a/plugins/claude-code-hermit/scripts/channel-status-responder.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
similarity index 83%
rename from plugins/claude-code-hermit/scripts/channel-status-responder.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
index 963ad6cc..d59171bc 100644
--- a/plugins/claude-code-hermit/scripts/channel-status-responder.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/channel-status-responder.ts
@@ -1,4 +1,4 @@
-// UserPromptSubmit hook — deterministic status responder.
+// UserPromptSubmit stage — deterministic status responder.
 //
 // When the inbound prompt is a <channel> envelope whose body is exactly
 // "status" (trimmed, case-insensitive) and the sender passes the channel's
@@ -19,15 +19,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { hermitDir } from './lib/cc-compat';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { loadConfig, isAllowedSender, isTrustedController } from './lib/channel-auth';
-import { isPaused, pauseReasonLabel } from './lib/pause';
-import { resolveTimezone, budgetLine } from './lib/spend-status';
-import { friendlyBoundary, parseSimpleCronTime } from './lib/time';
-import { wallMinutes } from './cron-tz-shift';
-import { sendToChannel } from './lib/channel-send';
-import { STATUS, resolveLocale, type Locale } from './lib/messages';
+import { isAllowedSender, isTrustedController } from '../channel-auth';
+import { isPaused, pauseReasonLabel } from '../pause';
+import { resolveTimezone, budgetLine } from '../spend-status';
+import { friendlyBoundary, parseSimpleCronTime } from '../time';
+import { wallMinutes } from '../cron-shift';
+import { sendToChannel } from '../channel-send';
+import { STATUS, resolveLocale, type Locale } from '../messages';
+import type { StageContext, StageResult } from './types';
 
 type Json = any;
 
@@ -167,25 +166,15 @@ export function composeStatusReply(dir: string, config: Json, opts: { redact?: b
   return lines.join(' ');
 }
 
-async function main(raw: string): Promise<void> {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
+export async function run(ctx: StageContext): Promise<StageResult | void> {
+  const envelope = ctx.envelope;
   if (!envelope) return;
 
   // Exact-match only — near-misses fall through to the model (probe-verified).
   if (envelope.body.trim().toLowerCase() !== 'status') return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   if (!config) return;
 
   if (!isAllowedSender(config, envelope.source, envelope.userId)) return;
@@ -201,10 +190,10 @@ async function main(raw: string): Promise<void> {
   const result = await sendToChannel(dir, reply, {
     target: { id: envelope.sourceKey, chat_id: envelope.chatId },
     timeoutMs: 6000,
+    config, // already loaded by the pipeline — don't make the sender re-read it
   });
   if (result.ok) {
-    console.log(JSON.stringify({ decision: 'block', reason: 'status answered deterministically' }));
-    return;
+    return { block: 'status answered deterministically' };
   }
 
   // Deterministic delivery failed — an unsupported platform (iMessage/webhook aren't
@@ -216,23 +205,10 @@ async function main(raw: string): Promise<void> {
   // UserPromptSubmit hook's stdout reaches the model on the same turn
   // (compiled/spike-userprompt-additionalcontext-probe-2026-07-05.md) — the same
   // mechanism channel-reply-reminder.ts relies on.
-  process.stdout.write(
-    `[status] Deterministic status delivery is unavailable on this channel. Relay the ` +
-    `following status to the operator verbatim via the channel reply tool (to the chat ` +
-    `this message arrived on), then stop — add no commentary:\n${reply}\n`
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    main(buf)
-      .catch(() => {})
-      .finally(() => process.exit(0));
-  });
-} catch {
-  process.exit(0);
+  return {
+    context:
+      `[status] Deterministic status delivery is unavailable on this channel. Relay the ` +
+      `following status to the operator verbatim via the channel reply tool (to the chat ` +
+      `this message arrived on), then stop — add no commentary:\n${reply}\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/harness-command-keyword.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
similarity index 63%
rename from plugins/claude-code-hermit/scripts/harness-command-keyword.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
index 0c7b1669..acb9c50b 100644
--- a/plugins/claude-code-hermit/scripts/harness-command-keyword.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/harness-command.ts
@@ -1,7 +1,4 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — deterministic harness-command recorder.
+// UserPromptSubmit stage — deterministic harness-command recorder.
 //
 // Native Claude Code slash commands that control the HARNESS (/model, /effort,
 // /compact, /clear) are unreachable from a channel: inbound channel prompts are
@@ -24,42 +21,28 @@ process.stdout.on('error', () => {});
 // because these commands mutate session state. An unauthorized sender is a silent no-op:
 // no marker, no stdout, so the mechanism can't be probed by an unauthorized prompt.
 
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { loadConfig, isTrustedController } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { readRuntimeJson } from './lib/runtime';
-import { parseHarnessCommand, writePendingCommand, renderCommand } from './lib/harness-command';
-
-type Json = any;
-
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
+import { safeForLLM } from '../sanitize';
+import { isTrustedController } from '../channel-auth';
+import { parseHarnessCommand, writePendingCommand, renderCommand } from '../harness-command';
+import type { StageContext, StageResult } from './types';
 
-  const env = parseChannelEnvelope(prompt);
+export function run(ctx: StageContext): StageResult | void {
+  const env = ctx.envelope;
   if (!env) return;
   if (!env.body) return;
 
   const parsed = parseHarnessCommand(env.body);
   if (!parsed) return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   if (!isTrustedController(config, env.source, env.userId, env.chatId)) return; // unauthorized — silent no-op
 
   // Interactive sessions store tmux_session: null (hermit-start.ts), so there is no pane
   // to deliver into. Refuse HERE rather than recording a marker the drain could never
   // consume — otherwise the operator gets an acknowledgement for a command that silently
   // never happens.
-  const runtime = readRuntimeJson();
+  const runtime = ctx.runtime();
   if (!runtime || runtime.runtime_mode === 'interactive' || !runtime.tmux_session) return;
 
   const by = safeForLLM((env.userId ?? env.source ?? 'channel').slice(0, 64));
@@ -72,20 +55,7 @@ function main(raw: string): void {
   if (!ok) return;
 
   const rendered = renderCommand(parsed);
-  process.stdout.write(
-    `[harness-command] "${rendered}" requested by ${by} — will be applied to this session when the current turn ends.\n`,
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
+  return {
+    context: `[harness-command] "${rendered}" requested by ${by} — will be applied to this session when the current turn ends.\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/pause-keyword.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
similarity index 62%
rename from plugins/claude-code-hermit/scripts/pause-keyword.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
index b0088778..dc7de0bc 100644
--- a/plugins/claude-code-hermit/scripts/pause-keyword.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/pause-keyword.ts
@@ -1,7 +1,4 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — deterministic pause/resume/snooze keyword writer
+// UserPromptSubmit stage — deterministic pause/resume/snooze keyword writer
 // (PROP-015). Writes state/pause.json directly from an inbound <channel>
 // envelope, before any model involvement, so pause/resume never depends on
 // model cooperation or on a tool call the pause-gate itself might deny.
@@ -17,32 +14,19 @@ process.stdout.on('error', () => {});
 // silent no-op: no state change, no stdout, so the mechanism can't be probed
 // by an unauthorized prompt.
 
-import { safeForLLM } from './lib/sanitize';
-import { hermitDir } from './lib/cc-compat';
-import { setPause, clearPause, parseSnoozeDuration } from './lib/pause';
-import { loadConfig, isTrustedController } from './lib/channel-auth';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-
-type Json = any;
+import { safeForLLM } from '../sanitize';
+import { setPause, clearPause, parseSnoozeDuration } from '../pause';
+import { isTrustedController } from '../channel-auth';
+import type { StageContext, StageResult } from './types';
 
 const MAX_BY_LEN = 64;
 const MAX_DURATION_LEN = 32;
 
-function main(raw: string): void {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
+export function run(ctx: StageContext): StageResult | void {
   // Shared envelope parser (also used by channel-reply-reminder/status-responder),
   // so the grammar can't drift. Requires a chat_id — which the DM-binding gate
   // below needs anyway, and every real inbound envelope carries.
-  const env = parseChannelEnvelope(prompt);
+  const env = ctx.envelope;
   if (!env) return;
   const sourceRaw = env.source;
   const userId = env.userId;
@@ -62,8 +46,8 @@ function main(raw: string): void {
   else if (snoozeMatch) { action = 'snooze'; durationRaw = snoozeMatch[1]; }
   if (!action) return;
 
-  const dir = hermitDir();
-  const config = loadConfig(dir);
+  const dir = ctx.dir;
+  const config = ctx.config();
   // Stricter gate than a plain reply: pausing is state-mutating, so an unconfigured
   // channel trusts only the operator's DM (chat_id === dm_channel_id), not accept-all.
   if (!isTrustedController(config, sourceRaw, userId, env.chatId)) return; // unauthorized — silent no-op
@@ -72,36 +56,22 @@ function main(raw: string): void {
 
   if (action === 'pause') {
     setPause(dir, { reason: 'operator', by });
-    process.stdout.write(
-      `[pause] Hermit paused by ${by} (indefinite). Only the channel reply tool works until resumed.\n`
-    );
+    return {
+      context: `[pause] Hermit paused by ${by} (indefinite). Only the channel reply tool works until resumed.\n`,
+    };
   } else if (action === 'resume') {
     clearPause(dir);
-    process.stdout.write(`[pause] Hermit resumed by ${by}. Normal operation restored.\n`);
+    return { context: `[pause] Hermit resumed by ${by}. Normal operation restored.\n` };
   } else {
     const durationSafe = safeForLLM((durationRaw ?? '').slice(0, MAX_DURATION_LEN));
     const ms = durationRaw ? parseSnoozeDuration(durationRaw) : null;
     if (ms === null) {
-      process.stdout.write(
-        `[pause] Could not parse snooze duration "${durationSafe}" — expected e.g. "30m", "2h", "1d". No change made.\n`
-      );
-      return;
+      return {
+        context: `[pause] Could not parse snooze duration "${durationSafe}" — expected e.g. "30m", "2h", "1d". No change made.\n`,
+      };
     }
     const until = new Date(Date.now() + ms).toISOString();
     setPause(dir, { reason: 'operator', by, until });
-    process.stdout.write(`[pause] Hermit paused by ${by} until ${until}.\n`);
+    return { context: `[pause] Hermit paused by ${by} until ${until}.\n` };
   }
 }
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
-    process.exit(0);
-  });
-} catch {
-  process.exit(0);
-}
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts
new file mode 100644
index 00000000..f38fc7b4
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/prompt-context.ts
@@ -0,0 +1,29 @@
+// UserPromptSubmit stage — injects per-prompt context so the model never anchors to stale state.
+
+import type { StageContext, StageResult } from './types';
+
+export function run(ctx: StageContext): StageResult | void {
+  const config = ctx.config();
+
+  const tz = (typeof config?.timezone === 'string' && config.timezone) ? config.timezone : 'UTC';
+
+  try {
+    const fmt = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      weekday: 'long',
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+      timeZoneName: 'short',
+      hour12: false,
+    });
+
+    const parts = Object.fromEntries(fmt.formatToParts(new Date()).map(p => [p.type, p.value]));
+    const formatted = `${parts.weekday}, ${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute} ${parts.timeZoneName}`;
+    return { context: `[Now: ${formatted}]\n` };
+  } catch {
+    // Invalid TZ or Intl unavailable — emit nothing; CC's currentDate remains
+  }
+}
diff --git a/plugins/claude-code-hermit/scripts/shutdown-gate.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
similarity index 56%
rename from plugins/claude-code-hermit/scripts/shutdown-gate.ts
rename to plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
index 9fecc2a0..715312c6 100644
--- a/plugins/claude-code-hermit/scripts/shutdown-gate.ts
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/shutdown-gate.ts
@@ -1,4 +1,4 @@
-// UserPromptSubmit hook — deterministic shutdown gate.
+// UserPromptSubmit stage — deterministic shutdown gate.
 //
 // While a shutdown is pending (runtime.json has shutdown_requested_at set and
 // shutdown_completed_at null), a <channel> message from an allowed sender gets a
@@ -13,39 +13,25 @@
 // /session-close command hermit-stop injects) are never a channel envelope and
 // pass through untouched.
 
-import { hermitDir } from './lib/cc-compat';
-import { parseChannelEnvelope } from './lib/channel-envelope';
-import { loadConfig, isAllowedSender } from './lib/channel-auth';
-import { readRuntimeJson } from './lib/runtime';
-import { sendToChannel } from './lib/channel-send';
-import { SHUTDOWN, resolveLocale } from './lib/messages';
+import { isAllowedSender } from '../channel-auth';
+import { sendToChannel } from '../channel-send';
+import { SHUTDOWN, resolveLocale } from '../messages';
+import type { StageContext, StageResult } from './types';
 
-type Json = any;
-
-async function main(raw: string): Promise<void> {
-  let payload: Json;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (!prompt) return;
-
-  const envelope = parseChannelEnvelope(prompt);
+export async function run(ctx: StageContext): Promise<StageResult | void> {
+  const envelope = ctx.envelope;
   if (!envelope) return; // not a channel message — operator/internal input passes
 
-  const dir = hermitDir();
+  const dir = ctx.dir;
 
   // Only gate a shutdown that is genuinely pending — check this before loading
   // config, since "no shutdown in flight" is the common case on every channel
   // message and this avoids a wasted config.json read for it.
-  const runtime = readRuntimeJson();
+  const runtime = ctx.runtime();
   const pending = !!runtime && !!runtime.shutdown_requested_at && !runtime.shutdown_completed_at;
   if (!pending) return;
 
-  const config = loadConfig(dir);
+  const config = ctx.config();
   if (!config) return;
 
   // Same allowed_users gating as the status responder — a sender the channel
@@ -57,31 +43,18 @@ async function main(raw: string): Promise<void> {
   const result = await sendToChannel(dir, reply, {
     target: { id: envelope.sourceKey, chat_id: envelope.chatId },
     timeoutMs: 6000,
+    config, // already loaded by the pipeline — don't make the sender re-read it
   });
   if (result.ok) {
-    console.log(JSON.stringify({ decision: 'block', reason: 'shutdown pending — deterministic reply sent' }));
-    return;
+    return { block: 'shutdown pending — deterministic reply sent' };
   }
 
   // Deterministic delivery failed — don't block into silence. Inject a narrow
   // instruction so the model relays the shutdown state and starts no new work.
-  process.stdout.write(
-    `[shutdown] A shutdown is in progress for this hermit. Reply to the operator (on the chat this ` +
-    `message arrived on) that you're shutting down and will be back after the restart, then stop — ` +
-    `start no new work.\n`,
-  );
-}
-
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    main(buf)
-      .catch(() => {})
-      .finally(() => process.exit(0));
-  });
-} catch {
-  process.exit(0);
+  return {
+    context:
+      `[shutdown] A shutdown is in progress for this hermit. Reply to the operator (on the chat this ` +
+      `message arrived on) that you're shutting down and will be back after the restart, then stop — ` +
+      `start no new work.\n`,
+  };
 }
diff --git a/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts b/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts
new file mode 100644
index 00000000..c504839e
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/prompt-stages/types.ts
@@ -0,0 +1,42 @@
+// The contract every UserPromptSubmit stage implements.
+//
+// Stages are plain functions, not scripts: they never read stdin, never write
+// stdout, and never call process.exit. They return what they want emitted and
+// let user-prompt-pipeline.ts decide — which is what makes the "a block emits
+// JSON alone" rule enforceable in one place instead of seven.
+
+export interface ChannelEnvelope {
+  source: string;
+  sourceKey: string;
+  chatId: string;
+  userId: string | null;
+  messageId?: string | null;
+  body: string;
+  ts?: string | null;
+}
+
+export interface StageContext {
+  /** Resolved hermit state dir — computed once for the whole pipeline. */
+  dir: string;
+  /** The submitted prompt text. */
+  prompt: string;
+  /** Parsed channel envelope, or null for operator/internal input. */
+  envelope: ChannelEnvelope | null;
+  /** config.json, read at most once per prompt regardless of how many stages ask. */
+  config(): any;
+  /** state/runtime.json, read at most once per prompt. */
+  runtime(): any;
+}
+
+export interface StageResult {
+  /** additionalContext to inject. Concatenated with other stages', in stage order. */
+  context?: string;
+  /**
+   * Reason for a `{"decision":"block"}`. Set only after the stage has confirmed
+   * the operator was told out-of-band (a successful channel send) — blocking
+   * without that would swallow the message into silence.
+   */
+  block?: string;
+}
+
+export type Stage = (ctx: StageContext) => StageResult | void | Promise<StageResult | void>;
diff --git a/plugins/claude-code-hermit/scripts/lib/spend-status.ts b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
index 60fd8659..3b4a3bd5 100644
--- a/plugins/claude-code-hermit/scripts/lib/spend-status.ts
+++ b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
@@ -1,4 +1,4 @@
-// Operator-language cap-status composition, shared by channel-status-responder.ts
+// Operator-language cap-status composition, shared by lib/prompt-stages/channel-status-responder.ts
 // (the deterministic `status` hook) and cost-reflect.ts (the --plain channel mode)
 // so the two surfaces can't drift on how a spend cap is phrased. Lives here rather
 // than in lib/budget.ts (which is pure evaluation, no I/O) because budgetLine reads
diff --git a/plugins/claude-code-hermit/scripts/lib/time.ts b/plugins/claude-code-hermit/scripts/lib/time.ts
index b518391c..867e752d 100644
--- a/plugins/claude-code-hermit/scripts/lib/time.ts
+++ b/plugins/claude-code-hermit/scripts/lib/time.ts
@@ -206,7 +206,7 @@ function elapsedSinceHHMM(nowHHMM: string, stampHHMM: string): number {
 
 // Parse the minute/hour fields of a simple numeric 5-field cron schedule
 // (e.g. "0 0 * * *"). Shared by hermit-watchdog.ts (daily-auto-close proximity)
-// and channel-status-responder.ts (next-routine line) — both only need the
+// and the channel-status-responder stage (next-routine line) — both only need the
 // fixed-time case, not full cron range/step/list support.
 function parseSimpleCronTime(schedule: string): { hour: number; minute: number } | null {
   const parts = String(schedule).trim().split(/\s+/);
diff --git a/plugins/claude-code-hermit/scripts/lib/tmux.ts b/plugins/claude-code-hermit/scripts/lib/tmux.ts
index 0fbff07d..c7b74198 100644
--- a/plugins/claude-code-hermit/scripts/lib/tmux.ts
+++ b/plugins/claude-code-hermit/scripts/lib/tmux.ts
@@ -28,7 +28,7 @@ export function getSessionName(config: Json): string {
  * punctuation — existing callers send prose ("/compact focus on unfinished work,
  * pending operator items, and in-flight decisions") and an allow-list would silently
  * break them. Callers handling UNTRUSTED input apply their own strict grammar on top
- * (see harness-command-keyword.ts).
+ * (see lib/prompt-stages/harness-command.ts).
  */
 function hasControlChars(text: string): boolean {
   for (let i = 0; i < text.length; i++) {
diff --git a/plugins/claude-code-hermit/scripts/prompt-context.ts b/plugins/claude-code-hermit/scripts/prompt-context.ts
deleted file mode 100644
index c6f00267..00000000
--- a/plugins/claude-code-hermit/scripts/prompt-context.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
-process.stdout.on('error', () => {});
-
-// UserPromptSubmit hook — injects per-prompt context so the model never anchors to stale state.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { hermitDir } from './lib/cc-compat';
-
-type Json = any;
-
-const AGENT_DIR = hermitDir();
-
-// Drain stdin (fail-open contract — broken pipe if unread)
-process.stdin.resume();
-process.stdin.on('data', () => {});
-process.stdin.on('error', () => {});
-
-function main() {
-  let config: Json = {};
-  try {
-    config = JSON.parse(fs.readFileSync(path.resolve(AGENT_DIR, 'config.json'), 'utf-8'));
-  } catch {
-    // No config or unreadable — use defaults
-  }
-
-  const tz = (typeof config.timezone === 'string' && config.timezone) ? config.timezone : 'UTC';
-
-  try {
-    const fmt = new Intl.DateTimeFormat('en-US', {
-      timeZone: tz,
-      weekday: 'long',
-      year: 'numeric',
-      month: '2-digit',
-      day: '2-digit',
-      hour: '2-digit',
-      minute: '2-digit',
-      timeZoneName: 'short',
-      hour12: false,
-    });
-
-    const parts = Object.fromEntries(fmt.formatToParts(new Date()).map(p => [p.type, p.value]));
-    const formatted = `${parts.weekday}, ${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute} ${parts.timeZoneName}`;
-    process.stdout.write(`[Now: ${formatted}]\n`);
-  } catch {
-    // Invalid TZ or Intl unavailable — emit nothing; CC's currentDate remains
-  }
-}
-
-try {
-  main();
-} catch {
-  // Fail open — never block a prompt
-}
-process.exit(0);
diff --git a/plugins/claude-code-hermit/scripts/record-operator-action.ts b/plugins/claude-code-hermit/scripts/record-operator-action.ts
index 1a09d587..ebff074a 100644
--- a/plugins/claude-code-hermit/scripts/record-operator-action.ts
+++ b/plugins/claude-code-hermit/scripts/record-operator-action.ts
@@ -139,6 +139,20 @@ function appendSkillUsage(name: string): void {
   } catch { /* fail-open */ }
 }
 
+// The UserPromptSubmit half, callable in-process by user-prompt-pipeline.ts.
+export function run(prompt: string): void {
+  if (!isRoutinePrompt(prompt)) {
+    // Skill-usage capture is operator-activity only — hermit's own injected
+    // slash commands (INJECTED_EXACT) are routine prompts, so gating on the
+    // same filter keeps automated heartbeat/session-close/routines fires out
+    // of the usage ledger (they'd otherwise log as source:'prompt' skill use).
+    const skillName = extractSkillName(prompt);
+    if (skillName) appendSkillUsage(skillName);
+    write();
+    openTurnMarker();
+  }
+}
+
 function main(raw: string): void {
   let prompt: string | null = null;
   try {
@@ -151,33 +165,28 @@ function main(raw: string): void {
     return;
   }
 
-  if (!isRoutinePrompt(prompt)) {
-    // Skill-usage capture is operator-activity only — hermit's own injected
-    // slash commands (INJECTED_EXACT) are routine prompts, so gating on the
-    // same filter keeps automated heartbeat/session-close/routines fires out
-    // of the usage ledger (they'd otherwise log as source:'prompt' skill use).
-    const skillName = extractSkillName(prompt);
-    if (skillName) appendSkillUsage(skillName);
+  run(prompt);
+}
+
+// Entry shell only when executed directly — importing this module (the pipeline
+// does, for run()) must not consume stdin or act on the caller's argv.
+if (import.meta.main) {
+  if (process.argv.includes('--force')) {
     write();
     openTurnMarker();
+    process.exit(0);
   }
-}
-
-if (process.argv.includes('--force')) {
-  write();
-  openTurnMarker();
-  process.exit(0);
-}
 
-try {
-  let buf = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', chunk => { buf += chunk; });
-  process.stdin.on('error', () => {});
-  process.stdin.on('end', () => {
-    try { main(buf); } catch { /* fail-open */ }
+  try {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', chunk => { buf += chunk; });
+    process.stdin.on('error', () => {});
+    process.stdin.on('end', () => {
+      try { main(buf); } catch { /* fail-open */ }
+      process.exit(0);
+    });
+  } catch {
     process.exit(0);
-  });
-} catch {
-  process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
new file mode 100644
index 00000000..38a8a04b
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
@@ -0,0 +1,154 @@
+// Suppress EPIPE errors (e.g. when stdout pipe closes early in tests)
+process.stdout.on('error', () => {});
+
+// UserPromptSubmit hook — the single process for the whole prompt path.
+//
+// Replaces seven separately-registered hooks. Each of those re-read stdin,
+// re-parsed the channel envelope, and re-read config; the operator paid all
+// seven process launches on every message they sent. This reads stdin once,
+// parses once, and runs the stages in an order that is now explicit in code
+// rather than implied by their order in hooks.json.
+//
+// Two behaviors that the multi-process shape could not express:
+//
+//   1. Shutdown is terminal. While a shutdown is pending, the audit/context
+//      stages still run, then the shutdown stage answers and the pipeline
+//      ends — whether or not its send succeeded. Previously a failed shutdown
+//      send fell through, and an exact `status` message could then send and
+//      block on its own, discarding the shutdown-relay instruction the model
+//      was supposed to act on. Pause/resume and harness commands are skipped
+//      for the same reason: mutating session state mid-shutdown answers a
+//      message the shutdown reply has already answered.
+//
+//   2. One disposition per prompt. Output is buffered and emitted once at the
+//      end: a confirmed block prints the decision JSON *alone*, because mixed
+//      plain text and JSON on stdout does not parse as a decision and the
+//      block would be silently lost.
+//
+// Contract preserved from the scripts this replaces: always exit 0, never
+// block on a failed send, and per-stage errors are isolated — a throwing stage
+// is logged to stderr and the rest still run (the stop-pipeline.ts pattern).
+
+import { hermitDir } from './lib/cc-compat';
+import { parseChannelEnvelope } from './lib/channel-envelope';
+import { loadConfig } from './lib/channel-auth';
+import { readRuntimeJson } from './lib/runtime';
+import type { StageContext, StageResult } from './lib/prompt-stages/types';
+
+import { run as recordOperatorAction } from './record-operator-action';
+import { run as promptContext } from './lib/prompt-stages/prompt-context';
+import { run as channelReplyReminder } from './lib/prompt-stages/channel-reply-reminder';
+import { run as pauseKeyword } from './lib/prompt-stages/pause-keyword';
+import { run as harnessCommand } from './lib/prompt-stages/harness-command';
+import { run as shutdownGate } from './lib/prompt-stages/shutdown-gate';
+import { run as channelStatusResponder } from './lib/prompt-stages/channel-status-responder';
+
+// Matches stop-pipeline.ts — a prompt payload far past this is not something a
+// stage can act on, and reading it unbounded is the only way this hook can hang.
+const MAX_STDIN_BYTES = 1024 * 1024;
+
+const out: string[] = [];
+let blockReason: string | null = null;
+
+async function stage(name: string, fn: (ctx: StageContext) => any, ctx: StageContext): Promise<void> {
+  if (blockReason) return; // a disposition is already settled
+  try {
+    const result: StageResult | void = await fn(ctx);
+    if (!result) return;
+    if (result.context) out.push(result.context);
+    if (result.block) blockReason = result.block;
+  } catch (e: any) {
+    process.stderr.write(`[user-prompt-pipeline] ${name}: ${e?.message || e}\n`);
+  }
+}
+
+async function main(raw: string): Promise<void> {
+  // Defensive parse: stages that don't need the payload still run on bad input,
+  // exactly as stop-pipeline.ts does.
+  let payload: any = {};
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    process.stderr.write('[user-prompt-pipeline] malformed stdin — continuing with empty payload\n');
+  }
+
+  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
+  if (prompt === null) return;
+
+  const dir = hermitDir();
+
+  let configCache: any;
+  let configRead = false;
+  let runtimeCache: any;
+  let runtimeRead = false;
+
+  const ctx: StageContext = {
+    dir,
+    prompt,
+    envelope: parseChannelEnvelope(prompt),
+    config() {
+      if (!configRead) { configRead = true; try { configCache = loadConfig(dir); } catch { configCache = null; } }
+      return configCache;
+    },
+    runtime() {
+      if (!runtimeRead) { runtimeRead = true; try { runtimeCache = readRuntimeJson(); } catch { runtimeCache = null; } }
+      return runtimeCache;
+    },
+  };
+
+  // 1-3. Audit and context. These run on every prompt, including during a
+  // shutdown — the operator's message is still recorded and the reply reminder
+  // still names the chat to answer on.
+  await stage('record-operator-action', () => { recordOperatorAction(prompt); }, ctx);
+  await stage('prompt-context', promptContext, ctx);
+  await stage('channel-reply-reminder', channelReplyReminder, ctx);
+
+  const rt = ctx.runtime();
+  const shutdownPending = !!rt && !!rt.shutdown_requested_at && !rt.shutdown_completed_at;
+
+  if (shutdownPending) {
+    // Terminal: answer the shutdown and stop. Nothing below runs — not pause,
+    // not a harness command, not status.
+    await stage('shutdown-gate', shutdownGate, ctx);
+    return;
+  }
+
+  // 4-5. State writers. Both land before any network send, so an outer-timeout
+  // kill can lose a send but never a state write.
+  await stage('pause-keyword', pauseKeyword, ctx);
+  await stage('harness-command', harnessCommand, ctx);
+
+  // 6. Deterministic status.
+  await stage('channel-status-responder', channelStatusResponder, ctx);
+}
+
+function emit(): void {
+  // A block must be the only thing on stdout: Claude Code parses stdout as a
+  // decision object, and any leading context text makes that parse fail, which
+  // would drop the block and deliver the prompt anyway. The accumulated context
+  // is moot on a blocked prompt — the model never sees that turn.
+  if (blockReason) {
+    console.log(JSON.stringify({ decision: 'block', reason: blockReason }));
+    return;
+  }
+  for (const chunk of out) process.stdout.write(chunk.endsWith('\n') ? chunk : `${chunk}\n`);
+}
+
+try {
+  let buf = '';
+  let truncated = false;
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk) => {
+    if (truncated) return;
+    buf += chunk;
+    if (buf.length > MAX_STDIN_BYTES) { buf = buf.slice(0, MAX_STDIN_BYTES); truncated = true; }
+  });
+  process.stdin.on('error', () => {});
+  process.stdin.on('end', () => {
+    main(buf)
+      .catch((e: any) => process.stderr.write(`[user-prompt-pipeline] ${e?.message || e}\n`))
+      .finally(() => { try { emit(); } catch { /* fail open */ } process.exit(0); });
+  });
+} catch {
+  process.exit(0);
+}
diff --git a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
index f6a426cb..18ea98b9 100644
--- a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
+++ b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
@@ -103,7 +103,7 @@ This is how the agent learns the DM channel ID for proactive outbound notificati
 Before running any heavy sub-step — an archive traversal, a multi-file search, or a delegated execution step — apply the **Context-hygiene & delegation** rule: delegate when its criteria hold and keep only the verdict.
 
 - **Harness command** (exactly `/compact`, `/clear`, `/model <arg>`, or `/effort <arg>`)
-  - Intercepted by the `harness-command-keyword.ts` `UserPromptSubmit` hook **before this skill runs** — the request is already recorded, and the `Stop` hook types it into the session when this turn ends. There is nothing for you to do; acknowledge briefly via the channel if you like.
+  - Intercepted by the `user-prompt-pipeline.ts` `UserPromptSubmit` hook's harness-command stage **before this skill runs** — the request is already recorded, and the `Stop` hook types it into the session when this turn ends. There is nothing for you to do; acknowledge briefly via the channel if you like.
   - Do **not** try to run it yourself, and do not treat it as a skill invocation.
   - It applies to *this* session only: the next `hermit-start` re-asserts `config.model` / `config.effort`. If Claude Code rejects the argument, that shows in the terminal, not in chat — so don't promise it took effect.
   - A near-miss (`/model` with no argument, a bare `clear`, or prose mentioning one) is **not** intercepted — classify it under the categories below instead.
@@ -169,7 +169,7 @@ Before running any heavy sub-step — an archive traversal, a multi-file search,
   - Reference specific files or decisions from SHELL.md when relevant
 
 - **Pause / resume / snooze** (bare, exact-match "pause", "stop", "resume", or "snooze <duration>")
-  - These exact messages are intercepted by the `pause-keyword.ts` `UserPromptSubmit` hook (PROP-015) **before this skill ever runs** — `state/pause.json` is already set or cleared by the time you see the prompt. There is nothing left for you to do for the state change itself; if you want to acknowledge it, reply via the channel.
+  - These exact messages are intercepted by the `user-prompt-pipeline.ts` `UserPromptSubmit` hook's pause stage (PROP-015) **before this skill ever runs** — `state/pause.json` is already set or cleared by the time you see the prompt. There is nothing left for you to do for the state change itself; if you want to acknowledge it, reply via the channel.
   - A sentence that merely mentions "pause" or "stop" (not an exact match) is not intercepted — classify it under Emergency below instead.
   - **Never attempt to resume yourself while paused.** The PreToolUse gate (`pause-gate.ts`) denies every tool call except the channel reply tool while paused — including a Bash call running `hermit-pause.ts off` — and returns the pause reason in the denial. Resume can only come from an exact "resume" message (the deterministic hook above) or the operator's own `.claude-code-hermit/bin/hermit-pause off`.
 
diff --git a/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts b/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
index 03e79646..1643c63b 100644
--- a/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-reply-reminder.test.ts
@@ -1,7 +1,9 @@
-// Behavioral tests for scripts/channel-reply-reminder.ts — the UserPromptSubmit
-// hook that reminds the model which reply tool to use, and captures inbound
-// messages into the episodic channel log. Exercised as a subprocess (stdin in,
-// stdout out), the boundary Claude Code sees — mirrors tests/pause-keyword.test.ts.
+// Behavioral tests for scripts/lib/prompt-stages/channel-reply-reminder.ts —
+// the stage that reminds the model which reply tool to use, and captures
+// inbound messages into the episodic channel log. Driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts, as a subprocess
+// (stdin in, stdout out) — the boundary Claude Code sees. Mirrors
+// tests/pause-keyword.test.ts.
 //
 // tests/channel-responder-reply-rule.test.ts is a separate, static wiring
 // check (skill text / hooks.json / script presence) — it does not run this
@@ -29,7 +31,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (prompt: string, dir: string) =>
-  runScript('channel-reply-reminder.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
+  runScript('user-prompt-pipeline.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
 
 describe('channel-reply-reminder', () => {
   test('bare source — names the exact reply tool', withDir(async (dir) => {
diff --git a/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts b/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
index c180cb78..3e4043a5 100644
--- a/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-responder-reply-rule.test.ts
@@ -16,7 +16,11 @@ import { PLUGIN_ROOT } from './helpers/run';
 
 const SKILL_PATH = path.join(PLUGIN_ROOT, 'skills', 'channel-responder', 'SKILL.md');
 const HOOKS_PATH = path.join(PLUGIN_ROOT, 'hooks', 'hooks.json');
-const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'channel-reply-reminder.ts');
+// The reminder is now a stage of scripts/user-prompt-pipeline.ts, not a
+// separately-registered hook script — the file moved, the registration is the
+// pipeline's. Test names below still say "channel-reply-reminder" because the
+// guarantee they pin is unchanged.
+const SCRIPT_PATH = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'prompt-stages', 'channel-reply-reminder.ts');
 
 const skill = fs.readFileSync(SKILL_PATH, 'utf-8');
 
@@ -37,7 +41,7 @@ test('skill §0 names generic reply tool pattern', () => {
 });
 
 test('hooks.json has channel-reply-reminder entry', () => {
-  expect(fs.readFileSync(HOOKS_PATH, 'utf-8')).toContain('channel-reply-reminder.ts');
+  expect(fs.readFileSync(HOOKS_PATH, 'utf-8')).toContain('user-prompt-pipeline.ts');
 });
 
 test('channel-reply-reminder.ts exists and is non-empty', () => {
diff --git a/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts b/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
index b2b9563b..fb5fa24e 100644
--- a/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-status-responder-wiring.test.ts
@@ -9,7 +9,7 @@ import path from 'node:path';
 import { PLUGIN_ROOT } from './helpers/run';
 
 const HOOKS_PATH = path.join(PLUGIN_ROOT, 'hooks', 'hooks.json');
-const RESPONDER_SCRIPT = path.join(PLUGIN_ROOT, 'scripts', 'channel-status-responder.ts');
+const RESPONDER_SCRIPT = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'prompt-stages', 'channel-status-responder.ts');
 const SEND_LIB = path.join(PLUGIN_ROOT, 'scripts', 'lib', 'channel-send.ts');
 const SEND_CLI = path.join(PLUGIN_ROOT, 'scripts', 'channel-send.ts');
 
@@ -32,7 +32,7 @@ test('hooks.json registers channel-status-responder.ts on UserPromptSubmit', ()
   const hooks = JSON.parse(fs.readFileSync(HOOKS_PATH, 'utf-8'));
   const entries = hooks.hooks.UserPromptSubmit ?? [];
   const registered = entries.some((e: any) =>
-    (e.hooks ?? []).some((h: any) => (h.args ?? []).some((a: string) => a.includes('channel-status-responder.ts')))
+    (e.hooks ?? []).some((h: any) => (h.args ?? []).some((a: string) => a.includes('user-prompt-pipeline.ts')))
   );
   expect(registered).toBe(true);
 });
diff --git a/plugins/claude-code-hermit/tests/channel-status-responder.test.ts b/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
index 839aefe3..7384df9c 100644
--- a/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
+++ b/plugins/claude-code-hermit/tests/channel-status-responder.test.ts
@@ -1,11 +1,18 @@
-// Contract tests for scripts/channel-status-responder.ts — the deterministic
-// send-then-block status responder. Exercised as a subprocess against a local
-// HTTP stub (HERMIT_TELEGRAM_API_URL override) standing in for the platform.
+// Contract tests for the deterministic send-then-block status responder —
+// scripts/lib/prompt-stages/channel-status-responder.ts, driven through the
+// single UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Exercised
+// as a subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL override)
+// standing in for the platform.
 //
 // Covers the probe-verified constraints this hook rests on: exact-match gate
 // (near-misses fall through), allowed_users enforcement, and send-then-block
 // (only emit {"decision":"block"} after a confirmed send; a failed send must
 // never leave both a blocked prompt and a silent operator).
+//
+// Pipeline note: a block prints the decision JSON alone, while a fall-through
+// carries the other stages' context (a `[Now: …]` line, the channel reply
+// reminder). "No block, no send" is therefore asserted as the absence of the
+// `[status]` marker rather than as empty stdout.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -39,7 +46,7 @@ function setupChannelWorkdir(configExtra: object = {}): Workdir {
 }
 
 async function run(wd: Workdir, body: string, stubUrl: string, user = 'u1') {
-  return runScript('channel-status-responder.ts', {
+  return runScript('user-prompt-pipeline.ts', {
     stdin: payload(body, user),
     cwd: wd.dir,
     env: { HERMIT_TELEGRAM_API_URL: stubUrl },
@@ -69,7 +76,7 @@ describe('channel-status-responder', () => {
     try {
       // Asked in a Telegram group: chat_id is the group id, distinct from dm_channel_id (12345).
       const groupPayload = JSON.stringify({ prompt: envelope('status', 'u1', '-1001234567890') });
-      const r = await runScript('channel-status-responder.ts', {
+      const r = await runScript('user-prompt-pipeline.ts', {
         stdin: groupPayload,
         cwd: wd.dir,
         env: { HERMIT_TELEGRAM_API_URL: stub.url },
@@ -103,7 +110,7 @@ describe('channel-status-responder', () => {
     try {
       const r = await run(wd, 'what is the status of the task you are working on?', stub.url);
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -117,7 +124,7 @@ describe('channel-status-responder', () => {
     try {
       const r = await run(wd, 'status', stub.url, 'not-allowed');
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -146,13 +153,13 @@ describe('channel-status-responder', () => {
     const stub = startHttpStub();
     const wd = setupChannelWorkdir();
     try {
-      const r = await runScript('channel-status-responder.ts', {
+      const r = await runScript('user-prompt-pipeline.ts', {
         stdin: JSON.stringify({ prompt: 'status' }),
         cwd: wd.dir,
         env: { HERMIT_TELEGRAM_API_URL: stub.url },
       });
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[status]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -161,7 +168,7 @@ describe('channel-status-responder', () => {
   });
 
   test('empty stdin -> fail open, exit 0', async () => {
-    const r = await runScript('channel-status-responder.ts', { stdin: '' });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '' });
     expect(r.exitCode).toBe(0);
   });
 
@@ -250,7 +257,7 @@ describe('channel-status-responder', () => {
       write(hermit(wd.dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending: [{ id: 'MP-20260705-0', status: 'pending', tier: 1, question: 'ok?' }] }));
 
       const stranger = JSON.stringify({ prompt: '<channel source="telegram" chat_id="999" user="stranger">status</channel>' });
-      const r = await runScript('channel-status-responder.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+      const r = await runScript('user-prompt-pipeline.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
       expect(r.exitCode).toBe(0);
       const text = stub.requests[0].body.text;
       expect(text).not.toContain('secret-migration'); // task text withheld
@@ -317,7 +324,7 @@ describe('channel-status-responder', () => {
       try {
         fs.writeFileSync(hermit(wd.dir, 'sessions', '.status.json'), JSON.stringify({ status: 'in_progress', task: 'segredo' }));
         const stranger = JSON.stringify({ prompt: '<channel source="telegram" chat_id="999" user="stranger">status</channel>' });
-        const r = await runScript('channel-status-responder.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+        const r = await runScript('user-prompt-pipeline.ts', { stdin: stranger, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
         expect(r.exitCode).toBe(0);
         const text = stub.requests[0].body.text as string;
         expect(text).not.toContain('segredo'); // task text withheld
@@ -339,7 +346,7 @@ describe('channel-status-responder', () => {
     try {
       fs.writeFileSync(hermit(wd.dir, 'sessions', '.status.json'), JSON.stringify({ status: 'in_progress', task: 'writing the plan' }));
       const qualified = JSON.stringify({ prompt: '<channel source="plugin:telegram:telegram" chat_id="12345" user="u1">status</channel>' });
-      const r = await runScript('channel-status-responder.ts', { stdin: qualified, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
+      const r = await runScript('user-prompt-pipeline.ts', { stdin: qualified, cwd: wd.dir, env: { HERMIT_TELEGRAM_API_URL: stub.url } });
       expect(r.exitCode).toBe(0);
       expect(JSON.parse(r.stdout.trim())).toMatchObject({ decision: 'block' });
       // A raw qualified target.id would miss lib/channel-send's SENDERS lookup entirely (zero requests).
diff --git a/plugins/claude-code-hermit/tests/cron-registry.test.ts b/plugins/claude-code-hermit/tests/cron-registry.test.ts
index af4caaf6..fae8c137 100644
--- a/plugins/claude-code-hermit/tests/cron-registry.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-registry.test.ts
@@ -15,7 +15,7 @@
 
 import { describe, test, expect } from 'bun:test';
 import { planCron, commitCron, computeWakeSpread, promptHash, REREGISTER_AGE_MS, filterRoutinesByIds } from '../scripts/cron-registry';
-import { shiftCron } from '../scripts/cron-tz-shift';
+import { shiftCron } from '../scripts/lib/cron-shift';
 
 const PLUGIN_ROOT = '/plugin';
 const BOOT_A = 'boot-aaa';
diff --git a/plugins/claude-code-hermit/tests/hooks.contract.test.ts b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
index d3cdbf63..78ee12e9 100644
--- a/plugins/claude-code-hermit/tests/hooks.contract.test.ts
+++ b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
@@ -1358,13 +1358,20 @@ describe('generate-summary', () => {
 });
 
 // -------------------------------------------------------
-// prompt-context (UserPromptSubmit hook)
+// prompt-context (a stage of the UserPromptSubmit pipeline)
+//
+// The stage lives in scripts/lib/prompt-stages/prompt-context.ts and is driven
+// through scripts/user-prompt-pipeline.ts. The pipeline only runs stages for a
+// payload that actually carries a prompt, so these pass a minimal one where the
+// old standalone script emitted on any stdin.
 // -------------------------------------------------------
 
+const PROMPT_CONTEXT_STDIN = JSON.stringify({ prompt: 'hello' });
+
 describe('prompt-context', () => {
   test('prompt-context (UTC fallback)', withDir(async (dir) => {
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toMatch(/^\[Now: .+ UTC\]/m);
@@ -1372,8 +1379,8 @@ describe('prompt-context', () => {
 
   test('prompt-context (configured TZ)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"America/New_York"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toMatch(/^\[Now: .+ (EST|EDT)\]/m);
@@ -1381,24 +1388,24 @@ describe('prompt-context', () => {
 
   test('prompt-context (invalid TZ, exits 0)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"Bogus/Zone"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
   }));
 
   test('prompt-context (invalid TZ, no [Now:] line)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"Bogus/Zone"}');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[Now:');
   }));
 
   test('prompt-context (malformed config, exits 0)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), 'not json');
-    const r = await runScript('prompt-context.ts', {
-      stdin: '', cwd: dir, env: { AGENT_DIR: hermit(dir) },
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: PROMPT_CONTEXT_STDIN, cwd: dir, env: { AGENT_DIR: hermit(dir) },
     });
     expect(r.exitCode).toBe(0);
   }));
@@ -1476,12 +1483,20 @@ describe('record-operator-action (usage capture)', () => {
 });
 
 // -------------------------------------------------------
-// channel-reply-reminder (UserPromptSubmit hook)
+// channel-reply-reminder (a stage of the UserPromptSubmit pipeline)
+//
+// The stage lives in scripts/lib/prompt-stages/channel-reply-reminder.ts and is
+// driven through scripts/user-prompt-pipeline.ts. prompt-context also runs on
+// every prompt, so "no reminder" is the absence of the reminder marker, not
+// empty stdout (empty stdout only survives where the payload carries no prompt
+// at all).
 // -------------------------------------------------------
 
+const NO_REMINDER = '[channel reply reminder]';
+
 describe('channel-reply-reminder', () => {
   const run = (prompt: string, dir: string) =>
-    runScript('channel-reply-reminder.ts', {
+    runScript('user-prompt-pipeline.ts', {
       stdin: JSON.stringify({ prompt }), cwd: dir,
     });
 
@@ -1511,25 +1526,25 @@ describe('channel-reply-reminder', () => {
   }));
 
   test('channel-reply-reminder (empty stdin)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', { stdin: '', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   }));
 
   test('channel-reply-reminder (malformed JSON)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', { stdin: '{broken', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   }));
 
   test('channel-reply-reminder (no envelope)', withDir(async (dir) => {
     const r = await run('hello world', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (envelope mid-prompt, no output)', withDir(async (dir) => {
     const r = await run('see <channel source="discord" chat_id="x">...', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (adversarial control char in chat_id)', withDir(async (dir) => {
@@ -1585,11 +1600,11 @@ describe('channel-reply-reminder', () => {
   }));
 
   test('channel-reply-reminder (capture: malformed envelope -> reminder skipped, exit 0, no throw)', withDir(async (dir) => {
-    const r = await runScript('channel-reply-reminder.ts', {
+    const r = await runScript('user-prompt-pipeline.ts', {
       stdin: JSON.stringify({ prompt: 'not a channel envelope at all' }), cwd: dir,
     });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 });
 
diff --git a/plugins/claude-code-hermit/tests/pause-keyword.test.ts b/plugins/claude-code-hermit/tests/pause-keyword.test.ts
index 0025976d..edf7f00e 100644
--- a/plugins/claude-code-hermit/tests/pause-keyword.test.ts
+++ b/plugins/claude-code-hermit/tests/pause-keyword.test.ts
@@ -1,8 +1,13 @@
-// Contract tests for scripts/pause-keyword.ts — the deterministic
-// pause/resume/snooze keyword writer (PROP-015). A UserPromptSubmit hook:
-// writes state/pause.json directly from an inbound <channel> envelope,
-// before any model turn. Exercised as a subprocess (stdin in, exit code/
-// stdout out), the boundary Claude Code sees.
+// Contract tests for the pause/resume/snooze keyword writer (PROP-015) —
+// scripts/lib/prompt-stages/pause-keyword.ts, driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Writes
+// state/pause.json directly from an inbound <channel> envelope, before any
+// model turn. Exercised as a subprocess (stdin in, exit code/stdout out),
+// the boundary Claude Code sees.
+//
+// Pipeline note: prompt-context runs on every prompt, so stdout always carries
+// a `[Now: …]` line. A "silent no-op" is therefore asserted as the absence of
+// the `[pause]` marker, not as empty stdout.
 //
 // Usage: bun test tests/pause-keyword.test.ts   (from the plugin root)
 
@@ -29,7 +34,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (prompt: string, dir: string) =>
-  runScript('pause-keyword.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
+  runScript('user-prompt-pipeline.ts', { stdin: JSON.stringify({ prompt }), cwd: dir });
 
 describe('pause-keyword', () => {
   test('"pause" from the operator DM (no allowlist, chat_id matches dm_channel_id) — sets flag, exit 0', withDir(async (dir) => {
@@ -47,7 +52,7 @@ describe('pause-keyword', () => {
   test('no allowlist, message from a non-DM chat — silent no-op (cannot freeze)', withDir(async (dir) => {
     const r = await run('<channel source="discord" chat_id="99" user="STRANGER">stop</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
@@ -85,7 +90,7 @@ describe('pause-keyword', () => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
     const r = await run('<channel source="discord" chat_id="1" user="INTRUDER">pause</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
@@ -99,37 +104,37 @@ describe('pause-keyword', () => {
   test('allowed_users=[] lockdown — silent no-op even with a user id', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":[]}}}');
     const r = await run('<channel source="discord" chat_id="1" user="ANYONE">pause</channel>', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('no user attribute, allowlist configured — rejected (unverifiable identity)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
     const r = await run('<channel source="discord" chat_id="1">pause</channel>', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('ordinary conversational text — no accidental trigger', withDir(async (dir) => {
     const r = await run('<channel source="discord" chat_id="1" user="U1">please pause and think about this</channel>', dir);
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('no envelope — no-op', withDir(async (dir) => {
     const r = await run('hello world', dir);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('[pause]');
     expect(isPaused(hermit(dir)).paused).toBe(false);
   }));
 
   test('empty stdin — fail-open, exit 0', withDir(async (dir) => {
-    const r = await runScript('pause-keyword.ts', { stdin: '', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: dir });
     expect(r.exitCode).toBe(0);
   }));
 
   test('malformed JSON stdin — fail-open, exit 0', withDir(async (dir) => {
-    const r = await runScript('pause-keyword.ts', { stdin: '{broken', cwd: dir });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: dir });
     expect(r.exitCode).toBe(0);
   }));
 
@@ -160,7 +165,7 @@ describe('pause-keyword', () => {
       write(hermit(dir, 'config.json'), '{"channels":{"discord":{"allowed_users":["ALLOWED_ID"]}}}');
       const r = await run('<channel source="plugin:discord:discord" chat_id="1" user="INTRUDER">pause</channel>', dir);
       expect(r.exitCode).toBe(0);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[pause]');
       expect(isPaused(hermit(dir)).paused).toBe(false);
     }));
 
diff --git a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
index 80646f10..0de13118 100644
--- a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
+++ b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
@@ -1,6 +1,12 @@
-// Contract tests for scripts/shutdown-gate.ts — the deterministic shutdown gate.
-// Exercised as a subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL)
-// standing in for the platform, mirroring the channel-status-responder tests.
+// Contract tests for the deterministic shutdown gate —
+// scripts/lib/prompt-stages/shutdown-gate.ts, driven through the single
+// UserPromptSubmit process, scripts/user-prompt-pipeline.ts. Exercised as a
+// subprocess against a local HTTP stub (HERMIT_TELEGRAM_API_URL) standing in
+// for the platform, mirroring the channel-status-responder tests.
+//
+// Pipeline note: a block prints the decision JSON alone; a pass-through still
+// carries the earlier stages' context (`[Now: …]`, the reply reminder), so
+// "pass through" is asserted as the absence of the `[shutdown]` marker.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -36,7 +42,7 @@ function writeRuntime(wd: Workdir, patch: Record<string, unknown>): void {
 const PENDING = { shutdown_requested_at: '2026-07-24T09:00:00+0000', shutdown_completed_at: null };
 
 async function run(wd: Workdir, prompt: string, stubUrl: string) {
-  return runScript('shutdown-gate.ts', {
+  return runScript('user-prompt-pipeline.ts', {
     stdin: JSON.stringify({ prompt }),
     cwd: wd.dir,
     env: { HERMIT_TELEGRAM_API_URL: stubUrl },
@@ -64,7 +70,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, { shutdown_requested_at: null, shutdown_completed_at: null });
       const r = await run(wd, envelope('do something'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -77,7 +83,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, { shutdown_requested_at: '2026-07-24T09:00:00+0000', shutdown_completed_at: '2026-07-24T09:01:00+0000' });
       const r = await run(wd, envelope('do something'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -90,7 +96,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, PENDING);
       const r = await run(wd, 'just a normal operator prompt', stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -103,7 +109,7 @@ describe('shutdown-gate', () => {
       const wd = setupChannelWorkdir();
       writeRuntime(wd, PENDING);
       const r = await run(wd, envelope('do something', 'intruder'), stub.url);
-      expect(r.stdout.trim()).toBe('');
+      expect(r.stdout).not.toContain('[shutdown]');
       expect(stub.requests.length).toBe(0);
     } finally {
       stub.stop();
@@ -122,7 +128,7 @@ describe('shutdown-gate', () => {
   test('malformed stdin → exit 0, no output', async () => {
     const wd = setupChannelWorkdir();
     writeRuntime(wd, PENDING);
-    const r = await runScript('shutdown-gate.ts', { stdin: 'not json', cwd: wd.dir, env: {} });
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: 'not json', cwd: wd.dir, env: {} });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   });
diff --git a/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
new file mode 100644
index 00000000..5a5acfe3
--- /dev/null
+++ b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
@@ -0,0 +1,163 @@
+// Contract tests for scripts/user-prompt-pipeline.ts — the single UserPromptSubmit
+// process — covering the two things the seven-hook shape could not express.
+//
+// 1. Shutdown is terminal. While a shutdown is pending, no later stage runs: not
+//    status (which used to send and block on its own after a FAILED shutdown send,
+//    discarding the shutdown relay instruction), not pause/resume, not a harness
+//    command. Each of those was reachable by construction before, because no hook
+//    could see what another had already done.
+// 2. One disposition per prompt. A block prints the decision JSON alone — mixed
+//    context text alongside it does not parse as a decision and the block is lost.
+//
+// Driven as a subprocess against a local HTTP stub, mirroring shutdown-gate.test.ts
+// and channel-status-responder.test.ts.
+
+import { describe, test, expect } from 'bun:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { runScript } from './helpers/run';
+import { setupWorkdir, type Workdir } from './helpers/workdir';
+import { startHttpStub } from './helpers/http-stub';
+
+const hermit = (dir: string, ...p: string[]) => path.join(dir, '.claude-code-hermit', ...p);
+
+function envelope(body: string, user = 'u1', chatId = '12345'): string {
+  return `<channel source="telegram" chat_id="${chatId}" user="${user}">${body}</channel>`;
+}
+
+function setupChannelWorkdir(): Workdir {
+  const wd = setupWorkdir();
+  const stateDir = path.join(wd.dir, '.claude.local', 'channels', 'telegram');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, '.env'), 'TELEGRAM_BOT_TOKEN=test-token\n');
+  fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({
+    timezone: 'UTC',
+    channels: { telegram: { enabled: true, dm_channel_id: '12345', allowed_users: ['u1'], state_dir: '.claude.local/channels/telegram' } },
+  }));
+  return wd;
+}
+
+function writeRuntime(wd: Workdir, patch: Record<string, unknown>): void {
+  const p = hermit(wd.dir, 'state', 'runtime.json');
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify({ version: 1, session_state: 'in_progress', ...patch }));
+}
+
+// A shutdown in flight, plus the pane facts a harness command needs — so the
+// harness stage is refused for the shutdown, not for a missing tmux session.
+const PENDING_SHUTDOWN = {
+  shutdown_requested_at: '2026-07-24T09:00:00+0000',
+  shutdown_completed_at: null,
+  runtime_mode: 'headless',
+  tmux_session: 'hermit-test',
+};
+
+async function run(wd: Workdir, body: string, stubUrl: string) {
+  return runScript('user-prompt-pipeline.ts', {
+    stdin: JSON.stringify({ prompt: envelope(body) }),
+    cwd: wd.dir,
+    env: { HERMIT_TELEGRAM_API_URL: stubUrl },
+  });
+}
+
+describe('user-prompt-pipeline: shutdown is terminal', () => {
+  test('status during a pending shutdown → one send, one block, status never answers', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, 'status', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      expect(JSON.parse(r.stdout.trim())).toMatchObject({ decision: 'block' });
+      // Exactly one outbound message: the shutdown reply. Two would mean the
+      // status stage answered the same prompt.
+      expect(stub.requests.length).toBe(1);
+      // And the block is the ONLY thing on stdout — no [Now:], no reply reminder.
+      expect(r.stdout).not.toContain('[Now:');
+      expect(r.stdout).not.toContain('[status]');
+    } finally {
+      stub.stop();
+    }
+  });
+
+  test('status during a pending shutdown with a FAILED send → shutdown relay only, status never answers', async () => {
+    const wd = setupChannelWorkdir();
+    writeRuntime(wd, PENDING_SHUTDOWN);
+
+    // Dead listener: the shutdown send fails. Previously the prompt then fell
+    // through and the status stage composed its own relay, swallowing the
+    // shutdown instruction the model was supposed to act on. No stub here on
+    // purpose — both stages read the same HERMIT_TELEGRAM_API_URL, so a request
+    // count could not tell the two senders apart; the discriminator is that the
+    // `[status]` relay is absent while the `[shutdown]` one is present.
+    const r = await run(wd, 'status', 'http://127.0.0.1:1');
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[shutdown]');
+    expect(r.stdout).not.toContain('[status]');
+    expect(r.stdout).not.toContain('"decision"'); // a failed send must not block
+  });
+
+  test('a harness command during a pending shutdown is refused, not acknowledged', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, '/model opus', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      // The Stop-stage drain refuses to deliver a command during shutdown, so
+      // recording one here would acknowledge something that never lands.
+      expect(fs.existsSync(hermit(wd.dir, 'state', 'pending-harness-command.json'))).toBe(false);
+      expect(r.stdout).not.toContain('[harness-command]');
+    } finally {
+      stub.stop();
+    }
+  });
+
+  test('resume during a pending shutdown does not clear an existing pause', async () => {
+    const stub = startHttpStub();
+    try {
+      const wd = setupChannelWorkdir();
+      const pausePath = hermit(wd.dir, 'state', 'pause.json');
+      fs.mkdirSync(path.dirname(pausePath), { recursive: true });
+      fs.writeFileSync(pausePath, JSON.stringify({ paused: true, reason: 'operator', by: 'u1' }));
+      writeRuntime(wd, PENDING_SHUTDOWN);
+
+      const r = await run(wd, 'resume', stub.url);
+
+      expect(r.exitCode).toBe(0);
+      expect(JSON.parse(fs.readFileSync(pausePath, 'utf-8')).paused).toBe(true);
+      expect(r.stdout).not.toContain('[pause]');
+    } finally {
+      stub.stop();
+    }
+  });
+});
+
+describe('user-prompt-pipeline: fail-open contract', () => {
+  test('malformed stdin exits 0 and emits nothing', async () => {
+    const wd = setupWorkdir();
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: wd.dir });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout.trim()).toBe('');
+  });
+
+  test('an ordinary prompt still records the operator-action markers', async () => {
+    const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: JSON.stringify({ prompt: 'do a thing' }),
+      cwd: wd.dir,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'operator-turn-open.json'))).toBe(true);
+  });
+});

From af4c6b755d88af0658d3a3225aa645cbd106652e Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 18:14:31 +0100
Subject: [PATCH 3/9] refactor(claude-code-hermit): absorb the proposal
 satellites into proposal.ts verbs

Seven top-level scripts become seven verbs over scripts/lib/proposals/ modules:
resolve-id, gate, queue-micro, micro, index, metrics, success-signal. Top-level
scripts drop 74 -> 67.

Every stdout grammar and exit code is preserved deliberately, not incidentally.
These verbs are not forced into proposal.ts's ok()/fail() helpers, because
callers branch on what they return: success-signal --validate must still exit 1
on a bad predicate (proposal-create reads that exit code), queue-micro and micro
must still exit 1 rather than drop a candidate silently, and index stays
fail-open with SKIP|no state dir at exit 0. Three verbs are therefore carved out
of the dispatcher's !verb || !stateDir guard: metrics defaults its state dir,
success-signal --validate reads no state at all, and index answers SKIP instead
of a usage error.

The extracted module is named index-rebuild.ts rather than index.ts so that an
import of './lib/proposals' cannot silently resolve to it; both
generate-summary.ts and lib/dashboard.ts import it directly.

Permissions are verb-pinned, not widened. The two bin/hermit-run grants become
"proposal micro *" and "proposal metrics *", keeping the space-before-* word
boundary. A bare "hermit-run proposal *" would have handed domain plugins
create, patch, shell-append, next-task and routine - arbitrary state-dir writes
- where two narrow routes existed before. The five retired direct-bun grants and
the two pre-absorption hermit-run routes are appended to HERMIT_OBSOLETE so
permissions-sync scrubs them from already-hatched hermits.

Fleet-scoped by necessity. bin/hermit-run resolves a script by bare filesystem
probe with no alias table, so a rename breaks in both version directions and
fails into hermit-exec.sh's misleading "plugin may predate this command" branch.
The three domain plugins that route through it therefore ship together with
required_core_version raised to >=1.2.34 across all three canonical fields.
Verified in a scratch hatch dir: both new routes dispatch, and both old names
hit the predate branch.

Consequence worth stating: until core is released at 1.2.34, doctor-check's
dependency check warns "3 sibling(s) outside required_core_version range (core
is 1.2.33)". That is the correct trade - pinning to >=1.2.33 would silence the
warn but let a hermit on 1.2.33 pass the check and then hit the route error at
runtime. main only reaches operators on a version bump, so the warn is confined
to this pre-release window.

Two test-quality fixes fell out of the move. A contract assertion checked that
hermit-evolve Step 8 does not name two now-deleted scripts inline; those names
now refer to nothing, so it passed while guarding nothing. It is replaced with a
structural check - at most one inline bun-script grant in Step 8, being the
apply-settings bootstrap caveat - that cannot go stale on a rename. And the
flag-lookup helper duplicated between proposal.ts and the extracted micro module
is now one flagValue() in lib/cli.ts.

bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0. HA 686 tests, dev 13,
fitness 129, all green.
---
 .claude/skills/stale-proposals/SKILL.md       |   4 +-
 .../.claude-plugin/hermit-meta.json           |   4 +-
 .../.claude-plugin/plugin.json                |   2 +-
 plugins/claude-code-dev-hermit/CHANGELOG.md   |   1 +
 .../skills/domain-brainstorm/SKILL.md         |   2 +-
 .../.claude-plugin/hermit-meta.json           |   4 +-
 .../.claude-plugin/plugin.json                |   2 +-
 .../claude-code-fitness-hermit/CHANGELOG.md   |   1 +
 .../skills/domain-brainstorm/SKILL.md         |   2 +-
 plugins/claude-code-hermit/CHANGELOG.md       |  23 +--
 .../claude-code-hermit/docs/architecture.md   |   2 +-
 .../scripts/apply-settings.ts                 |  27 ++-
 .../claude-code-hermit/scripts/ask-gate.ts    |   2 +-
 .../scripts/generate-summary.ts               |   2 +-
 .../scripts/lib/append-jsonl.ts               |   2 +-
 plugins/claude-code-hermit/scripts/lib/cli.ts |   9 +-
 .../scripts/lib/dashboard.ts                  |   2 +-
 .../{record-gate.ts => lib/proposals/gate.ts} |  35 ++--
 .../proposals/index-rebuild.ts}               |  25 ++-
 .../proposals/metrics.ts}                     |  19 ++-
 .../proposals/micro.ts}                       | 130 +++++++--------
 .../proposals/queue-micro.ts}                 |  26 ++-
 .../scripts/lib/proposals/resolve.ts          |  62 +++++++
 .../proposals/success-signal.ts}              |  24 ++-
 .../claude-code-hermit/scripts/proposal.ts    |  63 +++++--
 .../scripts/resolve-prop.ts                   |  63 -------
 .../claude-code-hermit/skills/brief/SKILL.md  |   2 +-
 .../skills/capability-brainstorm/SKILL.md     |   2 +-
 .../skills/channel-responder/SKILL.md         |  12 +-
 .../claude-code-hermit/skills/hatch/SKILL.md  |   4 +-
 .../skills/hermit-evolution/SKILL.md          |   2 +-
 .../skills/hermit-evolution/reference.md      |   2 +-
 .../skills/proposal-act/SKILL.md              |   8 +-
 .../skills/proposal-create/SKILL.md           |   4 +-
 .../skills/proposal-list/SKILL.md             |   2 +-
 .../skills/reflect/branches.md                |  12 +-
 .../skills/reflect/reference.md               |   2 +-
 .../tests/contracts.test.ts                   |  30 ++--
 .../tests/eval-success-signal.test.ts         |   8 +-
 .../tests/hermit-run.test.ts                  |   8 +-
 .../tests/procedure-capture.test.ts           |   6 +-
 .../tests/proposal-act-accept-flow.test.ts    |   6 +-
 .../tests/proposal-write.test.ts              |  52 ++++++
 .../tests/proposals-index.test.ts             |   8 +-
 .../claude-code-hermit/tests/scripts.test.ts  | 156 +++++++++---------
 .../.claude-plugin/hermit-meta.json           |   4 +-
 .../.claude-plugin/plugin.json                |   2 +-
 .../CHANGELOG.md                              |   3 +-
 .../skills/domain-brainstorm/SKILL.md         |   2 +-
 .../skills/ha-morning-brief/SKILL.md          |   2 +-
 50 files changed, 489 insertions(+), 388 deletions(-)
 rename plugins/claude-code-hermit/scripts/{record-gate.ts => lib/proposals/gate.ts} (79%)
 rename plugins/claude-code-hermit/scripts/{proposals-index.ts => lib/proposals/index-rebuild.ts} (87%)
 rename plugins/claude-code-hermit/scripts/{proposal-metrics-report.ts => lib/proposals/metrics.ts} (93%)
 rename plugins/claude-code-hermit/scripts/{micro-proposal.ts => lib/proposals/micro.ts} (52%)
 rename plugins/claude-code-hermit/scripts/{queue-micro-proposal.ts => lib/proposals/queue-micro.ts} (83%)
 create mode 100644 plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts
 rename plugins/claude-code-hermit/scripts/{eval-success-signal.ts => lib/proposals/success-signal.ts} (90%)
 delete mode 100644 plugins/claude-code-hermit/scripts/resolve-prop.ts

diff --git a/.claude/skills/stale-proposals/SKILL.md b/.claude/skills/stale-proposals/SKILL.md
index 468e8bb0..aa32bc79 100644
--- a/.claude/skills/stale-proposals/SKILL.md
+++ b/.claude/skills/stale-proposals/SKILL.md
@@ -62,7 +62,7 @@ Skip this entire step under `--no-apply`.
 For each `SHIPPED-STRONG` verdict, resolve the ID to a filename, then close it the same way `/claude-code-hermit:proposal-act` does — the metrics event goes first so the summary regen reflects it:
 
 ```bash
-bun plugins/claude-code-hermit/scripts/resolve-prop.ts .claude-code-hermit "<PROP-ID>"
+bun plugins/claude-code-hermit/scripts/proposal.ts resolve-id .claude-code-hermit "<PROP-ID>"
 
 bun plugins/claude-code-hermit/scripts/append-metrics.ts \
     .claude-code-hermit/state/proposal-metrics.jsonl \
@@ -76,7 +76,7 @@ HERMIT_PATCH
 
 Writing the evidence into the Decision line is what makes an automatic flip auditable: the operator can later see exactly which bullet closed the proposal and reopen it if the match was wrong.
 
-`resolve-prop.ts` returning `AMBIGUOUS` or `NONE` means don't guess — move that proposal into the Step 4 list instead. `proposal.ts` returning `ERROR|<reason>` means nothing was patched; report it and continue with the rest.
+`proposal.ts resolve-id` returning `AMBIGUOUS` or `NONE` means don't guess — move that proposal into the Step 4 list instead. `proposal.ts` returning `ERROR|<reason>` means nothing was patched; report it and continue with the rest.
 
 ## Step 4 — Ask about the rest
 
diff --git a/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
index f25928d6..f500913a 100644
--- a/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-dev-hermit/.claude-plugin/hermit-meta.json
@@ -1,7 +1,7 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   },
   "min_claude_code_version": ">=2.1.172"
 }
diff --git a/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json b/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
index 4beece81..af5711bb 100644
--- a/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-dev-hermit/.claude-plugin/plugin.json
@@ -4,7 +4,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ],
   "description": "Language-agnostic safety layer + dev conventions for any agent your hermit uses to write code",
diff --git a/plugins/claude-code-dev-hermit/CHANGELOG.md b/plugins/claude-code-dev-hermit/CHANGELOG.md
index 251630dc..9693f69f 100644
--- a/plugins/claude-code-dev-hermit/CHANGELOG.md
+++ b/plugins/claude-code-dev-hermit/CHANGELOG.md
@@ -8,6 +8,7 @@
 - `hatch`'s CLAUDE-APPEND version gate said to "extract the stamped version from the existing block", but no template or renderer ever wrote a version into the block — the gate degenerated to marker-present-only, so a plugin version bump alone never refreshed an already-hatched install. It now reads the stamp from `_hermit_versions["claude-code-dev-hermit"]` in `config.json`, which `hatch` itself already writes on every run.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - The CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-dev-hermit: Development Workflow -->`), placed outside both mode regions so it survives both renderings. Lets core's `hermit-evolve` bound the block exactly instead of a heuristic that used to mistake the template's own `<!-- mode:standard-only -->` annotation for the block marker.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - §Tests Before PR folded into §Implementation Flow (both stated one ordering, and `dev-pr` Gate 0 enforces the test-freshness half mechanically), the slug algorithm and its worked examples became one naming line, and the harness built-ins left §Dev Quick Reference. Rendered standard block 9,330 B → ~6,158 B, safety 6,338 B → ~4,703 B. No git-safety rule was removed.
diff --git a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
index 0e344a20..4ae9a7a6 100644
--- a/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-dev-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand dev-voice brainstorm — reads codebase friction signals
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
index 77e21845..a91e590c 100644
--- a/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-fitness-hermit/.claude-plugin/hermit-meta.json
@@ -1,6 +1,6 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   }
 }
diff --git a/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json b/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
index 1d50763d..12c7f85f 100644
--- a/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-fitness-hermit/.claude-plugin/plugin.json
@@ -4,7 +4,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ],
   "description": "Fitness/training layer for claude-code-hermit — Strava MCP integration, activity analysis skills, and routine templates for an autonomous training assistant",
diff --git a/plugins/claude-code-fitness-hermit/CHANGELOG.md b/plugins/claude-code-fitness-hermit/CHANGELOG.md
index bacb0313..1b78a53b 100644
--- a/plugins/claude-code-fitness-hermit/CHANGELOG.md
+++ b/plugins/claude-code-fitness-hermit/CHANGELOG.md
@@ -11,6 +11,7 @@
 - `hatch` no longer tells the operator to `cp .env.example .env`; a `.env.example` does not ship with the plugin.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 - `strava-sync` and `strava-health-check` routines removed — `fitness-brief` (morning + evening) now owns Strava connectivity, activity sync, RPE binding, and Run deep-dive as the plugin's two daily beats.
 - Activity notes carry `cardiac_drift_bpm` in frontmatter; `weekly-patterns` reads it there and falls back to the rendered line for older notes.
diff --git a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
index c39c843d..585a181d 100644
--- a/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-fitness-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand fitness-voice brainstorm — reads Strava history and tra
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index f86819e7..d03958ee 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -5,8 +5,8 @@
 ### Added
 - Channel-originated harness commands: an exact `/model <arg>`, `/effort <arg>`, `/compact`, or `/clear` from a trusted channel sender is recorded by a new `UserPromptSubmit` hook and typed into the session's pane when the turn ends. Args are passed through to Claude Code rather than checked against a fixed list, so new models and effort levels work without a plugin change.
 - `config.effort` — passed as `--effort` on every `hermit-start`, mirroring `config.model`, so a channel effort change reverts on restart instead of persisting. Ships `null` (no flag, model default); set it to opt into the revert-on-restart guarantee. Not the same lever as `config.env.CLAUDE_CODE_EFFORT_LEVEL`, which pins the session and makes a runtime `/effort` a no-op.
-- `micro-proposal.ts brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
-- Two `Bash(.claude-code-hermit/bin/hermit-run <script> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
+- `proposal.ts micro <dir> brief-cycle` — ages the whole micro-approval queue in one call (re-nudges `follow_up_count` 1 entries, expires 2+ entries, records each expiry) and returns a JSON verdict, replacing the per-entry `nudge`/`resolve` calls both briefs used to issue one at a time.
+- Two `Bash(.claude-code-hermit/bin/hermit-run proposal <verb> *)` allow entries so domain plugins can reach core's shared scripts through the project-resident `bin/hermit-run` (their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir). Each is pinned to the one verb that plugin needs — a bare `hermit-run proposal *` would also expose `create`, `patch`, `shell-append`, `next-task` and `routine`. The word-boundary space and `hermit-exec.sh`'s new `/`/`..` rejection keep the route from reaching a script outside core's `scripts/`.
 - `apply-settings.ts permissions-plan` and `permissions-sync` — the script now owns hermit's permission list end to end. `permissions-plan` prints `{"missing":[],"obsolete":[]}` without writing; `permissions-sync` applies it, adding sealed entries and removing only entries a previous plugin version shipped and has since retired. Operator-authored rules are never removed — deletion is filtered by a sealed registry, not by shape.
 
 ### Fixed
@@ -23,24 +23,27 @@
 - The CLAUDE-APPEND block dropped content already owned elsewhere: the watch authoring rules (the `watch` skill), the `channel-send.ts` exit-code walkthrough (`channel-responder` § Outbound notification protocol), the delegation break-even math (plugin `CLAUDE.md`), and the suggestion-path/exemption list behind the memory-first rule (the `proposal-triage` and `reflection-judge` gates that execute it). 7,877 B → ~6,199 B on a surface re-paid every session load and every subagent dispatch; no safety rule changed.
 - `≤200 chars` for push messages is stated once, in § Operator Notification. The notification skills point at it and keep their own condensation priorities, ending nine prose copies of one constant across four plugins.
 - A CLAUDE-APPEND marker that appears more than once in the target file is now refused (reported `block-ambiguous`, no Edit applied) instead of risking a replace that hits the wrong instance.
-- Micro-approval resolve/expire/nudge now go through the new `scripts/micro-proposal.ts` instead of hand-edited JSON, which could leave `state/micro-proposals.json` unparseable.
-- `queue-micro-proposal.ts` refuses to write over an unparseable `micro-proposals.json` instead of resetting it and silently dropping the pending backlog.
+- Micro-approval resolve/expire/nudge now go through `proposal.ts micro` instead of hand-edited JSON, which could leave `state/micro-proposals.json` unparseable.
+- `proposal.ts queue-micro` refuses to write over an unparseable `micro-proposals.json` instead of resetting it and silently dropping the pending backlog.
 - `hermit-evolve`'s sibling upgrade now applies `local > project` scope precedence when the same sibling is installed at both scopes in one project, matching `resolve-siblings.ts` and Claude Code's own settings layering — it previously read the project-scope install's version and changelog while the session was running the local-scope one.
-- `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches `micro-proposal.ts` via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
+- `hatch` Step 8's rationale no longer claims HA's `ha-morning-brief` reaches core's micro-approval writer via a `../claude-code-hermit/scripts/` sibling path (that path never resolved from an installed domain plugin); it reaches it via `bin/hermit-run`.
 
-### Removed
-- `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
-
-### Changed
 - One `UserPromptSubmit` process per submitted prompt instead of seven. `user-prompt-pipeline.ts` reads stdin once, parses the channel envelope once, and reads `config.json` and `runtime.json` at most once each, then runs the former hooks as ordered stages (six now live in `scripts/lib/prompt-stages/`). Stage precedence is explicit in code rather than implied by entry order in `hooks.json`, and a blocked prompt emits the decision JSON alone — mixed context text alongside it does not parse as a decision, which would silently drop the block.
 - Proactive operator notifications unified onto `channel-send.ts --notice`; `weekly-review`, `cost-reflect`, and (via § Operator Notification) `heartbeat`/`brief`/`capability-brainstorm` are tier-aware, so spend and technical detail no longer reach the client chat. On a `non-technical` install with no `maintainer_channel_id`, routine spend reports now land in `SHELL.md` Findings instead of the primary chat.
 - `hatch` Step 8 and `hermit-evolve` Step 8 no longer restate the permission list — both call the new verbs. Two copies of the list are gone, along with the hand-maintained stale-entry list in `hermit-evolve/reference.md`, which had drifted to 15 of the canonical entries and told the model to add a `Write` rule the writer deliberately strips. The delegated writer holds the single canonical list and writes via `fs`, so it also works under the strict hook profile where an `Edit`/`Write` to `.claude/settings*.json` is blocked.
 - The core CLAUDE-APPEND template gained a closing marker (`<!-- /claude-code-hermit: Session Discipline -->`), matching `claude-code-homeassistant-hermit`/`claude-code-fitness-hermit`/`feed-hermit`/`laravel-forge-hermit`. Bounds detection still falls back correctly for already-installed blocks that predate the marker.
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
+- The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
+- Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- `proposal-metrics-report.ts` and `eval-success-signal.ts` had no allow entry and were prompted for on every run; as `proposal.ts` verbs they are covered by the existing `proposal.ts` grant and run unattended. That is an authority change: a headless brainstorm kill-check and a success-signal validation now proceed without asking.
+
+### Removed
+- `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
+- Seven top-level proposal scripts, absorbed into `proposal.ts` verbs: `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `proposals-index.ts`, `proposal-metrics-report.ts`, `eval-success-signal.ts`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
-2. Run `bun <plugin_root>/scripts/apply-settings.ts <settings-file> permissions-sync` against the install's settings file (`.claude/settings.local.json` for a `local` hatch target, `.claude/settings.json` for `committed`). This is now the one step that reconciles permissions: it adds every sealed entry the install is missing — including `channel-send.ts` and `micro-proposal.ts`, both new this version — and scrubs entries from retired plugin versions, `next-prop-id.ts` among them. It replaces the per-entry "re-run hatch so X lands in the allow-list" instructions.
+2. Run `bun <plugin_root>/scripts/apply-settings.ts <settings-file> permissions-sync` against the install's settings file (`.claude/settings.local.json` for a `local` hatch target, `.claude/settings.json` for `committed`). This is now the one step that reconciles permissions: it adds every sealed entry the install is missing — including `channel-send.ts`, new this version — and scrubs entries from retired plugin versions: `next-prop-id.ts`, the five proposal satellites absorbed into `proposal.ts` verbs, and the two pre-absorption `hermit-run` routes. It replaces the per-entry "re-run hatch so X lands in the allow-list" instructions.
 3. If `claude-code-dev-hermit` is installed and its CLAUDE.md/CLAUDE.local.md contains the literal string `<!-- mode:standard-only -->`, a prior version of `hermit-evolve` hit the marker-discovery bug above and appended the raw, un-rendered dev-hermit template. Remove the entire stray block (from the first `<!-- mode:standard-only -->` or `<!-- mode:safety-only -->` line it introduced through the end of that appended region) — the correctly-rendered `<!-- claude-code-dev-hermit: Development Workflow -->` block elsewhere in the file is unaffected and should be left in place.
 4. If an operator customized their CLAUDE-APPEND block in place (core, `hermit-scribe`, or `claude-code-dev-hermit`), note that the next version-gap sync for that plugin will replace it with the shipped template now that closing markers make the block bounds authoritative — re-apply any customization after that sync.
 
diff --git a/plugins/claude-code-hermit/docs/architecture.md b/plugins/claude-code-hermit/docs/architecture.md
index c0f91f6a..00bfb637 100644
--- a/plugins/claude-code-hermit/docs/architecture.md
+++ b/plugins/claude-code-hermit/docs/architecture.md
@@ -187,7 +187,7 @@ One writer per state file. No shared mutation bus. (Exception: `state/micro-prop
 | `state/channel-log.sqlite`     | channel-reply-reminder stage + channel-hook.ts (append, via `lib/channel-log.ts`); weekly-review marks/prunes | search.ts (recall, fourth source); weekly-review consolidation |
 | `state/session-diff.json`      | session-diff.ts only                                | session-close (display)                                       |
 | `state/observations.jsonl`     | reflect + reflect-precheck + session-close + channel-responder (append only; `source` values: `cost-spike`, `quick-deferral`, `reflect-noticed`, `startup-drift`, `skill-correction`) | reflect (step 3b graduation), reflection-judge (§1.4 ledger verification) |
-| `state/proposal-metrics.jsonl` | proposal-create + proposal-act (append only)        | generate-summary.ts, proposal-metrics-report.ts (read-only)   |
+| `state/proposal-metrics.jsonl` | proposal-create + proposal-act (append only)        | generate-summary.ts, proposal.ts metrics (read-only)   |
 | `state/usage-metrics.jsonl`    | usage-track.ts (Skill/Read PostToolUse) + record-operator-action.ts (operator-typed `/skill`, append only; compacted >180d by weekly-review) | weekly-review (untouched-knowledge/dormant-skill suggestions) |
 | `state/micro-proposals.json`   | reflect + channel-bridged skills (queue, schema owned by reflect § Queuing procedure) + channel-responder/brief (resolve) | brief, generate-summary.ts |
 | `state/state-summary.md`       | generate-summary.ts only                            | humans                                                        |
diff --git a/plugins/claude-code-hermit/scripts/apply-settings.ts b/plugins/claude-code-hermit/scripts/apply-settings.ts
index 38e69a47..02a23042 100644
--- a/plugins/claude-code-hermit/scripts/apply-settings.ts
+++ b/plugins/claude-code-hermit/scripts/apply-settings.ts
@@ -52,13 +52,8 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/archive-shell.ts*)',
   'Bash(bun */scripts/evaluate-session.ts*)',
   'Bash(bun */scripts/append-metrics.ts*)',
-  'Bash(bun */scripts/resolve-prop.ts*)',
   'Bash(bun */scripts/proposal.ts*)',
-  'Bash(bun */scripts/record-gate.ts*)',
-  'Bash(bun */scripts/queue-micro-proposal.ts*)',
-  'Bash(bun */scripts/micro-proposal.ts*)',
   'Bash(bun */scripts/generate-summary.ts*)',
-  'Bash(bun */scripts/proposals-index.ts*)',
   'Bash(bun */scripts/update-reflection-state.ts*)',
   'Bash(bun */scripts/apply-reflection-actions.ts*)',
   'Bash(bun */scripts/transcript-digest.ts*)',
@@ -75,10 +70,14 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/cron-registry.ts*)',
   // Domain plugins reach core's shared scripts through the project-resident
   // bin/hermit-run (their own ${CLAUDE_PLUGIN_ROOT} can't reach core's versioned
-  // cache dir). Space before * is a word boundary — `micro-proposal *` matches
-  // `micro-proposal brief-cycle` but not a `micro-proposal…`-prefixed name.
-  'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
-  'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
+  // cache dir). Pinned to the two verbs they actually need, not a bare
+  // `hermit-run proposal *` — that would also hand them create, patch,
+  // shell-append, next-task and routine, i.e. arbitrary state-dir writes. The
+  // space before * is a word boundary: `proposal micro *` matches
+  // `proposal micro .claude-code-hermit brief-cycle` but not a
+  // `micro…`-prefixed verb.
+  'Bash(.claude-code-hermit/bin/hermit-run proposal micro *)',
+  'Bash(.claude-code-hermit/bin/hermit-run proposal metrics *)',
   "Bash(bash -c 'AGENT_DIR=\".claude-code-hermit\"*)",
   'Edit(.claude-code-hermit/**)',
 ];
@@ -96,6 +95,16 @@ const HERMIT_OBSOLETE = [
   'Bash(bun */scripts/run-with-profile.ts*)',
   'Bash(bun */scripts/suggest-compact.ts*)',
   'Bash(bun */scripts/next-prop-id.ts*)',
+  // Proposal satellites absorbed into proposal.ts verbs — the scripts are gone,
+  // so these grants now name nothing.
+  'Bash(bun */scripts/resolve-prop.ts*)',
+  'Bash(bun */scripts/record-gate.ts*)',
+  'Bash(bun */scripts/queue-micro-proposal.ts*)',
+  'Bash(bun */scripts/micro-proposal.ts*)',
+  'Bash(bun */scripts/proposals-index.ts*)',
+  // …and the two hermit-run routes that pointed at the pre-absorption names.
+  'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
+  'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
 ];
 
 // Sealed autoMode entries — operator-owned policy seeded at attended hatch and
diff --git a/plugins/claude-code-hermit/scripts/ask-gate.ts b/plugins/claude-code-hermit/scripts/ask-gate.ts
index c1f33b7d..a2339b70 100644
--- a/plugins/claude-code-hermit/scripts/ask-gate.ts
+++ b/plugins/claude-code-hermit/scripts/ask-gate.ts
@@ -44,7 +44,7 @@ import { runHook } from './lib/hook-input';
 const REDIRECT_REASON =
   'No interactive operator on this surface (always-on channel session). Do not retry ' +
   'AskUserQuestion. Instead: (1) send the question via the channel reply tool; (2) queue it ' +
-  'durably by running `bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts ' +
+  'durably by running `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro ' +
   '.claude-code-hermit` with a heredoc payload {"tier":1,"question":"...","options":[...]} — ' +
   'never hand-edit state/micro-proposals.json; (3) continue other work — the answer arrives as a ' +
   'channel message. If a human operator is in fact attending this terminal, they can relaunch ' +
diff --git a/plugins/claude-code-hermit/scripts/generate-summary.ts b/plugins/claude-code-hermit/scripts/generate-summary.ts
index 6fd26486..161f2451 100644
--- a/plugins/claude-code-hermit/scripts/generate-summary.ts
+++ b/plugins/claude-code-hermit/scripts/generate-summary.ts
@@ -4,7 +4,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { rebuildIndex } from './proposals-index';
+import { rebuildIndex } from './lib/proposals/index-rebuild';
 import { readMergedAlerts } from './lib/alert-state';
 
 type Json = any;
diff --git a/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts b/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
index 46816e9e..03820809 100644
--- a/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
+++ b/plugins/claude-code-hermit/scripts/lib/append-jsonl.ts
@@ -1,6 +1,6 @@
 // Shared validated-append primitive for JSONL event ledgers (proposal-metrics.jsonl,
 // observations.jsonl, micro-proposals.json's metrics companion, etc). Extracted from
-// append-metrics.ts so record-gate.ts and queue-micro-proposal.ts can append
+// append-metrics.ts so proposal.ts's gate and queue-micro verbs can append
 // pre-built events through the same validate-then-append contract instead of
 // re-implementing it.
 
diff --git a/plugins/claude-code-hermit/scripts/lib/cli.ts b/plugins/claude-code-hermit/scripts/lib/cli.ts
index 6f383f0a..9c6b4ddf 100644
--- a/plugins/claude-code-hermit/scripts/lib/cli.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cli.ts
@@ -3,7 +3,7 @@
 // and exits 0; readStdin() reads a heredoc payload to completion untrimmed
 // (callers trim where the original per-script behavior trimmed); readJson()
 // is a tolerant JSON-file reader for optional state files (null if missing
-// or invalid).
+// or invalid); flagValue() reads one `--flag value` pair out of an argv slice.
 
 import fs from 'node:fs';
 
@@ -28,4 +28,9 @@ function readJson(p: string): Json {
   try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; }
 }
 
-export { emit, readStdin, readJson };
+function flagValue(argv: string[], flag: string): string | undefined {
+  const i = argv.indexOf(flag);
+  return i === -1 ? undefined : argv[i + 1];
+}
+
+export { emit, readStdin, readJson, flagValue };
diff --git a/plugins/claude-code-hermit/scripts/lib/dashboard.ts b/plugins/claude-code-hermit/scripts/lib/dashboard.ts
index a20786e5..864ab8df 100644
--- a/plugins/claude-code-hermit/scripts/lib/dashboard.ts
+++ b/plugins/claude-code-hermit/scripts/lib/dashboard.ts
@@ -18,7 +18,7 @@ import { sha256 } from './hash';
 import { readMergedAlerts } from './alert-state';
 import { todayYMD } from './time';
 import { costIndexPath, readCostIndex } from './cost-log';
-import { rebuildIndex, type ProposalsIndex } from '../proposals-index';
+import { rebuildIndex, type ProposalsIndex } from './proposals/index-rebuild';
 import { loadStrings, fmt, type ArtifactStrings } from './artifact-strings';
 
 type Json = any;
diff --git a/plugins/claude-code-hermit/scripts/record-gate.ts b/plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
similarity index 79%
rename from plugins/claude-code-hermit/scripts/record-gate.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
index f5143201..f27ca701 100644
--- a/plugins/claude-code-hermit/scripts/record-gate.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/gate.ts
@@ -1,6 +1,6 @@
-// record-gate.ts — parses one proposal/reflect gate-agent verdict line, appends the
-// corresponding metric event, and returns a routing token.
-// Usage: bun record-gate.ts <hermit-state-dir> --gate <triage|judge> --caller <caller>
+// `proposal.ts gate <stateDir> …` — parses one proposal/reflect gate-agent verdict
+// line, appends the corresponding metric event, and returns a routing token.
+// Usage: proposal.ts gate <hermit-state-dir> --gate <triage|judge> --caller <caller>
 //        [--evidence-source <value>] [--tags <json-array>] <<'HERMIT_GATE'
 //        Title: <candidate title>
 //        Verdict: <the gate agent's verdict line, verbatim>
@@ -25,9 +25,9 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { utcISOStamp } from './lib/time';
-import { emit, readStdin } from './lib/cli';
+import { appendJsonlLine } from '../append-jsonl';
+import { utcISOStamp } from '../time';
+import { emit, readStdin } from '../cli';
 
 function parseArgs(argv: string[]): Record<string, string> {
   const out: Record<string, string> = {};
@@ -40,9 +40,8 @@ function parseArgs(argv: string[]): Record<string, string> {
   return out;
 }
 
-(async () => {
-  const stateDir = process.argv[2];
-  const flags = parseArgs(process.argv.slice(3));
+export async function run(stateDir: string, args: string[]): Promise<void> {
+  const flags = parseArgs(args);
   const gate = flags.gate; // 'triage' | 'judge'
   const caller = flags.caller ?? 'unknown';
   const evidenceSource = flags['evidence-source'] ?? 'archived-session';
@@ -59,21 +58,17 @@ function parseArgs(argv: string[]): Record<string, string> {
 
   const agent = gate === 'judge' ? 'reflection-judge' : 'proposal-triage';
 
-  if (stateDir) {
-    try { fs.mkdirSync(path.join(stateDir, 'state'), { recursive: true }); } catch { /* appendJsonlLine below reports the real failure */ }
-  }
+  try { fs.mkdirSync(path.join(stateDir, 'state'), { recursive: true }); } catch { /* appendJsonlLine below reports the real failure */ }
 
   function failClosed(): never {
-    if (stateDir) {
-      appendJsonlLine(
-        path.join(stateDir, 'state', 'proposal-metrics.jsonl'),
-        JSON.stringify({ ts: utcISOStamp(), type: 'gate-failed', agent, title }),
-      );
-    }
+    appendJsonlLine(
+      path.join(stateDir, 'state', 'proposal-metrics.jsonl'),
+      JSON.stringify({ ts: utcISOStamp(), type: 'gate-failed', agent, title }),
+    );
     emit('GATE_FAILED');
   }
 
-  if (!stateDir || (gate !== 'triage' && gate !== 'judge') || !verdictLine) failClosed();
+  if ((gate !== 'triage' && gate !== 'judge') || !verdictLine) failClosed();
 
   const ledger = path.join(stateDir, 'state', 'proposal-metrics.jsonl');
 
@@ -106,4 +101,4 @@ function parseArgs(argv: string[]): Record<string, string> {
   if (downgrade) emit(`PROCEED|DOWNGRADE:${downgrade[1]}`);
   if (suppress) emit(`DROP|SUPPRESS:${suppress[1]}`);
   failClosed();
-})();
+}
diff --git a/plugins/claude-code-hermit/scripts/proposals-index.ts b/plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
similarity index 87%
rename from plugins/claude-code-hermit/scripts/proposals-index.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
index 3324cba8..2cff9c80 100644
--- a/plugins/claude-code-hermit/scripts/proposals-index.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/index-rebuild.ts
@@ -1,9 +1,7 @@
-// proposals-index.ts — derived cache of every proposal's frontmatter.
-// Usage: bun proposals-index.ts <hermit-state-dir>
-// Output (stdout, one line): OK|<n> proposals  |  SKIP|no proposals dir
-// Exit 0 always. Writes state/proposals-index.json (full rebuild — never
-// incremental, so it cannot drift). Also exported as rebuildIndex() for the
-// generate-summary PostToolUse hook to call on every proposal write.
+// Derived cache of every proposal's frontmatter. Writes state/proposals-index.json
+// (full rebuild — never incremental, so it cannot drift). Driven by `proposal.ts
+// index`, and imported directly by the generate-summary PostToolUse hook and
+// lib/dashboard.ts, which call rebuildIndex() on every proposal write.
 //
 // Why this exists: proposal-list otherwise reads every PROP-*.md body in full
 // (~22K tokens for a dozen proposals) just to render a table from frontmatter.
@@ -11,10 +9,14 @@
 // reflection-state.json still tally proposal events independently from
 // proposal-metrics.jsonl — those are event counters, a different quantity, and
 // were not migrated onto this index.)
+//
+// Named index-rebuild, not index: a bare `index.ts` here would make
+// `import … from './lib/proposals'` silently resolve to this module.
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { readFileWithFrontmatter, globDir } from './lib/frontmatter';
+import { readFileWithFrontmatter, globDir } from '../frontmatter';
+import { emit } from '../cli';
 
 type Json = any;
 
@@ -138,11 +140,8 @@ export function rebuildIndex(stateDir: string, bodyOut?: Map<string, string>): P
   return index;
 }
 
-// CLI mode
-if (import.meta.main) {
-  const stateDir = process.argv[2];
-  if (!stateDir) { process.stdout.write('SKIP|no state dir\n'); process.exit(0); }
+// `proposal.ts index <stateDir>` — full rebuild, one bounded verdict line.
+export function run(stateDir: string): never {
   const index = rebuildIndex(stateDir);
-  process.stdout.write(index ? `OK|${index.count} proposals\n` : 'SKIP|no proposals dir\n');
-  process.exit(0);
+  emit(index ? `OK|${index.count} proposals` : 'SKIP|no proposals dir');
 }
diff --git a/plugins/claude-code-hermit/scripts/proposal-metrics-report.ts b/plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/proposal-metrics-report.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
index e508a4a9..814cd40c 100644
--- a/plugins/claude-code-hermit/scripts/proposal-metrics-report.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/metrics.ts
@@ -1,3 +1,7 @@
+// `proposal.ts metrics [<stateDir>] [--source=<key>]` — triage-survival and
+// acceptance rates per autonomous proposal source. The state dir is optional and
+// defaults to `.claude-code-hermit`, so a bare `proposal.ts metrics` still works.
+
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -40,8 +44,7 @@ const SEGMENTS: { key: string; triage: (e: Json) => boolean; accept: ((src: stri
   },
 ];
 
-function run() {
-  const rawArgs = process.argv.slice(2);
+function report(rawArgs: string[]) {
   const posArgs = rawArgs.filter(a => !a.startsWith('--'));
   const stateDir = posArgs[0] || '.claude-code-hermit';
   const sourceArg = (rawArgs.find(a => a.startsWith('--source=')) || '').slice('--source='.length) || null;
@@ -171,9 +174,11 @@ function run() {
   );
 }
 
-try {
-  run();
-} catch (err: any) {
-  process.stdout.write(`proposal-metrics-report: error — ${err.message}\n`);
-  process.exit(0);
+export function run(args: string[]): void {
+  try {
+    report(args);
+  } catch (err: any) {
+    process.stdout.write(`proposal metrics: error — ${err.message}\n`);
+    process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/micro-proposal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
similarity index 52%
rename from plugins/claude-code-hermit/scripts/micro-proposal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
index f28bb618..1ef165db 100644
--- a/plugins/claude-code-hermit/scripts/micro-proposal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/micro.ts
@@ -1,11 +1,11 @@
-// micro-proposal.ts — mutates state/micro-proposals.json for the micro-approval
-// queue. Every mutation goes through here so the file is only ever written by
-// JSON.stringify (issue 649: hand-edited JSON left a trailing comma, and every
-// reader treats an unparseable file as an empty queue).
+// `proposal.ts micro <stateDir> …` — mutates state/micro-proposals.json for the
+// micro-approval queue. Every mutation goes through here so the file is only ever
+// written by JSON.stringify (issue 649: hand-edited JSON left a trailing comma, and
+// every reader treats an unparseable file as an empty queue).
 // Usage:
-//   bun micro-proposal.ts <hermit-state-dir> resolve <MP-id> --action approved|rejected|answered|expired [--answer "<label>"]
-//   bun micro-proposal.ts <hermit-state-dir> nudge <MP-id>
-//   bun micro-proposal.ts <hermit-state-dir> brief-cycle
+//   proposal.ts micro <hermit-state-dir> resolve <MP-id> --action approved|rejected|answered|expired [--answer "<label>"]
+//   proposal.ts micro <hermit-state-dir> nudge <MP-id>
+//   proposal.ts micro <hermit-state-dir> brief-cycle
 // Output (stdout, one line):
 //   RESOLVED|<id>|<action>
 //   NUDGED|<id>|<follow_up_count>
@@ -29,42 +29,24 @@
 // brief/SKILL.md's MP lifecycle step.
 
 import path from 'node:path';
-import { utcISOStamp } from './lib/time';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { writeFileAtomic } from './lib/md-write';
-import { emit } from './lib/cli';
-import { readMicroProposals } from './lib/micro-proposals-io';
+import { utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+import { writeFileAtomic } from '../md-write';
+import { emit, flagValue } from '../cli';
+import { readMicroProposals } from '../micro-proposals-io';
 
 type Json = any;
 
 const VERBS = ['resolve', 'nudge'];
 const ACTIONS = ['approved', 'rejected', 'answered', 'expired'];
 
-const stateDir = process.argv[2];
-const verb = process.argv[3];
-const id = process.argv[4];
+const USAGE = 'Usage: proposal.ts micro <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>] | brief-cycle';
 
 function fail(msg: string): never {
   console.error(msg);
   process.exit(1);
 }
 
-if (!stateDir || !verb) {
-  fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>] | brief-cycle');
-}
-
-// brief-cycle takes no <MP-id> — dispatch it before the id requirement below.
-if (verb === 'brief-cycle') briefCycle(stateDir);
-
-if (!id) {
-  fail('Usage: bun micro-proposal.ts <hermit-state-dir> resolve|nudge <MP-id> [--action <a>] [--answer <label>]');
-}
-
-function flag(name: string): string | undefined {
-  const i = process.argv.indexOf(name);
-  return i === -1 ? undefined : process.argv[i + 1];
-}
-
 // Age the whole pending queue in one pass. Bucketing mirrors the per-entry rules
 // the brief skills used to issue one call at a time: count 0 -> report only,
 // count 1 -> report + bump to 2, count >=2 -> expire. Ledger lines are appended
@@ -116,48 +98,60 @@ function briefCycle(dir: string): never {
   emit(JSON.stringify({ new: fresh, renudged, expired }));
 }
 
-// Validate the whole invocation before touching disk. Otherwise a dropped id
-// (`resolve --action approved`) makes `--action` the id, misses, and exits 0 on
-// NONE|no-match — the entry stays pending and the caller believes it resolved.
-if (!VERBS.includes(verb)) fail(`Unknown verb: ${verb} (expected ${VERBS.join('|')})`);
-if (id.startsWith('-')) fail(`Missing <MP-id> — got the flag "${id}" in its place.`);
+export function run(stateDir: string, args: string[]): never {
+  const verb = args[0];
+  const id = args[1];
 
-const action = verb === 'resolve' ? flag('--action') : undefined;
-if (verb === 'resolve' && (!action || !ACTIONS.includes(action))) {
-  fail(`--action must be one of: ${ACTIONS.join(', ')}`);
-}
-const answer = flag('--answer');
+  if (!verb) fail(USAGE);
 
-const microPath = path.join(stateDir, 'state', 'micro-proposals.json');
+  // brief-cycle takes no <MP-id> — dispatch it before the id requirement below.
+  if (verb === 'brief-cycle') briefCycle(stateDir);
 
-// Deliberately NOT lib/cli.ts's readJson — it flattens "missing" and "corrupt"
-// to null. Corrupt must fail loud so the file is never silently replaced.
-const read = readMicroProposals(microPath);
-if (read.status === 'missing') emit('NONE|no-match'); // nothing queued, nothing to mutate
-if (read.status === 'corrupt') fail(`${read.error} — refusing to write. Repair it first.`);
-const micro: Json = read.data;
+  if (!id) fail(USAGE);
 
-const idx = micro.pending.findIndex((e: Json) => e.id === id);
-if (idx === -1) emit('NONE|no-match');
-const entry = micro.pending[idx];
+  // Validate the whole invocation before touching disk. Otherwise a dropped id
+  // (`resolve --action approved`) makes `--action` the id, misses, and exits 0 on
+  // NONE|no-match — the entry stays pending and the caller believes it resolved.
+  if (!VERBS.includes(verb)) fail(`Unknown verb: ${verb} (expected ${VERBS.join('|')})`);
+  if (id.startsWith('-')) fail(`Missing <MP-id> — got the flag "${id}" in its place.`);
 
-if (verb === 'nudge') {
-  const next = (typeof entry.follow_up_count === 'number' ? entry.follow_up_count : 0) + 1;
-  entry.follow_up_count = next;
-  writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
-  emit(`NUDGED|${id}|${next}`);
-}
+  const action = verb === 'resolve' ? flagValue(args, '--action') : undefined;
+  if (verb === 'resolve' && (!action || !ACTIONS.includes(action))) {
+    fail(`--action must be one of: ${ACTIONS.join(', ')}`);
+  }
+  const answer = flagValue(args, '--answer');
+
+  const microPath = path.join(stateDir, 'state', 'micro-proposals.json');
+
+  // Deliberately NOT lib/cli.ts's readJson — it flattens "missing" and "corrupt"
+  // to null. Corrupt must fail loud so the file is never silently replaced.
+  const read = readMicroProposals(microPath);
+  if (read.status === 'missing') emit('NONE|no-match'); // nothing queued, nothing to mutate
+  if (read.status === 'corrupt') fail(`${read.error} — refusing to write. Repair it first.`);
+  const micro: Json = read.data;
+
+  const idx = micro.pending.findIndex((e: Json) => e.id === id);
+  if (idx === -1) emit('NONE|no-match');
+  const entry = micro.pending[idx];
+
+  if (verb === 'nudge') {
+    const next = (typeof entry.follow_up_count === 'number' ? entry.follow_up_count : 0) + 1;
+    entry.follow_up_count = next;
+    writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
+    emit(`NUDGED|${id}|${next}`);
+  }
 
-// Capture the question before removal — the ledger event carries it.
-const question = entry.question;
-micro.pending.splice(idx, 1);
-writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
+  // Capture the question before removal — the ledger event carries it.
+  const question = entry.question;
+  micro.pending.splice(idx, 1);
+  writeFileAtomic(microPath, JSON.stringify(micro, null, 2) + '\n');
 
-const event: Json = { ts: utcISOStamp(), type: 'micro-resolved', micro_id: id, action, question };
-if (answer !== undefined) event.answer = answer;
-const err = appendJsonlLine(path.join(stateDir, 'state', 'proposal-metrics.jsonl'), JSON.stringify(event));
-// The queue write already landed, so re-running this command would only report
-// NONE|no-match — say so, or the caller retries and loses the event for good.
-if (err) fail(`${err} — ${id} was already removed from pending; the micro-resolved event was NOT recorded. Do not re-run; append it by hand.`);
+  const event: Json = { ts: utcISOStamp(), type: 'micro-resolved', micro_id: id, action, question };
+  if (answer !== undefined) event.answer = answer;
+  const err = appendJsonlLine(path.join(stateDir, 'state', 'proposal-metrics.jsonl'), JSON.stringify(event));
+  // The queue write already landed, so re-running this command would only report
+  // NONE|no-match — say so, or the caller retries and loses the event for good.
+  if (err) fail(`${err} — ${id} was already removed from pending; the micro-resolved event was NOT recorded. Do not re-run; append it by hand.`);
 
-emit(`RESOLVED|${id}|${action}`);
+  emit(`RESOLVED|${id}|${action}`);
+}
diff --git a/plugins/claude-code-hermit/scripts/queue-micro-proposal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
similarity index 83%
rename from plugins/claude-code-hermit/scripts/queue-micro-proposal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
index 5884e93d..365a81ec 100644
--- a/plugins/claude-code-hermit/scripts/queue-micro-proposal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/queue-micro.ts
@@ -1,6 +1,6 @@
-// queue-micro-proposal.ts — generates an MP-id, dedups, appends a pending entry to
-// state/micro-proposals.json, and logs the micro-queued metric event.
-// Usage: bun queue-micro-proposal.ts <hermit-state-dir> <<'HERMIT_MP'
+// `proposal.ts queue-micro <stateDir>` — generates an MP-id, dedups, appends a
+// pending entry to state/micro-proposals.json, and logs the micro-queued event.
+// Usage: proposal.ts queue-micro <hermit-state-dir> <<'HERMIT_MP'
 //        {"tier":1,"question":"<full question text>","options":["..."],"on_resolve":"..."}
 //        HERMIT_MP
 //   — stdin only (question is free text and may contain apostrophes/quotes; no argv mode).
@@ -17,21 +17,15 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { todayYMD, utcISOStamp } from './lib/time';
-import { appendJsonlLine } from './lib/append-jsonl';
-import { readStdin, readJson } from './lib/cli';
-import { writeFileAtomic } from './lib/md-write';
-import { readMicroProposals } from './lib/micro-proposals-io';
+import { todayYMD, utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+import { readStdin, readJson } from '../cli';
+import { writeFileAtomic } from '../md-write';
+import { readMicroProposals } from '../micro-proposals-io';
 
 type Json = any;
 
-(async () => {
-  const stateDir = process.argv[2];
-  if (!stateDir) {
-    console.error("Usage: bun queue-micro-proposal.ts <hermit-state-dir> <<'HERMIT_MP' ... HERMIT_MP");
-    process.exit(1);
-  }
-
+export async function run(stateDir: string): Promise<void> {
   const raw = (await readStdin()).trim();
   let payload: Json;
   try {
@@ -108,4 +102,4 @@ type Json = any;
   }
 
   process.stdout.write(`QUEUED|${id}\n`);
-})();
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts b/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts
new file mode 100644
index 00000000..757f7171
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/resolve.ts
@@ -0,0 +1,62 @@
+// `proposal.ts resolve-id <stateDir> <operator-input>` — resolves an operator's
+// PROP-id input to a proposal filename.
+// Output (stdout, one line):
+//   MATCH|<filename>
+//   AMBIGUOUS|<json array of {file, title}>
+//   NONE|not-a-prop-id
+//   NONE|no-match
+// Exit 0 always — resolution failures are reported via the verdict token, not exit code.
+// Implements proposal-act/SKILL.md § Resolving a Proposal ID. Glob matching is
+// case-insensitive: step 1 uppercases the whole input (including any slug suffix),
+// while real proposal filenames carry a lowercase slug — case-insensitive matching
+// is required for the suffix form to ever match a real file.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { readFrontmatter } from '../frontmatter';
+import { emit } from '../cli';
+
+// Anchored glob → regex. Never a bare `PROP-NNN*` — that collides with 4-digit NNN
+// filenames (e.g. `PROP-0061.md`) once proposal counts cross 1000.
+function globToRegExp(pattern: string): RegExp {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+  return new RegExp(`^${escaped}$`, 'i');
+}
+
+export function run(stateDir: string, rawInput: string | undefined): never {
+  if (rawInput === undefined) emit('NONE|not-a-prop-id');
+
+  const input = rawInput.trim().toUpperCase();
+  const m = input.match(/^PROP-(\d+)(?:-(.+))?$/);
+  if (!m) emit('NONE|not-a-prop-id');
+
+  const num = m[1].padStart(3, '0');
+  const suffix = m[2];
+
+  const proposalsDir = path.join(stateDir, 'proposals');
+  let files: string[] = [];
+  try {
+    files = fs.readdirSync(proposalsDir).filter(f => f.endsWith('.md')).sort();
+  } catch {
+    emit('NONE|no-match');
+  }
+
+  let matches: string[];
+  if (!suffix) {
+    const legacy = globToRegExp(`PROP-${num}.md`);
+    const newFormat = globToRegExp(`PROP-${num}-*.md`);
+    matches = files.filter(f => legacy.test(f) || newFormat.test(f));
+  } else {
+    const pattern = globToRegExp(`PROP-${num}-*${suffix}*.md`);
+    matches = files.filter(f => pattern.test(f));
+  }
+
+  if (matches.length === 0) emit('NONE|no-match');
+  if (matches.length === 1) emit(`MATCH|${matches[0]}`);
+
+  const payload = matches.map(f => ({
+    file: f,
+    title: readFrontmatter(path.join(proposalsDir, f))?.title ?? null,
+  }));
+  emit(`AMBIGUOUS|${JSON.stringify(payload)}`);
+}
diff --git a/plugins/claude-code-hermit/scripts/eval-success-signal.ts b/plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
similarity index 90%
rename from plugins/claude-code-hermit/scripts/eval-success-signal.ts
rename to plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
index 03cd6158..db3d6d87 100644
--- a/plugins/claude-code-hermit/scripts/eval-success-signal.ts
+++ b/plugins/claude-code-hermit/scripts/lib/proposals/success-signal.ts
@@ -1,12 +1,13 @@
-#!/usr/bin/env bun
 // Evaluate or validate a success_signal predicate for a hermit proposal.
 //
-// Validate mode (grammar check only — no state reads):
-//   bun eval-success-signal.ts --validate "<predicate>"
-//   Exits 0 + prints "OK" if valid. Exits 1 + prints a reason if invalid.
+// Validate mode (grammar check only — no state reads, so no state dir):
+//   proposal.ts success-signal --validate "<predicate>"
+//   Exits 0 + prints "OK" if valid. Exits 1 + prints a reason if invalid — callers
+//   (proposal-create, proposal-act) branch on that exit code, so it must stay
+//   non-zero even though every other proposal.ts verb exits 0.
 //
 // Evaluate mode (check predicate against session reports):
-//   bun eval-success-signal.ts <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"
+//   proposal.ts success-signal <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"
 //   Prints one JSON line:
 //     {"verdict":"MET|UNMET|INSUFFICIENT_DATA","metric":"...","op":"...","threshold":N,"window":N,"observed":N,"sessions_counted":N}
 //   Never throws — any failure emits INSUFFICIENT_DATA.
@@ -16,7 +17,7 @@
 //   OP in {<, <=, >, >=}; NUMBER positive float; N positive integer.
 
 import path from 'node:path';
-import { readFrontmatter, globDir } from './lib/frontmatter';
+import { readFrontmatter, globDir } from '../frontmatter';
 
 type Json = any;
 
@@ -174,18 +175,17 @@ function runEvaluate(stateDir: string, acceptedDateStr: string, acceptedInSessio
 
 // ─── Entry point ──────────────────────────────────────────────────────────────
 
-function main() {
-  const args = process.argv.slice(2);
+export function run(args: string[]): void {
   if (args[0] === '--validate') {
     if (args.length < 2) {
-      process.stdout.write('usage: eval-success-signal.ts --validate "<predicate>"\n');
+      process.stdout.write('usage: proposal.ts success-signal --validate "<predicate>"\n');
       process.exit(1);
     }
     runValidate(args.slice(1).join(' '));
   } else {
     if (args.length < 4) {
       process.stdout.write(
-        'usage: eval-success-signal.ts <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"\n'
+        'usage: proposal.ts success-signal <stateDir> "<accepted_date>" "<accepted_in_session|null>" "<predicate>"\n'
       );
       // Fail open — emit INSUFFICIENT_DATA so reflect doesn't crash.
       emitInsufficient(null);
@@ -195,7 +195,3 @@ function main() {
     runEvaluate(stateDir, acceptedDate, acceptedInSession, rest.join(' '));
   }
 }
-
-if (import.meta.main) {
-  main();
-}
diff --git a/plugins/claude-code-hermit/scripts/proposal.ts b/plugins/claude-code-hermit/scripts/proposal.ts
index 2dd8fd86..025e2678 100644
--- a/plugins/claude-code-hermit/scripts/proposal.ts
+++ b/plugins/claude-code-hermit/scripts/proposal.ts
@@ -44,19 +44,41 @@
 //     Upserts by `id` into config.json's routines array. Output:
 //     `OK|added` / `OK|updated` or `ERROR|<reason>`.
 //
-// Exit 0 always; only a missing verb/state-dir argv exits 1 (creation should
-// never proceed on a mis-invocation, but a resolved, validated failure is
-// always a verdict line, not a crash).
+// The verbs below are the proposal-lifecycle *readers and satellites*, absorbed
+// from what used to be one top-level script each. They keep their own stdout
+// grammars and exit codes rather than being forced into `ok()`/`fail()` —
+// callers branch on those, and rewriting them would be a behavior change:
+//
+//   resolve-id <stateDir> <operator-input>       MATCH|… AMBIGUOUS|… NONE|…
+//   gate <stateDir> --gate … --caller …          PROCEED|… DROP|… GATE_FAILED
+//   queue-micro <stateDir>                       QUEUED|<MP-id> / DUPLICATE|<id>
+//   micro <stateDir> resolve|nudge|brief-cycle   RESOLVED|… NUDGED|… NONE|… / JSON
+//   index <stateDir>                             OK|<n> proposals / SKIP|…
+//   metrics [<stateDir>] [--source=<key>]        markdown table / one-line verdict
+//   success-signal --validate "<predicate>"      OK (exit 0) / reason (exit 1)
+//   success-signal <stateDir> <date> <sess> <p>  one JSON verdict line
+//
+// Exit 0 always, EXCEPT: a missing verb/state-dir argv exits 1 (creation should
+// never proceed on a mis-invocation, but a resolved, validated failure is always
+// a verdict line, not a crash), and `queue-micro` / `micro` / `success-signal
+// --validate` exit 1 on malformed input — a silent queue-drop or a silently
+// accepted bad predicate is the failure mode those three exist to remove.
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { readStdin, readJson } from './lib/cli';
+import { readStdin, readJson, flagValue } from './lib/cli';
 import { appendJsonlLine } from './lib/append-jsonl';
 import { writeFileAtomic, patchFrontmatter, appendToSection, appendShellLine, findSection, PATCH_KEY_RE } from './lib/md-write';
 import { computeBase, readTimezone, SUFFIX_LETTERS } from './lib/prop-id';
 import { zonedISOStamp, utcISOStamp } from './lib/time';
-import { rebuildIndex } from './proposals-index';
+import { rebuildIndex, run as runIndex } from './lib/proposals/index-rebuild';
 import { run as regenerateSummary } from './generate-summary';
+import { run as runResolveId } from './lib/proposals/resolve';
+import { run as runGate } from './lib/proposals/gate';
+import { run as runQueueMicro } from './lib/proposals/queue-micro';
+import { run as runMicro } from './lib/proposals/micro';
+import { run as runMetrics } from './lib/proposals/metrics';
+import { run as runSuccessSignal } from './lib/proposals/success-signal';
 
 type Json = any;
 
@@ -81,11 +103,6 @@ function regenTail(stateDir: string): void {
   try { regenerateSummary(path.join(stateDir, 'state')); } catch (e: any) { warn(`summary regen failed: ${e.message}`); }
 }
 
-function flagValue(argv: string[], flag: string): string | undefined {
-  const i = argv.indexOf(flag);
-  return i === -1 ? undefined : argv[i + 1];
-}
-
 // ---------------------------------------------------------------- create ---
 
 const VALID_CATEGORIES = new Set(['improvement', 'routine', 'capability', 'constraint', 'bug']);
@@ -395,12 +412,31 @@ async function verbRoutine(stateDir: string): Promise<void> {
 
 // ------------------------------------------------------------------- main --
 
+const VERBS = 'create|patch|shell-append|next-task|routine|resolve-id|gate|queue-micro|micro|index|metrics|success-signal';
+
 async function main(): Promise<void> {
   const verb = process.argv[2];
   const stateDir = process.argv[3];
 
+  // `metrics` defaults its state dir, and `success-signal --validate` is a pure
+  // grammar check that reads no state at all — for those two, argv[3] is not a
+  // state dir and the guard below must not demand one. Both take the whole tail
+  // (argv[3] onward) so their own arg parsing is unchanged from when they were
+  // standalone scripts.
+  const tail = process.argv.slice(3);
+  if (verb === 'metrics') return runMetrics(tail);
+  if (verb === 'success-signal') return runSuccessSignal(tail);
+  // `index` was fail-open before it was absorbed: a missing state dir answered
+  // `SKIP|no state dir` on stdout at exit 0, never a usage error. Preserve that —
+  // it is a derived-cache rebuild, and its callers treat a non-zero exit as a
+  // real failure rather than "nothing to do".
+  if (verb === 'index' && !stateDir) {
+    process.stdout.write('SKIP|no state dir\n');
+    process.exit(0);
+  }
+
   if (!verb || !stateDir) {
-    console.error('Usage: bun proposal.ts <create|patch|shell-append|next-task|routine> <hermit-state-dir> [args...]');
+    console.error(`Usage: bun proposal.ts <${VERBS}> <hermit-state-dir> [args...]`);
     process.exit(1);
   }
 
@@ -411,6 +447,11 @@ async function main(): Promise<void> {
     case 'shell-append': return verbShellAppend(stateDir, rest);
     case 'next-task': return verbNextTask(stateDir);
     case 'routine': return verbRoutine(stateDir);
+    case 'resolve-id': return runResolveId(stateDir, rest[0]);
+    case 'gate': return runGate(stateDir, rest);
+    case 'queue-micro': return runQueueMicro(stateDir);
+    case 'micro': return runMicro(stateDir, rest);
+    case 'index': return runIndex(stateDir);
     default:
       fail('unknown-verb');
   }
diff --git a/plugins/claude-code-hermit/scripts/resolve-prop.ts b/plugins/claude-code-hermit/scripts/resolve-prop.ts
deleted file mode 100644
index 1bcdfd96..00000000
--- a/plugins/claude-code-hermit/scripts/resolve-prop.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-// resolve-prop.ts — resolves an operator's PROP-id input to a proposal filename.
-// Usage: bun resolve-prop.ts <hermit-state-dir> <operator-input>
-// Output (stdout, one line):
-//   MATCH|<filename>
-//   AMBIGUOUS|<json array of {file, title}>
-//   NONE|not-a-prop-id
-//   NONE|no-match
-// Exit 0 always — resolution failures are reported via the verdict token, not exit code.
-// Implements proposal-act/SKILL.md § Resolving a Proposal ID. Glob matching is
-// case-insensitive: step 1 uppercases the whole input (including any slug suffix),
-// while real proposal filenames carry a lowercase slug — case-insensitive matching
-// is required for the suffix form to ever match a real file.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { readFrontmatter } from './lib/frontmatter';
-import { emit } from './lib/cli';
-
-const stateDir = process.argv[2];
-const rawInput = process.argv[3];
-
-if (!stateDir || rawInput === undefined) emit('NONE|not-a-prop-id');
-
-const input = rawInput.trim().toUpperCase();
-const m = input.match(/^PROP-(\d+)(?:-(.+))?$/);
-if (!m) emit('NONE|not-a-prop-id');
-
-const num = m![1].padStart(3, '0');
-const suffix = m![2];
-
-const proposalsDir = path.join(stateDir, 'proposals');
-let files: string[] = [];
-try {
-  files = fs.readdirSync(proposalsDir).filter(f => f.endsWith('.md')).sort();
-} catch {
-  emit('NONE|no-match');
-}
-
-// Anchored glob → regex. Never a bare `PROP-NNN*` — that collides with 4-digit NNN
-// filenames (e.g. `PROP-0061.md`) once proposal counts cross 1000.
-function globToRegExp(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
-  return new RegExp(`^${escaped}$`, 'i');
-}
-
-let matches: string[];
-if (!suffix) {
-  const legacy = globToRegExp(`PROP-${num}.md`);
-  const newFormat = globToRegExp(`PROP-${num}-*.md`);
-  matches = files.filter(f => legacy.test(f) || newFormat.test(f));
-} else {
-  const pattern = globToRegExp(`PROP-${num}-*${suffix}*.md`);
-  matches = files.filter(f => pattern.test(f));
-}
-
-if (matches.length === 0) emit('NONE|no-match');
-if (matches.length === 1) emit(`MATCH|${matches[0]}`);
-
-const payload = matches.map(f => ({
-  file: f,
-  title: readFrontmatter(path.join(proposalsDir, f))?.title ?? null,
-}));
-emit(`AMBIGUOUS|${JSON.stringify(payload)}`);
diff --git a/plugins/claude-code-hermit/skills/brief/SKILL.md b/plugins/claude-code-hermit/skills/brief/SKILL.md
index bf5afe34..c3ae9172 100644
--- a/plugins/claude-code-hermit/skills/brief/SKILL.md
+++ b/plugins/claude-code-hermit/skills/brief/SKILL.md
@@ -67,7 +67,7 @@ Emphasize forward-looking content. Compose from runner JSON (see Dispatch above)
 - If `config.always_on` is `true`: run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/check-upgrade.sh" "${CLAUDE_PLUGIN_ROOT}"` from the project root. If it emits an `---Upgrade Available---` section, append a final line to the brief: `⚠ Plugin update available: <the version line>` (pass the directive verbatim). Output nothing if the script is silent. (Interactive operators already see this notice at session-start step 2; the gate avoids double-notification.)
 
 <!-- keep in sync with plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md step 9a — same MP lifecycle protocol -->
-After composing the morning brief, age the micro-proposal queue in one pass: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit brief-cycle`. It reads `state/micro-proposals.json`, runs the whole lifecycle atomically (re-nudges `follow_up_count` 1 entries, expires `follow_up_count` ≥2 entries and records each expiry), and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}` — never hand-edit the file or read it separately. Render straight from that verdict:
+After composing the morning brief, age the micro-proposal queue in one pass: run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit brief-cycle`. It reads `state/micro-proposals.json`, runs the whole lifecycle atomically (re-nudges `follow_up_count` 1 entries, expires `follow_up_count` ≥2 entries and records each expiry), and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}` — never hand-edit the file or read it separately. Render straight from that verdict:
 - Each `new` entry (first display): append as a final line. Without `options`: `MP-YYYYMMDD-N (tier N): [question]` — Reply `"MP-YYYYMMDD-N yes"` or `"MP-YYYYMMDD-N no"`. (Bare `yes`/`no` accepted when only one pending.) With `options`: render them numbered under the question and reply hint `Reply "MP-YYYYMMDD-N <number or label>"` (bare accepted when only one pending).
 - Each `renudged` entry: append with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] — ignore again to drop it" (if it carries `options`, re-render them numbered beneath it so the choices aren't lost on the re-nudge).
 - `expired` entries were dropped this cycle — do not surface them, and do not resurrect unless fresh evidence accumulates from scratch.
diff --git a/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md b/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
index e663be10..6df5c0f6 100644
--- a/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
+++ b/plugins/claude-code-hermit/skills/capability-brainstorm/SKILL.md
@@ -10,7 +10,7 @@ description: On-demand hermit-voice brainstorm — synthesizes memory, capabilit
 After ≥8 invocations, run:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal-metrics-report.ts .claude-code-hermit --source=capability-brainstorm
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts metrics .claude-code-hermit --source=capability-brainstorm
 ```
 
 Triage-survival < 25% or acceptance < 30% → cut this skill rather than tune it — the signal-to-noise ratio isn't there. `INSUFFICIENT` output means the ≥8-verdict sample hasn't been reached yet; wait and re-check.
diff --git a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
index 18ea98b9..d6297d5d 100644
--- a/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
+++ b/plugins/claude-code-hermit/skills/channel-responder/SKILL.md
@@ -135,27 +135,27 @@ Before running any heavy sub-step — an archive traversal, a multi-file search,
   - **Parsing the answer against the target entry:**
     - Entry has no `options` (plain yes/no entry): the answer must be `yes` or `no` (case-insensitive). Anything else on this entry → ambiguous, ask for clarification once, do not resolve.
     - Entry has `options` (2-4 labels): a bare number `k` within range (1 through the option count) selects `options[k-1]`; a number outside that range is ambiguous. Otherwise, case-insensitive prefix match the answer against the labels; a unique match resolves, no match or a multi-label prefix match is ambiguous. A bare `yes`/`no` against an options entry is ambiguous — reply with the numbered options and ask once, do not resolve.
-  - **Suggestion escape hatch:** when a bare `yes`/`no`/`later` can't be cleanly resolved here (ambiguous against an options entry, or multiple pending entries), run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit` (validates the index against disk — one bounded output line) and check the refreshed `state/proposals-index.json`. If it has a `status: "proposed"` proposal, append to the clarification reply: "…or reply 'YES #N' to act on an open suggestion instead." Precedence is unchanged — this only hands a bare reply meant for a Suggestion card a way out of the micro-proposal loop.
+  - **Suggestion escape hatch:** when a bare `yes`/`no`/`later` can't be cleanly resolved here (ambiguous against an options entry, or multiple pending entries), run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit` (validates the index against disk — one bounded output line) and check the refreshed `state/proposals-index.json`. If it has a `status: "proposed"` proposal, append to the clarification reply: "…or reply 'YES #N' to act on an open suggestion instead." Precedence is unchanged — this only hands a bare reply meant for a Suggestion card a way out of the micro-proposal loop.
   - **On resolved entry:** every branch below resolves the entry via one script call — never hand-edit `state/micro-proposals.json` (issue 649: a stray trailing comma from a hand-edit removal corrupted the file and every reader silently treated it as an empty queue).
     - **Entry has `on_resolve`** → **resolve on disk FIRST, then invoke.** Run:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action answered --answer "<selected label>"
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action answered --answer "<selected label>"
       ```
       This removes the entry from `pending`, writes the file, and appends the `micro-resolved` event (`"action":"answered"`) in one atomic call — *before* invoking the command. The `on_resolve` command can run a long implementation (e.g. `proposal-act … --answer "implement now"` runs the falsification gate + full implementation); if the durable-queue removal were left until after that, a crash or compaction mid-implementation would leave the entry pending and heartbeat would keep re-nudging a question already acted on. Then substitute the selected label into the `on_resolve` `{answer}` placeholder — **wrap it in double quotes** so a multi-word label (e.g. `session task`) stays a single `--answer` argument — and invoke the resulting skill command. This is how a channel-bridged ask (e.g. a 3-option proposal-act entry) re-enters the asking skill at the right branch — the invoked command itself detects it's a re-entry and skips straight to acting on the answer. The `answered` event is audit-only (neither an approval nor a rejection, so it's outside the micro approval-rate metrics). See § Channel-safe ask bridge below.
     - **No `on_resolve`, "yes" on tier 1** → execute the change at next idle, log outcome in SHELL.md, then:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action approved
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action approved
       ```
     - **No `on_resolve`, "yes" on tier 2** → create PROP-NNN via `/claude-code-hermit:proposal-create`, queue for next idle, then run the same `resolve <id> --action approved` call.
     - **No `on_resolve`, "no"** → run:
       ```bash
-      bun ${CLAUDE_PLUGIN_ROOT}/scripts/micro-proposal.ts .claude-code-hermit resolve <id> --action rejected
+      bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts micro .claude-code-hermit resolve <id> --action rejected
       ```
   - If no pending micro-proposals: classify as normal message (fall through to categories below).
 
 - **Proposal approval** ("accept PROP-", "go ahead with PROP-", "approve PROP-", referencing proposal numbers, `#N`, or a bare/`#N`-qualified `YES`/`LATER`/`NO` reply to a Suggestion card — only when no pending micro-proposal claimed the reply first, per Micro-approval response above)
   - **Map the reply to an action** (case-insensitive): `YES` / "go ahead" / "accept" → `accept`; `LATER` / "hold" / "defer" → `defer`; `NO` / "drop" / "dismiss" → `dismiss`. `accept PROP-`/`approve PROP-` phrasing maps to `accept` directly; the operator can also spell the action out instead of YES/LATER/NO.
-  - **Resolve the target proposal:** first run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit` to validate the index against disk (one bounded output line — catches out-of-band file renames/moves that never went through Write/Edit). Then, for an explicit `#N` or `PROP-NNN` reference — confirm it matches a proposal in the refreshed `state/proposals-index.json`; if it doesn't, reply in plain voice ("I don't see a Suggestion #N — reply with one of the open numbers") rather than routing to `proposal-act` (whose no-match error is terminal-voice and names a slash command). On a match, route through `/claude-code-hermit:proposal-act <action> PROP-N` (`proposal-act` zero-pads the integer itself). A bare `YES`/`LATER`/`NO` with no `#N`: read the refreshed `state/proposals-index.json`, filter to `status: "proposed"`. Exactly one → apply to it. Zero or 2+ → reply listing the open Suggestion numbers and ask the operator to specify (e.g. "Reply 'YES #14'").
+  - **Resolve the target proposal:** first run `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit` to validate the index against disk (one bounded output line — catches out-of-band file renames/moves that never went through Write/Edit). Then, for an explicit `#N` or `PROP-NNN` reference — confirm it matches a proposal in the refreshed `state/proposals-index.json`; if it doesn't, reply in plain voice ("I don't see a Suggestion #N — reply with one of the open numbers") rather than routing to `proposal-act` (whose no-match error is terminal-voice and names a slash command). On a match, route through `/claude-code-hermit:proposal-act <action> PROP-N` (`proposal-act` zero-pads the integer itself). A bare `YES`/`LATER`/`NO` with no `#N`: read the refreshed `state/proposals-index.json`, filter to `status: "proposed"`. Exactly one → apply to it. Zero or 2+ → reply listing the open Suggestion numbers and ask the operator to specify (e.g. "Reply 'YES #14'").
   - Never surface internal proposal fields back to the channel (the exact list and `#N` derivation are canonical in `proposal-list` §4a) — confirm using the Suggestion number (see `proposal-act`'s channel-tagged notify).
 
 - **New instruction** ("work on X", "switch to Y", "prioritize Z")
@@ -265,7 +265,7 @@ Canonical protocol for proactively notifying the operator (referenced from `CLAU
 Canonical dual-delivery rule for any skill that hits a decision point on a channel-tagged turn (inbound prompt contains a `<channel source="...">` tag) — referenced from `proposal-act` and `hermit-settings` (and any future skill that needs to ask a bounded question over a channel).
 
 - **(a) Conversational side**: send the question via the channel reply tool, same as any other response — the operator is usually right there.
-- **(b) Durable side, bounded asks only**: a bounded ask (2-4 discrete options, including plain yes/no) ALSO gets queued as a pending entry via `queue-micro-proposal.ts` (see reflect's § Micro-approval queuing) — `options` set to the labels (omit for plain yes/no), `tier: 1`, and `on_resolve` set to the skill invocation that should run once an answer is picked, with `{answer}` as the placeholder for the selected label. Free-form asks (no bounded set of answers) are reply-tool only — no entry is queued for those.
+- **(b) Durable side, bounded asks only**: a bounded ask (2-4 discrete options, including plain yes/no) ALSO gets queued as a pending entry via `proposal.ts queue-micro` (see reflect's § Micro-approval queuing) — `options` set to the labels (omit for plain yes/no), `tier: 1`, and `on_resolve` set to the skill invocation that should run once an answer is picked, with `{answer}` as the placeholder for the selected label. Free-form asks (no bounded set of answers) are reply-tool only — no entry is queued for those.
 - **Whichever surface answers first resolves it.** If the operator answers in the same live turn (interactive-style, still within the asking skill's own flow), the asking skill acts on it directly AND resolves the MP entry itself — remove it from `pending`, write the file, and append the same `micro-resolved` `"action":"answered"` event as § Micro-approval response above — so the entry doesn't dangle waiting for a reply that already happened. If the operator answers later (new turn, possibly a new session), the § Micro-approval response resolver above handles it via `on_resolve`.
 - **Never call `AskUserQuestion` on a channel-tagged turn.** It renders in the terminal/transcript, which is invisible to a remote operator — exactly the strand this bridge exists to prevent.
 
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index 742d31e8..a86c01da 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -552,8 +552,8 @@ entries the target lacks, and any entries from retired plugin versions it still
 **What the permissions buy:**
 
 - `git diff`, `git status`, `git log` — session-diff.ts hook auto-populates `## Changed` in SHELL.md
-- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts` — the proposal-act/proposal-create/reflect mechanics wrappers; without these, ID resolution, gate-verdict routing, and micro-approval queuing (including HA's `ha-morning-brief`, which reaches `micro-proposal.ts` via `.claude-code-hermit/bin/hermit-run`) would all be functionally denied headlessly. Includes `proposal.ts` — the single CLI (create/patch/shell-append/next-task/routine verbs) that proposal-create/proposal-act use for every `.claude-code-hermit/` state-dir write; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
-- `.claude-code-hermit/bin/hermit-run micro-proposal *` / `proposal-metrics-report *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. The space before `*` is a word boundary — matches `micro-proposal brief-cycle`, not a `micro-proposal…`-prefixed name — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
+- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `proposal.ts` — the single proposal CLI. Its create/patch/shell-append/next-task/routine verbs perform every `.claude-code-hermit/` state-dir write proposal-create and proposal-act make; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Its resolve-id/gate/queue-micro/micro/index/metrics/success-signal verbs are the proposal-act/proposal-create/reflect mechanics; without them, ID resolution, gate-verdict routing, and micro-approval queuing would all be functionally denied headlessly. Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `.claude-code-hermit/bin/hermit-run proposal micro *` / `proposal metrics *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. Each grant is pinned to the one verb that plugin needs, never a bare `hermit-run proposal *` — that would also expose `create`, `patch`, `shell-append`, `next-task` and `routine`, i.e. arbitrary state-dir writes. The space before `*` is a word boundary — matches `proposal micro .claude-code-hermit brief-cycle`, not a `micro…`-prefixed verb — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
 - `bash -c 'AGENT_DIR=...` — SessionStart hook that loads session context on every startup
 - `Edit` on `.claude-code-hermit/**` — heartbeat appends to SHELL.md, increments config.json tick counter, and skills update session state without prompting (Edit rules cover all file-editing tools, including Write)
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
index 7e72b003..c72ddc2c 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
@@ -12,7 +12,7 @@ If this skill was invoked from a channel-arrived message (the inbound prompt con
 
 ## Step 1 — Dispatch the eval runner
 
-Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal-metrics-report.ts` and `cost-reflect.ts` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
+Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal.ts metrics` and `cost-reflect.ts` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
 
 Pass `plugin_root: ${CLAUDE_PLUGIN_ROOT}` in the dispatch prompt — the runner reads `reference.md` as file content, where `${CLAUDE_PLUGIN_ROOT}` is never substituted, so it needs the resolved absolute path to run the scripts and read template/skill paths.
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
index 6a9c706c..c5a9067e 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
@@ -20,7 +20,7 @@ Steps are independent — read files and run scripts concurrently where possible
    week if the review file for it doesn't exist yet.
 3. `.claude-code-hermit/state/proposal-metrics.jsonl` — scan from the end (most recent first); stop
    at entries older than 30 days. Use `resolved_at` and `created_at` to compute resolution days.
-4. Run `bun <plugin_root>/scripts/proposal-metrics-report.ts .claude-code-hermit` and
+4. Run `bun <plugin_root>/scripts/proposal.ts metrics .claude-code-hermit` and
    capture stdout. Skip gracefully if unavailable. (Steps 4 and 5 may run concurrently.)
 5. Run `bun <plugin_root>/scripts/cost-reflect.ts .claude-code-hermit 30` and capture
    stdout. This produces a 30-day cost breakdown including a `### Cost by source` section. Skip
diff --git a/plugins/claude-code-hermit/skills/proposal-act/SKILL.md b/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
index e76d2f28..ce516512 100644
--- a/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-act/SKILL.md
@@ -8,7 +8,7 @@ Take action on a proposal: accept, defer, dismiss, or resolve.
 
 ## Step 0 — Channel reply
 
-If this skill was invoked from a channel-arrived message (the inbound prompt contains a `<channel source="...">` tag), reply via that channel's reply tool. Otherwise emit to conversation. On a channel-tagged turn, step 4's bounded ask (below) also queues a durable micro-proposal entry via `queue-micro-proposal.ts` — see `channel-responder` § Channel-safe ask bridge — so it survives compaction or a session restart.
+If this skill was invoked from a channel-arrived message (the inbound prompt contains a `<channel source="...">` tag), reply via that channel's reply tool. Otherwise emit to conversation. On a channel-tagged turn, step 4's bounded ask (below) also queues a durable micro-proposal entry via `proposal.ts queue-micro` — see `channel-responder` § Channel-safe ask bridge — so it survives compaction or a session restart.
 
 ## Usage
 
@@ -28,7 +28,7 @@ If no action or ID is provided, ask the operator which proposal and action.
 
 Before reading any proposal file, resolve the operator's input to a filename:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/resolve-prop.ts .claude-code-hermit "<operator input>"
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts resolve-id .claude-code-hermit "<operator input>"
 ```
 - `MATCH|<filename>` — proceed with that file.
 - `NONE|not-a-prop-id` — error "Not a PROP id."
@@ -65,7 +65,7 @@ When the operator accepts a proposal:
    - `accepted_in_session`: if `session_id` is non-null, plan `--set accepted_in_session=<session_id>`. If no session is active (`session_id` is null), leave it unset (frontmatter default `null` stays).
    - `success_signal` (optional): check whether the body has a `## Success Signal` section with a non-empty predicate line (ignore comment lines starting with `<!--`). If found, validate it:
      ```
-     bun ${CLAUDE_PLUGIN_ROOT}/scripts/eval-success-signal.ts --validate "<predicate line>"
+     bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts success-signal --validate "<predicate line>"
      ```
      Exit 0 → plan a stdin `Set: success_signal=<predicate line>` line for the patch call (free text — never argv `--set`). Exit non-zero → plan a `proposal.ts shell-append` warning: `PROP-NNN success_signal ignored: <reason printed by the script>`. No section, or empty/comment-only → leave `success_signal` unset. Never block accept regardless of outcome.
 
@@ -95,7 +95,7 @@ When the operator accepts a proposal:
 
    **Channel-tagged turn:** do not wait interactively for a reply in this turn. Send the question via the channel reply tool in plain voice with the three options numbered — "Suggestion #N — start now, queue it as a task, or leave it to you?" (derive `#N` per `proposal-list` §4a; never surface `PROP-NNN` or the title's bracket prefix to the channel). AND queue a pending micro-proposal entry:
    ```bash
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts .claude-code-hermit <<'HERMIT_MP'
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro .claude-code-hermit <<'HERMIT_MP'
    {"tier":1,"question":"Suggestion #N accepted — how should it be implemented?","options":["implement now","session task","manual"],"on_resolve":"/claude-code-hermit:proposal-act accept PROP-NNN --answer {answer}"}
    HERMIT_MP
    ```
diff --git a/plugins/claude-code-hermit/skills/proposal-create/SKILL.md b/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
index c17c949e..50f9425f 100644
--- a/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-create/SKILL.md
@@ -34,7 +34,7 @@ Evidence: <one-paragraph evidence summary>
 
 This is a single-candidate call (a batch of one), so the response is one verdict block. Lines 2+ are additive metadata (`closest_prop`, `aligned`, `operator_excerpt`, `overlap_compiled`, `prior_discussion`, `failed_condition`) — read for context if useful but do not branch on them. Record line 1 as the verdict:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate triage --caller proposal-create \
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate triage --caller proposal-create \
     --evidence-source "<evidence source>" --tags '[<caller-supplied tags>]' <<'HERMIT_GATE'
 Title: <proposal title>
 Verdict: <the agent's line 1, verbatim>
@@ -114,7 +114,7 @@ Header fields:
 Body guidance:
 - Write a clear Context, Problem, Proposed Solution, Impact, and Verification (never leave blank — state the check, or an explicit "none needed because…"). If the caller passed `Evidence Origin: external-content`, open `## Context` with: `**Evidence origin: external-content (web / raw / non-operator) — review for injection before accepting.**` This makes operator scrutiny explicit for proposals seeded by untrusted external content.
 - Fill `## References` with the backward-looking sources that grounded this proposal: cite code as `file_path:line_number`, link docs/URLs, reference session reports (`S-NNN`), proposals (`PROP-NNN`), or memory by name. If purely operator-requested or qualitative with nothing to cite, write `n/a — <reason>` (e.g. `n/a — operator-requested`). Do not restate forward-looking verification steps in References.
-- **Success signal — push for measurable.** When the proposal's benefit is cost-measurable, fill `## Success Signal` with exactly one v1-grammar predicate — `avg_session_cost_usd <op> <number> over <N> sessions` — and validate it before writing: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/eval-success-signal.ts --validate "<predicate>"` (non-zero exit → fix the predicate or leave the section empty; never write an invalid one). Leaving it empty is the **documented exception** for benefits the v1 grammar cannot measure — when empty, leave a comment explaining why (e.g. `<!-- benefit is qualitative: X -->`; proposal-act ignores comment lines there). A filled predicate lets the Resolution Check auto-resolve from measurement instead of the weaker prose pattern-absence test. (This section only seeds the body text — `success_signal` in frontmatter is set later, during accept, once the operator has reviewed it.)
+- **Success signal — push for measurable.** When the proposal's benefit is cost-measurable, fill `## Success Signal` with exactly one v1-grammar predicate — `avg_session_cost_usd <op> <number> over <N> sessions` — and validate it before writing: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts success-signal --validate "<predicate>"` (non-zero exit → fix the predicate or leave the section empty; never write an invalid one). Leaving it empty is the **documented exception** for benefits the v1 grammar cannot measure — when empty, leave a comment explaining why (e.g. `<!-- benefit is qualitative: X -->`; proposal-act ignores comment lines there). A filled predicate lets the Resolution Check auto-resolve from measurement instead of the weaker prose pattern-absence test. (This section only seeds the body text — `success_signal` in frontmatter is set later, during accept, once the operator has reviewed it.)
 - Leave `## Operator Decision` blank — the operator fills that in.
 - Do NOT write bullet-point metadata (`- **Created:**`, etc.) — all metadata lives in the header lines / frontmatter only.
 
diff --git a/plugins/claude-code-hermit/skills/proposal-list/SKILL.md b/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
index 36b24455..c79cd7a6 100644
--- a/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
+++ b/plugins/claude-code-hermit/skills/proposal-list/SKILL.md
@@ -18,7 +18,7 @@ Read `.claude-code-hermit/state/proposals-index.json` — a derived cache of eve
 
 Rebuild the index first, then read it:
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposals-index.ts .claude-code-hermit
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts index .claude-code-hermit
 ```
 The rebuild reads frontmatter off disk — idempotent, no LLM/token cost — so run it unconditionally rather than trusting an mtime heuristic: it also catches out-of-band proposal writes and **deletions** that the `generate-summary` hook (which fires only on `Edit`/`Write` tool payloads) never sees. The script prints `SKIP|no proposals dir` when there are no proposals — in that case respond "No proposals found." and stop. If the index's `count` is 0, also respond "No proposals found." and stop.
 
diff --git a/plugins/claude-code-hermit/skills/reflect/branches.md b/plugins/claude-code-hermit/skills/reflect/branches.md
index e100c270..cdbce227 100644
--- a/plugins/claude-code-hermit/skills/reflect/branches.md
+++ b/plugins/claude-code-hermit/skills/reflect/branches.md
@@ -20,7 +20,7 @@ Invoked from SKILL.md § Scheduled-checks mode. Run at most one due check, then
      Evidence: <one-paragraph summary>
      Sessions: none
      ```
-     Pass it to § Candidate processing → Evidence Validation (`claude-code-hermit:reflection-judge`). On a `PROCEED` token, gate with the Proposal triage gate (`claude-code-hermit:proposal-triage`, a batch of one here — single candidate; pass `--caller scheduled-checks` to `record-gate.ts`). On triage `PROCEED|CREATE`: Tier 1/2 → Micro-approval queuing; Tier 3 → `/claude-code-hermit:proposal-create`. A `DROP|...` token from either gate → drop silently (note in the Progress Log). `GATE_FAILED` from either gate → fail closed per § Gate failure handling; the candidate re-surfaces on the next scheduled-checks run.
+     Pass it to § Candidate processing → Evidence Validation (`claude-code-hermit:reflection-judge`). On a `PROCEED` token, gate with the Proposal triage gate (`claude-code-hermit:proposal-triage`, a batch of one here — single candidate; pass `--caller scheduled-checks` to the `gate` verb). On triage `PROCEED|CREATE`: Tier 1/2 → Micro-approval queuing; Tier 3 → `/claude-code-hermit:proposal-create`. A `DROP|...` token from either gate → drop silently (note in the Progress Log). `GATE_FAILED` from either gate → fail closed per § Gate failure handling; the candidate re-surfaces on the next scheduled-checks run.
    - **`empty`:** no candidate. `consecutive_empty += 1` (persisted in step 7). Check the interval-adjustment rule below.
    - **`unavailable`:** note in SHELL.md `## Findings`: `Scheduled check skipped: <id> — skill unavailable (cooldown 4h)`. No candidate.
    - **`error`:** note in SHELL.md `## Findings`: `Scheduled check error: <id> — retrying after interval_days`. No candidate.
@@ -114,7 +114,7 @@ Artifact: <machine-written state file> — <cited value/pattern>   (optional)
 
 The judge returns one verdict line per candidate, matched by `<title>`. For each candidate, record its line:
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate judge --caller reflect <<'HERMIT_GATE'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate judge --caller reflect <<'HERMIT_GATE'
 Title: <title>
 Verdict: <the judge's line for this candidate, verbatim>
 HERMIT_GATE
@@ -126,7 +126,7 @@ HERMIT_GATE
 
 ### Gate failure handling
 
-`record-gate.ts` fails closed by construction: an unrecognized, malformed, or empty verdict line always returns `GATE_FAILED` and appends the `gate-failed` metric itself (agent tagged via `--gate triage|judge`) — no separate append needed at the call site. On `GATE_FAILED`: do not create or queue the candidate. Note `gate-failed: <agent> — <title>` in the SHELL.md Progress Log. The candidate re-surfaces on the next reflect cycle.
+The `gate` verb fails closed by construction: an unrecognized, malformed, or empty verdict line always returns `GATE_FAILED` and appends the `gate-failed` metric itself (agent tagged via `--gate triage|judge`) — no separate append needed at the call site. On `GATE_FAILED`: do not create or queue the candidate. Note `gate-failed: <agent> — <title>` in the SHELL.md Progress Log. The candidate re-surfaces on the next reflect cycle.
 
 ### Component Health signal ladder
 
@@ -155,7 +155,7 @@ Evidence: <one-paragraph evidence summary>
 
 The gate returns one verdict block per candidate, matched by `<title>`. Line 1 of each block is that candidate's verdict; lines 2+ are additive metadata (`closest_prop`, `aligned`, `operator_excerpt`, `overlap_compiled`, `prior_discussion`, `failed_condition`) — read for context if useful, but do not treat as part of the verdict for branching. For each candidate, record its verdict line (use `"caller":"reflect"` on a normal reflect run, or `"caller":"scheduled-checks"` when invoked via § Scheduled checks):
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/record-gate.ts .claude-code-hermit --gate triage --caller reflect <<'HERMIT_GATE'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts gate .claude-code-hermit --gate triage --caller reflect <<'HERMIT_GATE'
 Title: <title>
 Verdict: <that candidate's line 1, verbatim>
 HERMIT_GATE
@@ -195,7 +195,7 @@ Every micro-proposal question must include: **[observed pattern + duration] + [c
 Queuing procedure:
 
 ```bash
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/queue-micro-proposal.ts .claude-code-hermit <<'HERMIT_MP'
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts queue-micro .claude-code-hermit <<'HERMIT_MP'
 {"tier":<1|2>,"question":"<full question text>","options":["<label>", ...],"on_resolve":"<full skill invocation with an {answer} placeholder>"}
 HERMIT_MP
 ```
@@ -215,7 +215,7 @@ Component Health improves existing components. This subsection is the symmetric
 After ≥8 procedure-capture candidates surfaced, run:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal-metrics-report.ts .claude-code-hermit --source=procedure-capture
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/proposal.ts metrics .claude-code-hermit --source=procedure-capture
 ```
 
 Triage-survival < 25% or acceptance < 30% → disable procedure capture rather than tune it. `INSUFFICIENT` output means the ≥8-verdict sample hasn't been reached yet; do not read thresholds until it does.
diff --git a/plugins/claude-code-hermit/skills/reflect/reference.md b/plugins/claude-code-hermit/skills/reflect/reference.md
index 19735a7b..b42a9c40 100644
--- a/plugins/claude-code-hermit/skills/reflect/reference.md
+++ b/plugins/claude-code-hermit/skills/reflect/reference.md
@@ -38,7 +38,7 @@ Run this step only if `resolution_check` is listed in `phases_json`.
 
    **If `success_signal` is non-null** — run the predicate:
    ```
-   bun <plugin_root>/scripts/eval-success-signal.ts .claude-code-hermit "<accepted_date>" "<accepted_in_session|null>" "<success_signal>"
+   bun <plugin_root>/scripts/proposal.ts success-signal .claude-code-hermit "<accepted_date>" "<accepted_in_session|null>" "<success_signal>"
    ```
    Parse the one JSON line on stdout. Branch on `verdict`:
    - `INSUFFICIENT_DATA` → skip; add nothing to `resolution_actions` for this proposal.
diff --git a/plugins/claude-code-hermit/tests/contracts.test.ts b/plugins/claude-code-hermit/tests/contracts.test.ts
index 02d2ca73..cefe1087 100644
--- a/plugins/claude-code-hermit/tests/contracts.test.ts
+++ b/plugins/claude-code-hermit/tests/contracts.test.ts
@@ -951,7 +951,7 @@ describe('kill metrics contract', () => {
   const proposalTemplate = read(path.join(TEMPLATES, 'PROPOSAL.md.template'));
   const proposalCreate = read(path.join(SKILLS, 'proposal-create', 'SKILL.md'));
   const capabilityBrainstorm = read(path.join(SKILLS, 'capability-brainstorm', 'SKILL.md'));
-  const reportScriptPath = path.join(SCRIPTS, 'proposal-metrics-report.ts');
+  const reportScriptPath = path.join(SCRIPTS, 'lib', 'proposals', 'metrics.ts');
   const reportScript = fs.existsSync(reportScriptPath) ? read(reportScriptPath) : '';
 
   test('PROPOSAL.md.template must declare a tags field so proposal-create can write it', () => {
@@ -971,7 +971,7 @@ describe('kill metrics contract', () => {
 
   test('proposal-create triage-verdict event must include evidence_source', () => {
     // missing → triage-survival rate cannot be segmented by brainstorm origin.
-    // record-gate.ts (tests/scripts.test.ts describe('record-gate')) guards that the
+    // the gate verb (tests/scripts.test.ts describe('proposal gate')) guards that the
     // flag actually lands in the appended event; this guards the call site passes it.
     expect(proposalCreate).toContain('--evidence-source "<evidence source>"');
   });
@@ -990,14 +990,14 @@ describe('kill metrics contract', () => {
     expect(proposalScript).toMatch(/type:\s*'created'[\s\S]{0,80}\btags\b/);
   });
 
-  test('capability-brainstorm kill criteria must invoke proposal-metrics-report.ts', () => {
+  test('capability-brainstorm kill criteria must invoke the metrics verb', () => {
     const parts = capabilityBrainstorm.split('## Kill criteria');
     expect(parts.length).toBeGreaterThan(1); // Kill criteria section missing
     const killSection = parts[1].split('## ')[0];
-    expect(killSection).toContain('proposal-metrics-report.ts');
+    expect(killSection).toContain('proposal.ts metrics');
   });
 
-  test('proposal-metrics-report.ts segment registry must discriminate capability-brainstorm', () => {
+  test('proposal.ts metrics segment registry must discriminate capability-brainstorm', () => {
     // The contract between the emitter (proposal-create) and the consumer
     // (brainstorm kill criteria) holds via evidence_source (triage) and tags (acceptance).
     expect(fs.existsSync(reportScriptPath)).toBe(true);
@@ -1032,8 +1032,8 @@ describe('procedure capture contract', () => {
     return killParts[1].split('**Detection')[0];
   }
 
-  test('reflect procedure-capture kill criteria must invoke proposal-metrics-report.ts', () => {
-    expect(procedureCaptureKillSection()).toContain('proposal-metrics-report.ts');
+  test('reflect procedure-capture kill criteria must invoke the metrics verb', () => {
+    expect(procedureCaptureKillSection()).toContain('proposal.ts metrics');
   });
 
   test('reflect kill criteria must document the 25%/30% kill thresholds', () => {
@@ -2626,9 +2626,9 @@ describe('proposal-triage batch contract', () => {
   });
 
   test('reflect/branches.md parses the title-tagged triage verdict grammar', () => {
-    // Routed via record-gate.ts's PROCEED/DROP tokens rather than the raw agent
+    // Routed via the gate verb's PROCEED/DROP tokens rather than the raw agent
     // grammar directly — the raw `CREATE: <title>` line still flows into the
-    // script's stdin (see the record-gate.ts invocation just above these lines).
+    // script's stdin (see the gate-verb invocation just above these lines).
     expect(branches).toContain('PROCEED|CREATE');
     expect(branches).toContain('DROP|DUPLICATE:<PROP-ID>');
     expect(branches).toContain('DROP|SUPPRESS:<code>');
@@ -2843,9 +2843,15 @@ describe('hermit-evolve permission delegation contract', () => {
   test('Step 8 no longer hand-enumerates the per-script allow-list', () => {
     // The removed prose opened with this phrase before listing scripts by name.
     expect(evolveRef).not.toContain('The required entries are:');
-    // A couple of the previously-enumerated script names must not reappear as an
-    // inline permission list (they may still appear elsewhere in the file).
-    expect(step8).not.toContain('`queue-micro-proposal.ts`, `micro-proposal.ts`');
+    // Structural, not name-based: an enumeration is *many* `Bash(bun */scripts/…)`
+    // patterns written out in Step 8. Exactly one is expected and allowed — the
+    // bootstrap caveat naming apply-settings.ts's own grant, for a hermit whose
+    // allow-list predates the script that would add it. Naming two example scripts
+    // here (the previous form) went stale the moment those scripts were absorbed
+    // into proposal.ts verbs: the assertion still passed, but against nothing.
+    const inlineGrants = step8.match(/Bash\(bun \*\/scripts\//g) ?? [];
+    expect(inlineGrants.length).toBe(1);
+    expect(step8).toContain('Bash(bun */scripts/apply-settings.ts*)');
   });
 
   test('Step 8 no longer hand-maintains the stale-entry removal list', () => {
diff --git a/plugins/claude-code-hermit/tests/eval-success-signal.test.ts b/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
index 841f0b90..2918d3a2 100644
--- a/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
+++ b/plugins/claude-code-hermit/tests/eval-success-signal.test.ts
@@ -1,4 +1,4 @@
-// Unit tests for scripts/eval-success-signal.ts (bun test port of test-eval-success-signal.sh).
+// Unit tests for proposal.ts's success-signal verb (bun test port of test-eval-success-signal.sh).
 // Validate mode (grammar) and evaluate mode (MET / UNMET / INSUFFICIENT_DATA).
 //
 // The script is a CLI contract (argv in, process.exit + one-line JSON on stdout,
@@ -17,7 +17,7 @@ import { runScript } from './helpers/run';
 // ---------- helpers ----------
 
 const validate = (predicate: string) =>
-  runScript('eval-success-signal.ts', { args: ['--validate', predicate] });
+  runScript('proposal.ts', { args: ['success-signal', '--validate', predicate] });
 
 /** Run a test body with a throwaway .claude-code-hermit state dir (sessions/ pre-made). */
 function withStateDir(fn: (sdir: string) => Promise<void> | void, subdir = 'sessions') {
@@ -56,8 +56,8 @@ Test.
 
 /** Evaluate-mode run; asserts exit 0 and returns the parsed JSON verdict line. */
 async function evaluate(sdir: string, acceptedDate: string, acceptedInSession: string, predicate: string) {
-  const r = await runScript('eval-success-signal.ts', {
-    args: [sdir, acceptedDate, acceptedInSession, predicate],
+  const r = await runScript('proposal.ts', {
+    args: ['success-signal', sdir, acceptedDate, acceptedInSession, predicate],
   });
   expect(r.exitCode).toBe(0);
   return JSON.parse(r.stdout);
diff --git a/plugins/claude-code-hermit/tests/hermit-run.test.ts b/plugins/claude-code-hermit/tests/hermit-run.test.ts
index 3c9a53ae..f5e0614e 100644
--- a/plugins/claude-code-hermit/tests/hermit-run.test.ts
+++ b/plugins/claude-code-hermit/tests/hermit-run.test.ts
@@ -128,10 +128,10 @@ describe('hermit-exec.sh name guard', () => {
   });
 
   test('a real script name dispatches to bun', async () => {
-    // micro-proposal.ts with no args prints its own usage and exits 1 — proof the
-    // name resolved to scripts/micro-proposal.ts and bun ran it.
-    const r = await bash(HERMIT_EXEC, ['micro-proposal'], {});
+    // proposal.ts with no verb prints its own usage and exits 1 — proof the
+    // name resolved to scripts/proposal.ts and bun ran it.
+    const r = await bash(HERMIT_EXEC, ['proposal'], {});
     expect(r.exitCode).toBe(1);
-    expect(r.stdout + r.stderr).toContain('micro-proposal.ts');
+    expect(r.stdout + r.stderr).toContain('proposal.ts');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/procedure-capture.test.ts b/plugins/claude-code-hermit/tests/procedure-capture.test.ts
index 7de0d77e..ab4a2e0f 100644
--- a/plugins/claude-code-hermit/tests/procedure-capture.test.ts
+++ b/plugins/claude-code-hermit/tests/procedure-capture.test.ts
@@ -119,8 +119,8 @@ describe('reflect: kill criteria', () => {
     expect(reflect).toContain('30%');
   });
 
-  test('reflect: kill criteria invokes proposal-metrics-report.ts for procedure-capture', () => {
-    expect(reflect).toContain('proposal-metrics-report.ts');
+  test('reflect: kill criteria invokes the metrics verb for procedure-capture', () => {
+    expect(reflect).toContain('proposal.ts metrics');
   });
 
   test('reflect: kill criteria passes --source=procedure-capture to report script', () => {
@@ -164,7 +164,7 @@ describe('proposal-create: ## Skill Draft variant', () => {
   });
 
   test('proposal-create: triage-verdict emission carries tags (segments triage-survival)', () => {
-    // Emitted by record-gate.ts (tests/scripts.test.ts describe('record-gate') guards
+    // Emitted by the gate verb (tests/scripts.test.ts describe('proposal gate') guards
     // the field lands in the actual event); this guards the call site passes `--tags`.
     expect(proposalCreate).toContain("--tags '[<caller-supplied tags>]'");
   });
diff --git a/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts b/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
index 2686b678..07671e8c 100644
--- a/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-act-accept-flow.test.ts
@@ -125,7 +125,7 @@ test("frontmatter description mentions 'start implementing now'", () => {
 });
 
 // Step 2's success_signal bullet: capture and validation.
-// Guards that the step exists, references eval-success-signal.ts, and never blocks accept.
+// Guards that the step exists, references the success-signal verb, and never blocks accept.
 // (Folded from a standalone numbered step 3c into step 2's "determine what to
 // set" bullet list when the accept flow consolidated onto proposal.ts patch —
 // same behavior, new anchor.)
@@ -134,8 +134,8 @@ describe('step 3c: success_signal', () => {
     expect(skill).toContain('`success_signal` (optional)');
   });
 
-  test('step 3c: references eval-success-signal.ts', () => {
-    expect(skill).toContain('eval-success-signal.ts');
+  test('step 3c: references the success-signal verb', () => {
+    expect(skill).toContain('proposal.ts success-signal');
   });
 
   test('step 3c: never blocks accept', () => {
diff --git a/plugins/claude-code-hermit/tests/proposal-write.test.ts b/plugins/claude-code-hermit/tests/proposal-write.test.ts
index 83ddc140..28953412 100644
--- a/plugins/claude-code-hermit/tests/proposal-write.test.ts
+++ b/plugins/claude-code-hermit/tests/proposal-write.test.ts
@@ -470,3 +470,55 @@ describe('proposal.ts routine', () => {
     expect(fs.readFileSync(path.join(stateArg(dir), 'config.json'), 'utf-8')).toBe(before);
   }));
 });
+
+// -------------------------------------------------------
+// Dispatch gate — the two absorbed verbs that legitimately take no state dir
+// -------------------------------------------------------
+//
+// Every other verb is refused without one (`!verb || !stateDir` → exit 1), which
+// is what stops a mis-invocation from creating anything. These two are carved
+// out ahead of that guard: `success-signal --validate` is a pure grammar check
+// that reads no state, and `metrics` defaults the state dir. If the carve-out
+// regressed, both would exit 1 with a usage line and their callers — a
+// proposal-create predicate check, a domain brainstorm's kill-criteria check —
+// would read that as a failure verdict.
+
+describe('proposal.ts dispatch gate', () => {
+  test('success-signal --validate needs no state dir; exit code still carries the verdict', async () => {
+    const ok = await runScript('proposal.ts', {
+      args: ['success-signal', '--validate', 'avg_session_cost_usd < 1.5 over 5 sessions'],
+    });
+    expect(ok.exitCode).toBe(0);
+    expect(ok.stdout.trim()).toBe('OK');
+
+    // Non-zero on a bad predicate is load-bearing: proposal-create branches on it.
+    const bad = await runScript('proposal.ts', { args: ['success-signal', '--validate', 'nonsense'] });
+    expect(bad.exitCode).toBe(1);
+    expect(bad.stdout).toContain('invalid grammar');
+  });
+
+  test('metrics needs no state dir — it defaults to .claude-code-hermit', withDir(async (dir) => {
+    const r = await runScript('proposal.ts', { args: ['metrics'], cwd: dir });
+    expect(r.exitCode).toBe(0);
+    // No ledger under the default dir → the fail-open line, not a usage error.
+    expect(r.stdout).toContain('No proposal metrics yet.');
+    expect(r.stderr).not.toContain('Usage:');
+  }));
+
+  test('a verb that does need a state dir is still refused without one', async () => {
+    const r = await runScript('proposal.ts', { args: ['create'] });
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toContain('Usage: bun proposal.ts');
+  });
+});
+
+// `index` is the third carve-out: it was a fail-open derived-cache rebuild before
+// absorption (`SKIP|no state dir`, exit 0) and stays one. Falling through to the
+// generic exit-1 usage guard would read as a real failure to its callers.
+describe('proposal.ts index fail-open contract', () => {
+  test('index with no state dir → SKIP on stdout, exit 0', async () => {
+    const r = await runScript('proposal.ts', { args: ['index'] });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout.trim()).toBe('SKIP|no state dir');
+  });
+});
diff --git a/plugins/claude-code-hermit/tests/proposals-index.test.ts b/plugins/claude-code-hermit/tests/proposals-index.test.ts
index 46a2d927..b001c926 100644
--- a/plugins/claude-code-hermit/tests/proposals-index.test.ts
+++ b/plugins/claude-code-hermit/tests/proposals-index.test.ts
@@ -1,4 +1,4 @@
-// proposals-index.ts — derived-cache correctness + hook-dispatch wiring.
+// proposal.ts index / lib/proposals/index-rebuild.ts — derived-cache correctness + hook-dispatch wiring.
 // The index replaces reading every PROP-*.md body (~22K tokens) with a single
 // frontmatter mirror, and becomes the single source of proposal counts.
 //
@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { rebuildIndex } from '../scripts/proposals-index';
+import { rebuildIndex } from '../scripts/lib/proposals/index-rebuild';
 import { runScript } from './helpers/run';
 
 const hermit = (dir: string, ...p: string[]) => path.join(dir, '.claude-code-hermit', ...p);
@@ -93,14 +93,14 @@ describe('CLI verdict', () => {
   test('OK|<n> proposals with a proposals dir', async () => {
     const dir = makeDir();
     writeProposal(dir, 'PROP-001-a-120000.md', fm({ status: 'proposed' }) + '# Proposal: PROP-001 — A\n');
-    const r = await runScript('proposals-index.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('proposal.ts', { args: ['index', '.claude-code-hermit'], cwd: dir });
     expect(r.stdout.trim()).toBe('OK|1 proposals');
   });
 
   test('SKIP|no proposals dir when absent', async () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hermit-noprop-'));
     fs.mkdirSync(hermit(dir, 'state'), { recursive: true });
-    const r = await runScript('proposals-index.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('proposal.ts', { args: ['index', '.claude-code-hermit'], cwd: dir });
     expect(r.stdout.trim()).toBe('SKIP|no proposals dir');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index 5ddeea05..54284d25 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -1326,58 +1326,58 @@ describe('append-metrics (dual-mode)', () => {
 });
 
 // -------------------------------------------------------
-// resolve-prop.ts (subprocess — PROP-id fuzzy resolution)
+// proposal.ts resolve-id (subprocess — PROP-id fuzzy resolution)
 // -------------------------------------------------------
 
-describe('resolve-prop', () => {
+describe('proposal resolve-id', () => {
   function seedProposal(dir: string, filename: string, title: string) {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     write(hermit(dir, 'proposals', filename), `---\ntitle: ${title}\n---\nbody\n`);
   }
   async function resolveProp(dir: string, input: string) {
-    const r = await runScript('resolve-prop.ts', { args: [hermit(dir), input] });
+    const r = await runScript('proposal.ts', { args: ['resolve-id', hermit(dir), input] });
     expect(r.exitCode).toBe(0);
     return r.stdout.trimEnd();
   }
 
-  test('resolve-prop (legacy exact match)', withDir(async (dir) => {
+  test('resolve-id (legacy exact match)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-007.md', 'Legacy');
     expect(await resolveProp(dir, 'prop-7')).toBe('MATCH|PROP-007.md');
   }));
 
-  test('resolve-prop (new-format bare-id match)', withDir(async (dir) => {
+  test('resolve-id (new-format bare-id match)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'PROP-6')).toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (suffix match, lowercase input against lowercase slug)', withDir(async (dir) => {
+  test('resolve-id (suffix match, lowercase input against lowercase slug)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'prop-006-capability-brainstorm-103612'))
       .toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (suffix match, timestamp-only input)', withDir(async (dir) => {
+  test('resolve-id (suffix match, timestamp-only input)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     expect(await resolveProp(dir, 'PROP-006-103612')).toBe('MATCH|PROP-006-capability-brainstorm-103612.md');
   }));
 
-  test('resolve-prop (4-digit NNN never collides with 3-digit bare id)', withDir(async (dir) => {
+  test('resolve-id (4-digit NNN never collides with 3-digit bare id)', withDir(async (dir) => {
     // PROP-006 must not match PROP-0061.md once proposal counts cross 1000.
     seedProposal(dir, 'PROP-0061.md', 'Collision');
     expect(await resolveProp(dir, 'PROP-6')).toBe('NONE|no-match');
   }));
 
-  test('resolve-prop (0 matches)', withDir(async (dir) => {
+  test('resolve-id (0 matches)', withDir(async (dir) => {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     expect(await resolveProp(dir, 'PROP-999')).toBe('NONE|no-match');
   }));
 
-  test('resolve-prop (not a PROP id)', withDir(async (dir) => {
+  test('resolve-id (not a PROP id)', withDir(async (dir) => {
     fs.mkdirSync(hermit(dir, 'proposals'), { recursive: true });
     expect(await resolveProp(dir, 'hello')).toBe('NONE|not-a-prop-id');
   }));
 
-  test('resolve-prop (2+ matches — AMBIGUOUS carries file + title)', withDir(async (dir) => {
+  test('resolve-id (2+ matches — AMBIGUOUS carries file + title)', withDir(async (dir) => {
     seedProposal(dir, 'PROP-006-capability-brainstorm-103612.md', 'Foo');
     seedProposal(dir, 'PROP-006-something-else-110000.md', 'Bar');
     const out = await resolveProp(dir, 'PROP-6');
@@ -1391,15 +1391,15 @@ describe('resolve-prop', () => {
 });
 
 // -------------------------------------------------------
-// record-gate.ts (subprocess — gate-verdict parsing + metric append + routing)
+// proposal.ts gate (subprocess — gate-verdict parsing + metric append + routing)
 // -------------------------------------------------------
 
-describe('record-gate', () => {
+describe('proposal gate', () => {
   async function gate(dir: string, opts: { gate: 'triage' | 'judge'; caller?: string; evidenceSource?: string; tags?: string[] }, title: string, verdict: string) {
-    const args = [hermit(dir), '--gate', opts.gate, '--caller', opts.caller ?? 'reflect'];
+    const args = ['gate', hermit(dir), '--gate', opts.gate, '--caller', opts.caller ?? 'reflect'];
     if (opts.evidenceSource) args.push('--evidence-source', opts.evidenceSource);
     if (opts.tags) args.push('--tags', JSON.stringify(opts.tags));
-    const r = await runScript('record-gate.ts', { args, stdin: `Title: ${title}\nVerdict: ${verdict}\n` });
+    const r = await runScript('proposal.ts', { args, stdin: `Title: ${title}\nVerdict: ${verdict}\n` });
     expect(r.exitCode).toBe(0);
     return r.stdout.trim();
   }
@@ -1409,7 +1409,7 @@ describe('record-gate', () => {
     return fs.readFileSync(p, 'utf-8').trim().split('\n').filter(Boolean).map(l => JSON.parse(l));
   }
 
-  test('record-gate (triage CREATE -> PROCEED + triage-verdict event)', withDir(async (dir) => {
+  test('gate (triage CREATE -> PROCEED + triage-verdict event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage', caller: 'proposal-create', evidenceSource: 'capability-brainstorm', tags: ['capability-brainstorm'] }, 'Foo', 'CREATE: Foo');
     expect(out).toBe('PROCEED|CREATE');
     const lines = ledgerLines(dir);
@@ -1417,68 +1417,68 @@ describe('record-gate', () => {
     expect(lines[0]).toMatchObject({ type: 'triage-verdict', verdict: 'CREATE', caller: 'proposal-create', evidence_source: 'capability-brainstorm', tags: ['capability-brainstorm'] });
   }));
 
-  test('record-gate (triage SUPPRESS -> DROP with code)', withDir(async (dir) => {
+  test('gate (triage SUPPRESS -> DROP with code)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'SUPPRESS: Foo — weak-recurrence: one-off ("excerpt")');
     expect(out).toBe('DROP|SUPPRESS:weak-recurrence');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'triage-verdict', verdict: 'SUPPRESS' });
   }));
 
-  test('record-gate (triage DUPLICATE -> DROP with PROP-ID)', withDir(async (dir) => {
+  test('gate (triage DUPLICATE -> DROP with PROP-ID)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'DUPLICATE: Foo — PROP-019: same problem');
     expect(out).toBe('DROP|DUPLICATE:PROP-019');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'triage-verdict', verdict: 'DUPLICATE' });
   }));
 
-  test('record-gate (triage garbled verdict -> GATE_FAILED + gate-failed event)', withDir(async (dir) => {
+  test('gate (triage garbled verdict -> GATE_FAILED + gate-failed event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'triage' }, 'Foo', 'garbled nonsense');
     expect(out).toBe('GATE_FAILED');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'gate-failed', agent: 'proposal-triage', title: 'Foo' });
   }));
 
-  test('record-gate (judge ACCEPT -> PROCEED, no ledger event)', withDir(async (dir) => {
+  test('gate (judge ACCEPT -> PROCEED, no ledger event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'ACCEPT: Bar');
     expect(out).toBe('PROCEED|ACCEPT');
     expect(ledgerLines(dir)).toHaveLength(0);
   }));
 
-  test('record-gate (judge ACCEPT with source tag)', withDir(async (dir) => {
+  test('gate (judge ACCEPT with source tag)', withDir(async (dir) => {
     expect(await gate(dir, { gate: 'judge' }, 'Bar', 'ACCEPT (current-session): Bar')).toBe('PROCEED|ACCEPT');
   }));
 
-  test('record-gate (judge DOWNGRADE -> PROCEED with tier)', withDir(async (dir) => {
+  test('gate (judge DOWNGRADE -> PROCEED with tier)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'DOWNGRADE:2: Bar — auto-closed-evidence');
     expect(out).toBe('PROCEED|DOWNGRADE:2');
   }));
 
-  test('record-gate (judge DOWNGRADE quarantine — tier passes through as-is)', withDir(async (dir) => {
+  test('gate (judge DOWNGRADE quarantine — tier passes through as-is)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'DOWNGRADE:3 (current-session): Bar — quarantine: external origin');
     expect(out).toBe('PROCEED|DOWNGRADE:3');
   }));
 
-  test('record-gate (judge SUPPRESS -> DROP with code, no ledger event)', withDir(async (dir) => {
+  test('gate (judge SUPPRESS -> DROP with code, no ledger event)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', 'SUPPRESS: Bar — no-sessions: no cross-session evidence cited');
     expect(out).toBe('DROP|SUPPRESS:no-sessions');
     expect(ledgerLines(dir)).toHaveLength(0);
   }));
 
-  test('record-gate (judge empty verdict -> GATE_FAILED + gate-failed event tagged reflection-judge)', withDir(async (dir) => {
+  test('gate (judge empty verdict -> GATE_FAILED + gate-failed event tagged reflection-judge)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'judge' }, 'Bar', '');
     expect(out).toBe('GATE_FAILED');
     expect(ledgerLines(dir)[0]).toMatchObject({ type: 'gate-failed', agent: 'reflection-judge', title: 'Bar' });
   }));
 
-  test('record-gate (invalid --gate value -> GATE_FAILED)', withDir(async (dir) => {
+  test('gate (invalid --gate value -> GATE_FAILED)', withDir(async (dir) => {
     const out = await gate(dir, { gate: 'bogus' as any }, 'Foo', 'CREATE: Foo');
     expect(out).toBe('GATE_FAILED');
   }));
 
-  test('record-gate (missing state/ subdir does not crash — creates it before appending)', async () => {
+  test('gate (missing state/ subdir does not crash — creates it before appending)', async () => {
     // Regression: appendJsonlLine's fs.appendFileSync throws ENOENT if state/ doesn't
     // exist yet, which would violate this script's own "Exit 0 always" contract.
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'record-gate-nodir-'));
     try {
-      const r = await runScript('record-gate.ts', {
-        args: [dir, '--gate', 'triage', '--caller', 'test'],
+      const r = await runScript('proposal.ts', {
+        args: ['gate', dir, '--gate', 'triage', '--caller', 'test'],
         stdin: 'Title: Foo\nVerdict: CREATE: Foo\n',
       });
       expect(r.exitCode).toBe(0);
@@ -1492,16 +1492,16 @@ describe('record-gate', () => {
 });
 
 // -------------------------------------------------------
-// queue-micro-proposal.ts (subprocess — MP-id generation + dedup + queue write)
+// proposal.ts queue-micro (subprocess — MP-id generation + dedup + queue write)
 // -------------------------------------------------------
 
-describe('queue-micro-proposal', () => {
+describe('proposal queue-micro', () => {
   function seed(dir: string) {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[]}');
   }
   async function queue(dir: string, payload: any) {
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify(payload) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify(payload) });
     expect(r.exitCode).toBe(0);
     return r.stdout.trim();
   }
@@ -1509,7 +1509,7 @@ describe('queue-micro-proposal', () => {
     return readJson(hermit(dir, 'state', 'micro-proposals.json'));
   }
 
-  test('queue-micro-proposal (first entry of the day is N=0)', withDir(async (dir) => {
+  test('queue-micro (first entry of the day is N=0)', withDir(async (dir) => {
     seed(dir);
     const out = await queue(dir, { tier: 1, question: 'For 3 weeks I added the same hashtags. Automate it? Yes / No' });
     expect(out).toMatch(/^QUEUED\|MP-\d{8}-0$/);
@@ -1518,7 +1518,7 @@ describe('queue-micro-proposal', () => {
     expect(micro.pending[0]).toMatchObject({ tier: 1, status: 'pending', follow_up_count: 0 });
   }));
 
-  test('queue-micro-proposal (N increments within the same day)', withDir(async (dir) => {
+  test('queue-micro (N increments within the same day)', withDir(async (dir) => {
     seed(dir);
     const out1 = await queue(dir, { tier: 1, question: 'Question A' });
     const out2 = await queue(dir, { tier: 2, question: 'Question B' });
@@ -1527,7 +1527,7 @@ describe('queue-micro-proposal', () => {
     expect(n2).toBe(n1 + 1);
   }));
 
-  test('queue-micro-proposal (dedup by exact question match)', withDir(async (dir) => {
+  test('queue-micro (dedup by exact question match)', withDir(async (dir) => {
     seed(dir);
     const out1 = await queue(dir, { tier: 1, question: 'Same question here' });
     const id1 = out1.split('|')[1];
@@ -1536,7 +1536,7 @@ describe('queue-micro-proposal', () => {
     expect(microFile(dir).pending).toHaveLength(1);
   }));
 
-  test('queue-micro-proposal (on_resolve forces tier 1 and tags the event kind:ask)', withDir(async (dir) => {
+  test('queue-micro (on_resolve forces tier 1 and tags the event kind:ask)', withDir(async (dir) => {
     seed(dir);
     await queue(dir, { tier: 3, question: 'Bridged Q?', options: ['a', 'b'], on_resolve: '/skill accept {answer}' });
     const entry = microFile(dir).pending[0];
@@ -1547,7 +1547,7 @@ describe('queue-micro-proposal', () => {
     expect(ledger[0]).toMatchObject({ type: 'micro-queued', tier: 1, kind: 'ask' });
   }));
 
-  test('queue-micro-proposal (preserves existing pending entries on write)', withDir(async (dir) => {
+  test('queue-micro (preserves existing pending entries on write)', withDir(async (dir) => {
     seed(dir);
     write(hermit(dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending: [{ id: 'MP-20260101-0', tier: 1, status: 'pending', follow_up_count: 0, ts: '2026-01-01T00:00:00Z', question: 'Old question' }] }));
     await queue(dir, { tier: 1, question: 'New question' });
@@ -1556,31 +1556,31 @@ describe('queue-micro-proposal', () => {
     expect(pending[0].id).toBe('MP-20260101-0');
   }));
 
-  test('queue-micro-proposal (missing question -> exit 1, no write)', withDir(async (dir) => {
+  test('queue-micro (missing question -> exit 1, no write)', withDir(async (dir) => {
     seed(dir);
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1 }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1 }) });
     expect(r.exitCode).toBe(1);
   }));
 
-  test('queue-micro-proposal (invalid JSON -> exit 1, no write)', withDir(async (dir) => {
+  test('queue-micro (invalid JSON -> exit 1, no write)', withDir(async (dir) => {
     seed(dir);
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: 'not-json' });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: 'not-json' });
     expect(r.exitCode).toBe(1);
   }));
 
-  test('queue-micro-proposal (corrupt existing file -> exit 1, refuses to overwrite)', withDir(async (dir) => {
+  test('queue-micro (corrupt existing file -> exit 1, refuses to overwrite)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
 
-  test('queue-micro-proposal (parseable file with no `pending` key -> heals, other keys preserved)', withDir(async (dir) => {
+  test('queue-micro (parseable file with no `pending` key -> heals, other keys preserved)', withDir(async (dir) => {
     write(hermit(dir, 'config.json'), '{"timezone":"UTC"}');
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"active":null}');
-    const r = await runScript('queue-micro-proposal.ts', { args: [hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
+    const r = await runScript('proposal.ts', { args: ['queue-micro', hermit(dir)], stdin: JSON.stringify({ tier: 1, question: 'New question' }) });
     expect(r.exitCode).toBe(0);
     const micro = readJson(hermit(dir, 'state', 'micro-proposals.json'));
     expect(micro.pending).toHaveLength(1);
@@ -1589,10 +1589,10 @@ describe('queue-micro-proposal', () => {
 });
 
 // -------------------------------------------------------
-// micro-proposal.ts (subprocess — resolve/nudge, issue 649 regression)
+// proposal.ts micro (subprocess — resolve/nudge, issue 649 regression)
 // -------------------------------------------------------
 
-describe('micro-proposal', () => {
+describe('proposal micro', () => {
   function seed(dir: string, pending: any[]) {
     write(hermit(dir, 'state', 'micro-proposals.json'), JSON.stringify({ pending }));
   }
@@ -1607,7 +1607,7 @@ describe('micro-proposal', () => {
 
   test('resolve (issue 649 regression: file stays parseable and holds the surviving entry after removal)', withDir(async (dir) => {
     seed(dir, [entryA, entryB]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe(`RESOLVED|${entryA.id}|approved`);
     const raw = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
@@ -1619,7 +1619,7 @@ describe('micro-proposal', () => {
 
   test('nudge (increments follow_up_count, leaves other fields intact)', withDir(async (dir) => {
     seed(dir, [entryA]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'nudge', entryA.id] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'nudge', entryA.id] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe(`NUDGED|${entryA.id}|1`);
     const entry = microFile(dir).pending[0];
@@ -1630,7 +1630,7 @@ describe('micro-proposal', () => {
   test('resolve on a corrupt file -> exit 1, file byte-unchanged', withDir(async (dir) => {
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-1', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-1', '--action', 'approved'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1638,7 +1638,7 @@ describe('micro-proposal', () => {
   test('resolve unknown id -> NONE|no-match, exit 0, no write', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-does-not-exist', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-does-not-exist', '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('NONE|no-match');
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
@@ -1646,14 +1646,14 @@ describe('micro-proposal', () => {
 
   test('resolve --action answered --answer emits the ledger event shape', withDir(async (dir) => {
     seed(dir, [entryA]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'answered', '--answer', 'session task'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'answered', '--answer', 'session task'] });
     expect(r.exitCode).toBe(0);
     const events = ledger(dir);
     expect(events[0]).toMatchObject({ type: 'micro-resolved', micro_id: entryA.id, action: 'answered', answer: 'session task', question: entryA.question });
   }));
 
   test('resolve on absent file -> NONE|no-match, exit 0', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', 'MP-anything', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', 'MP-anything', '--action', 'approved'] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('NONE|no-match');
   }));
@@ -1661,7 +1661,7 @@ describe('micro-proposal', () => {
   test('resolve with missing --action -> exit 1, file unchanged', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1669,14 +1669,14 @@ describe('micro-proposal', () => {
   test('resolve with the <MP-id> omitted -> exit 1, never a silent NONE|no-match', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', '--action', 'approved'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', '--action', 'approved'] });
     expect(r.exitCode).toBe(1);
     expect(r.stdout).not.toContain('NONE|no-match');
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
 
   test('unknown verb -> exit 1 even when the file is absent', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'expire', 'MP-20260101-0'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'expire', 'MP-20260101-0'] });
     expect(r.exitCode).toBe(1);
     expect(r.stdout).not.toContain('NONE|no-match');
   }));
@@ -1684,7 +1684,7 @@ describe('micro-proposal', () => {
   test('resolve with invalid --action -> exit 1, file unchanged', withDir(async (dir) => {
     seed(dir, [entryA]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'resolve', entryA.id, '--action', 'bogus'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'resolve', entryA.id, '--action', 'bogus'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -1694,7 +1694,7 @@ describe('micro-proposal', () => {
     const c1 = { id: 'MP-c1', tier: 1, status: 'pending', follow_up_count: 1, question: 'q1' };
     const c2 = { id: 'MP-c2', tier: 1, status: 'pending', follow_up_count: 2, question: 'q2' };
     seed(dir, [c0, c1, c2]);
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     const verdict = JSON.parse(r.stdout.trim());
     // `tier` is carried through — the brief renders "(tier N)" from the verdict alone.
@@ -1714,7 +1714,7 @@ describe('micro-proposal', () => {
   test('brief-cycle on an all-count-0 queue is a pure read (no write, no ledger)', withDir(async (dir) => {
     seed(dir, [entryA, entryB]);
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     const verdict = JSON.parse(r.stdout.trim());
     expect(verdict.new).toHaveLength(2);
@@ -1725,7 +1725,7 @@ describe('micro-proposal', () => {
   }));
 
   test('brief-cycle on an absent file -> empty verdict, exit 0, no write', withDir(async (dir) => {
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(0);
     expect(JSON.parse(r.stdout.trim())).toEqual({ new: [], renudged: [], expired: [] });
     expect(fs.existsSync(hermit(dir, 'state', 'micro-proposals.json'))).toBe(false);
@@ -1734,7 +1734,7 @@ describe('micro-proposal', () => {
   test('brief-cycle on a corrupt file -> exit 1, file byte-unchanged', withDir(async (dir) => {
     write(hermit(dir, 'state', 'micro-proposals.json'), '{"pending":[{"id":"MP-1"},]}');
     const before = fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8');
-    const r = await runScript('micro-proposal.ts', { args: [hermit(dir), 'brief-cycle'] });
+    const r = await runScript('proposal.ts', { args: ['micro', hermit(dir), 'brief-cycle'] });
     expect(r.exitCode).toBe(1);
     expect(fs.readFileSync(hermit(dir, 'state', 'micro-proposals.json'), 'utf-8')).toBe(before);
   }));
@@ -3998,29 +3998,29 @@ describe('channel-log', () => {
 });
 
 // -------------------------------------------------------
-// proposal-metrics-report.ts (subprocess — argv/stdout CLI contract)
+// proposal.ts metrics (subprocess — argv/stdout CLI contract)
 // -------------------------------------------------------
 
-describe('proposal-metrics-report', () => {
+describe('proposal metrics', () => {
   const runReport = async (dir: string, ...extra: string[]) => {
-    const r = await runScript('proposal-metrics-report.ts', { args: [hermit(dir), ...extra] });
+    const r = await runScript('proposal.ts', { args: ['metrics', hermit(dir), ...extra] });
     expect(r.exitCode).toBe(0);
     return r.stdout + r.stderr;
   };
   const metricsFile = (dir: string) => hermit(dir, 'state', 'proposal-metrics.jsonl');
 
   // Missing / empty file — fails open
-  test('proposal-metrics-report (missing file exits 0)', withDir(async (dir) => {
+  test('metrics (missing file exits 0)', withDir(async (dir) => {
     expect(await runReport(dir)).toContain('No proposal metrics');
   }));
 
-  test('proposal-metrics-report (empty file exits 0)', withDir(async (dir) => {
+  test('metrics (empty file exits 0)', withDir(async (dir) => {
     write(metricsFile(dir), '');
     expect(await runReport(dir)).toContain('No proposal metrics');
   }));
 
   // Insufficient sample (<8) — INSUFFICIENT output
-  test('proposal-metrics-report --source (INSUFFICIENT, n<8)', withDir(async (dir) => {
+  test('metrics --source (INSUFFICIENT, n<8)', withDir(async (dir) => {
     // 3 triage-verdicts from brainstorm + 2 created tagged brainstorm, 1 accepted
     write(metricsFile(dir), [
       '{"ts":"2026-01-01T00:00:00Z","type":"triage-verdict","verdict":"CREATE","caller":"proposal-create","evidence_source":"capability-brainstorm","tags":["capability-brainstorm"]}',
@@ -4055,20 +4055,20 @@ describe('proposal-metrics-report', () => {
       }
       lines.push('{"ts":"2026-01-01T02:00:00Z","type":"responded","proposal_id":"PROP-001","action":"accept"}');
       write(metricsFile(wd.dir), lines.join('\n') + '\n');
-      const r = await runScript('proposal-metrics-report.ts', {
-        args: [hermit(wd.dir), '--source=capability-brainstorm'],
+      const r = await runScript('proposal.ts', {
+        args: ['metrics', hermit(wd.dir), '--source=capability-brainstorm'],
       });
       out = r.stdout + r.stderr;
     });
     afterAll(() => wd.cleanup());
 
-    test('proposal-metrics-report --source (survival 40%)', () => {
+    test('metrics --source (survival 40%)', () => {
       expect(out).toContain('triage-survival 40%');
     });
-    test('proposal-metrics-report --source (acceptance 25%)', () => {
+    test('metrics --source (acceptance 25%)', () => {
       expect(out).toContain('acceptance 25%');
     });
-    test('proposal-metrics-report --source (KILL verdict)', () => {
+    test('metrics --source (KILL verdict)', () => {
       expect(out).toContain('KILL');
     });
   });
@@ -4087,24 +4087,24 @@ describe('proposal-metrics-report', () => {
         '{"ts":"2026-01-01T02:00:00Z","type":"responded","proposal_id":"PROP-R1","action":"accept"}',
         '',
       ].join('\n'));
-      const r = await runScript('proposal-metrics-report.ts', { args: [hermit(wd.dir)] });
+      const r = await runScript('proposal.ts', { args: ['metrics', hermit(wd.dir)] });
       out = r.stdout + r.stderr;
     });
     afterAll(() => wd.cleanup());
 
-    test('proposal-metrics-report table (header present)', () => {
+    test('metrics table (header present)', () => {
       expect(out).toContain('Proposal acceptance by source');
     });
-    test('proposal-metrics-report table (reflect row present)', () => {
+    test('metrics table (reflect row present)', () => {
       expect(out).toContain('| reflect |');
     });
-    test('proposal-metrics-report table (capability-brainstorm row present)', () => {
+    test('metrics table (capability-brainstorm row present)', () => {
       expect(out).toContain('| capability-brainstorm |');
     });
   });
 
   // Malformed line is skipped; valid events still counted
-  test('proposal-metrics-report (malformed line skipped)', withDir(async (dir) => {
+  test('metrics (malformed line skipped)', withDir(async (dir) => {
     write(metricsFile(dir), [
       'this is not json at all',
       '{"ts":"2026-01-01T00:01:00Z","type":"triage-verdict","verdict":"CREATE","caller":"reflect"}',
@@ -4114,7 +4114,7 @@ describe('proposal-metrics-report', () => {
   }));
 
   // --source with unknown key reports error gracefully
-  test('proposal-metrics-report (unknown --source key)', withDir(async (dir) => {
+  test('metrics (unknown --source key)', withDir(async (dir) => {
     write(metricsFile(dir),
       '{"ts":"2026-01-01T00:01:00Z","type":"triage-verdict","verdict":"CREATE","caller":"reflect"}\n');
     expect(await runReport(dir, '--source=nonexistent')).toContain('Unknown source key');
diff --git a/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
index 549cfbf3..f621f912 100644
--- a/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-homeassistant-hermit/.claude-plugin/hermit-meta.json
@@ -1,7 +1,7 @@
 {
-  "required_core_version": ">=1.2.30",
+  "required_core_version": ">=1.2.34",
   "requires": {
-    "claude-code-hermit": ">=1.2.30"
+    "claude-code-hermit": ">=1.2.34"
   },
   "hermit": {
     "boot_skill": "/claude-code-homeassistant-hermit:ha-boot"
diff --git a/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json b/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
index 428e6ad6..e2420f17 100644
--- a/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
+++ b/plugins/claude-code-homeassistant-hermit/.claude-plugin/plugin.json
@@ -18,7 +18,7 @@
   "dependencies": [
     {
       "name": "claude-code-hermit",
-      "version": "^1.2.30"
+      "version": "^1.2.34"
     }
   ]
 }
diff --git a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
index 45dbd3cf..820ed425 100644
--- a/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
+++ b/plugins/claude-code-homeassistant-hermit/CHANGELOG.md
@@ -8,9 +8,10 @@
 ### Fixed
 - `domain-brainstorm` no longer writes its own `brainstorm-emit` event — core's triage gate already records every verdict. Proposals now carry `tags: [capability-brainstorm]` instead of `[domain-brainstorm, ideation]`, so they count toward the brainstorm kill-criteria segment rather than `reflect`'s.
 - `ha-boot` and `SAFETY.md` no longer point the operator at a `.env.example` that does not ship; replaced with a direct "create `.env`" instruction.
-- `ha-morning-brief`'s micro-proposal lifecycle now runs in one `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle` call through core's writer (one atomic round-trip that re-nudges, expires, and records expiries), instead of two inline `bun -e` re-implementations of that writer — so a nudge, an expiry, or a crash mid-write can no longer corrupt the queue.
+- `ha-morning-brief`'s micro-proposal lifecycle now runs in one `.claude-code-hermit/bin/hermit-run proposal micro .claude-code-hermit brief-cycle` call through core's writer (one atomic round-trip that re-nudges, expires, and records expiries), instead of two inline `bun -e` re-implementations of that writer — so a nudge, an expiry, or a crash mid-write can no longer corrupt the queue.
 
 ### Changed
+- Requires core `>=1.2.34`. Core absorbed its proposal satellites into `proposal.ts` verbs, so the shared route this plugin calls through `bin/hermit-run` is now `proposal micro …` / `proposal metrics …`. `bin/hermit-run` resolves a script by bare filesystem probe, so pairing this version with an older core fails with a misleading "plugin may predate this command" error.
 - `domain-brainstorm` reads core's proposal-metrics report via `.claude-code-hermit/bin/hermit-run` (a path relative to this plugin can't reach core's install), and a kill-criteria breach now escalates to the operator as a class-level signal instead of instructing the skill to self-retire (the shared segment can't attribute noise to one skill).
 
 ### Changed
diff --git a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
index 6e46d658..82f62cec 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/domain-brainstorm/SKILL.md
@@ -7,7 +7,7 @@ description: On-demand HA-voice brainstorm — reads entity inventory, automatio
 
 ## Kill criteria (read before running)
 
-After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal-metrics-report .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
+After ≥8 invocations, check the `capability-brainstorm` segment of core's proposal metrics report — run `.claude-code-hermit/bin/hermit-run proposal metrics .claude-code-hermit --source=capability-brainstorm` (the project-resident `bin/hermit-run` resolves core's plugin root, which a path relative to this plugin can't reach), or read the `capability-brainstorm` row of the table `/claude-code-hermit:hermit-evolution` prints. If triage-survival < 25% or PROP-acceptance < 30%, treat it as a class-level signal that brainstorm output is noisy and raise it with the operator — the segment is shared with core's `capability-brainstorm` and the other domain brainstorm skills, so it cannot by itself say which skill to cut.
 
 ### Gate 0 — Gather inputs
 
diff --git a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
index f6520ed9..d007153e 100644
--- a/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
+++ b/plugins/claude-code-homeassistant-hermit/skills/ha-morning-brief/SKILL.md
@@ -55,7 +55,7 @@ When both `claude-code-hermit` and `claude-code-homeassistant-hermit` are instal
    - Read `.claude-code-hermit/cost-summary.md` if it exists — include yesterday's cost
 
 <!-- keep in sync with plugins/claude-code-hermit/skills/brief/SKILL.md — same MP lifecycle protocol -->
-9a. **Micro-proposals lifecycle** — age the queue in one call: `.claude-code-hermit/bin/hermit-run micro-proposal .claude-code-hermit brief-cycle`. This runs core's writer through the project-resident `bin/hermit-run`, which resolves core's plugin root (a static `../claude-code-hermit/…` path can't — HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/` and the version segment isn't knowable from skill text). It performs the whole `follow_up_count` 0/1/2+ lifecycle atomically (re-nudges count-1 entries, expires count-2+ entries, records each expiry) and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}`. Never hand-edit `state/micro-proposals.json`. Render from that verdict:
+9a. **Micro-proposals lifecycle** — age the queue in one call: `.claude-code-hermit/bin/hermit-run proposal micro .claude-code-hermit brief-cycle`. This runs core's writer through the project-resident `bin/hermit-run`, which resolves core's plugin root (a static `../claude-code-hermit/…` path can't — HA's `${CLAUDE_PLUGIN_ROOT}` is `<cache>/<marketplace>/claude-code-homeassistant-hermit/<version>/` and the version segment isn't knowable from skill text). It performs the whole `follow_up_count` 0/1/2+ lifecycle atomically (re-nudges count-1 entries, expires count-2+ entries, records each expiry) and prints one JSON line `{"new":[…],"renudged":[…],"expired":[…]}`. Never hand-edit `state/micro-proposals.json`. Render from that verdict:
    - Each `new` entry: include in `Awaiting decision:` output (see Output Format).
    - Each `renudged` entry: include in `Awaiting decision:` with softer framing: "Still waiting on MP-YYYYMMDD-N: [question] (ignore again to drop it)".
    - `expired` entries were dropped this cycle — do not surface them.

From c3542a4f13dfd56c5a9382df657ec42ad56bb015 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 18:23:25 +0100
Subject: [PATCH 4/9] refactor(claude-code-hermit): one artifact.ts over the
 page renderers

render-dashboard.ts, render-proposals-page.ts, render-weekly-artifact.ts and
artifact-strings-scaffold.ts become `artifact.ts render <page>` and
`artifact.ts scaffold-strings`. The three render scripts were the same twelve
lines three times: resolve an out path, render, mkdir -p, write, print the
{path,bytes,hash} receipt, exit 1 on anything thrown. Only the default out path
and the render call actually differed, so those are the only two things the
PAGES table holds; the table also supplies the usage string and the
unknown-page check, so it is not a parallel list to keep in sync.

The weekly page's frontmatter-strip moved to lib/weekly-artifact.ts, beside the
dashboard and proposals-page renderer libs it now sits with. It throws instead
of calling process.exit itself, so the shared catch owns the exit path.

Receipt shape, default out paths, and exit-1-on-failure are unchanged - the
refresh protocols in docs/artifacts.md hash-gate on that receipt, and a
publish is skipped when the hash matches. Confirmed the weekly receipt hash is
byte-identical before and after. What did change is stderr text: failures now
read "artifact render weekly: failed: ..." rather than a per-script prefix, and
a missing arg prints the two-verb usage. Both are diagnostic only; the callers
treat any non-zero exit as "skip silently".

Three scripts with a superficially similar shape are deliberately NOT absorbed.
render-docker-templates.ts writes several files from stdin JSON and documents
that it hashes nothing (manifest-seed.ts owns that); render-security-overlay.ts
has two subcommands and does live docker inspection; hatch-scaffold.ts
scaffolds a tree and receipts as created/overwritten/preserved. None has a
single output path or a hash, so folding them in would either drop fields their
callers read or force a hash onto a script that disclaims one.

Also corrects docs/config-reference.md, which still named the deleted
render-weekly-artifact.ts in its renderer list.

bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0.
---
 plugins/claude-code-hermit/CHANGELOG.md       |  2 +
 plugins/claude-code-hermit/docs/artifacts.md  |  4 +-
 .../docs/config-reference.md                  |  2 +-
 .../scripts/artifact-strings-scaffold.ts      | 12 ---
 .../claude-code-hermit/scripts/artifact.ts    | 92 +++++++++++++++++++
 .../scripts/lib/weekly-artifact.ts            | 22 +++++
 .../scripts/render-dashboard.ts               | 27 ------
 .../scripts/render-proposals-page.ts          | 27 ------
 .../scripts/render-weekly-artifact.ts         | 43 ---------
 .../claude-code-hermit/skills/hatch/SKILL.md  |  2 +-
 .../skills/hermit-settings/SKILL.md           |  2 +-
 ...tifact.test.ts => artifact-render.test.ts} | 20 ++--
 12 files changed, 131 insertions(+), 124 deletions(-)
 delete mode 100644 plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts
 create mode 100644 plugins/claude-code-hermit/scripts/artifact.ts
 create mode 100644 plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts
 delete mode 100644 plugins/claude-code-hermit/scripts/render-dashboard.ts
 delete mode 100644 plugins/claude-code-hermit/scripts/render-proposals-page.ts
 delete mode 100644 plugins/claude-code-hermit/scripts/render-weekly-artifact.ts
 rename plugins/claude-code-hermit/tests/{render-weekly-artifact.test.ts => artifact-render.test.ts} (76%)

diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index d03958ee..f3640c95 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -35,11 +35,13 @@
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 - The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
 - Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- The three Artifact-page renderers and the strings scaffold are `artifact.ts` verbs: `render dashboard|proposals|weekly` and `scaffold-strings`. The `{path,bytes,hash}` receipt, the default out paths, and exit-1-on-failure are unchanged — the refresh protocols hash-gate on that receipt. The weekly page's frontmatter-strip moved to `lib/weekly-artifact.ts`, beside the dashboard and proposals-page renderer libs.
 - `proposal-metrics-report.ts` and `eval-success-signal.ts` had no allow entry and were prompted for on every run; as `proposal.ts` verbs they are covered by the existing `proposal.ts` grant and run unattended. That is an authority change: a headless brainstorm kill-check and a success-signal validation now proceed without asking.
 
 ### Removed
 - `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
 - Seven top-level proposal scripts, absorbed into `proposal.ts` verbs: `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `proposals-index.ts`, `proposal-metrics-report.ts`, `eval-success-signal.ts`.
+- Four top-level artifact scripts, absorbed into `artifact.ts` verbs: `render-dashboard.ts`, `render-proposals-page.ts`, `render-weekly-artifact.ts`, `artifact-strings-scaffold.ts`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
diff --git a/plugins/claude-code-hermit/docs/artifacts.md b/plugins/claude-code-hermit/docs/artifacts.md
index da696ff7..e6f52f42 100644
--- a/plugins/claude-code-hermit/docs/artifacts.md
+++ b/plugins/claude-code-hermit/docs/artifacts.md
@@ -36,7 +36,7 @@ Every script-rendered artifact type (dashboard, proposals page, weekly review) f
 the same five steps; only the render script, `<title>`, and `state/artifacts.json` key
 differ per type (called out in each subsection below):
 
-1. Run the type's render script (e.g. `bun ${CLAUDE_PLUGIN_ROOT}/scripts/render-dashboard.ts .claude-code-hermit`)
+1. Run the type's render script (e.g. `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts render dashboard .claude-code-hermit`)
    and parse stdout JSON (`path`, `bytes`, `hash`).
 2. Read `.claude-code-hermit/state/artifacts.json` (if present) and compare `hash` to
    `<key>.hash`. **Unchanged → stop here**, no publish (avoids minting a no-op
@@ -126,7 +126,7 @@ is not localized — format, not language.
 `.md` natively — confirmed empirically) with its YAML frontmatter stripped (raw
 frontmatter renders as an ugly literal block; every field is already legible in the
 report body's evolution block and the dashboard's weekly section). Rendered by
-`scripts/render-weekly-artifact.ts` — no HTML step, so no CSS/fragment/`<title>`
+`artifact.ts render weekly` — no HTML step, so no CSS/fragment/`<title>`
 wrapping to build; the same five-step hash-gate/publish/state-write procedure still
 applies (hash is `sha256` of the frontmatter-stripped body). `<title>` for the
 `Artifact` call is the report's own top heading (e.g. `Weekly Review — 2026-W27`).
diff --git a/plugins/claude-code-hermit/docs/config-reference.md b/plugins/claude-code-hermit/docs/config-reference.md
index 1160b2e7..f5009ad7 100644
--- a/plugins/claude-code-hermit/docs/config-reference.md
+++ b/plugins/claude-code-hermit/docs/config-reference.md
@@ -256,7 +256,7 @@ Publishing of hermit-generated pages to Claude Code's [Artifacts](https://code.c
 
 **Disabling artifacts at the Claude Code level** (independent of these flags) — any of: `"disableArtifact": true` in `settings.json`, `CLAUDE_CODE_DISABLE_ARTIFACT=1`, or adding `Artifact` to `permissions.deny`. With any of these set, publish attempts fail and the hermit falls back the same way as a missing entitlement. If you run the hermit in tmux/headless (the norm for `hermit-start`), also set `CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0` in `config.env` — otherwise a successful publish tries to open a browser with nothing to receive it.
 
-Modify with `/hermit-settings artifact-dashboard`, `artifact-proposals`, `artifact-weekly-review`, or `artifact-authorization`. Validated by `validate-config.ts`. Renderers: `scripts/lib/dashboard.ts`, `scripts/lib/proposals-page.ts`, `scripts/render-weekly-artifact.ts` (all deterministic — no model authorship except the dashboard's embedded brief text — so a refresh costs a render, not a generation).
+Modify with `/hermit-settings artifact-dashboard`, `artifact-proposals`, `artifact-weekly-review`, or `artifact-authorization`. Validated by `validate-config.ts`. Renderers: `scripts/lib/dashboard.ts`, `scripts/lib/proposals-page.ts`, `scripts/lib/weekly-artifact.ts` (via `scripts/artifact.ts render weekly`) (all deterministic — no model authorship except the dashboard's embedded brief text — so a refresh costs a render, not a generation).
 
 ---
 
diff --git a/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts b/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts
deleted file mode 100644
index c0bf289f..00000000
--- a/plugins/claude-code-hermit/scripts/artifact-strings-scaffold.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// artifact-strings-scaffold.ts — prints the artifact-strings.json scaffold with
-// every chrome key at its English default, for a language-set skill (hatch /
-// hermit-settings) to translate the *values* in place and write to
-// state/artifact-strings.json. Keeps DEFAULT_STRINGS the single source of keys —
-// the model never hand-transcribes the key set.
-// Usage: bun artifact-strings-scaffold.ts <language> [generatedISO]
-
-import { DEFAULT_STRINGS } from './lib/artifact-strings';
-
-const language = process.argv[2] || 'en';
-const generated = process.argv[3] || '';
-process.stdout.write(JSON.stringify({ language, generated, strings: DEFAULT_STRINGS }, null, 2) + '\n');
diff --git a/plugins/claude-code-hermit/scripts/artifact.ts b/plugins/claude-code-hermit/scripts/artifact.ts
new file mode 100644
index 00000000..c8622f5d
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/artifact.ts
@@ -0,0 +1,92 @@
+// artifact.ts — single CLI for the Artifact-page renderers and the
+// artifact-strings scaffold. One script per page was three copies of the same
+// twelve lines: resolve an out path, render, mkdir -p, write, print the
+// {path,bytes,hash} receipt, exit 1 on anything thrown.
+//
+// Usage:
+//   bun artifact.ts render <dashboard|proposals|weekly> <hermit-state-dir> [outPath]
+//     Renders the page to disk. Prints {"path":…,"bytes":…,"hash":…} on success;
+//     exits 1 on failure. The refresh protocols in docs/artifacts.md treat any
+//     failure as "skip silently", so the stderr text is diagnostic only — the
+//     exit code is the contract.
+//
+//   bun artifact.ts scaffold-strings <language> [generatedISO]
+//     Prints the artifact-strings.json scaffold with every chrome key at its
+//     English default, for a language-set skill (hatch / hermit-settings) to
+//     translate the *values* in place and write to state/artifact-strings.json.
+//     Keeps DEFAULT_STRINGS the single source of keys — the model never
+//     hand-transcribes the key set.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadDashboardState, renderDashboard } from './lib/dashboard';
+import { loadProposalsPageState, renderProposalsPage } from './lib/proposals-page';
+import { renderWeeklyArtifact } from './lib/weekly-artifact';
+import { DEFAULT_STRINGS } from './lib/artifact-strings';
+
+interface Rendered { content: string; hash: string }
+
+// Each page contributes only what actually differs between them: where it lands
+// by default, and how its bytes are produced.
+const PAGES: Record<string, { defaultOut: (dir: string) => string; render: (dir: string) => Rendered }> = {
+  dashboard: {
+    defaultOut: dir => path.join(dir, 'state', 'dashboard.html'),
+    render: dir => {
+      const { html, hash } = renderDashboard(loadDashboardState(dir));
+      return { content: html, hash };
+    },
+  },
+  proposals: {
+    defaultOut: dir => path.join(dir, 'state', 'proposals-page.html'),
+    render: dir => {
+      const { html, hash } = renderProposalsPage(loadProposalsPageState(dir));
+      return { content: html, hash };
+    },
+  },
+  weekly: {
+    defaultOut: dir => path.join(dir, 'state', 'weekly-review-artifact.md'),
+    render: renderWeeklyArtifact,
+  },
+};
+
+const PAGE_NAMES = Object.keys(PAGES).join('|');
+const USAGE = `Usage: bun artifact.ts render <${PAGE_NAMES}> <hermit-state-dir> [outPath]\n` +
+              `       bun artifact.ts scaffold-strings <language> [generatedISO]`;
+
+function usage(): never {
+  console.error(USAGE);
+  process.exit(1);
+}
+
+function verbRender(page: string | undefined, hermitDir: string | undefined, outArg: string | undefined): void {
+  if (!page || !hermitDir) usage();
+  const spec = PAGES[page];
+  if (!spec) {
+    console.error(`artifact render: unknown page "${page}" (expected ${PAGE_NAMES})`);
+    process.exit(1);
+  }
+  const outPath = outArg || spec.defaultOut(hermitDir);
+  try {
+    const { content, hash } = spec.render(hermitDir);
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, content, 'utf8');
+    process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(content), hash }) + '\n');
+  } catch (err: any) {
+    console.error(`artifact render ${page}: failed: ${err?.message ?? err}`);
+    process.exit(1);
+  }
+}
+
+function verbScaffoldStrings(language: string | undefined, generated: string | undefined): void {
+  process.stdout.write(
+    JSON.stringify({ language: language || 'en', generated: generated || '', strings: DEFAULT_STRINGS }, null, 2) + '\n',
+  );
+}
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+switch (verb) {
+  case 'render': verbRender(rest[0], rest[1], rest[2]); break;
+  case 'scaffold-strings': verbScaffoldStrings(rest[0], rest[1]); break;
+  default: usage();
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts b/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts
new file mode 100644
index 00000000..c19a1be0
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/weekly-artifact.ts
@@ -0,0 +1,22 @@
+// Weekly-review artifact source: finds the latest compiled/review-weekly-*.md and
+// strips its YAML frontmatter (rendered raw it's an ugly wall of metrics; every
+// field is already legible in the report body's evolution block and the
+// dashboard's weekly section). The Artifact tool renders .md directly — no HTML
+// renderer needed for this page, so unlike lib/dashboard.ts and
+// lib/proposals-page.ts this one has no render step, only a body extraction.
+//
+// Driven by `artifact.ts render weekly`. Throws on no-source/unreadable; the
+// caller turns that into the shared exit-1 path.
+
+import path from 'node:path';
+import { readFileWithFrontmatter, globDir } from './frontmatter';
+import { sha256 } from './hash';
+
+export function renderWeeklyArtifact(hermitDir: string): { content: string; hash: string } {
+  const compiledDir = path.join(hermitDir, 'compiled');
+  const files = globDir(compiledDir, /^review-weekly-.*\.md$/); // YYYY-Wnn sorts chronologically by name
+  if (files.length === 0) throw new Error('no compiled/review-weekly-*.md found');
+  const latest = readFileWithFrontmatter(files[files.length - 1]);
+  if (!latest) throw new Error('latest weekly review file unreadable');
+  return { content: latest.body, hash: sha256(latest.body) };
+}
diff --git a/plugins/claude-code-hermit/scripts/render-dashboard.ts b/plugins/claude-code-hermit/scripts/render-dashboard.ts
deleted file mode 100644
index 225c8e39..00000000
--- a/plugins/claude-code-hermit/scripts/render-dashboard.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-// render-dashboard.ts — renders the Hermit Dashboard artifact fragment to disk.
-// Usage: bun render-dashboard.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the Dashboard Refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { loadDashboardState, renderDashboard } from './lib/dashboard';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-dashboard.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'dashboard.html');
-
-try {
-  const state = loadDashboardState(hermitDir);
-  const { html, hash } = renderDashboard(state);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, html, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(html), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-dashboard: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/scripts/render-proposals-page.ts b/plugins/claude-code-hermit/scripts/render-proposals-page.ts
deleted file mode 100644
index 03c95d35..00000000
--- a/plugins/claude-code-hermit/scripts/render-proposals-page.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-// render-proposals-page.ts — renders the Hermit Proposals-page artifact fragment to disk.
-// Usage: bun render-proposals-page.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the artifacts.md refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { loadProposalsPageState, renderProposalsPage } from './lib/proposals-page';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-proposals-page.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'proposals-page.html');
-
-try {
-  const state = loadProposalsPageState(hermitDir);
-  const { html, hash } = renderProposalsPage(state);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, html, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(html), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-proposals-page: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts b/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts
deleted file mode 100644
index ac1d4df6..00000000
--- a/plugins/claude-code-hermit/scripts/render-weekly-artifact.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-// render-weekly-artifact.ts — finds the latest compiled/review-weekly-*.md and
-// strips its YAML frontmatter (rendered raw it's an ugly wall of metrics; every
-// field is already legible in the report body's evolution block and the
-// dashboard's weekly section), writing the plain markdown body to disk. The
-// Artifact tool renders .md directly — no HTML renderer needed for this page.
-// Usage: bun render-weekly-artifact.ts <hermit-state-dir> [outPath]
-// Prints {"path":..., "bytes":..., "hash":...} on success; exits 1 on failure
-// (caller — the artifacts.md refresh protocol — treats any failure as "skip silently").
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { readFileWithFrontmatter, globDir } from './lib/frontmatter';
-import { sha256 } from './lib/hash';
-
-const hermitDir = process.argv[2];
-if (!hermitDir) {
-  console.error('Usage: bun render-weekly-artifact.ts <hermit-state-dir> [outPath]');
-  process.exit(1);
-}
-
-const outPath = process.argv[3] || path.join(hermitDir, 'state', 'weekly-review-artifact.md');
-
-try {
-  const compiledDir = path.join(hermitDir, 'compiled');
-  const files = globDir(compiledDir, /^review-weekly-.*\.md$/); // YYYY-Wnn sorts chronologically by name
-  if (files.length === 0) {
-    console.error('render-weekly-artifact: no compiled/review-weekly-*.md found');
-    process.exit(1);
-  }
-  const latest = readFileWithFrontmatter(files[files.length - 1]);
-  if (!latest) {
-    console.error('render-weekly-artifact: latest weekly review file unreadable');
-    process.exit(1);
-  }
-  const body = latest.body;
-  const hash = sha256(body);
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, body, 'utf8');
-  process.stdout.write(JSON.stringify({ path: outPath, bytes: Buffer.byteLength(body), hash }) + '\n');
-} catch (err: any) {
-  console.error(`render-weekly-artifact: failed: ${err?.message ?? err}`);
-  process.exit(1);
-}
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index a86c01da..1e22e3dd 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -378,7 +378,7 @@ The script-rendered Artifact pages (dashboard, proposals) read their fixed UI ch
 
 Run **only** when the chosen `language` is set and is not `en`:
 
-1. Emit the English scaffold: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact-strings-scaffold.ts <language> <current-ISO-timestamp>`.
+1. Emit the English scaffold: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts scaffold-strings <language> <current-ISO-timestamp>`.
 2. Translate every value inside the `strings` object into the operator's language. Leave the keys and any `{placeholder}` tokens **verbatim** (word order may move around a token, but the token text must not change or be translated). Leave the `language` and `generated` fields as emitted.
 3. Write the result to `.claude-code-hermit/state/artifact-strings.json`.
 
diff --git a/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md b/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
index 2d9ad29a..653640a2 100644
--- a/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-settings/SKILL.md
@@ -120,7 +120,7 @@ Auto-detect the system locale via Bash as a default suggestion.
 Ask: "Preferred language? (e.g., pt, en, es, fr) [current value or auto-detected]"
 Run `settings-edit ... set language <value>`.
 Then re-sync the artifact-chrome translation table (the dashboard/proposals pages overlay `.claude-code-hermit/state/artifact-strings.json` per key over the English defaults):
-- New value is **not** `en`: emit `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact-strings-scaffold.ts <value> <current-ISO-timestamp>`, translate every `strings` value into that language (keep keys and `{placeholder}` tokens verbatim), and write `.claude-code-hermit/state/artifact-strings.json`.
+- New value is **not** `en`: emit `bun ${CLAUDE_PLUGIN_ROOT}/scripts/artifact.ts scaffold-strings <value> <current-ISO-timestamp>`, translate every `strings` value into that language (keep keys and `{placeholder}` tokens verbatim), and write `.claude-code-hermit/state/artifact-strings.json`.
 - New value is `en`: delete `.claude-code-hermit/state/artifact-strings.json` if it exists (absent file ⇒ English chrome).
 
 **If argument is "timezone":**
diff --git a/plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts b/plugins/claude-code-hermit/tests/artifact-render.test.ts
similarity index 76%
rename from plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts
rename to plugins/claude-code-hermit/tests/artifact-render.test.ts
index 2e807ddc..d5ffea1f 100644
--- a/plugins/claude-code-hermit/tests/render-weekly-artifact.test.ts
+++ b/plugins/claude-code-hermit/tests/artifact-render.test.ts
@@ -1,5 +1,5 @@
-// bun test for scripts/render-weekly-artifact.ts — weekly-review passthrough CLI.
-// Usage: bun test tests/render-weekly-artifact.test.ts   (from the plugin root)
+// bun test for artifact.ts's weekly render verb — weekly-review passthrough.
+// Usage: bun test tests/artifact-render.test.ts   (from the plugin root)
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
@@ -27,10 +27,10 @@ function writeWeekly(hermitDir: string, week: string, fm: Record<string, string>
   fs.writeFileSync(path.join(hermitDir, 'compiled', `review-weekly-${week}.md`), `---\n${yaml}\n---\n${body}\n`);
 }
 
-describe('render-weekly-artifact.ts', () => {
+describe('artifact.ts render weekly', () => {
   test('strips frontmatter, keeps the body intact', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27', total_cost_usd: '3.21' }, '# Weekly Review — 2026-W27\n\nBody content here.');
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(0);
     const outPath = path.join(hermitDir, 'state', 'weekly-review-artifact.md');
     const written = fs.readFileSync(outPath, 'utf8');
@@ -43,7 +43,7 @@ describe('render-weekly-artifact.ts', () => {
   test('picks the latest week by filename sort', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W26', { week: '2026-W26' }, 'Older body.');
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Newer body.');
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(0);
     const written = fs.readFileSync(path.join(hermitDir, 'state', 'weekly-review-artifact.md'), 'utf8');
     expect(written).toContain('Newer body.');
@@ -52,8 +52,8 @@ describe('render-weekly-artifact.ts', () => {
 
   test('hash is stable for identical content across runs', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Stable body.');
-    const a = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
-    const b = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const a = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
+    const b = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     const hashA = JSON.parse(a.stdout).hash;
     const hashB = JSON.parse(b.stdout).hash;
     expect(hashA).toBe(hashB);
@@ -61,14 +61,14 @@ describe('render-weekly-artifact.ts', () => {
 
   test('hash changes when the compiled report changes', withHermitDir(async (hermitDir) => {
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Version one.');
-    const before = JSON.parse((await runScript('render-weekly-artifact.ts', { args: [hermitDir] })).stdout);
+    const before = JSON.parse((await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] })).stdout);
     writeWeekly(hermitDir, '2026-W27', { week: '2026-W27' }, 'Version two.');
-    const after = JSON.parse((await runScript('render-weekly-artifact.ts', { args: [hermitDir] })).stdout);
+    const after = JSON.parse((await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] })).stdout);
     expect(before.hash).not.toBe(after.hash);
   }));
 
   test('exits non-zero when no compiled weekly review exists', withHermitDir(async (hermitDir) => {
-    const r = await runScript('render-weekly-artifact.ts', { args: [hermitDir] });
+    const r = await runScript('artifact.ts', { args: ['render', 'weekly', hermitDir] });
     expect(r.exitCode).toBe(1);
   }));
 });

From effca117b59ab5f050fd3f4654573f28204d98c2 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 18:37:00 +0100
Subject: [PATCH 5/9] refactor(claude-code-hermit): one cost-report.ts over the
 three cost readouts

today-cost.ts, session-cost.ts and cost-reflect.ts become `cost-report.ts
today|session|reflect` over lib/cost-report/{today,session,reflect}.ts.

All three stay fail-open readers, which is the property that matters: an
unreadable log still prints "cost data unavailable" rather than a misleading
$0.00, session still prints {"cost_usd":0,"tokens":0}, and reflect still turns
a throw into a one-line error at exit 0. Their callers are morning briefs and
channel replies that have to compose even when there is no cost data.

Two threading points were the risk in this move and both were checked against
the pre-move files: session's --opened-at/--closed-at overrides were module
scope closure variables and are now explicit parameters to readWindow(), with
the same ?? precedence; and reflect's argv indices still line up, since the
dispatcher passes argv.slice(3) where the old script read argv.slice(2) and the
verb now occupies the slot that shifted.

Fixes a cost the consolidation itself introduced: session.ts and today.ts each
resolved hermitDir() at MODULE scope, and cost-report.ts imports every verb
module unconditionally, so hermitDir()'s fs.existsSync walk (up to 8 levels)
ran on every invocation regardless of verb. Both now resolve inside run(),
matching what reflect.ts already did.

Not addressed here, and worth its own change: today, session and
lib/session-cost.ts each carry a separate "read cost-log.jsonl, JSON.parse each
line, accumulate" loop. That triplication predates this move. It is not a naive
merge either - the three have different predicates (today-only, exact-match,
window-range) and different fail-open shapes - and lib/cost-log.ts is not a
drop-in, because it buckets by configured timezone where today deliberately
uses a raw UTC slice.

bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0.
---
 plugins/claude-code-hermit/CHANGELOG.md       |  2 +
 plugins/claude-code-hermit/CLAUDE.md          |  2 +-
 .../claude-code-hermit/scripts/cost-report.ts | 35 ++++++++
 .../cost-report/reflect.ts}                   | 32 +++++---
 .../scripts/lib/cost-report/session.ts        | 80 +++++++++++++++++++
 .../cost-report/today.ts}                     | 19 +++--
 .../scripts/lib/session-cost.ts               |  6 +-
 .../scripts/lib/spend-status.ts               |  2 +-
 .../scripts/session-cost.ts                   | 75 -----------------
 .../claude-code-hermit/skills/brief/SKILL.md  |  4 +-
 .../skills/brief/reference.md                 |  2 +-
 .../skills/cost-reflect/SKILL.md              |  4 +-
 .../skills/hermit-evolution/reference.md      |  2 +-
 ...in.test.ts => cost-report-reflect.test.ts} |  4 +-
 ...st.test.ts => cost-report-session.test.ts} | 41 ++++------
 ...cost.test.ts => cost-report-today.test.ts} | 12 +--
 .../tests/cost-tracker.test.ts                |  2 +-
 .../claude-code-hermit/tests/scripts.test.ts  |  4 +-
 18 files changed, 186 insertions(+), 142 deletions(-)
 create mode 100644 plugins/claude-code-hermit/scripts/cost-report.ts
 rename plugins/claude-code-hermit/scripts/{cost-reflect.ts => lib/cost-report/reflect.ts} (93%)
 create mode 100644 plugins/claude-code-hermit/scripts/lib/cost-report/session.ts
 rename plugins/claude-code-hermit/scripts/{today-cost.ts => lib/cost-report/today.ts} (62%)
 delete mode 100644 plugins/claude-code-hermit/scripts/session-cost.ts
 rename plugins/claude-code-hermit/tests/{cost-reflect-plain.test.ts => cost-report-reflect.test.ts} (97%)
 rename plugins/claude-code-hermit/tests/{session-cost.test.ts => cost-report-session.test.ts} (86%)
 rename plugins/claude-code-hermit/tests/{today-cost.test.ts => cost-report-today.test.ts} (88%)

diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index f3640c95..9ed40522 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -35,6 +35,7 @@
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 - The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
 - Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- The three cost readouts are `cost-report.ts` verbs: `today`, `session <id> [--opened-at --closed-at]`, `reflect [<dir>] [<days>] [--plain]`, over `lib/cost-report/{today,session,reflect}.ts`. All three stay fail-open readers — an unreadable log still prints `cost data unavailable` rather than a misleading `$0.00`, and `reflect` still turns a throw into a one-line error at exit 0 — because their callers are briefs and channel replies that must compose without cost data.
 - The three Artifact-page renderers and the strings scaffold are `artifact.ts` verbs: `render dashboard|proposals|weekly` and `scaffold-strings`. The `{path,bytes,hash}` receipt, the default out paths, and exit-1-on-failure are unchanged — the refresh protocols hash-gate on that receipt. The weekly page's frontmatter-strip moved to `lib/weekly-artifact.ts`, beside the dashboard and proposals-page renderer libs.
 - `proposal-metrics-report.ts` and `eval-success-signal.ts` had no allow entry and were prompted for on every run; as `proposal.ts` verbs they are covered by the existing `proposal.ts` grant and run unattended. That is an authority change: a headless brainstorm kill-check and a success-signal validation now proceed without asking.
 
@@ -42,6 +43,7 @@
 - `next-prop-id.ts`, which had no production caller — `proposal.ts create` claims IDs atomically via exclusive file create. The prediction-only helpers behind it (`nextPropId`, `resolveSuffix`, `PropIdParts`) go with it; `computeBase`, `slugify`, and `SUFFIX_LETTERS` stay.
 - Seven top-level proposal scripts, absorbed into `proposal.ts` verbs: `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `proposals-index.ts`, `proposal-metrics-report.ts`, `eval-success-signal.ts`.
 - Four top-level artifact scripts, absorbed into `artifact.ts` verbs: `render-dashboard.ts`, `render-proposals-page.ts`, `render-weekly-artifact.ts`, `artifact-strings-scaffold.ts`.
+- Three top-level cost scripts, absorbed into `cost-report.ts` verbs: `today-cost.ts`, `session-cost.ts`, `cost-reflect.ts`. (`lib/session-cost.ts`, the shared window-cost algorithm, is unrelated and stays.)
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
diff --git a/plugins/claude-code-hermit/CLAUDE.md b/plugins/claude-code-hermit/CLAUDE.md
index acfae527..5e01bc84 100644
--- a/plugins/claude-code-hermit/CLAUDE.md
+++ b/plugins/claude-code-hermit/CLAUDE.md
@@ -108,7 +108,7 @@ bun test
   Hooks and helper scripts print verdict-sized digests, never raw logs or full state dumps
   (everything a hook prints on success is injected into context). Skills must not `Read`
   unbounded surfaces (`cost-log.jsonl`, `*.jsonl` event logs, the channel DB) directly —
-  front them with a script that returns a bounded summary (the `session-cost.ts` /
+  front them with a script that returns a bounded summary (the `cost-report.ts` /
   `heartbeat-precheck.ts` / `lib/search.ts` pattern); a bounded slice (e.g. reflect's
   tail-20 of cost-log) is the ceiling, not the norm. Session-start injection
   (`startup-context.ts`, `generate-summary.ts`) is the largest recurring cost — a new
diff --git a/plugins/claude-code-hermit/scripts/cost-report.ts b/plugins/claude-code-hermit/scripts/cost-report.ts
new file mode 100644
index 00000000..195ea949
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/cost-report.ts
@@ -0,0 +1,35 @@
+// cost-report.ts — single CLI for the three cost readouts, over
+// lib/cost-report/{today,session,reflect}.ts.
+//
+// Usage:
+//   bun cost-report.ts today
+//     "$X.XX (<tokens>) across N session(s)" for today. An unreadable log prints
+//     "cost data unavailable" rather than a misleading $0.00.
+//
+//   bun cost-report.ts session <session_id> [--opened-at <iso>] [--closed-at <iso>]
+//     {"cost_usd":<n>,"tokens":<n>} for one logical session's arc window.
+//
+//   bun cost-report.ts reflect [<stateDir>] [<days>] [--plain]
+//     The spend breakdown; --plain is the channel-safe prose form.
+//
+// Each verb keeps the exit code and stdout grammar it had as its own script —
+// all three are fail-open readers (exit 0 even with no data), because their
+// callers are briefs and channel replies that must still compose without cost.
+
+import { run as runToday } from './lib/cost-report/today';
+import { run as runSession } from './lib/cost-report/session';
+import { run as runReflect } from './lib/cost-report/reflect';
+
+const USAGE = 'Usage: bun cost-report.ts <today|session|reflect> [args...]';
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+
+switch (verb) {
+  case 'today': runToday(); break;
+  case 'session': runSession(rest); break;
+  case 'reflect': runReflect(rest); break;
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/cost-reflect.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
similarity index 93%
rename from plugins/claude-code-hermit/scripts/cost-reflect.ts
rename to plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
index 54aadd20..f7dea63c 100644
--- a/plugins/claude-code-hermit/scripts/cost-reflect.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/reflect.ts
@@ -1,11 +1,16 @@
+// `cost-report.ts reflect [<stateDir>] [<days>] [--plain]` — the "why is my bill
+// like this" report. Table mode is the full per-model/per-source breakdown;
+// --plain is the channel-safe prose answer. Fail-open: any throw becomes a
+// one-line error on stdout at exit 0, never a blocked caller.
+
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { costByType } from './lib/pricing';
-import { loadConfig } from './lib/channel-auth';
-import { money, resolveTimezone, budgetLine } from './lib/spend-status';
-import { todayYMD } from './lib/time';
-import { costLogPath, hermitDir } from './lib/cc-compat';
+import { costByType } from '../pricing';
+import { loadConfig } from '../channel-auth';
+import { money, resolveTimezone, budgetLine } from '../spend-status';
+import { todayYMD } from '../time';
+import { costLogPath, hermitDir } from '../cc-compat';
 
 type Json = any;
 
@@ -134,8 +139,7 @@ function buildPlainStatement(stateDir: string, costLog: string): string {
   return lines.join('\n') + '\n';
 }
 
-function run() {
-  const rawArgs = process.argv.slice(2);
+function report(rawArgs: string[]) {
   const plainMode = rawArgs.includes('--plain');
   const positional = rawArgs.filter(a => a !== '--plain');
   // An absolute arg (as tests pass) is used verbatim; a relative/absent arg is
@@ -316,10 +320,12 @@ function run() {
   }
 }
 
-try {
-  run();
-} catch (err: any) {
-  // Fail-open: never block on a cost-reflect failure
-  process.stdout.write(`cost-reflect: error — ${err.message}\n`);
-  process.exit(0);
+export function run(args: string[]): void {
+  try {
+    report(args);
+  } catch (err: any) {
+    // Fail-open: never block on a cost-reflect failure
+    process.stdout.write(`cost-reflect: error — ${err.message}\n`);
+    process.exit(0);
+  }
 }
diff --git a/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts
new file mode 100644
index 00000000..599e72e7
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/session.ts
@@ -0,0 +1,80 @@
+// `cost-report.ts session <session_id> [--opened-at <iso>] [--closed-at <iso>]`
+// Sums cost-log.jsonl entries for the current logical session and prints the result.
+// Output: JSON {"cost_usd": <number>, "tokens": <number>}
+//
+// Primary mode: window-delta. cost-log.jsonl rows are tagged with the transcript's
+// process session_id (a UUID), never the logical S-NNN id (assigned only at close),
+// and one long-lived transcript holds many logical sessions — so an exact session_id
+// match against S-NNN always misses. Instead, sum every row whose timestamp falls in
+// the arc window [opened_at, closed_at]. Both bounds are read from state/runtime.json
+// (maintained by cost-tracker.ts: opened_at re-stamped per arc keyed on the transcript
+// id, closed_at stamped on the idle transition) unless overridden via --opened-at /
+// --closed-at. A live arc has no closed_at yet, so the window ends at now.
+//
+// Fallback mode: when no opened_at is available (older runtime.json, or none yet),
+// fail open to the legacy exact session_id sum — same zeros-for-unknown-id behavior
+// as before.
+// Fails open throughout: missing log or unreadable state prints {"cost_usd": 0, "tokens": 0}.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { costLogPath, hermitDir } from '../cc-compat';
+import { readRuntimeJson } from '../runtime';
+import { computeSessionCost } from '../session-cost';
+
+// Arc-window rationale is in the file header above; this just applies the
+// --opened-at / --closed-at overrides on top of runtime.json's values.
+function readWindow(root: string, openedAtOverride?: string, closedAtOverride?: string): { openedAt?: string; closedAt?: string } {
+  const rt = readRuntimeJson(path.join(root, 'state')) || {};
+  return {
+    openedAt: openedAtOverride ?? (typeof rt.opened_at === 'string' ? rt.opened_at : undefined),
+    closedAt: closedAtOverride ?? (typeof rt.closed_at === 'string' ? rt.closed_at : undefined),
+  };
+}
+
+function sumMatching(costLog: string, predicate: (e: any) => boolean): { cost: number; tokens: number } {
+  let cost = 0;
+  let tokens = 0;
+  try {
+    for (const line of fs.readFileSync(costLog, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const e = JSON.parse(line);
+        if (predicate(e)) {
+          cost += e.estimated_cost_usd || 0;
+          tokens += e.total_tokens || 0;
+        }
+      } catch {}
+    }
+  } catch {}
+  return { cost, tokens };
+}
+
+// root/costLog are resolved here, not at module scope: cost-report.ts imports
+// every verb module unconditionally, and hermitDir() is an fs.existsSync walk up
+// to 8 levels — at module scope it would run on every invocation, including the
+// verbs that never touch it. reflect.ts already resolves inside its own entry.
+export function run(argv: string[]): void {
+  const root = hermitDir();
+  const costLog = costLogPath(root);
+
+  let sessionId = '';
+  let openedAtOverride: string | undefined;
+  let closedAtOverride: string | undefined;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--opened-at') { openedAtOverride = argv[++i]; continue; }
+    if (a === '--closed-at') { closedAtOverride = argv[++i]; continue; }
+    if (!sessionId) sessionId = a;
+  }
+
+  const { openedAt, closedAt } = readWindow(root, openedAtOverride, closedAtOverride);
+  const measured = computeSessionCost({ logPath: costLog, openedAt, closedAt });
+
+  // Window mode unavailable (no opened_at) — fall back to the legacy exact-match sum.
+  const result = measured.available
+    ? { cost: measured.cost_usd, tokens: measured.tokens }
+    : sumMatching(costLog, e => e.session_id === sessionId);
+
+  process.stdout.write(JSON.stringify({ cost_usd: Math.round(result.cost * 10000) / 10000, tokens: result.tokens }) + '\n');
+}
diff --git a/plugins/claude-code-hermit/scripts/today-cost.ts b/plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
similarity index 62%
rename from plugins/claude-code-hermit/scripts/today-cost.ts
rename to plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
index 8d1e3c48..71ffb826 100644
--- a/plugins/claude-code-hermit/scripts/today-cost.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cost-report/today.ts
@@ -1,19 +1,19 @@
-// Prints today's spend: "$X.XX (<tokens>) across N session(s)".
+// `cost-report.ts today` — prints today's spend as
+// "$X.XX (<tokens>) across N session(s)".
 // Log resolved against the anchored hermit root (survives cwd drift), not cwd.
 // Unreadable log -> "cost data unavailable" (not a misleading $0.00); a readable
 // log with no rows today -> honest $0.00.
 
 import fs from 'node:fs';
-import { formatTokens } from './lib/format';
-import { costLogPath, hermitDir } from './lib/cc-compat';
+import { formatTokens } from '../format';
+import { costLogPath, hermitDir } from '../cc-compat';
 
-const COST_LOG = costLogPath(hermitDir());
 const UNAVAILABLE = 'cost data unavailable';
 
-function render(): string {
+function render(costLog: string): string {
   let raw: string;
   try {
-    raw = fs.readFileSync(COST_LOG, 'utf8');
+    raw = fs.readFileSync(costLog, 'utf8');
   } catch {
     return UNAVAILABLE;
   }
@@ -39,4 +39,9 @@ function render(): string {
   }
 }
 
-process.stdout.write(render() + '\n');
+// Resolved here rather than at module scope — see the note in session.ts: every
+// verb module is imported unconditionally, so a module-scope hermitDir() walk
+// would run even for the verbs that never read it.
+export function run(): void {
+  process.stdout.write(render(costLogPath(hermitDir())) + '\n');
+}
diff --git a/plugins/claude-code-hermit/scripts/lib/session-cost.ts b/plugins/claude-code-hermit/scripts/lib/session-cost.ts
index 4d726193..5cc0e458 100644
--- a/plugins/claude-code-hermit/scripts/lib/session-cost.ts
+++ b/plugins/claude-code-hermit/scripts/lib/session-cost.ts
@@ -1,7 +1,7 @@
-// Shared window-cost algorithm used by scripts/session-cost.ts (CLI) and
+// Shared window-cost algorithm used by cost-report.ts's session verb and
 // scripts/session-archive.ts (report frontmatter). Pure: caller supplies the
-// [openedAt, closedAt] arc bounds (from state/runtime.json — see session-cost.ts's
-// header for the arc-window rationale) and the cost-log path; no env/argv reads here.
+// [openedAt, closedAt] arc bounds (from state/runtime.json — see cost-report.ts's
+// session verb header for the arc-window rationale) and the cost-log path; no env/argv reads here.
 //
 // `available` is the contract callers branch on, not `cost_usd === 0` — a session
 // with a real opened_at but zero matching cost-log rows is a MEASURED zero and must
diff --git a/plugins/claude-code-hermit/scripts/lib/spend-status.ts b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
index 3b4a3bd5..251d586d 100644
--- a/plugins/claude-code-hermit/scripts/lib/spend-status.ts
+++ b/plugins/claude-code-hermit/scripts/lib/spend-status.ts
@@ -1,5 +1,5 @@
 // Operator-language cap-status composition, shared by lib/prompt-stages/channel-status-responder.ts
-// (the deterministic `status` hook) and cost-reflect.ts (the --plain channel mode)
+// (the deterministic `status` hook) and cost-report.ts's reflect verb (the --plain channel mode)
 // so the two surfaces can't drift on how a spend cap is phrased. Lives here rather
 // than in lib/budget.ts (which is pure evaluation, no I/O) because budgetLine reads
 // the cost index.
diff --git a/plugins/claude-code-hermit/scripts/session-cost.ts b/plugins/claude-code-hermit/scripts/session-cost.ts
deleted file mode 100644
index a920dde2..00000000
--- a/plugins/claude-code-hermit/scripts/session-cost.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-// Sums cost-log.jsonl entries for the current logical session and prints the result.
-// Usage: bun session-cost.ts <session_id> [--opened-at <iso>] [--closed-at <iso>]
-// Output: JSON {"cost_usd": <number>, "tokens": <number>}
-//
-// Primary mode: window-delta. cost-log.jsonl rows are tagged with the transcript's
-// process session_id (a UUID), never the logical S-NNN id (assigned only at close),
-// and one long-lived transcript holds many logical sessions — so an exact session_id
-// match against S-NNN always misses. Instead, sum every row whose timestamp falls in
-// the arc window [opened_at, closed_at]. Both bounds are read from state/runtime.json
-// (maintained by cost-tracker.ts: opened_at re-stamped per arc keyed on the transcript
-// id, closed_at stamped on the idle transition) unless overridden via --opened-at /
-// --closed-at. A live arc has no closed_at yet, so the window ends at now.
-//
-// Fallback mode: when no opened_at is available (older runtime.json, or none yet),
-// fail open to the legacy exact session_id sum — same zeros-for-unknown-id behavior
-// as before.
-// Fails open throughout: missing log or unreadable state prints {"cost_usd": 0, "tokens": 0}.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { costLogPath, hermitDir } from './lib/cc-compat';
-import { readRuntimeJson } from './lib/runtime';
-import { computeSessionCost } from './lib/session-cost';
-
-const ROOT = hermitDir();
-const COST_LOG = costLogPath(ROOT);
-
-const argv = process.argv.slice(2);
-let sessionId = '';
-let openedAtOverride: string | undefined;
-let closedAtOverride: string | undefined;
-for (let i = 0; i < argv.length; i++) {
-  const a = argv[i];
-  if (a === '--opened-at') { openedAtOverride = argv[++i]; continue; }
-  if (a === '--closed-at') { closedAtOverride = argv[++i]; continue; }
-  if (!sessionId) sessionId = a;
-}
-
-// Arc-window rationale is in the file header above; this just applies the
-// --opened-at / --closed-at overrides on top of runtime.json's values.
-function readWindow(): { openedAt?: string; closedAt?: string } {
-  const rt = readRuntimeJson(path.join(ROOT, 'state')) || {};
-  return {
-    openedAt: openedAtOverride ?? (typeof rt.opened_at === 'string' ? rt.opened_at : undefined),
-    closedAt: closedAtOverride ?? (typeof rt.closed_at === 'string' ? rt.closed_at : undefined),
-  };
-}
-
-function sumMatching(predicate: (e: any) => boolean): { cost: number; tokens: number } {
-  let cost = 0;
-  let tokens = 0;
-  try {
-    for (const line of fs.readFileSync(COST_LOG, 'utf8').split('\n')) {
-      if (!line.trim()) continue;
-      try {
-        const e = JSON.parse(line);
-        if (predicate(e)) {
-          cost += e.estimated_cost_usd || 0;
-          tokens += e.total_tokens || 0;
-        }
-      } catch {}
-    }
-  } catch {}
-  return { cost, tokens };
-}
-
-const { openedAt, closedAt } = readWindow();
-const measured = computeSessionCost({ logPath: COST_LOG, openedAt, closedAt });
-
-// Window mode unavailable (no opened_at) — fall back to the legacy exact-match sum.
-const result = measured.available
-  ? { cost: measured.cost_usd, tokens: measured.tokens }
-  : sumMatching(e => e.session_id === sessionId);
-
-process.stdout.write(JSON.stringify({ cost_usd: Math.round(result.cost * 10000) / 10000, tokens: result.tokens }) + '\n');
diff --git a/plugins/claude-code-hermit/skills/brief/SKILL.md b/plugins/claude-code-hermit/skills/brief/SKILL.md
index c3ae9172..dc0a8987 100644
--- a/plugins/claude-code-hermit/skills/brief/SKILL.md
+++ b/plugins/claude-code-hermit/skills/brief/SKILL.md
@@ -79,7 +79,7 @@ After composing the morning brief, age the micro-proposal queue in one pass: run
 
 Emphasize backward-looking content. Compose from runner JSON (see Dispatch above) and live main-session data:
 - **Sessions today:** use `runner.sessions_today`; also note any progress in the current SHELL.md progress log (read SHELL.md in main **(fresh read — re-read the file(s) now; do not reuse a value cached in context from before compaction)**).
-- **Today's cost:** run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/today-cost.ts"` (live, in main) — do not use `cost-summary.md` for today's figure; it is only updated once per day and will be stale in always-on deployments.
+- **Today's cost:** run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts today"` (live, in main) — do not use `cost-summary.md` for today's figure; it is only updated once per day and will be stale in always-on deployments.
 - **Key findings:** use `runner.findings`
 - **Tomorrow:** use `runner.tomorrow`
 - After generating summary: if `runtime.json session_state` is `in_progress` or SHELL.md has progress entries since last report, note it in the brief (e.g., "Session still open — run /session-close to archive.") and let the operator close explicitly. Exception: if `config.always_on` is `true` AND `config.routines` contains an enabled entry with `id` `daily-auto-close` (the midnight routine, which invokes `/claude-code-hermit:session-close --scheduled`), suppress the note — the auto-close routine archives it at midnight. Idle transitions are owned by the `session` skill and `scripts/session-archive.ts`; brief does not trigger them.
@@ -130,4 +130,4 @@ Next: description of next action (or "Session complete" if all done)
 
 When invoked with "brief today", "daily summary", or "what happened today":
 
-Compose from runner JSON (mode: `daily`). For today's cost and token total, run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/today-cost.ts"` (live, in main). Use `runner.cost_context.week` and `runner.cost_context.all_time` for aggregates from `cost-summary.md`. Use `runner.sessions_today`, `runner.findings`, and `runner.tomorrow` for the day narrative. Format as a day-level summary covering: work done, cost, and proposals created/resolved.
+Compose from runner JSON (mode: `daily`). For today's cost and token total, run `bun "${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts today"` (live, in main). Use `runner.cost_context.week` and `runner.cost_context.all_time` for aggregates from `cost-summary.md`. Use `runner.sessions_today`, `runner.findings`, and `runner.tomorrow` for the day narrative. Format as a day-level summary covering: work done, cost, and proposals created/resolved.
diff --git a/plugins/claude-code-hermit/skills/brief/reference.md b/plugins/claude-code-hermit/skills/brief/reference.md
index b2665d89..2b941a3c 100644
--- a/plugins/claude-code-hermit/skills/brief/reference.md
+++ b/plugins/claude-code-hermit/skills/brief/reference.md
@@ -71,7 +71,7 @@ The calling skill passes the following scalars in the dispatch prompt (do not re
    Sessions values and the already magnitude-suffixed Tokens figure from the `## This Week` and
    `## All Time` sections **verbatim** (e.g. `"$1189.14 (532M tokens) across 44 sessions"`) — do
    not reformat or rescale the token count. Set `cost_context.yesterday` to `null` (today's live
-   cost runs in the calling main session via `today-cost.ts`).
+   cost runs in the calling main session via `cost-report.ts today`).
 3. Set `report_summary: null`, `pending_proposals: []`, `operator_priorities: []`, `queued_work: []`.
 
 ### default-no-session
diff --git a/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md b/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
index e84a8c0f..bb7add52 100644
--- a/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
+++ b/plugins/claude-code-hermit/skills/cost-reflect/SKILL.md
@@ -15,13 +15,13 @@ If this skill was invoked from a channel-arrived message (the inbound prompt con
 On a channel-tagged turn (Step 0 detected a `<channel source="...">` tag), run the plain-language mode instead of the full breakdown — a channel operator asking "why is my bill high" shouldn't get raw token-category jargon:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-reflect.ts .claude-code-hermit --plain
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts reflect .claude-code-hermit --plain
 ```
 
 Otherwise (terminal/dev use), run the full breakdown:
 
 ```
-bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-reflect.ts .claude-code-hermit
+bun ${CLAUDE_PLUGIN_ROOT}/scripts/cost-report.ts reflect .claude-code-hermit
 ```
 
 Capture stdout. If the output starts with "No cost data" or "No spend recorded yet", report that message and stop — there's nothing to send.
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
index c5a9067e..6dc6c6d3 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/reference.md
@@ -22,7 +22,7 @@ Steps are independent — read files and run scripts concurrently where possible
    at entries older than 30 days. Use `resolved_at` and `created_at` to compute resolution days.
 4. Run `bun <plugin_root>/scripts/proposal.ts metrics .claude-code-hermit` and
    capture stdout. Skip gracefully if unavailable. (Steps 4 and 5 may run concurrently.)
-5. Run `bun <plugin_root>/scripts/cost-reflect.ts .claude-code-hermit 30` and capture
+5. Run `bun <plugin_root>/scripts/cost-report.ts reflect .claude-code-hermit 30` and capture
    stdout. This produces a 30-day cost breakdown including a `### Cost by source` section. Skip
    gracefully if unavailable.
 6. `.claude-code-hermit/config.json` — read `routines[]` (id, schedule, enabled), `monitors[]`
diff --git a/plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
similarity index 97%
rename from plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
index 6a196765..72ff33e6 100644
--- a/plugins/claude-code-hermit/tests/cost-reflect-plain.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
@@ -66,7 +66,7 @@ function setup(budget: object | null, entries: LogEntry[]): { dir: string; cchDi
 }
 
 async function runPlain(cchDir: string): Promise<string> {
-  const result = await runScript('cost-reflect.ts', { args: [cchDir, '--plain'] });
+  const result = await runScript('cost-report.ts', { args: ['reflect', cchDir, '--plain'] });
   expect(result.exitCode).toBe(0);
   return result.stdout;
 }
@@ -172,7 +172,7 @@ describe('cost-reflect --plain: no-jargon invariant', () => {
 describe('cost-reflect table mode: unaffected by --plain', () => {
   test('default invocation still returns the raw breakdown', async () => {
     const { cchDir } = setup(null, [{ daysAgo: 0, source: 'other' }]);
-    const result = await runScript('cost-reflect.ts', { args: [cchDir, '7'] });
+    const result = await runScript('cost-report.ts', { args: ['reflect', cchDir, '7'] });
     expect(result.exitCode).toBe(0);
     expect(result.stdout).toContain('### Cost by token type');
     expect(result.stdout).toContain('cache_read');
diff --git a/plugins/claude-code-hermit/tests/session-cost.test.ts b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
similarity index 86%
rename from plugins/claude-code-hermit/tests/session-cost.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-session.test.ts
index 91d020d9..08fc204e 100644
--- a/plugins/claude-code-hermit/tests/session-cost.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
@@ -43,7 +43,7 @@ function seedRuntime(dir: string, data: object): string {
   return runtimePath;
 }
 
-describe('session-cost.ts', () => {
+describe('cost-report.ts session', () => {
   test('sums cost and tokens for the target session_id only', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.1234, total_tokens: 10000, source: 'other', model: 'sonnet' },
@@ -51,8 +51,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'S-002', estimated_cost_usd: 0.9999, total_tokens: 99999, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -65,8 +64,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.5, total_tokens: 50000, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-999'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-999'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -76,8 +74,7 @@ describe('session-cost.ts', () => {
 
   test('returns zeros when cost-log is absent', withTmpdir(async (dir) => {
     // no cost-log seeded
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -91,8 +88,7 @@ describe('session-cost.ts', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.25, total_tokens: 25000, source: 'other', model: 'sonnet' },
     ]);
 
-    const r = await runScript('session-cost.ts', {
-      args: ['S-001'], cwd: dir, env: baseEnv(dir),
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
@@ -109,7 +105,7 @@ describe('session-cost.ts', () => {
 // .claude-code-hermit/compiled/audit-live-harness-token-efficiency-2026-07-09.md.
 // -------------------------------------------------------
 
-describe('session-cost.ts: window-delta mode', () => {
+describe('cost-report.ts session: window-delta mode', () => {
   test('sums rows within [opened_at, closed_at], ignoring session_id, boundaries inclusive', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: '2026-06-01T09:59:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.50, total_tokens: 5000, source: 'other' }, // before window
@@ -118,8 +114,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.30, total_tokens: 3000, source: 'other' }, // == closed_at (inclusive)
       { timestamp: '2026-06-01T11:00:01Z', session_id: 'uuid-1', estimated_cost_usd: 0.99, total_tokens: 9999, source: 'other' }, // after window
     ]);
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', '2026-06-01T11:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', '2026-06-01T11:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -134,7 +129,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.50, total_tokens: 500, source: 'other' },  // after opened_at
     ]);
     seedRuntime(dir, { opened_at: '2026-06-01T10:00:00Z' });
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.50, 4);
@@ -147,8 +142,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T09:05:00Z', session_id: 'uuid-shared', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // arc 1
       { timestamp: '2026-06-01T14:00:00Z', session_id: 'uuid-shared', estimated_cost_usd: 0.30, total_tokens: 300, source: 'other' }, // arc 2
     ]);
-    const r = await runScript('session-cost.ts', {
-      args: ['S-YYY', '--opened-at', '2026-06-01T13:00:00Z', '--closed-at', '2026-06-01T15:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-YYY', '--opened-at', '2026-06-01T13:00:00Z', '--closed-at', '2026-06-01T15:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -163,7 +157,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T11:00:00Z', session_id: 'S-002', estimated_cost_usd: 0.9999, total_tokens: 99999, source: 'other' },
     ]);
     seedRuntime(dir, { session_state: 'in_progress' }); // no opened_at key
-    const r = await runScript('session-cost.ts', { args: ['S-001'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.1234, 4);
@@ -175,7 +169,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 0.5, total_tokens: 500, source: 'other' },
     ]);
     seedRuntime(dir, { opened_at: 'not-a-date' });
-    const r = await runScript('session-cost.ts', { args: ['S-001'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-001'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.5, 4);
@@ -188,8 +182,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00.000Z', session_id: 'uuid-1', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // after
     ]);
     // 2026-06-01T12:00:00+02:00 == 2026-06-01T10:00:00Z
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T12:00:00+0200'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T12:00:00+0200'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -200,8 +193,7 @@ describe('session-cost.ts: window-delta mode', () => {
 
   test('missing/absent cost-log in window mode fails open to zeros', withTmpdir(async (dir) => {
     // no cost-log seeded
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -216,7 +208,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T14:00:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.99, total_tokens: 999, source: 'routine:reflect' }, // autonomous, after closed_at → excluded
     ]);
     seedRuntime(dir, { opened_at: '2026-06-01T10:00:00Z', closed_at: '2026-06-01T11:00:00Z' });
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.20, 4);
@@ -228,8 +220,7 @@ describe('session-cost.ts: window-delta mode', () => {
       { timestamp: '2026-06-01T10:30:00Z', session_id: 'uuid-1', estimated_cost_usd: 0.20, total_tokens: 200, source: 'other' }, // inside [opened, now]
     ]);
     // Unparseable --closed-at previously → closedMs NaN → `ts <= NaN` false for every row → false 0.
-    const r = await runScript('session-cost.ts', {
-      args: ['S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', 'not-a-date'],
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX', '--opened-at', '2026-06-01T10:00:00Z', '--closed-at', 'not-a-date'],
       cwd: dir, env: baseEnv(dir),
     });
     expect(r.exitCode).toBe(0);
@@ -247,7 +238,7 @@ describe('session-cost.ts: window-delta mode', () => {
     const hermitRoot = path.join(dir, '.claude-code-hermit');
     fs.writeFileSync(path.join(hermitRoot, 'config.json'), '{}');
     const drifted = path.join(hermitRoot, 'state');
-    const r = await runScript('session-cost.ts', { args: ['S-XXX'], cwd: drifted, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['session', 'S-XXX'], cwd: drifted, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     const out = JSON.parse(r.stdout.trim());
     expect(out.cost_usd).toBeCloseTo(0.50, 4);
diff --git a/plugins/claude-code-hermit/tests/today-cost.test.ts b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
similarity index 88%
rename from plugins/claude-code-hermit/tests/today-cost.test.ts
rename to plugins/claude-code-hermit/tests/cost-report-today.test.ts
index d3949ef7..01cf037d 100644
--- a/plugins/claude-code-hermit/tests/today-cost.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
@@ -42,7 +42,7 @@ function baseEnv(projectDir: string) {
 
 const today = new Date().toISOString().slice(0, 10);
 
-describe('today-cost.ts', () => {
+describe('cost-report.ts today', () => {
   test('drift regression: reports the real total when cwd has drifted into a subdir', withTmpdir(async (dir) => {
     seedCostLog(dir, [
       { timestamp: `${today}T10:00:00Z`, session_id: 'S-001', estimated_cost_usd: 14.91, total_tokens: 28500000, source: 'other' },
@@ -51,7 +51,7 @@ describe('today-cost.ts', () => {
     const drifted = path.join(dir, '.claude-code-hermit', 'proposals');
     fs.mkdirSync(drifted, { recursive: true });
 
-    const r = await runScript('today-cost.ts', { cwd: drifted, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: drifted, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('$14.91 (28.5M tokens) across 1 session(s)');
   }));
@@ -64,7 +64,7 @@ describe('today-cost.ts', () => {
     const drifted = path.join(dir, '.claude-code-hermit', 'proposals');
     fs.mkdirSync(drifted, { recursive: true });
 
-    const r = await runScript('today-cost.ts', {
+    const r = await runScript('cost-report.ts', { args: ['today'],
       cwd: drifted,
       env: { CLAUDE_PLUGIN_ROOT: PLUGIN_ROOT, CLAUDE_PROJECT_DIR: '', AGENT_DIR: '' },
     });
@@ -74,7 +74,7 @@ describe('today-cost.ts', () => {
 
   test('unavailable: cost log absent', withTmpdir(async (dir) => {
     seedHermitRoot(dir);
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('cost data unavailable');
   }));
@@ -82,7 +82,7 @@ describe('today-cost.ts', () => {
   test('unavailable: cost log path is a directory (non-ENOENT read failure)', withTmpdir(async (dir) => {
     seedHermitRoot(dir);
     fs.mkdirSync(path.join(dir, '.claude', 'cost-log.jsonl'), { recursive: true });
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('cost data unavailable');
   }));
@@ -92,7 +92,7 @@ describe('today-cost.ts', () => {
       { timestamp: '2020-01-01T10:00:00Z', session_id: 'S-001', estimated_cost_usd: 5, total_tokens: 5000, source: 'other' },
     ]);
     seedHermitRoot(dir);
-    const r = await runScript('today-cost.ts', { cwd: dir, env: baseEnv(dir) });
+    const r = await runScript('cost-report.ts', { args: ['today'], cwd: dir, env: baseEnv(dir) });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('$0.00 (0 tokens) across 0 session(s)');
   }));
diff --git a/plugins/claude-code-hermit/tests/cost-tracker.test.ts b/plugins/claude-code-hermit/tests/cost-tracker.test.ts
index 1198c07e..16e02ec6 100644
--- a/plugins/claude-code-hermit/tests/cost-tracker.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-tracker.test.ts
@@ -376,7 +376,7 @@ describe('cost-tracker: max_prompt_tokens (real context size vs per-turn sum)',
 
 // ---------------------------------------------------------------------------
 // Subprocess: cost-tracker stamps/clears runtime.json's opened_at (PR-6 part b —
-// session-cost.ts's window-delta mode reads this field). See maintainOpenedAt in
+// cost-report.ts session's window-delta mode reads this field). See maintainOpenedAt in
 // cost-tracker.ts.
 // ---------------------------------------------------------------------------
 
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index 54284d25..f0b48515 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -3036,7 +3036,7 @@ describe('pricing', () => {
 // -------------------------------------------------------
 
 async function runCostReflect(dir: string): Promise<string> {
-  const r = await runScript('cost-reflect.ts', { args: ['.claude-code-hermit'], cwd: dir });
+  const r = await runScript('cost-report.ts', { args: ['reflect', '.claude-code-hermit'], cwd: dir });
   return r.stdout + r.stderr;
 }
 
@@ -3148,7 +3148,7 @@ describe('cost-reflect', () => {
 
   // Missing log: .claude/cost-log.jsonl does not exist
   test("cost-reflect: missing log → 'No cost data' (exit 0)", withDir(async (dir) => {
-    const r = await runScript('cost-reflect.ts', { args: ['.claude-code-hermit'], cwd: dir });
+    const r = await runScript('cost-report.ts', { args: ['reflect', '.claude-code-hermit'], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout + r.stderr).toMatch(/no cost data/i);
   }));

From e3b6eada959709021ca0b80cfa8d13a067fbffd8 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 18:45:11 +0100
Subject: [PATCH 6/9] refactor(claude-code-hermit): fold the expiry probe into
 setup-token-mint.ts

setup-token-probe.ts becomes `setup-token-mint.ts probe`, and hermit-meta.json's
expiry_probe command moves with it. The doctor protocol is unchanged: exactly
one line of stdout, OK | EXPIRED | EXPIRES:<iso8601>, exit 0 on every path
including the catch, because a probe failure must never read as a credential
problem. Verified by hand across all four paths (no record, valid record,
unreadable record, unknown verb) and through doctor's own arg-free bash -c
invocation.

The verb takes the hermit dir positionally so the declared probe command can
stay argument-free while tests point it at a fixture. Its no-arg fallback is the
module-level HERMIT_DIR const rather than the old script's inline literal; that
const is process.env.HERMIT_DIR || '.claude-code-hermit', and HERMIT_DIR is set
nowhere in production paths, so the two resolve identically today. Every other
verb in the file already defaults through it.

One new cost on the probe path, small and read-only: setup-token-mint.ts reads
config.json at module scope (MINT_CONFIG), which the standalone probe never did.
Measured 50-run batches show no regression regardless - ~38ms/run vs the old
script's ~41ms, both dominated by bun startup and both ~1% of doctor's 5s probe
timeout. Nothing else runs at import: every mutating operation (mint start,
marker write, capture file, tmux teardown) sits inside functions unreachable
from this verb.

This is an authority change worth naming: the probe had no permission entry of
its own and was prompted for on every run; it is now covered by the existing
setup-token-mint.ts grant, so doctor's credential-expiry check runs unattended.

bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0.
---
 .../.claude-plugin/hermit-meta.json           |  2 +-
 plugins/claude-code-hermit/CHANGELOG.md       |  2 ++
 .../scripts/setup-token-mint.ts               | 27 +++++++++++++++-
 .../scripts/setup-token-probe.ts              | 31 -------------------
 .../tests/setup-token.test.ts                 |  4 +--
 5 files changed, 31 insertions(+), 35 deletions(-)
 delete mode 100644 plugins/claude-code-hermit/scripts/setup-token-probe.ts

diff --git a/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json b/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
index 60c1e903..060cd813 100644
--- a/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
+++ b/plugins/claude-code-hermit/.claude-plugin/hermit-meta.json
@@ -4,7 +4,7 @@
   "credentials": [
     {
       "name": "setup-token",
-      "expiry_probe": "bun ${CLAUDE_PLUGIN_ROOT}/scripts/setup-token-probe.ts",
+      "expiry_probe": "bun ${CLAUDE_PLUGIN_ROOT}/scripts/setup-token-mint.ts probe",
       "warn_days": 14,
       "reauth_skill": "/claude-code-hermit:relogin"
     }
diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 9ed40522..491ba848 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -35,6 +35,7 @@
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 - The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
 - Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- The setup-token expiry probe is a `setup-token-mint.ts probe` verb, and `hermit-meta.json`'s `expiry_probe` command moves with it. The `OK | EXPIRED | EXPIRES:<iso8601>` one-line protocol is unchanged, including printing `OK` (not a false expiry) for a hermit with no record or an unreadable one. Another authority change: the probe had no allow entry of its own and is now covered by the existing `setup-token-mint.ts` grant, so doctor's credential-expiry check runs unattended.
 - The three cost readouts are `cost-report.ts` verbs: `today`, `session <id> [--opened-at --closed-at]`, `reflect [<dir>] [<days>] [--plain]`, over `lib/cost-report/{today,session,reflect}.ts`. All three stay fail-open readers — an unreadable log still prints `cost data unavailable` rather than a misleading `$0.00`, and `reflect` still turns a throw into a one-line error at exit 0 — because their callers are briefs and channel replies that must compose without cost data.
 - The three Artifact-page renderers and the strings scaffold are `artifact.ts` verbs: `render dashboard|proposals|weekly` and `scaffold-strings`. The `{path,bytes,hash}` receipt, the default out paths, and exit-1-on-failure are unchanged — the refresh protocols hash-gate on that receipt. The weekly page's frontmatter-strip moved to `lib/weekly-artifact.ts`, beside the dashboard and proposals-page renderer libs.
 - `proposal-metrics-report.ts` and `eval-success-signal.ts` had no allow entry and were prompted for on every run; as `proposal.ts` verbs they are covered by the existing `proposal.ts` grant and run unattended. That is an authority change: a headless brainstorm kill-check and a success-signal validation now proceed without asking.
@@ -44,6 +45,7 @@
 - Seven top-level proposal scripts, absorbed into `proposal.ts` verbs: `resolve-prop.ts`, `record-gate.ts`, `queue-micro-proposal.ts`, `micro-proposal.ts`, `proposals-index.ts`, `proposal-metrics-report.ts`, `eval-success-signal.ts`.
 - Four top-level artifact scripts, absorbed into `artifact.ts` verbs: `render-dashboard.ts`, `render-proposals-page.ts`, `render-weekly-artifact.ts`, `artifact-strings-scaffold.ts`.
 - Three top-level cost scripts, absorbed into `cost-report.ts` verbs: `today-cost.ts`, `session-cost.ts`, `cost-reflect.ts`. (`lib/session-cost.ts`, the shared window-cost algorithm, is unrelated and stays.)
+- `setup-token-probe.ts`, absorbed into `setup-token-mint.ts probe`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
diff --git a/plugins/claude-code-hermit/scripts/setup-token-mint.ts b/plugins/claude-code-hermit/scripts/setup-token-mint.ts
index 1933ea61..bccd2f74 100644
--- a/plugins/claude-code-hermit/scripts/setup-token-mint.ts
+++ b/plugins/claude-code-hermit/scripts/setup-token-mint.ts
@@ -28,6 +28,8 @@
  *   await-token-and-install   capture the token, install it, print the digest
  *   finish                    restart the session so the new token takes effect
  *   abort                     tear down a running mint
+ *   probe [hermitDir]         doctor's expiry probe — one line: OK | EXPIRED |
+ *                             EXPIRES:<iso8601> (see hermit-meta.json)
  */
 
 import fs from 'node:fs';
@@ -511,9 +513,32 @@ async function main(): Promise<void> {
       break;
     }
 
+    case 'probe': {
+      // Expiry probe for core's own setup-token credential, declared in
+      // .claude-plugin/hermit-meta.json and run by doctor's credential-expiry
+      // check. Protocol (doctor-check.ts runExpiryProbe): exactly one line of
+      // stdout — OK | EXPIRED | EXPIRES:<iso8601>.
+      //
+      // A hermit not using token auth has no record and prints OK: there is
+      // nothing to check, which is materially different from "expired". Note
+      // this never reads the token file itself — expiry lives in the record.
+      //
+      // Takes an optional dir positionally so the declared probe command can
+      // stay argument-free while tests can point it at a fixture.
+      try {
+        const record = readTokenRecord(process.argv[3] || HERMIT_DIR);
+        console.log(record ? `EXPIRES:${record.expires_at}` : 'OK');
+      } catch {
+        // Never let a probe failure read as a credential problem; doctor
+        // reports an unparseable line as "probe failed" on its own.
+        console.log('OK');
+      }
+      break;
+    }
+
     default:
       process.stderr.write(
-        'Usage: setup-token-mint.ts <terminal|relay|start|await-url|submit-code|await-token-and-install|finish|abort|status>\n'
+        'Usage: setup-token-mint.ts <terminal|relay|start|await-url|submit-code|await-token-and-install|finish|abort|status|probe>\n'
       );
       code = 1;
   }
diff --git a/plugins/claude-code-hermit/scripts/setup-token-probe.ts b/plugins/claude-code-hermit/scripts/setup-token-probe.ts
deleted file mode 100644
index ad6cdb78..00000000
--- a/plugins/claude-code-hermit/scripts/setup-token-probe.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Expiry probe for core's own setup-token credential, declared in
- * .claude-plugin/hermit-meta.json and run by doctor's credential-expiry check.
- *
- * Protocol (doctor-check.ts runExpiryProbe): exactly one line of stdout —
- * OK | EXPIRED | EXPIRES:<iso8601>.
- *
- * A hermit not using token auth has no record and prints OK: there is nothing
- * to check, which is materially different from "expired". Note this probe never
- * reads the token file itself — expiry lives entirely in the record.
- *
- * Usage: bun scripts/setup-token-probe.ts [hermitDir]
- */
-
-import { readTokenRecord } from './lib/setup-token';
-
-const hermitDir = process.argv[2] || '.claude-code-hermit';
-
-try {
-  const record = readTokenRecord(hermitDir);
-  if (!record) {
-    console.log('OK');
-  } else {
-    console.log(`EXPIRES:${record.expires_at}`);
-  }
-} catch {
-  // Never let a probe failure read as a credential problem; doctor reports an
-  // unparseable line as "probe failed" on its own.
-  console.log('OK');
-}
diff --git a/plugins/claude-code-hermit/tests/setup-token.test.ts b/plugins/claude-code-hermit/tests/setup-token.test.ts
index 8ced5881..ca7d3f2a 100644
--- a/plugins/claude-code-hermit/tests/setup-token.test.ts
+++ b/plugins/claude-code-hermit/tests/setup-token.test.ts
@@ -172,7 +172,7 @@ describe('auth-mode detection', () => {
 
 describe('doctor expiry probe', () => {
   const probe = async (hermitDir: string) =>
-    (await runScript('setup-token-probe.ts', { args: [hermitDir] })).stdout.trim();
+    (await runScript('setup-token-mint.ts', { args: ['probe', hermitDir] })).stdout.trim();
 
   test('no record → OK (not token mode is not a problem)', async () => {
     const root = tmpdir();
@@ -205,7 +205,7 @@ describe('doctor expiry probe', () => {
       fs.mkdirSync(hermitDir, { recursive: true });
       fs.mkdirSync(configDir, { recursive: true });
       installToken(hermitDir, configDir, VALID);
-      const out = (await runScript('setup-token-probe.ts', { args: [hermitDir] })).stdout;
+      const out = (await runScript('setup-token-mint.ts', { args: ['probe', hermitDir] })).stdout;
       expect(out.trim().split('\n')).toHaveLength(1);
       expect(out).not.toContain(VALID);
     } finally {

From 0d53a787809061b28375828f626cda0ee8af5b95 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 19:09:13 +0100
Subject: [PATCH 7/9] refactor(claude-code-hermit): heartbeat.ts and
 routines.ts over lib modules

The last seven scripts of the consolidation become two CLIs:
  heartbeat.ts precheck|alert-state          over lib/heartbeat/
  routines.ts due|precheck|cron-registry|tz-shift|log-event   over lib/routines/

Every verdict token and emission line is unchanged, which is the property that
matters here: the monitors grep them and record-operator-action.ts's
isRoutinePrompt() matches them. That covers SKIP|... / EVALUATE / AUTO_CLOSE /
ALERT, PROCEED, and the ROUTINE_DUE [hermit-routine:<id>] line.

Dispatch is a dynamic import per verb, with the verb spliced out of process.argv
first so each module keeps the argv indices it used standing alone. That is
deliberate: ~1200 lines of scheduling, alert derivation and registry
reconciliation stay byte-for-byte rather than being rethreaded through a
parameter, and the poll verbs don't load the graphs they never touch. Measured
against the old standalone precheck over 40 alternating runs in a controlled
tree: -1.0%, inside one standard deviation. No per-poll cost.

log-routine-event.sh is now TypeScript, the last shell script on the routine
path. The appended line is byte-identical - same key order, same
second-precision UTC stamp - and the fired-after-fired dedup guard is preserved.
due and precheck call it in-process instead of spawning a subprocess per stamp
(3.43ms -> 0.04ms measured). The event name is still unvalidated, matching bash;
rejecting names it used to record would be a behavior change.

Two things this shape forced, both bugs if missed:
  - registry.ts's CLI sat behind `import.meta.main`, which is FALSE under a
    dynamic import, so it would have silently never run. It is a named runCli()
    export now. It cannot run at module scope either, because
    cron-registry.test.ts imports the module for its pure helpers.
  - due.ts and precheck.ts still resolved the deleted shell script by path.

The env-override contract is unchanged, and deliberately so: HEARTBEAT_PRECHECK
and ROUTINE_DUE_SCRIPT still take a BARE script path invoked with the same
arguments. The monitors build the command as a bash array and prepend the verb
only on the default branch, so no test stub needed changing and the documented
contract stays literally true.

One knowing deviation from the bash original: its walk-up loop skipped the
filesystem root, so a hermit at exactly /.claude-code-hermit was never found.
The port checks it. Reproducing that limitation would mean adding a bug on an
unreachable path.

Top-level scripts 80 -> 57 across the branch; shell entrypoints 5 -> 4.
bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0.
---
 .claude/settings.json                         |  2 +-
 plugins/claude-code-hermit/CHANGELOG.md       |  4 +
 plugins/claude-code-hermit/CLAUDE.md          |  2 +-
 .../claude-code-hermit/docs/always-on-ops.md  |  6 +-
 plugins/claude-code-hermit/docs/always-on.md  |  2 +-
 .../docs/routine-authoring.md                 |  4 +-
 .../scripts/apply-reflection-actions.ts       |  2 +-
 .../scripts/apply-settings.ts                 | 13 ++-
 .../scripts/cost-tracker.ts                   |  6 +-
 .../scripts/heartbeat-monitor.sh              | 14 +++-
 .../claude-code-hermit/scripts/heartbeat.ts   | 37 +++++++++
 .../scripts/hermit-start.ts                   |  2 +-
 .../scripts/hermit-watchdog.ts                |  2 +-
 .../scripts/lib/cron-shift.ts                 |  2 +-
 .../heartbeat/alert-update.ts}                |  8 +-
 .../heartbeat/precheck.ts}                    | 20 ++---
 .../{routine-due.ts => lib/routines/due.ts}   | 17 ++--
 .../scripts/lib/routines/event.ts             | 82 +++++++++++++++++++
 .../routines/precheck.ts}                     | 19 ++---
 .../routines/registry.ts}                     | 21 +++--
 .../routines/tz-shift.ts}                     | 30 ++++---
 .../scripts/lib/trigger-source.ts             |  6 +-
 .../scripts/log-routine-event.sh              | 41 ----------
 .../scripts/record-operator-action.ts         | 12 +--
 .../scripts/routine-monitor.sh                | 13 ++-
 .../claude-code-hermit/scripts/routines.ts    | 70 ++++++++++++++++
 .../scripts/transcript-digest.ts              |  2 +-
 .../scripts/validate-config.ts                |  2 +-
 .../claude-code-hermit/skills/hatch/SKILL.md  |  2 +-
 .../skills/heartbeat/SKILL.md                 |  4 +-
 .../skills/heartbeat/reference.md             |  6 +-
 .../skills/hermit-doctor/SKILL.md             |  2 +-
 .../skills/hermit-routines/SKILL.md           | 16 ++--
 .../skills/session-close/SKILL.md             |  2 +-
 .../skills/smoke-test/SKILL.md                |  8 +-
 .../tests/alert-state-durability.test.ts      |  8 +-
 .../tests/auto-close.test.ts                  | 15 ++--
 .../tests/budget-precheck.test.ts             |  4 +-
 .../tests/contracts.test.ts                   |  4 +-
 .../tests/cron-registry.test.ts               |  2 +-
 .../tests/cron-tz-shift.test.ts               |  4 +-
 .../tests/heartbeat-default-scan.test.ts      |  4 +-
 .../tests/heartbeat-injection-scan.test.ts    |  4 +-
 .../tests/routine-due.test.ts                 |  8 +-
 .../tests/routine-precheck.test.ts            | 10 +--
 .../claude-code-hermit/tests/scripts.test.ts  | 51 ++++++------
 46 files changed, 386 insertions(+), 209 deletions(-)
 create mode 100644 plugins/claude-code-hermit/scripts/heartbeat.ts
 rename plugins/claude-code-hermit/scripts/{update-alert-state.ts => lib/heartbeat/alert-update.ts} (97%)
 rename plugins/claude-code-hermit/scripts/{heartbeat-precheck.ts => lib/heartbeat/precheck.ts} (96%)
 rename plugins/claude-code-hermit/scripts/{routine-due.ts => lib/routines/due.ts} (94%)
 create mode 100755 plugins/claude-code-hermit/scripts/lib/routines/event.ts
 rename plugins/claude-code-hermit/scripts/{routine-precheck.ts => lib/routines/precheck.ts} (74%)
 rename plugins/claude-code-hermit/scripts/{cron-registry.ts => lib/routines/registry.ts} (94%)
 rename plugins/claude-code-hermit/scripts/{cron-tz-shift.ts => lib/routines/tz-shift.ts} (54%)
 delete mode 100755 plugins/claude-code-hermit/scripts/log-routine-event.sh
 create mode 100644 plugins/claude-code-hermit/scripts/routines.ts

diff --git a/.claude/settings.json b/.claude/settings.json
index b40e0dad..03c5d4e4 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -3,7 +3,7 @@
     "allow": [
       "Bash(gh issue:*)",
       "Bash(node */skills/hermit-scribe/file-issue.js*)",
-      "Bash(node */scripts/cron-tz-shift.js *)",
+      "Bash(bun */scripts/routines.ts tz-shift *)",
       "Bash(node */scripts/resolve-outbound-channel.js *)"
     ],
     "deny": []
diff --git a/plugins/claude-code-hermit/CHANGELOG.md b/plugins/claude-code-hermit/CHANGELOG.md
index 491ba848..d0f57716 100644
--- a/plugins/claude-code-hermit/CHANGELOG.md
+++ b/plugins/claude-code-hermit/CHANGELOG.md
@@ -35,6 +35,9 @@
 - `bin/hermit-run` validates `HERMIT_PLUGIN_ROOT` by manifest name and fails loud when two marketplaces provide `claude-code-hermit` (instead of silently taking glob order); `hermit-exec.sh` rejects a script name containing `/` or `..`.
 - The proposal mechanics are seven `proposal.ts` verbs instead of seven top-level scripts: `resolve-id`, `gate`, `queue-micro`, `micro`, `index`, `metrics`, `success-signal`, each over a module in `scripts/lib/proposals/`. Every stdout grammar and exit code is unchanged — `success-signal --validate` still exits non-zero on a bad predicate, and `queue-micro`/`micro` still exit 1 rather than dropping a candidate silently. `metrics` and `success-signal --validate` take no state dir.
 - Domain plugins reach the two shared verbs by their new names: `hermit-run proposal micro …` and `hermit-run proposal metrics …`. This is why `claude-code-dev-hermit`, `claude-code-fitness-hermit`, and `claude-code-homeassistant-hermit` now require core `>=1.2.34` — `bin/hermit-run` resolves a script by bare filesystem probe, so an old domain plugin against this core (or the reverse) fails with a misleading "plugin may predate this command" error.
+- The heartbeat and routine mechanics are two CLIs over `lib/heartbeat/` and `lib/routines/`: `heartbeat.ts precheck|alert-state` and `routines.ts due|precheck|cron-registry|tz-shift|log-event`. Every verdict token and emission line is unchanged — `SKIP|…`/`EVALUATE`/`AUTO_CLOSE`/`ALERT`, `PROCEED`, and the `ROUTINE_DUE [hermit-routine:<id>]` line the monitors grep and `isRoutinePrompt()` matches.
+- `log-routine-event.sh` is now TypeScript (`lib/routines/event.ts`), the last shell script in the routine path. The appended line is byte-identical — same key order, same second-precision UTC stamp — and the `fired`-after-`fired` dedup guard is preserved. `routines.ts due` and `routines.ts precheck` call it in-process instead of spawning a subprocess per stamp.
+- `HEARTBEAT_PRECHECK` / `ROUTINE_DUE_SCRIPT` keep their exact contract: an override is still a bare script path invoked with the same arguments. The monitors pass the new verb only on the default path.
 - The setup-token expiry probe is a `setup-token-mint.ts probe` verb, and `hermit-meta.json`'s `expiry_probe` command moves with it. The `OK | EXPIRED | EXPIRES:<iso8601>` one-line protocol is unchanged, including printing `OK` (not a false expiry) for a hermit with no record or an unreadable one. Another authority change: the probe had no allow entry of its own and is now covered by the existing `setup-token-mint.ts` grant, so doctor's credential-expiry check runs unattended.
 - The three cost readouts are `cost-report.ts` verbs: `today`, `session <id> [--opened-at --closed-at]`, `reflect [<dir>] [<days>] [--plain]`, over `lib/cost-report/{today,session,reflect}.ts`. All three stay fail-open readers — an unreadable log still prints `cost data unavailable` rather than a misleading `$0.00`, and `reflect` still turns a throw into a one-line error at exit 0 — because their callers are briefs and channel replies that must compose without cost data.
 - The three Artifact-page renderers and the strings scaffold are `artifact.ts` verbs: `render dashboard|proposals|weekly` and `scaffold-strings`. The `{path,bytes,hash}` receipt, the default out paths, and exit-1-on-failure are unchanged — the refresh protocols hash-gate on that receipt. The weekly page's frontmatter-strip moved to `lib/weekly-artifact.ts`, beside the dashboard and proposals-page renderer libs.
@@ -46,6 +49,7 @@
 - Four top-level artifact scripts, absorbed into `artifact.ts` verbs: `render-dashboard.ts`, `render-proposals-page.ts`, `render-weekly-artifact.ts`, `artifact-strings-scaffold.ts`.
 - Three top-level cost scripts, absorbed into `cost-report.ts` verbs: `today-cost.ts`, `session-cost.ts`, `cost-reflect.ts`. (`lib/session-cost.ts`, the shared window-cost algorithm, is unrelated and stays.)
 - `setup-token-probe.ts`, absorbed into `setup-token-mint.ts probe`.
+- Seven top-level heartbeat/routine scripts, absorbed into `heartbeat.ts` and `routines.ts` verbs: `heartbeat-precheck.ts`, `update-alert-state.ts`, `routine-due.ts`, `routine-precheck.ts`, `cron-registry.ts`, `cron-tz-shift.ts`, `log-routine-event.sh`.
 
 ### Upgrade Instructions
 1. The CLAUDE-APPEND change reaches installed hermits through the standard `<!-- claude-code-hermit: Session Discipline -->` marker-block resync `hermit-evolve` already performs. Skills and scripts ship in the plugin, so no per-operator migration is needed for those.
diff --git a/plugins/claude-code-hermit/CLAUDE.md b/plugins/claude-code-hermit/CLAUDE.md
index 5e01bc84..af89e043 100644
--- a/plugins/claude-code-hermit/CLAUDE.md
+++ b/plugins/claude-code-hermit/CLAUDE.md
@@ -109,7 +109,7 @@ bun test
   (everything a hook prints on success is injected into context). Skills must not `Read`
   unbounded surfaces (`cost-log.jsonl`, `*.jsonl` event logs, the channel DB) directly —
   front them with a script that returns a bounded summary (the `cost-report.ts` /
-  `heartbeat-precheck.ts` / `lib/search.ts` pattern); a bounded slice (e.g. reflect's
+  `heartbeat.ts precheck` / `lib/search.ts` pattern); a bounded slice (e.g. reflect's
   tail-20 of cost-log) is the ceiling, not the norm. Session-start injection
   (`startup-context.ts`, `generate-summary.ts`) is the largest recurring cost — a new
   section there must justify its per-session tokens against how often it changes behavior.
diff --git a/plugins/claude-code-hermit/docs/always-on-ops.md b/plugins/claude-code-hermit/docs/always-on-ops.md
index ce9f8126..5337bffa 100644
--- a/plugins/claude-code-hermit/docs/always-on-ops.md
+++ b/plugins/claude-code-hermit/docs/always-on-ops.md
@@ -183,13 +183,13 @@ Manage with `/claude-code-hermit:hermit-settings routines`. Changes take effect
 
 `hermit-start.ts` auto-sends `/claude-code-hermit:hermit-routines load` after launching the always-on session. The skill resolves `$CLAUDE_PLUGIN_ROOT`, then:
 
-**Monitor mode (tried first).** Registers one persistent Monitor subprocess (`scripts/routine-monitor.sh`, 60s poll) running `scripts/routine-due.ts`, which reads `config.routines` directly, evaluates each enabled non-anchor routine's schedule against `state/routine-schedule.json` cursors, applies the pause/waiting/idle gates itself, and prints a single `ROUTINE_DUE [hermit-routine:<id>] ...` line only for routines that should actually wake the session — a routine that's due-but-skipped costs zero model tokens. `hermit-routines run <ids>` handles the wake: it re-runs `scripts/routine-precheck.ts` for the `started` stamp, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`. The anchor (`heartbeat-restart`) still registers via a single `CronCreate`, kept fresh by the same diff-planner (`scripts/cron-registry.ts`) described below, scoped to that one routine.
+**Monitor mode (tried first).** Registers one persistent Monitor subprocess (`scripts/routine-monitor.sh`, 60s poll) running `scripts/routines.ts due`, which reads `config.routines` directly, evaluates each enabled non-anchor routine's schedule against `state/routine-schedule.json` cursors, applies the pause/waiting/idle gates itself, and prints a single `ROUTINE_DUE [hermit-routine:<id>] ...` line only for routines that should actually wake the session — a routine that's due-but-skipped costs zero model tokens. `hermit-routines run <ids>` handles the wake: it re-runs `scripts/routines.ts precheck` for the `started` stamp, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`. The anchor (`heartbeat-restart`) still registers via a single `CronCreate`, kept fresh by the same diff-planner (`scripts/routines.ts cron-registry`) described below, scoped to that one routine.
 
-**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/cron-registry.ts plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `cron-tz-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routine-precheck.ts`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
+**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/routines.ts cron-registry plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `cron-tz-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routines.ts precheck`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
 
 `/claude-code-hermit:hermit-routines load --reset` bypasses both diffs and does an unconditional sweep — the escape hatch for suspected drift.
 
-`routine-precheck.ts` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routine-due.ts` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
+`routines.ts precheck` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routine-due.ts` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
 
 **`heartbeat-restart`** fires at 4am daily and re-invokes `load`, which re-registers the heartbeat Monitor and re-arms the routine monitor (or, in fallback mode, the routine CronCreates — which expire after 7 days without this daily re-arm).
 
diff --git a/plugins/claude-code-hermit/docs/always-on.md b/plugins/claude-code-hermit/docs/always-on.md
index b7995cf6..665a8851 100644
--- a/plugins/claude-code-hermit/docs/always-on.md
+++ b/plugins/claude-code-hermit/docs/always-on.md
@@ -202,7 +202,7 @@ This means even a raw `docker compose down` (without `hermit-docker down`) will
 
 Heartbeat archives the current session via two triggers:
 
-- **12h inactivity** — `heartbeat-precheck.ts` checks `last-operator-action.json` on each tick. If the operator has not acted for >12h, it returns the `AUTO_CLOSE` verdict.
+- **12h inactivity** — `heartbeat.ts precheck` checks `last-operator-action.json` on each tick. If the operator has not acted for >12h, it returns the `AUTO_CLOSE` verdict.
 - **Daily midnight with lull** — the `daily-auto-close` routine fires at `0 0 * * *` (local). If the operator is currently active (last action ≤10 min), the routine writes `state/pending-close.json`. The next heartbeat tick where the operator has been idle >10 min drains the flag and emits `AUTO_CLOSE`. If the operator was already idle when the routine fired, it closes directly without queueing.
 
 On either trigger:
diff --git a/plugins/claude-code-hermit/docs/routine-authoring.md b/plugins/claude-code-hermit/docs/routine-authoring.md
index 1ef9f7be..fbba67fc 100644
--- a/plugins/claude-code-hermit/docs/routine-authoring.md
+++ b/plugins/claude-code-hermit/docs/routine-authoring.md
@@ -58,7 +58,7 @@ produce a report.
    decision "is there anything to do here?" can be answered in bash — a file's mtime, a threshold
    comparison, a hash — write a precheck script that prints one token and exits 0, and only load
    the skill body on the branch that needs it. The shipped archetypes:
-   - `scripts/heartbeat-precheck.ts` — emits `SKIP|<reason>`, `OK`, `AUTO_CLOSE`, or `EVALUATE`.
+   - `scripts/heartbeat.ts precheck` — emits `SKIP|<reason>`, `OK`, `AUTO_CLOSE`, or `EVALUATE`.
      Only `EVALUATE` loads the heartbeat skill body.
    - `scripts/reflect-precheck.ts` — emits `EMPTY` or `RUN|<phases-json>`. On `EMPTY` the precheck itself
      owns the audit trail (updates `reflection-state.json`, appends the Progress Log line) so
@@ -114,5 +114,5 @@ narrow haiku subagent instead of a broad session-model skill.
   schema, cron rules, and the `model` field this pattern relies on.
 - `skills/hermit-routines/SKILL.md` — the registration mechanism (`load`/`list`/`status`/`stop`)
   and the model-override dispatch behavior cited above.
-- `scripts/heartbeat-precheck.ts`, `scripts/reflect-precheck.ts` — the shipped precheck
+- `scripts/heartbeat.ts precheck`, `scripts/reflect-precheck.ts` — the shipped precheck
   archetypes to copy the shape of, not reinvent.
diff --git a/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts b/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
index 715beca3..535a88ba 100644
--- a/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
+++ b/plugins/claude-code-hermit/scripts/apply-reflection-actions.ts
@@ -8,7 +8,7 @@
 //         metrics_event, shell_findings_line}, ...]}
 // Output: one JSON line — {"ok":true,"applied":{...}} (+ "errors" when any
 // post-validation write failed) or {"ok":false,"reason":...} with zero writes.
-// Exit 0 always (update-alert-state.ts pattern); only missing argv exits 1.
+// Exit 0 always (lib/heartbeat/alert-update.ts pattern); only missing argv exits 1.
 //
 // Durability split: proposal frontmatter patches and metrics appends are the
 // all-or-nothing core; SHELL.md `## Findings` appends are best-effort session
diff --git a/plugins/claude-code-hermit/scripts/apply-settings.ts b/plugins/claude-code-hermit/scripts/apply-settings.ts
index 02a23042..40dc4924 100644
--- a/plugins/claude-code-hermit/scripts/apply-settings.ts
+++ b/plugins/claude-code-hermit/scripts/apply-settings.ts
@@ -47,7 +47,7 @@ const HERMIT_ALLOW = [
   'Bash(git status:*)',
   'Bash(git log:*)',
   'Bash(bun */scripts/cost-tracker.ts*)',
-  'Bash(bun */scripts/heartbeat-precheck.ts*)',
+  'Bash(bun */scripts/heartbeat.ts precheck*)',
   'Bash(bun */scripts/reflect-precheck.ts*)',
   'Bash(bun */scripts/archive-shell.ts*)',
   'Bash(bun */scripts/evaluate-session.ts*)',
@@ -58,7 +58,7 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/apply-reflection-actions.ts*)',
   'Bash(bun */scripts/transcript-digest.ts*)',
   'Bash(bun */scripts/setup-token-mint.ts*)',
-  'Bash(bun */scripts/cron-tz-shift.ts*)',
+  'Bash(bun */scripts/routines.ts tz-shift*)',
   'Bash(bun */scripts/evolve-plan.ts*)',
   'Bash(bun */scripts/evolve-finalize.ts*)',
   'Bash(bun */scripts/manifest-seed.ts*)',
@@ -66,8 +66,8 @@ const HERMIT_ALLOW = [
   'Bash(bun */scripts/channel-log.ts*)',
   'Bash(bun */scripts/channel-send.ts*)',
   'Bash(bun */scripts/session-archive.ts*)',
-  'Bash(bun */scripts/routine-precheck.ts*)',
-  'Bash(bun */scripts/cron-registry.ts*)',
+  'Bash(bun */scripts/routines.ts precheck*)',
+  'Bash(bun */scripts/routines.ts cron-registry*)',
   // Domain plugins reach core's shared scripts through the project-resident
   // bin/hermit-run (their own ${CLAUDE_PLUGIN_ROOT} can't reach core's versioned
   // cache dir). Pinned to the two verbs they actually need, not a bare
@@ -105,6 +105,11 @@ const HERMIT_OBSOLETE = [
   // …and the two hermit-run routes that pointed at the pre-absorption names.
   'Bash(.claude-code-hermit/bin/hermit-run micro-proposal *)',
   'Bash(.claude-code-hermit/bin/hermit-run proposal-metrics-report *)',
+  // Heartbeat/routine scripts absorbed into heartbeat.ts and routines.ts verbs.
+  'Bash(bun */scripts/heartbeat-precheck.ts*)',
+  'Bash(bun */scripts/routine-precheck.ts*)',
+  'Bash(bun */scripts/cron-registry.ts*)',
+  'Bash(bun */scripts/cron-tz-shift.ts*)',
 ];
 
 // Sealed autoMode entries — operator-owned policy seeded at attended hatch and
diff --git a/plugins/claude-code-hermit/scripts/cost-tracker.ts b/plugins/claude-code-hermit/scripts/cost-tracker.ts
index 2e767331..3e299b6d 100644
--- a/plugins/claude-code-hermit/scripts/cost-tracker.ts
+++ b/plugins/claude-code-hermit/scripts/cost-tracker.ts
@@ -601,7 +601,7 @@ function markBudgetNotified(newPeriods: Json[], periodKey: Record<string, string
 // and, for `action:"pause"`, set the PROP-015 pause flag with an auto-resume boundary.
 // Newly-created entries also get a direct channel push; `notified` is only
 // flipped true on a confirmed send, so a failed send leaves the existing
-// heartbeat-precheck EVALUATE wake as the fallback announcement path.
+// `heartbeat.ts precheck` EVALUATE wake as the fallback announcement path.
 // Fail-open throughout — never throws, since run()'s caller must never be blocked by
 // this check.
 async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: Json, locale: Locale = 'en'): Promise<void> {
@@ -691,7 +691,7 @@ async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: J
 
     // Then push — bounded well under the Stop pipeline's 15s budget — and record
     // `notified` via a fresh read-modify-write. On failure, notified stays false so
-    // heartbeat-precheck's EVALUATE wake remains the fallback announcement path.
+    // `heartbeat.ts precheck`'s EVALUATE wake remains the fallback announcement path.
     if (newPeriods.length > 0) {
       // Full USD/cap/ratio detail is maintainer-tier; on a stock install (no
       // maintainer channel, technical profile) it falls back to the primary chat,
@@ -709,7 +709,7 @@ async function applyBudgetCheck(costIdx: Json, timezone: string, budgetConfig: J
       // the maintainer leg was delivered (a chat, or its intended Findings home),
       // OR the client "paused until X" line landed on the primary chat. A degraded
       // Findings fallback (configured maintainer channel unreachable) leaves
-      // notified:false so heartbeat-precheck's EVALUATE wake re-announces once the
+      // notified:false so `heartbeat.ts precheck`'s EVALUATE wake re-announces once the
       // channel recovers.
       if (res.maintainer?.delivered || res.client?.ok === true) markBudgetNotified(newPeriods, periodKey);
     }
diff --git a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
index 9d8915db..0b218364 100755
--- a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # Usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>
 # Env: HEARTBEAT_MONITOR_ONCE=1  → run one iteration and exit (tests)
-#      HEARTBEAT_PRECHECK=<path> → override precheck path (tests)
+#      HEARTBEAT_PRECHECK=<path> → override precheck path (tests). Still a bare
+#                                  script path called with `--peek <dir>`; the
+#                                  default now prepends heartbeat.ts's verb.
 # Polls heartbeat-precheck.ts --peek and emits a notification only when the
 # LLM needs to wake up (EVALUATE, AUTO_CLOSE, or ALERT verdict). --peek means
 # the polling itself is read-only; the mutating tick happens once when
@@ -14,11 +16,17 @@
 set -u
 INTERVAL="${1:?usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>}"
 HB_DIR="${2:?usage: heartbeat-monitor.sh <interval_seconds> <hermit_state_dir>}"
-PRECHECK="${HEARTBEAT_PRECHECK:-$(dirname "$0")/heartbeat-precheck.ts}"
+# Array, not a string: the default is two words (script + verb) and an override
+# is one, and `bun "$X"` on a spaced string would look for a file with a space.
+if [[ -n "${HEARTBEAT_PRECHECK:-}" ]]; then
+  PRECHECK=("$HEARTBEAT_PRECHECK")
+else
+  PRECHECK=("$(dirname "$0")/heartbeat.ts" precheck)
+fi
 mkdir -p "$HB_DIR/state"
 first=1
 while true; do
-  verdict="$(bun "$PRECHECK" --peek "$HB_DIR" 2>/dev/null || echo "ERROR")"
+  verdict="$(bun "${PRECHECK[@]}" --peek "$HB_DIR" 2>/dev/null || echo "ERROR")"
   _ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   printf '{"last_peek_at":"%s"}\n' "$_ts" > "$HB_DIR/state/.heartbeat-liveness.tmp" \
     && mv "$HB_DIR/state/.heartbeat-liveness.tmp" "$HB_DIR/state/heartbeat-liveness.json" \
diff --git a/plugins/claude-code-hermit/scripts/heartbeat.ts b/plugins/claude-code-hermit/scripts/heartbeat.ts
new file mode 100644
index 00000000..3a5615ae
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/heartbeat.ts
@@ -0,0 +1,37 @@
+// heartbeat.ts — single CLI for the heartbeat mechanics, over
+// lib/heartbeat/{precheck,alert-update}.ts.
+//
+// Usage:
+//   bun heartbeat.ts precheck [--peek] <hermit-state-dir>
+//     The monitor's poll and /heartbeat run's mutating tick. --peek is
+//     read-only. Prints one verdict line: OK | EVALUATE | AUTO_CLOSE | ALERT |
+//     SKIP|<reason>. The monitor greps these, so the grammar is load-bearing.
+//
+//   bun heartbeat.ts alert-state <state-file>
+//     Applies one alert-state update from stdin.
+//
+// The verb is spliced out of process.argv before the module loads, so each
+// module keeps the argv indices it used as a standalone script — 550-odd lines
+// of alert derivation and lull arithmetic stay byte-for-byte unchanged rather
+// than being rethreaded through a parameter. Loading is lazy for the same
+// reason it is in routines.ts: a precheck poll runs every interval and has no
+// business parsing the alert-update graph.
+
+export {}; // module scope: every import here is dynamic, and top-level await needs it
+
+const USAGE = 'Usage: bun heartbeat.ts <precheck [--peek] <dir> | alert-state <state-file>>';
+
+const verb = process.argv[2];
+process.argv.splice(2, 1);
+
+switch (verb) {
+  case 'precheck':
+    await import('./lib/heartbeat/precheck');
+    break;
+  case 'alert-state':
+    await import('./lib/heartbeat/alert-update');
+    break;
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/hermit-start.ts b/plugins/claude-code-hermit/scripts/hermit-start.ts
index 064cbe9c..c166ebe4 100644
--- a/plugins/claude-code-hermit/scripts/hermit-start.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-start.ts
@@ -390,7 +390,7 @@ function clearStatusCacheOnBoot(): void {
 
 /**
  * Stamps a fresh per-process nonce at state/.boot-id on every always-on boot.
- * cron-registry.ts (the hermit-routines diff planner) compares this against the
+ * `routines.ts cron-registry` (the hermit-routines diff planner) compares this against the
  * boot_id stored in its state/cron-registry.json mirror: a mismatch means the
  * mirror describes a prior process's CronCreates, which durable:false already
  * killed on exit, so the planner treats every enabled routine as CREATE with no
diff --git a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
index 26d9c4c1..3b5b9178 100644
--- a/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
+++ b/plugins/claude-code-hermit/scripts/hermit-watchdog.ts
@@ -262,7 +262,7 @@ export function inActiveHours(activeHours: Json, timezone: string, ref?: Date):
     if (!/^\d{2}:\d{2}$/.test(start) || !/^\d{2}:\d{2}$/.test(end)) return true; // fail-open on malformed window
     const now = currentHHMM(timezone, ref);
     if (now === null) return true; // fail-open on unparseable tz
-    return start <= now && now < end; // end-exclusive, matching heartbeat-precheck
+    return start <= now && now < end; // end-exclusive, matching heartbeat.ts precheck
   } catch {
     return true; // fail-open
   }
diff --git a/plugins/claude-code-hermit/scripts/lib/cron-shift.ts b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
index 844e054b..0befd17d 100644
--- a/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
@@ -1,4 +1,4 @@
-// Timezone-aware cron shifting — the pure logic behind scripts/cron-tz-shift.ts.
+// Timezone-aware cron shifting — the pure logic behind scripts/routines.ts tz-shift.
 //
 // Lives in lib/ so importers (cron-registry.ts, hermit-watchdog.ts, the
 // status-responder stage) don't pull in a top-level CLI script just to reach
diff --git a/plugins/claude-code-hermit/scripts/update-alert-state.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
similarity index 97%
rename from plugins/claude-code-hermit/scripts/update-alert-state.ts
rename to plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
index e12c37d6..78a1daba 100644
--- a/plugins/claude-code-hermit/scripts/update-alert-state.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat/alert-update.ts
@@ -17,7 +17,7 @@
 //
 // The eval JSON is read from stdin (not argv) so free-text alert content can't
 // break shell quoting.
-// Usage: bun update-alert-state.ts <state-file-path>   # eval-json on stdin
+// Usage: bun heartbeat.ts alert-state <state-file-path>   # eval-json on stdin
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -25,15 +25,15 @@ import {
   readAlertState, defaultAlertState, quarantineAlertState, writeAlertState,
   classifyTick, deriveMicroPendingKeys, deriveProposalPendingKeys, deriveStaleSession, FiringItem,
   MICRO_PREFIX, PROPOSAL_PREFIX, STALE_KEY, isStructuredKey,
-} from './lib/alert-state';
-import { currentHHMM, todayYMD, resolveHermitNowMs, parseDuration } from './lib/time';
+} from '../alert-state';
+import { currentHHMM, todayYMD, resolveHermitNowMs, parseDuration } from '../time';
 
 type Json = any;
 
 const stateFile = process.argv[2];
 
 if (!stateFile) {
-  console.error('Usage: bun update-alert-state.ts <state-file-path>   # eval-json on stdin');
+  console.error('Usage: bun heartbeat.ts alert-state <state-file-path>   # eval-json on stdin');
   process.exit(1);
 }
 
diff --git a/plugins/claude-code-hermit/scripts/heartbeat-precheck.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
similarity index 96%
rename from plugins/claude-code-hermit/scripts/heartbeat-precheck.ts
rename to plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
index 7bb01d6e..5d8a1602 100644
--- a/plugins/claude-code-hermit/scripts/heartbeat-precheck.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat/precheck.ts
@@ -1,5 +1,5 @@
-// heartbeat-precheck.ts — fast-path verdict before the LLM evaluates HEARTBEAT.md.
-// Usage: bun heartbeat-precheck.ts [--peek] <hermit-state-dir>
+// `heartbeat.ts precheck` — fast-path verdict before the LLM evaluates HEARTBEAT.md.
+// Usage: bun heartbeat.ts precheck [--peek] <hermit-state-dir>
 // Output (stdout, one line): SKIP|<reason>  |  OK  |  AUTO_CLOSE  |  EVALUATE  |  ALERT|<detail>
 // Exit 0 always. Without --peek: writes updated alert-state.json (increments total_ticks).
 // With --peek: read-only — computes the same verdict without any state mutation.
@@ -10,14 +10,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { currentHHMM, todayYMD, parseDuration } from './lib/time';
-import { readAlertState, defaultAlertState, quarantineAlertState, writeAlertState, readMergedAlerts } from './lib/alert-state';
-import { readFrontmatter, listProposalFiles } from './lib/frontmatter';
-import { isProposalScanItem } from './lib/heartbeat-items';
-import { isPaused } from './lib/pause';
-import { scanForInjection } from './lib/injection-scan';
-import { sha256 } from './lib/hash';
-import { AUTO_CLOSE_LULL_MINUTES } from './lib/auto-close';
+import { currentHHMM, todayYMD, parseDuration } from '../time';
+import { readAlertState, defaultAlertState, quarantineAlertState, writeAlertState, readMergedAlerts } from '../alert-state';
+import { readFrontmatter, listProposalFiles } from '../frontmatter';
+import { isProposalScanItem } from '../heartbeat-items';
+import { isPaused } from '../pause';
+import { scanForInjection } from '../injection-scan';
+import { sha256 } from '../hash';
+import { AUTO_CLOSE_LULL_MINUTES } from '../auto-close';
 
 type Json = any;
 
diff --git a/plugins/claude-code-hermit/scripts/routine-due.ts b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
similarity index 94%
rename from plugins/claude-code-hermit/scripts/routine-due.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/due.ts
index 0fd638ad..9939d572 100644
--- a/plugins/claude-code-hermit/scripts/routine-due.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
@@ -1,9 +1,9 @@
-// routine-due.ts — deterministic scheduler for monitor-mode routines. Polled every
+// `routines.ts due` — deterministic scheduler for monitor-mode routines. Polled every
 // interval by routine-monitor.sh. Owns all gating (pause/waiting/idle), all state writes
 // (state/routine-schedule.json cursors, state/routine-monitor-liveness.json), and emits
 // a single ROUTINE_DUE line only for routines that should actually wake the session.
 //
-// Usage: bun routine-due.ts <hermit-dir>
+// Usage: bun routines.ts due <hermit-dir>
 // Output (stdout): nothing, or exactly one line:
 //   ROUTINE_DUE [hermit-routine:<id1>] [hermit-routine:<id2>] ...
 // The bracketed markers are load-bearing — cost-tracker.ts classifySource reads this
@@ -24,11 +24,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { isPaused } from './lib/pause';
-import { validateCronSchedule, ROUTINE_ID_RE } from './validate-config';
-import { makeTzFormatter, partsFromFormatter, compileCron, cronMatchesCompiled } from './lib/cron-match';
-import { readJson as readJSON } from './lib/cli';
+import { isPaused } from '../pause';
+import { validateCronSchedule, ROUTINE_ID_RE } from '../../validate-config';
+import { makeTzFormatter, partsFromFormatter, compileCron, cronMatchesCompiled } from '../cron-match';
+import { readJson as readJSON } from '../cli';
+import { logRoutineEvent } from './event';
 
 type Json = any;
 
@@ -44,7 +44,6 @@ const stateDir = path.join(hermitDir, 'state');
 const projectRoot = path.dirname(hermitDir);
 const schedulePath = path.join(stateDir, 'routine-schedule.json');
 const livenessPath = path.join(stateDir, 'routine-monitor-liveness.json');
-const logScript = path.join(import.meta.dir, 'log-routine-event.sh');
 
 function now(): Date {
   if (process.env.HERMIT_NOW) {
@@ -80,7 +79,7 @@ function writeLiveness(): void {
 
 function stamp(id: string, event: string): void {
   try {
-    execFileSync(logScript, [id, event, 'monitor'], { cwd: projectRoot, stdio: ['ignore', 'ignore', 'ignore'] });
+    logRoutineEvent(id, event, 'monitor', projectRoot);
   } catch { /* fail-open — a stamp failure must not block the routine */ }
 }
 
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/event.ts b/plugins/claude-code-hermit/scripts/lib/routines/event.ts
new file mode 100755
index 00000000..1e634edf
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/lib/routines/event.ts
@@ -0,0 +1,82 @@
+// `routines.ts log-event <routine-id> <event> [delivery]` — appends one line to
+// state/routine-metrics.jsonl. Events: fired | skipped-waiting | skipped-paused |
+// started. delivery: cron-create (default) | monitor.
+//
+// Ported from log-routine-event.sh. The emitted line is byte-identical to the
+// shell version — same key order, same UTC second-precision stamp — because
+// cost attribution, the doctor's routine-cost check, and several tests match on
+// the literal `"routine_id":"<id>","event":"<e>"` substring.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { utcISOStamp } from '../time';
+import { appendJsonlLine } from '../append-jsonl';
+
+// Deliberately not an enum check: the shell version accepted any event string,
+// and rejecting one here would refuse input that used to be recorded.
+const USAGE = 'Usage: routines.ts log-event <routine-id> <event> [delivery]';
+
+// CronCreate prompts fire with cwd set to the session's primary working
+// directory, which may be a subdirectory of the hermit project root. Walk up to
+// the nearest ancestor containing .claude-code-hermit/ so the relative path
+// resolves correctly regardless of launch cwd.
+function findHermitRoot(from: string): string | null {
+  let dir = path.resolve(from);
+  while (dir !== path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, '.claude-code-hermit'))) return dir;
+    dir = path.dirname(dir);
+  }
+  return fs.existsSync(path.join(dir, '.claude-code-hermit')) ? dir : null;
+}
+
+/**
+ * Appends one routine event. Returns null on success, or an error message.
+ *
+ * `fromDir` is where the .claude-code-hermit/ walk-up starts — the in-process
+ * callers (due.ts, precheck.ts) pass the project root they already resolved,
+ * which is what they used to pass as the subprocess `cwd`. They now call this
+ * directly rather than spawning, saving a process per stamp on the routine
+ * fire path.
+ */
+export function logRoutineEvent(
+  id: string,
+  event: string,
+  delivery = 'cron-create',
+  fromDir: string = process.cwd(),
+): string | null {
+  const root = findHermitRoot(fromDir);
+  if (!root) return `could not find .claude-code-hermit/ in any parent of ${fromDir}`;
+  const metrics = path.join(root, '.claude-code-hermit', 'state', 'routine-metrics.jsonl');
+
+  // Dedup guard (issue #464): heartbeat-restart re-invokes `hermit-routines
+  // load` at its own prompt tail, which can re-trigger the cron and emit a
+  // second `fired` with no intervening `started`. The prompt always logs
+  // `started` immediately before `fired`, so a `fired` whose latest same-routine
+  // event is already `fired` can only be the spurious re-trigger.
+  if (event === 'fired') {
+    try {
+      const needle = `"routine_id":"${id}"`;
+      const matching = fs.readFileSync(metrics, 'utf8').split('\n').filter(l => l.includes(needle));
+      const last = matching[matching.length - 1];
+      if (last && last.includes('"event":"fired"')) return null; // suppressed re-trigger
+    } catch { /* no ledger yet — nothing to dedup against */ }
+  }
+
+  return appendJsonlLine(
+    metrics,
+    JSON.stringify({ ts: utcISOStamp(), routine_id: id, event, delivery }),
+  );
+}
+
+export function run(args: string[]): void {
+  const [id, event, delivery] = args;
+  if (!id || !event) {
+    process.stderr.write(`${USAGE}\n`);
+    process.exit(1);
+  }
+  const err = logRoutineEvent(id, event, delivery || 'cron-create');
+  if (err) {
+    process.stderr.write(`routines.ts log-event: ${err}\n`);
+    process.exit(1);
+  }
+}
diff --git a/plugins/claude-code-hermit/scripts/routine-precheck.ts b/plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
similarity index 74%
rename from plugins/claude-code-hermit/scripts/routine-precheck.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
index 86fc2362..52b4ccfb 100644
--- a/plugins/claude-code-hermit/scripts/routine-precheck.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/precheck.ts
@@ -1,20 +1,20 @@
-// routine-precheck.ts — consolidates a routine fire's pre-dispatch gate (waiting-check +
+// `routines.ts precheck` — consolidates a routine fire's pre-dispatch gate (waiting-check +
 // pause-check) and the `started` stamp into one script call, replacing 2-3 separate
-// model-issued tool calls per fire with one. Mirrors reflect-precheck.ts's / heartbeat-
-// precheck.ts's verdict-token contract. Delegates the JSONL write to log-routine-event.sh,
+// model-issued tool calls per fire with one. Mirrors reflect-precheck.ts's /
+// `heartbeat.ts precheck`'s verdict-token contract. Delegates the JSONL write to lib/routines/event.ts,
 // which stays the single writer — the #464 dedup guard and JSONL schema live in exactly
 // one place.
-// Usage: bun routine-precheck.ts <routine-id> <rdw:true|false> [delivery]
+// Usage: bun routines.ts precheck <routine-id> <rdw:true|false> [delivery]
 // Output (stdout, one line): SKIP | PROCEED
-// Side effect: stamps skipped-waiting | skipped-paused | started via log-routine-event.sh.
+// Side effect: stamps skipped-waiting | skipped-paused | started via logRoutineEvent().
 // Exit 0 always — fail-open to PROCEED on any read error (a malformed runtime.json must
 // never silently kill a routine).
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { hermitDir } from './lib/cc-compat';
-import { isPaused } from './lib/pause';
+import { hermitDir } from '../cc-compat';
+import { isPaused } from '../pause';
+import { logRoutineEvent } from './event';
 
 function emit(verdict: string): never {
   process.stdout.write(verdict + '\n');
@@ -34,11 +34,10 @@ try {
   emit('PROCEED'); // fail-open: can't resolve the hermit dir → never silently kill the routine
 }
 const PROJECT_ROOT = path.dirname(HERMIT_ROOT);
-const LOG_SCRIPT = path.join(import.meta.dir, 'log-routine-event.sh');
 
 function stamp(event: string): void {
   try {
-    execFileSync(LOG_SCRIPT, [id, event, delivery], { cwd: PROJECT_ROOT, stdio: ['ignore', 'ignore', 'ignore'] });
+    logRoutineEvent(id, event, delivery, PROJECT_ROOT);
   } catch { /* fail-open — a stamp failure must not block the routine */ }
 }
 
diff --git a/plugins/claude-code-hermit/scripts/cron-registry.ts b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
similarity index 94%
rename from plugins/claude-code-hermit/scripts/cron-registry.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/registry.ts
index 5da587b5..b3af9cf9 100644
--- a/plugins/claude-code-hermit/scripts/cron-registry.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
@@ -1,8 +1,8 @@
-// cron-registry.ts — diff-based plan/commit for hermit-routines CronCreate registration.
+// `routines.ts cron-registry` — diff-based plan/commit for hermit-routines CronCreate registration.
 //
 // Usage:
-//   bun cron-registry.ts plan   <hermit-state-dir> <plugin-root> [--force]
-//   bun cron-registry.ts commit <hermit-state-dir> <plugin-root> <created-id-csv>
+//   bun routines.ts cron-registry plan   <hermit-state-dir> <plugin-root> [--force]
+//   bun routines.ts cron-registry commit <hermit-state-dir> <plugin-root> <created-id-csv>
 //
 // --force (used by `load --reset`) skips every mirror/hash/age comparison and
 // returns every enabled routine as CREATE with no DELETE lines — the caller is
@@ -34,9 +34,9 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { sha256 } from './lib/hash';
-import { shiftCron } from './lib/cron-shift';
-import { parseCronField } from './validate-config';
+import { sha256 } from '../hash';
+import { shiftCron } from '../cron-shift';
+import { parseCronField } from '../../validate-config';
 
 type Json = any;
 
@@ -289,13 +289,18 @@ export { planCron, commitCron, computeWakeSpread, readMirror, readBootId, prompt
 export type { Mirror, MirrorEntry, PlanResult, PlanCreate, ShiftedRoutine };
 
 // --- CLI ---
-if (import.meta.main) {
+// A named export, not an `import.meta.main` guard: this module is no longer an
+// entry point (routines.ts's cron-registry verb calls runCli()), and under that
+// dynamic import `import.meta.main` is false, so a guard would silently never
+// fire. tests/cron-registry.test.ts imports the pure helpers above, which is why
+// this cannot simply run at module scope.
+export function runCli(): void {
   const mode = process.argv[2];
   const hermitDir = process.argv[3];
   const pluginRoot = process.argv[4];
 
   if ((mode !== 'plan' && mode !== 'commit') || !hermitDir || !pluginRoot) {
-    process.stdout.write('SKIP|usage: cron-registry.ts <plan|commit> <hermit-dir> <plugin-root> [created-csv] [--force] [--ids <csv>]\n');
+    process.stdout.write('SKIP|usage: routines.ts cron-registry <plan|commit> <hermit-dir> <plugin-root> [created-csv] [--force] [--ids <csv>]\n');
     process.exit(0);
   }
 
diff --git a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts b/plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts
similarity index 54%
rename from plugins/claude-code-hermit/scripts/cron-tz-shift.ts
rename to plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts
index 600dc525..37d4c9d1 100644
--- a/plugins/claude-code-hermit/scripts/cron-tz-shift.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/tz-shift.ts
@@ -1,24 +1,26 @@
-// Rewrite a 5-field cron expression from one IANA timezone to the machine's local timezone.
-// Usage: bun cron-tz-shift.ts "<cron-expr>" "<from-tz>"
-// Stdout: shifted cron (or original on unsupported/fail-open paths)
-// Stderr: WARN: <reason>  (when passing through unchanged due to unsupported pattern)
-// Exit 0 always except: malformed cron that fails validateCronSchedule, or unparseable HERMIT_CRON_TZ_SHIFT_NOW
+// `routines.ts tz-shift "<cron-expr>" "<from-tz>"` — rewrites a 5-field cron
+// expression from one IANA timezone to the machine's local timezone.
+// Stdout: shifted cron (or the original on unsupported/fail-open paths)
+// Stderr: WARN: <reason>  (when passing through unchanged)
+// Exit 0 always except: a malformed cron that fails validateCronSchedule, or an
+// unparseable HERMIT_CRON_TZ_SHIFT_NOW.
 //
-// The shift logic itself lives in lib/cron-shift.ts; this file is its CLI.
+// The shift arithmetic itself lives in lib/cron-shift.ts, shared with
+// lib/routines/registry.ts; this is only its CLI face.
 
-import { validateCronSchedule } from './validate-config';
-import { shiftCron, wallMinutes } from './lib/cron-shift';
+import { validateCronSchedule } from '../../validate-config';
+import { shiftCron } from '../cron-shift';
 
-function resolveMachineTz() {
+function resolveMachineTz(): string | null {
   try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }
   catch { return null; }
 }
 
-function main() {
-  const [,, cronExpr, fromTz] = process.argv;
+export function run(args: string[]): void {
+  const [cronExpr, fromTz] = args;
 
   if (!cronExpr) {
-    process.stderr.write('Usage: bun cron-tz-shift.ts "<cron-expr>" "<from-tz>"\n');
+    process.stderr.write('Usage: bun routines.ts tz-shift "<cron-expr>" "<from-tz>"\n');
     process.exit(1);
   }
 
@@ -50,7 +52,3 @@ function main() {
   process.stdout.write(result + '\n');
   if (warn) process.stderr.write(`WARN: ${warn}\n`);
 }
-
-if (import.meta.main) {
-  main();
-}
diff --git a/plugins/claude-code-hermit/scripts/lib/trigger-source.ts b/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
index 2206afbc..d62cc2c6 100644
--- a/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
+++ b/plugins/claude-code-hermit/scripts/lib/trigger-source.ts
@@ -39,8 +39,10 @@ function classifySource(triggerText: string): string {
   const routineMatch = triggerText.match(/\[hermit-routine:([A-Za-z0-9._-]+)\]/);
   // Length-cap to 64 chars so ids can't overflow markdown table cells
   if (routineMatch) return `routine:${routineMatch[1].slice(0, 64)}`;
-  // log-routine-event.sh fallback: present in tool_result when the skill fires the marker
-  const logMatch = triggerText.match(/log-routine-event\.sh\s+([A-Za-z0-9._-]+)/);
+  // log-event fallback: present in tool_result when the skill fires the marker.
+  // Both spellings are matched — the old `log-routine-event.sh <id>` form still
+  // appears in historic transcripts that cost attribution replays.
+  const logMatch = triggerText.match(/(?:log-routine-event\.sh|routines\.ts log-event)\s+([A-Za-z0-9._-]+)/);
   if (logMatch) return `routine:${logMatch[1].slice(0, 64)}`;
   // Inbound-channel envelope (see lib/channel-envelope.ts): source is plugin-qualified
   // on the wire (e.g. `plugin:discord:discord`, `plugin:voice:voice`). Bucket by the
diff --git a/plugins/claude-code-hermit/scripts/log-routine-event.sh b/plugins/claude-code-hermit/scripts/log-routine-event.sh
deleted file mode 100755
index 2119da7a..00000000
--- a/plugins/claude-code-hermit/scripts/log-routine-event.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-# Append one event line to .claude-code-hermit/state/routine-metrics.jsonl
-# Usage: log-routine-event.sh <routine-id> <event> [delivery]
-# Events: fired | skipped-waiting | skipped-paused | started
-# delivery: cron-create (default) | monitor
-set -euo pipefail
-
-id="$1"
-event="$2"
-delivery="${3:-cron-create}"
-
-# CronCreate prompts fire with $PWD set to the session's primary working
-# directory, which may be a subdirectory of the hermit project root. Walk up
-# to the nearest ancestor containing .claude-code-hermit/ so the relative path
-# resolves correctly regardless of launch CWD.
-dir="$PWD"
-while [[ "$dir" != "/" ]]; do
-  [[ -d "$dir/.claude-code-hermit" ]] && break
-  dir="$(dirname "$dir")"
-done
-if [[ "$dir" == "/" ]]; then
-  echo "log-routine-event.sh: could not find .claude-code-hermit/ in any parent of $PWD" >&2
-  exit 1
-fi
-
-metrics="$dir/.claude-code-hermit/state/routine-metrics.jsonl"
-
-# Dedup guard (issue #464): heartbeat-restart re-invokes `hermit-routines load`
-# at its own prompt tail, which can re-trigger the cron and emit a second
-# `fired` with no intervening `started`. The prompt always logs `started`
-# immediately before `fired`, so a `fired` whose latest same-routine event is
-# already `fired` can only be the spurious re-trigger. Portable; no date math.
-if [[ "$event" == "fired" && -f "$metrics" ]]; then
-  last="$(grep -F "\"routine_id\":\"$id\"" "$metrics" | tail -n 1 || true)"
-  [[ "$last" == *'"event":"fired"'* ]] && exit 0
-fi
-
-ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-printf '{"ts":"%s","routine_id":"%s","event":"%s","delivery":"%s"}\n' \
-  "$ts" "$id" "$event" "$delivery" \
-  >> "$metrics"
diff --git a/plugins/claude-code-hermit/scripts/record-operator-action.ts b/plugins/claude-code-hermit/scripts/record-operator-action.ts
index ebff074a..ef8b28ed 100644
--- a/plugins/claude-code-hermit/scripts/record-operator-action.ts
+++ b/plugins/claude-code-hermit/scripts/record-operator-action.ts
@@ -1,10 +1,10 @@
 process.stdout.on('error', () => {});
 
 // UserPromptSubmit + SessionStart hook — records when an operator prompt is received.
-// Writes state/last-operator-action.json so heartbeat-precheck.ts can gate AUTO_CLOSE
+// Writes state/last-operator-action.json so `heartbeat.ts precheck` can gate AUTO_CLOSE
 // on genuine operator silence rather than SHELL.md mtime (which routine writes reset).
 // Also opens state/operator-turn-open.json on the same kept prompts (plus --force) so
-// routine-due.ts can defer monitor-mode routines only while a real operator turn is in
+// `routines.ts due` can defer monitor-mode routines only while a real operator turn is in
 // flight; stop-pipeline.ts clears it at Stop (issue #617 — session_state alone starved
 // routines indefinitely because it never resets on its own).
 //
@@ -21,7 +21,7 @@ process.stdout.on('error', () => {});
 //   <channel…           — unauthorized DMs arrive here before channel-responder's allowlist
 //                          check; recording them would let bot traffic suppress AUTO_CLOSE
 //   HEARTBEAT_EVALUATE/HEARTBEAT_ERROR/ROUTINE_DUE/ROUTINE_MONITOR_ERROR — Monitor-delivered
-//                          scheduler wake notifications (heartbeat-monitor.sh, routine-due.ts,
+//                          scheduler wake notifications (heartbeat-monitor.sh, routines.ts due,
 //                          routine-monitor.sh) — see isRoutinePrompt below
 //   hermit's own tmux-injected slash commands — see INJECTED_EXACT below. Every
 //   other bare `/…` prompt counts as operator activity (see isRoutinePrompt).
@@ -48,8 +48,8 @@ function write() {
   writeMarker(TMP_PATH, STATE_PATH);
 }
 
-// Marks "an operator turn is in flight" for routine-due.ts's defer gate. Cleared by
-// stop-pipeline.ts at Stop; routine-due.ts applies a 60-min TTL as an orphaned-marker
+// Marks "an operator turn is in flight" for `routines.ts due`'s defer gate. Cleared by
+// stop-pipeline.ts at Stop; `routines.ts due` applies a 60-min TTL as an orphaned-marker
 // backstop (a failed Stop must not starve routines forever).
 function openTurnMarker() {
   writeMarker(TURN_TMP, TURN_PATH);
@@ -84,7 +84,7 @@ function isRoutinePrompt(prompt: string): boolean {
   // UserPromptSubmit hook fired at all in scratch tmux sessions; revisit if a
   // future probe contradicts this):
   //   heartbeat-monitor.sh:26-34 → "HEARTBEAT_EVALUATE" (bare) | "HEARTBEAT_ERROR: <detail>"
-  //   routine-due.ts:219         → "ROUTINE_DUE [hermit-routine:<id>] ..."
+  //   lib/routines/due.ts             → "ROUTINE_DUE [hermit-routine:<id>] ..."
   //   routine-monitor.sh:26      → "ROUTINE_MONITOR_ERROR: <detail>"
   // tests/auto-close.test.ts monitor-emission drift guard re-derives this list
   // from the emitters' source — extend both together.
diff --git a/plugins/claude-code-hermit/scripts/routine-monitor.sh b/plugins/claude-code-hermit/scripts/routine-monitor.sh
index 5db07e2a..f269cfbe 100755
--- a/plugins/claude-code-hermit/scripts/routine-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/routine-monitor.sh
@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # Usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>
 # Env: ROUTINE_MONITOR_ONCE=1    → run one iteration and exit (tests)
-#      ROUTINE_DUE_SCRIPT=<path> → override routine-due path (tests)
+#      ROUTINE_DUE_SCRIPT=<path> → override routine-due path (tests). Still a bare
+#                                  script path called with `<dir>`; the default
+#                                  now prepends routines.ts's verb.
 # Polls routine-due.ts, which owns all gating/state/liveness writes and prints a
 # ROUTINE_DUE line only when eligible routines are due. No first-iteration
 # suppression needed: routine-due initializes unseen routines to "now" and fires
@@ -14,13 +16,18 @@
 set -u
 INTERVAL="${1:?usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>}"
 RT_DIR="${2:?usage: routine-monitor.sh <interval_seconds> <hermit_state_dir>}"
-DUE="${ROUTINE_DUE_SCRIPT:-$(dirname "$0")/routine-due.ts}"
+# Array, not a string — see heartbeat-monitor.sh for why.
+if [[ -n "${ROUTINE_DUE_SCRIPT:-}" ]]; then
+  DUE=("$ROUTINE_DUE_SCRIPT")
+else
+  DUE=("$(dirname "$0")/routines.ts" due)
+fi
 fail_count=0
 # Emission grammar (this line's "$out" and the ROUTINE_MONITOR_ERROR line below) is
 # load-bearing: record-operator-action.ts isRoutinePrompt() drops these lines;
 # tests/auto-close.test.ts drift guard syncs them.
 while true; do
-  if out="$(bun "$DUE" "$RT_DIR" 2>/dev/null)"; then
+  if out="$(bun "${DUE[@]}" "$RT_DIR" 2>/dev/null)"; then
     fail_count=0
     [[ -n "$out" ]] && echo "$out"
   else
diff --git a/plugins/claude-code-hermit/scripts/routines.ts b/plugins/claude-code-hermit/scripts/routines.ts
new file mode 100644
index 00000000..7ae7d4a6
--- /dev/null
+++ b/plugins/claude-code-hermit/scripts/routines.ts
@@ -0,0 +1,70 @@
+// routines.ts — single CLI for the routine mechanics, over lib/routines/.
+//
+// Usage:
+//   bun routines.ts due <hermit-state-dir>
+//     The monitor's poll. Owns all gating/state/liveness writes and prints a
+//     `ROUTINE_DUE [hermit-routine:<id>] …` line only when routines are due.
+//     That line is load-bearing: record-operator-action.ts's isRoutinePrompt()
+//     matches it, and tests/auto-close.test.ts guards it against drift.
+//
+//   bun routines.ts precheck <id> <rdw> [delivery]
+//     Per-routine gate at fire time. Prints PROCEED or a SKIP verdict.
+//
+//   bun routines.ts cron-registry <mode> <hermit-state-dir> [plugin-root] [--ids …]
+//     Reconciles the CronCreate registry against config.json.
+//
+//   bun routines.ts tz-shift "<cron-expr>" "<from-tz>"
+//     Rewrites a cron expression into the machine's local timezone.
+//
+//   bun routines.ts log-event <routine-id> <event> [delivery]
+//     Appends one line to state/routine-metrics.jsonl.
+//
+// Verb dispatch is lazy, and for the first three the verb is spliced out of
+// process.argv so each module keeps the argv indices it used as a standalone
+// script — ~650 lines of scheduling, cron matching and registry reconciliation
+// stay byte-for-byte unchanged rather than being rethreaded through a
+// parameter. `due` runs on every monitor interval, so it has no business
+// loading the registry or tz-shift graphs to do it.
+
+export {}; // module scope: every import here is dynamic, and top-level await needs it
+
+const USAGE = 'Usage: bun routines.ts <due|precheck|cron-registry|tz-shift|log-event> [args...]';
+
+const verb = process.argv[2];
+const rest = process.argv.slice(3);
+
+switch (verb) {
+  // argv-index-preserving verbs: drop the verb, then let the module run.
+  case 'due':
+    process.argv.splice(2, 1);
+    await import('./lib/routines/due');
+    break;
+  case 'precheck':
+    process.argv.splice(2, 1);
+    await import('./lib/routines/precheck');
+    break;
+  // registry.ts exports pure helpers that tests import, so its CLI cannot run at
+  // module scope; it is a named export instead.
+  case 'cron-registry': {
+    process.argv.splice(2, 1);
+    const { runCli } = await import('./lib/routines/registry');
+    runCli();
+    break;
+  }
+
+  // Already parameterized — pass the tail directly.
+  case 'tz-shift': {
+    const { run } = await import('./lib/routines/tz-shift');
+    run(rest);
+    break;
+  }
+  case 'log-event': {
+    const { run } = await import('./lib/routines/event');
+    run(rest);
+    break;
+  }
+
+  default:
+    console.error(USAGE);
+    process.exit(1);
+}
diff --git a/plugins/claude-code-hermit/scripts/transcript-digest.ts b/plugins/claude-code-hermit/scripts/transcript-digest.ts
index 3e1886b0..e8ed8c3d 100644
--- a/plugins/claude-code-hermit/scripts/transcript-digest.ts
+++ b/plugins/claude-code-hermit/scripts/transcript-digest.ts
@@ -54,7 +54,7 @@ const DEFAULT_SESSIONS = 10;
 const DAY_MS = 86_400_000;
 
 // v1 excludes Bash from productive-wake detection deliberately: every heartbeat
-// wake runs heartbeat-precheck.ts via Bash by construction, so counting any Bash
+// wake runs `heartbeat.ts precheck` via Bash by construction, so counting any Bash
 // call would peg productive_wakes/wakes at 100% and kill the defer-loop signal.
 // Undercount (a wake that only mutates state through a hermit script reads as
 // unproductive) is accepted for v1; a hermit-script allowlist is a v1.1 option.
diff --git a/plugins/claude-code-hermit/scripts/validate-config.ts b/plugins/claude-code-hermit/scripts/validate-config.ts
index b6165895..241e5f51 100644
--- a/plugins/claude-code-hermit/scripts/validate-config.ts
+++ b/plugins/claude-code-hermit/scripts/validate-config.ts
@@ -33,7 +33,7 @@ const VALID_BUDGET_ACTION = ['alert', 'pause'];
 const VALID_TELEMETRY_DEST = ['webhook'];
 const TIME_RE = /^\d{2}:\d{2}$/;
 const ENV_VAR_RE = /^[A-Z_][A-Z0-9_]*$/;
-// Routine ids travel in bracket markers, --ids CSVs, and JSONL output — shared with routine-due.ts.
+// Routine ids travel in bracket markers, --ids CSVs, and JSONL output — shared with lib/routines/due.ts.
 const ROUTINE_ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
 
 /** True for loopback hosts (localhost/127.0.0.1/::1) where a plaintext bearer token stays on-box. */
diff --git a/plugins/claude-code-hermit/skills/hatch/SKILL.md b/plugins/claude-code-hermit/skills/hatch/SKILL.md
index 1e22e3dd..24fe39d9 100644
--- a/plugins/claude-code-hermit/skills/hatch/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hatch/SKILL.md
@@ -552,7 +552,7 @@ entries the target lacks, and any entries from retired plugin versions it still
 **What the permissions buy:**
 
 - `git diff`, `git status`, `git log` — session-diff.ts hook auto-populates `## Changed` in SHELL.md
-- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (heartbeat-precheck, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `proposal.ts` — the single proposal CLI. Its create/patch/shell-append/next-task/routine verbs perform every `.claude-code-hermit/` state-dir write proposal-create and proposal-act make; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Its resolve-id/gate/queue-micro/micro/index/metrics/success-signal verbs are the proposal-act/proposal-create/reflect mechanics; without them, ID resolution, gate-verdict routing, and micro-approval queuing would all be functionally denied headlessly. Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
+- `bun */scripts/<name>.ts` — Stop hooks (cost-tracker, session-diff, evaluate-session) and precheck scripts (`heartbeat.ts precheck`, reflect-precheck), scoped to plugin scripts only. Includes `manifest-seed.ts`, which the seeding sub-step below runs to write the template-manifest baseline (deferred from Step 2 so the permission is in place first). Includes `channel-log.ts`, which weekly-review's consolidation step runs unattended to list/mark/prune the episodic channel log (PROP-010). Includes `session-archive.ts`, the deterministic session-lifecycle writer (idle/close/auto-close/open/recover) that replaced the session-mgr subagent — without this permission a hatched hermit would be asked (functionally denied headlessly) on its first idle transition. Includes `proposal.ts` — the single proposal CLI. Its create/patch/shell-append/next-task/routine verbs perform every `.claude-code-hermit/` state-dir write proposal-create and proposal-act make; without it, proposal creation and every accept/defer/dismiss/resolve mutation would be functionally denied in background/worktree sessions (the harness's isolation guard blocks the Write/Edit tools there, not Bash). Its resolve-id/gate/queue-micro/micro/index/metrics/success-signal verbs are the proposal-act/proposal-create/reflect mechanics; without them, ID resolution, gate-verdict routing, and micro-approval queuing would all be functionally denied headlessly. Includes `apply-reflection-actions.ts` and `transcript-digest.ts` — reflect's transactional resolution-action apply and its behavioral-telemetry digest; without these a scheduled reflect silently degrades to introspection-only and never resolves a proposal. Includes `setup-token-mint.ts` — the login-token renewal driver `/relogin` runs; that skill exists to be driven from chat when the hermit's login is about to lapse, so a permission prompt there is an outright denial and the renewal it was meant to perform never happens
 - `.claude-code-hermit/bin/hermit-run proposal micro *` / `proposal metrics *` — domain plugins (HA's `ha-morning-brief`, the `domain-brainstorm` skills) reach core's shared scripts through the project-resident `bin/hermit-run`, since their own `${CLAUDE_PLUGIN_ROOT}` can't resolve core's versioned cache dir. Each grant is pinned to the one verb that plugin needs, never a bare `hermit-run proposal *` — that would also expose `create`, `patch`, `shell-append`, `next-task` and `routine`, i.e. arbitrary state-dir writes. The space before `*` is a word boundary — matches `proposal micro .claude-code-hermit brief-cycle`, not a `micro…`-prefixed verb — and `hermit-exec.sh` additionally rejects `/`/`..` in the script name, so the route can't reach a script outside core's `scripts/`. Without these, headless domain briefs and brainstorm metrics checks are functionally denied
 - `bash -c 'AGENT_DIR=...` — SessionStart hook that loads session context on every startup
 - `Edit` on `.claude-code-hermit/**` — heartbeat appends to SHELL.md, increments config.json tick counter, and skills update session state without prompting (Edit rules cover all file-editing tools, including Write)
diff --git a/plugins/claude-code-hermit/skills/heartbeat/SKILL.md b/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
index 956f2d9b..e8969ee1 100644
--- a/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
+++ b/plugins/claude-code-hermit/skills/heartbeat/SKILL.md
@@ -28,7 +28,7 @@ This subcommand is the handler for `HEARTBEAT_EVALUATE` notifications emitted by
 
 1. Run the precheck:
    ```
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat-precheck.ts .claude-code-hermit
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts precheck .claude-code-hermit
    ```
 2. Read the verdict (first line of output):
    - Starts with `SKIP|` → emit `HEARTBEAT_SKIP (<reason>)`. No channel notification. No SHELL.md write. Stop.
@@ -61,7 +61,7 @@ This subcommand is the handler for `HEARTBEAT_EVALUATE` notifications emitted by
 5. **Apply writes** in the main session (to preserve cost attribution and channel/file access). First, validate the subagent return: if it cannot be parsed as JSON, or is missing either required **key** (`firing`, `self_eval_updates`), **skip all writes and emit `HEARTBEAT_OK`** — fail-open, never corrupt persistent state. Otherwise:
    - Pass the subagent return to the dedicated script on **stdin** via a quoted heredoc so free-text `text` / `self_eval` values (which may contain apostrophes) can't break the command:
      ```
-     bun ${CLAUDE_PLUGIN_ROOT}/scripts/update-alert-state.ts .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
+     bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts alert-state .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
      <subagent-return-json>
      HERMIT_ALERT_JSON
      ```
diff --git a/plugins/claude-code-hermit/skills/heartbeat/reference.md b/plugins/claude-code-hermit/skills/heartbeat/reference.md
index e027da90..b5899efc 100644
--- a/plugins/claude-code-hermit/skills/heartbeat/reference.md
+++ b/plugins/claude-code-hermit/skills/heartbeat/reference.md
@@ -4,7 +4,7 @@ This file is the instruction spec for the isolated-context subagent dispatched b
 The subagent reads only files (no inherited session context) and returns **judgment only** — which items
 are currently firing, and a human-readable label for each. All bookkeeping (dedup, suppression,
 resolution, the daily digest, monitoring lines, operator notifications, `last_clean_eval_at`, and
-`heartbeat_result`) is derived deterministically by `update-alert-state.ts` from the returned firing set —
+`heartbeat_result`) is derived deterministically by `heartbeat.ts alert-state` from the returned firing set —
 the subagent never authors any of it. This split exists because a small model (`heartbeat.model`,
 haiku by default) intermittently fabricated that bookkeeping when it was asked to author it directly
 (issue #594): inventing schema fields, garbling keys, and marking a still-pending micro-proposal
@@ -20,7 +20,7 @@ This file is read only on the EVALUATE path, once the precheck determines a full
 
 **2. Per-item evaluation.** For each item in HEARTBEAT.md:
 - **Default proposals item** (text references `proposals/` and `status: proposed`): skip it entirely.
-  `update-alert-state.ts` derives its live state directly from `proposals/` frontmatter every tick,
+  `heartbeat.ts alert-state` derives its live state directly from `proposals/` frontmatter every tick,
   independent of anything returned here — there is nothing for you to evaluate or report.
 - **Custom items** (disk thresholds, SQL checks, file patterns, etc.): apply LLM judgment using
   available project files and context needed to evaluate the condition. Produce a semantic key per
@@ -45,7 +45,7 @@ Produce one semantic key per firing item:
 Normalise: lowercase, remove non-alphanumeric characters, truncate at the listed limit.
 
 **Never** emit a `micro-proposal-pending:*` or `proposal-pending:*` key, or the `stale-session` key.
-Those are derived and owned entirely by `update-alert-state.ts` — the two prefixes from
+Those are derived and owned entirely by `heartbeat.ts alert-state` — the two prefixes from
 `state/micro-proposals.json` and `proposals/*.md` frontmatter, `stale-session` from `runtime.json` +
 the bottom-most SHELL.md Progress Log timestamp — an entry you emit under any of them is dropped as
 a phantom and has no effect.
diff --git a/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md b/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
index 76a2ef7c..d8977e57 100644
--- a/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-doctor/SKILL.md
@@ -46,7 +46,7 @@ to run at any time. Produces no side effects beyond writing
    Do not touch heartbeat-owned fields (`self_eval_updates`, `last_clean_eval_at`). If either
    `new_entries` or `resolved_keys` is non-empty, persist via the same stdin API heartbeat uses:
    ```bash
-   bun ${CLAUDE_PLUGIN_ROOT}/scripts/update-alert-state.ts .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
+   bun ${CLAUDE_PLUGIN_ROOT}/scripts/heartbeat.ts alert-state .claude-code-hermit/state/alert-state.json <<'HERMIT_ALERT_JSON'
    {"new_entries": {...}, "updated_entries": {}, "resolved_keys": [...]}
    HERMIT_ALERT_JSON
    ```
diff --git a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
index 929290b4..65ba8e70 100644
--- a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
@@ -26,7 +26,7 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
 
 1. Resolve the plugin root path: derive it from this skill's **Base directory**, which the harness injects into the invocation context as `<plugin_root>/skills/hermit-routines`. Strip the trailing `/skills/hermit-routines` to get `pluginRoot`. This works in both installed and `--plugin-dir` modes. (`$CLAUDE_PLUGIN_ROOT` is NOT a Bash env var at runtime — evaluating it in Bash always returns empty. The braced `${CLAUDE_PLUGIN_ROOT}` form is text-substituted in skill markdown only in installed mode. Neither is reliable here — always use the Base-directory derivation.) The resolved `pluginRoot` must be baked into the Monitor `command` and into any CronCreate-delivered prompt at registration — it is not available inside either subprocess or cron-delivered prompts.
 
-   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or any of `<pluginRoot>/scripts/log-routine-event.sh`, `<pluginRoot>/scripts/routine-precheck.ts`, `<pluginRoot>/scripts/routine-monitor.sh`, `<pluginRoot>/scripts/cron-registry.ts` does not exist (`test -f`), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
+   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or any of `<pluginRoot>/scripts/routines.ts log-event`, `<pluginRoot>/scripts/routines.ts precheck`, `<pluginRoot>/scripts/routine-monitor.sh`, `<pluginRoot>/scripts/routines.ts cron-registry` does not exist (`test -f`), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
 2. Read `config.routines`, filter `enabled: true`, split into the anchor (`id === "heartbeat-restart"`) and everyone else ("scheduled routines").
 
    **Empty scheduled-routine set does not early-exit** — an operator disabling every routine mid-session must not leave a live monitor/anchor/crons behind. Reconcile: TaskStop any `routine-monitor` task (ignore not-found), delete `state/routine-monitor-liveness.json` and `state/routine-monitor.runtime.json`, run the anchor-only planner leg (Step 3's `--ids heartbeat-restart`, which with nothing else enabled emits `DELETE:` for every tracked id including the anchor if it too is disabled) and execute its deletes, then log "No enabled routines in config." and stop.
@@ -35,18 +35,18 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
    - **Register:** call the Monitor tool — `description: "routine-monitor"` (reserved slot), `command: "bash <pluginRoot>/scripts/routine-monitor.sh 60 $PWD/.claude-code-hermit"`, `timeout_ms: 86400000` (schema-required boilerplate on a persistent monitor — it does not expire on this deadline; the daily anchor re-arm exists to recover from monitor *death* and session restarts, not a timeout), `persistent: true`.
    - **Liveness-verify:** wait 5s, then check `state/routine-monitor-liveness.json` exists. Absent → the subprocess likely failed to spawn (seccomp/nested-userns) — `TaskStop` the task just registered and go to Step 3-F.
    - On success: write `state/routine-monitor.runtime.json`: `{"description":"routine-monitor","task_id":"<id>","command":"<cmd>","interval":60,"started_at":"<ISO now>","mode":"monitor"}`. If there are zero scheduled routines but the anchor is enabled, skip registering the Monitor and record `"routines":0` in the runtime file instead — go straight to anchor registration below.
-   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/cron-registry.ts plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `... cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
+   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `... cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
    - **First-transition sweep only** (runtime file was absent, or `mode` just changed to `monitor`): also call `CronList` and `CronDelete` every entry whose prompt contains `[hermit-routine:` except `[hermit-routine:heartbeat-restart]` — covers live crons from an in-process upgrade that the mirror no longer tracks (duplicate-fire hazard).
    - Log: `Routines: monitor registered (<N> scheduled), anchor re-armed.` or the `routines:0`/first-transition variants.
 4. **Step 3-F — fallback** (Monitor unavailable, registration failed, or liveness-verify failed): run the **CronCreate flow** below against the full enabled set (scheduled routines + anchor), then write `state/routine-monitor.runtime.json`: `{"mode":"croncreate-fallback","started_at":"<ISO now>"}`.
 
    **CronCreate flow** (also used verbatim by `load --reset`'s fallback branch):
-   1. Run the diff planner: `bun <pluginRoot>/scripts/cron-registry.ts plan .claude-code-hermit <pluginRoot>` (append ` --force` for `load --reset`). Parse stdout: `DELETE:<id>`, `CREATE:<id>|<schedule>`, `WARN:<id>|<reason>`, `KEEP:<n>`, optional trailing `WAKESPREAD:<distinct>|<max>|<loneliest>`.
+   1. Run the diff planner: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot>` (append ` --force` for `load --reset`). Parse stdout: `DELETE:<id>`, `CREATE:<id>|<schedule>`, `WARN:<id>|<reason>`, `KEEP:<n>`, optional trailing `WAKESPREAD:<distinct>|<max>|<loneliest>`.
       - First line `SKIP|<reason>` (planner fell open, e.g. corrupt `config.json`): abort, log `Routine load aborted: cron planner failed — <reason>. No routines registered.`
       - No `DELETE:`/`CREATE:` lines (only `KEEP:<n>`, optional `WAKESPREAD:`): already current — log `Routines unchanged: <n> current, 0 registered.` (plus the wake-spread line if present); stop. No `CronList`, no `CronCreate`, no `CronDelete` this run.
       - Otherwise, if any `DELETE:` lines: call `CronList` once, `CronDelete` each entry whose prompt contains `[hermit-routine:<id>]` (skip silently if absent).
    2. For each `CREATE:<id>|<schedule>` line, build the prompt (Shared execution semantics, below) using `<schedule>` as-is (already tz-shifted). Call `CronCreate`: `cron: <schedule>`, `recurring: true`, `durable: false`, `prompt: <resolved>`. **Per-routine error isolation:** if `CronCreate` throws for one routine, record the failure and continue — track which ids succeeded.
-   3. Commit: `bun <pluginRoot>/scripts/cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>"` (append ` --force` for `load --reset`).
+   3. Commit: `bun <pluginRoot>/scripts/routines.ts cron-registry commit .claude-code-hermit <pluginRoot> "<succeeded-csv>"` (append ` --force` for `load --reset`).
    4. Log: `Routines registered: <N> ok, <M> failed, <K> kept[, <W> tz-warned]`. List failures/warnings on their own lines. If `WAKESPREAD:<distinct>|<max>|<loneliest>` was present: `WARN: wake spread — <distinct> distinct 30-min wake windows (max <max>); consider clustering: <loneliest>` (advisory only).
 
 **`load --reset`:** the unconditional escape hatch for suspected drift. **Monitor mode:** unconditionally `TaskStop`/orphan-sweep any `routine-monitor` task, `CronList` → `CronDelete` every live `[hermit-routine:*]` entry (anchor included), delete `state/routine-schedule.json` (deliberate baseline reset — the ordinary re-arm's "preserve the cursor" rule doesn't apply here), then re-register per Step 3 with `--force` appended to **both** the anchor `plan` and `commit` calls. **Fallback mode:** Step 3's planner call gets `--force` (every enabled routine becomes `CREATE`, no `DELETE`s) — `--reset` also sweeps unconditionally first: `CronList`, then `CronDelete` every `[hermit-routine:` entry. Step 3's `commit` call gets `--force` too. Both modes need `--force` on `commit` as well as `plan`: an unforced `commit` replan would carry stale `registered_at` forward, undoing the reset's clock.
@@ -55,15 +55,15 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
 
 Used both by the fallback CronCreate prompt (built at `CREATE:` time) and by the `run <ids>` handler (below) — one definition, two callers.
 
-One shared template for both `run_during_waiting` (rdw) values — `routine-precheck.ts` takes `rdw` as an argument and consults the waiting-check and the binding pause flag internally. Default `run_during_waiting` is `false` when the field is absent.
+One shared template for both `run_during_waiting` (rdw) values — `routines.ts precheck` takes `rdw` as an argument and consults the waiting-check and the binding pause flag internally. Default `run_during_waiting` is `false` when the field is absent.
 
 **Model-override substitution.** Read the routine's optional `model` field. First, if `id === "heartbeat-restart"`, treat `model` as absent regardless of its value — its re-arm append must run in the session, so it is never dispatched to a subagent. Then: if `model` is absent/null, invoke `/<skill>` directly. If set to a non-null `<model>`, dispatch instead: resolve `<abs-project-dir>` as the session's current absolute working directory (the project root) and `dispatch the skill via the Agent tool: subagent_type "general-purpose", model "<model>", prompt "The hermit project is at <abs-project-dir>; its state lives in <abs-project-dir>/.claude-code-hermit/. Invoke the skill /<skill> to completion, following its instructions exactly, and resolve any project-relative .claude-code-hermit/ reads/writes against <abs-project-dir> — pass the absolute <abs-project-dir>/.claude-code-hermit path to any hermit script the skill runs rather than relying on your cwd. Return only a one-line status."` **Language clause:** when `config.language` is set, append one more sentence to that prompt — `All operator-facing prose you produce (channel messages, push notifications, report text) must be written in <language>.` — substituting the configured language; append nothing when it is null. No script call: the dispatching session already holds the language in its Operator Preferences context. This anchors the subagent's own project-relative state paths without constraining where else it may work — a dispatched skill that legitimately changes directory for unrelated work (e.g. a custom routine touching a sibling repo) is unaffected, since `.claude-code-hermit/` always lives under `<abs-project-dir>` regardless of the subagent's cwd at invocation time. The Agent runs in isolated context and returns only a one-line status; the precheck call, the `fired` log line, and any `heartbeat-restart`/`reflect_after` appends stay in the session turn at the session model.
 
 Base execution, one routine, `<delivery>` = `cron-create` (fallback prompt) or `monitor` (`run` handler):
 ```
-Run: bun <pluginRoot>/scripts/routine-precheck.ts <id> <rdw> <delivery>
+Run: bun <pluginRoot>/scripts/routines.ts precheck <id> <rdw> <delivery>
 If the output is SKIP, stop. If PROCEED, then invoke /<skill> (or dispatch per the model-override rule above). After it completes, run:
-<pluginRoot>/scripts/log-routine-event.sh <id> fired <delivery>
+<pluginRoot>/scripts/routines.ts log-event <id> fired <delivery>
 ```
 Replace `<pluginRoot>`, `<id>`, `<rdw>` (`true`/`false`; default `false`), and `<skill>` (passed verbatim to the slash invocation — `claude-code-hermit:brief --morning` becomes `/claude-code-hermit:brief --morning`).
 
@@ -71,7 +71,7 @@ Replace `<pluginRoot>`, `<id>`, `<rdw>` (`true`/`false`; default `false`), and `
 
 **`reflect_after: true`:** append after the trailing `fired` log line (and after the `heartbeat-restart` append if both apply). Skip when `skill` is `claude-code-hermit:reflect` — chaining reflect after reflect is a config foot-gun.
 ```
-Then, only if routine-precheck returned PROCEED (not SKIP), run <pluginRoot>/scripts/reflect-precheck.ts .claude-code-hermit <pluginRoot> --quick. If its first output line is exactly `EMPTY`, do not invoke reflect. Otherwise (a `RUN|<hash>` line) invoke /claude-code-hermit:reflect --quick --precheck-verdict '<that full line>'.
+Then, only if `routines.ts precheck` returned PROCEED (not SKIP), run <pluginRoot>/scripts/reflect-precheck.ts .claude-code-hermit <pluginRoot> --quick. If its first output line is exactly `EMPTY`, do not invoke reflect. Otherwise (a `RUN|<hash>` line) invoke /claude-code-hermit:reflect --quick --precheck-verdict '<that full line>'.
 ```
 
 **Special case — `skill` is exactly `claude-code-hermit:reflect`:** reflect's body should not load on days with nothing to reflect on. Replace the invoke clause with:
diff --git a/plugins/claude-code-hermit/skills/session-close/SKILL.md b/plugins/claude-code-hermit/skills/session-close/SKILL.md
index e31988f0..da0d19e4 100644
--- a/plugins/claude-code-hermit/skills/session-close/SKILL.md
+++ b/plugins/claude-code-hermit/skills/session-close/SKILL.md
@@ -54,7 +54,7 @@ Invoked by the `daily-auto-close` routine at `0 0 * * *` (local) — the midnigh
    The verb owns the whole branch table: it reads `session_state` and the operator-action clock, deletes a stale `pending-close.json` itself when there is nothing to close, writes a fresh queue flag itself when the operator is active, and fails open to close-now when the clock is missing or invalid (operator idle indefinitely). A corrupt or unreadable `runtime.json` maps to `noop`, not close-now — closing a session whose state is unknowable would be fail-destructive.
 2. Branch on the returned `decision`:
    - **`noop`** — stop: do not notify the operator, do not write to `routine-metrics.jsonl`.
-   - **`queued`** — stop. The heartbeat-precheck drain block emits `AUTO_CLOSE` on the next tick where the operator has been idle >10 minutes.
+   - **`queued`** — stop. The `heartbeat.ts precheck` drain block emits `AUTO_CLOSE` on the next tick where the operator has been idle >10 minutes.
    - **`close-now`** — close directly by proceeding through the Auto-close path (`--auto`) above (steps 6–8, `Closed Via: auto`). Stop.
    - **`ok === false`** — append the returned `reason` to SHELL.md `## Findings` and stop; the routine retries next midnight.
 
diff --git a/plugins/claude-code-hermit/skills/smoke-test/SKILL.md b/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
index f79d4ecb..f188043b 100644
--- a/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
+++ b/plugins/claude-code-hermit/skills/smoke-test/SKILL.md
@@ -43,12 +43,12 @@ Track `passed`, `warnings`, `failures` counts. Collect output lines for the fina
   - Found: **PASS** `scheduled_checks[N]: <plugin>:<skill-name> loaded`
   - Not found: **WARN** `scheduled_checks[N]: <plugin>:<skill-name> not loaded — install the plugin or remove the entry`
 
-### 4b. Verify cron-tz-shift helper
+### 4b. Verify the tz-shift helper
 
-Run: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/cron-tz-shift.ts "0 4 * * *" "UTC"`
+Run: `bun ${CLAUDE_PLUGIN_ROOT}/scripts/routines.ts tz-shift "0 4 * * *" "UTC"`
 
-- Exit 0 and stdout is `0 4 * * *`: **PASS** `cron-tz-shift helper available`
-- Exit non-zero or wrong stdout: **FAIL** `cron-tz-shift helper missing or broken — run /hermit-evolve`
+- Exit 0 and stdout is `0 4 * * *`: **PASS** `routines.ts tz-shift helper available`
+- Exit non-zero or wrong stdout: **FAIL** `routines.ts tz-shift helper missing or broken — run /hermit-evolve`
 
 ### 5. Routine validation (static)
 
diff --git a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
index 370fa58b..231a78d3 100644
--- a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
+++ b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
@@ -41,8 +41,8 @@ function withTmp(fn: (dir: string) => Promise<void> | void) {
 
 /** Run heartbeat-precheck from inside the workdir, return verdict. */
 async function precheck(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
@@ -51,8 +51,8 @@ async function precheck(dir: string, peek = false): Promise<string> {
 
 /** Run update-alert-state against the workdir's alert-state.json with a stdin payload. */
 async function updateAlertState(dir: string, payload: object): Promise<void> {
-  await runScript('update-alert-state.ts', {
-    args: [alertPath(dir)],
+  await runScript('heartbeat.ts', {
+    args: ['alert-state', alertPath(dir)],
     stdin: JSON.stringify(payload),
   });
 }
diff --git a/plugins/claude-code-hermit/tests/auto-close.test.ts b/plugins/claude-code-hermit/tests/auto-close.test.ts
index f71526c0..dde32527 100644
--- a/plugins/claude-code-hermit/tests/auto-close.test.ts
+++ b/plugins/claude-code-hermit/tests/auto-close.test.ts
@@ -57,8 +57,8 @@ function touchAgo(p: string, hours: number): void {
 
 /** Run heartbeat-precheck from inside the workdir and return its verdict. */
 async function precheck(dir: string, opts: { now?: string; peek?: boolean } = {}): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(opts.peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(opts.peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: opts.now ? { HERMIT_NOW: opts.now } : {},
   });
@@ -547,7 +547,7 @@ describe('record-operator-action: monitor emission strings stay in sync', () =>
   // routine-due.ts builds its line from a template literal rather than a bare echo —
   // assert the grammar anchor is still present in source.
   test('routine-due.ts still emits the ROUTINE_DUE [hermit-routine: grammar', () => {
-    const src = fs.readFileSync(path.join(SCRIPTS_DIR, 'routine-due.ts'), 'utf-8');
+    const src = fs.readFileSync(path.join(SCRIPTS_DIR, 'lib', 'routines', 'due.ts'), 'utf-8');
     expect(src).toContain('ROUTINE_DUE ');
     expect(src).toContain('[hermit-routine:');
   });
@@ -1149,9 +1149,12 @@ describe('auto-close-decision verb', () => {
   // constant — both the precheck drain and the decision verb import it from
   // lib/auto-close, so they can never disagree on the boundary.
   test('heartbeat-precheck and session-archive both import the lull from lib/auto-close', () => {
-    const precheckSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'heartbeat-precheck.ts'), 'utf-8');
+    const precheckSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'lib', 'heartbeat', 'precheck.ts'), 'utf-8');
     const archiveSrc = fs.readFileSync(path.join(SCRIPTS_DIR, 'session-archive.ts'), 'utf-8');
-    expect(precheckSrc).toContain('lib/auto-close');
-    expect(archiveSrc).toContain('lib/auto-close');
+    // Assert the imported symbol, not the import path: precheck.ts now lives in
+    // lib/heartbeat/ and reaches the same module as '../auto-close'. The
+    // invariant is that neither hardcodes the lull.
+    expect(precheckSrc).toContain('AUTO_CLOSE_LULL_MINUTES');
+    expect(archiveSrc).toContain('AUTO_CLOSE_LULL_MINUTES');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/budget-precheck.test.ts b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
index 6538ed16..1696070f 100644
--- a/plugins/claude-code-hermit/tests/budget-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
@@ -70,8 +70,8 @@ const budgetEntry = (notified: boolean) => ({
 });
 
 async function precheck(dir: string): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: ['.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
diff --git a/plugins/claude-code-hermit/tests/contracts.test.ts b/plugins/claude-code-hermit/tests/contracts.test.ts
index cefe1087..a3b59a39 100644
--- a/plugins/claude-code-hermit/tests/contracts.test.ts
+++ b/plugins/claude-code-hermit/tests/contracts.test.ts
@@ -1259,8 +1259,8 @@ describe('hermit-routines diff-registration contract', () => {
   const skillContent = read(path.join(SKILLS, 'hermit-routines', 'SKILL.md'));
 
   test('SKILL.md wires the diff planner into load\'s success path', () => {
-    expect(skillContent).toContain('cron-registry.ts plan');
-    expect(skillContent).toContain('cron-registry.ts commit');
+    expect(skillContent).toContain('routines.ts cron-registry plan');
+    expect(skillContent).toContain('routines.ts cron-registry commit');
   });
 
   test('load\'s default success path is no longer an unconditional CronList sweep', () => {
diff --git a/plugins/claude-code-hermit/tests/cron-registry.test.ts b/plugins/claude-code-hermit/tests/cron-registry.test.ts
index fae8c137..63e437ee 100644
--- a/plugins/claude-code-hermit/tests/cron-registry.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-registry.test.ts
@@ -14,7 +14,7 @@
 // never silently ride a routine past CC's real 7-day auto-expiry cliff.
 
 import { describe, test, expect } from 'bun:test';
-import { planCron, commitCron, computeWakeSpread, promptHash, REREGISTER_AGE_MS, filterRoutinesByIds } from '../scripts/cron-registry';
+import { planCron, commitCron, computeWakeSpread, promptHash, REREGISTER_AGE_MS, filterRoutinesByIds } from '../scripts/lib/routines/registry';
 import { shiftCron } from '../scripts/lib/cron-shift';
 
 const PLUGIN_ROOT = '/plugin';
diff --git a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
index 521da9c7..ea8e2092 100644
--- a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
@@ -17,8 +17,8 @@ const W = '2026-01-15T12:00:00Z'; // winter reference (Lisbon=UTC+0)
 const S = '2026-07-15T12:00:00Z'; // summer reference (Lisbon=UTC+1)
 
 const shift = (tz: string, now: string, cron: string, fromTz: string) =>
-  runScript('cron-tz-shift.ts', {
-    args: [cron, fromTz],
+  runScript('routines.ts', {
+    args: ['tz-shift', cron, fromTz],
     env: { TZ: tz, HERMIT_CRON_TZ_SHIFT_NOW: now },
   });
 
diff --git a/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts b/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
index e48a3e49..58b01fda 100644
--- a/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
+++ b/plugins/claude-code-hermit/tests/heartbeat-default-scan.test.ts
@@ -85,8 +85,8 @@ function build(fix: Fixture): string {
 }
 
 async function verdict(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env: { HERMIT_NOW: NOW },
   });
diff --git a/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts b/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
index 59fa596f..d513b5a6 100644
--- a/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
+++ b/plugins/claude-code-hermit/tests/heartbeat-injection-scan.test.ts
@@ -74,8 +74,8 @@ function contentHash(text: string): string {
 }
 
 async function verdict(dir: string, peek = false, env?: Record<string, string>): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: [...(peek ? ['--peek'] : []), '.claude-code-hermit'],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek'] : []), '.claude-code-hermit'],
     cwd: dir,
     env,
   });
diff --git a/plugins/claude-code-hermit/tests/routine-due.test.ts b/plugins/claude-code-hermit/tests/routine-due.test.ts
index 85f35403..fe003acd 100644
--- a/plugins/claude-code-hermit/tests/routine-due.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-due.test.ts
@@ -53,7 +53,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (dir: string, now: string) =>
-  runScript('routine-due.ts', { args: [hermit(dir)], env: { HERMIT_NOW: now } });
+  runScript('routines.ts', { args: ['due', hermit(dir)], env: { HERMIT_NOW: now } });
 
 describe('routine-due', () => {
   test('no schedule file + due-now mark → init-to-now, NO emission, entry created', withDir(async (dir) => {
@@ -218,8 +218,8 @@ describe('routine-due', () => {
 
     // Force the schedule persist to fail via the test seam — the deferred skip stamp must
     // not be written and the cursor must not advance (persist-before-stamp ordering).
-    const rFail = await runScript('routine-due.ts', {
-      args: [hermit(dir)],
+    const rFail = await runScript('routines.ts', {
+      args: ['due', hermit(dir)],
       env: { HERMIT_NOW: '2026-07-15T09:00:00Z', HERMIT_DUE_FORCE_PERSIST_FAIL: '1' },
     });
     expect(rFail.exitCode).toBe(0);
@@ -310,7 +310,7 @@ describe('routine-due', () => {
   }));
 
   test('missing hermit-dir arg → exit 0, no crash, no output', withDir(async (dir) => {
-    const r = await runScript('routine-due.ts', { args: [] });
+    const r = await runScript('routines.ts', { args: ['due', ] });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   }));
diff --git a/plugins/claude-code-hermit/tests/routine-precheck.test.ts b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
index ef8eaf06..20275f29 100644
--- a/plugins/claude-code-hermit/tests/routine-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
@@ -35,7 +35,7 @@ function withDir(fn: (dir: string) => Promise<void> | void) {
 }
 
 const run = (id: string, rdw: 'true' | 'false', dir: string) =>
-  runScript('routine-precheck.ts', { args: [id, rdw], cwd: dir });
+  runScript('routines.ts', { args: ['precheck', id, rdw], cwd: dir });
 
 describe('routine-precheck', () => {
   test('idle, unpaused, rdw=false → PROCEED + one started row', withDir(async (dir) => {
@@ -98,7 +98,7 @@ describe('routine-precheck', () => {
   }));
 
   test('missing routine id → fail-open PROCEED, no metrics row written', withDir(async (dir) => {
-    const r = await runScript('routine-precheck.ts', { args: [], cwd: dir });
+    const r = await runScript('routines.ts', { args: ['precheck', ], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('PROCEED');
     expect(readMetricsRows(dir)).toHaveLength(0);
@@ -110,8 +110,8 @@ describe('routine-precheck', () => {
     // the root-cwd cases above rely on the fail-open branch instead — see file header).
     fs.writeFileSync(hermit(dir, 'config.json'), '{}');
     fs.mkdirSync(path.join(dir, 'app', 'sub'), { recursive: true });
-    const r = await runScript('routine-precheck.ts', {
-      args: ['nested-routine', 'false'],
+    const r = await runScript('routines.ts', {
+      args: ['precheck', 'nested-routine', 'false'],
       cwd: path.join(dir, 'app', 'sub'),
     });
     expect(r.exitCode).toBe(0);
@@ -128,7 +128,7 @@ describe('routine-precheck', () => {
   }));
 
   test('explicit delivery arg "monitor" serializes delivery: monitor', withDir(async (dir) => {
-    const r = await runScript('routine-precheck.ts', { args: ['test-routine', 'false', 'monitor'], cwd: dir });
+    const r = await runScript('routines.ts', { args: ['precheck', 'test-routine', 'false', 'monitor'], cwd: dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('PROCEED');
     const rows = readMetricsRows(dir);
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index f0b48515..f84351d1 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -684,7 +684,7 @@ describe('update-alert-state', () => {
 
   async function updateAlertState(dir: string, payload: string, env: Record<string, string> = { HERMIT_NOW: NOW }) {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: payload, env });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: payload, env });
     expect(r.exitCode).toBe(0);
     return {
       state: fs.existsSync(stateFile) ? readJson(stateFile) : null,
@@ -784,8 +784,8 @@ describe('update-alert-state', () => {
 
   test('update-alert-state (missing state file — fail-open, seeds default, exits 0)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', {
-      args: [stateFile], stdin: firingPayload([{ key: 'custom:x', text: 'k fired' }]), env: { HERMIT_NOW: NOW },
+    const r = await runScript('heartbeat.ts', {
+      args: ['alert-state', stateFile], stdin: firingPayload([{ key: 'custom:x', text: 'k fired' }]), env: { HERMIT_NOW: NOW },
     });
     expect(r.exitCode).toBe(0);
     const d = readJson(stateFile);
@@ -794,7 +794,7 @@ describe('update-alert-state', () => {
 
   test('update-alert-state (bad JSON payload — exits 1, no write)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: 'not-json' });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: 'not-json' });
     expect(r.exitCode).toBe(1);
     expect(fs.existsSync(stateFile)).toBe(false);
   }));
@@ -804,13 +804,13 @@ describe('update-alert-state', () => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
 
     write(stateFile, before);
-    let r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: JSON.stringify({ firing: 'not-an-array', self_eval_updates: {} }), env: { HERMIT_NOW: NOW } });
+    let r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: JSON.stringify({ firing: 'not-an-array', self_eval_updates: {} }), env: { HERMIT_NOW: NOW } });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(readJson(stateFile)).toEqual(JSON.parse(before)); // untouched — never coerced to empty and aged
 
     write(stateFile, before);
-    r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: JSON.stringify({ firing: [{ key: 'checklist:x' }], self_eval_updates: {} }), env: { HERMIT_NOW: NOW } }); // missing text
+    r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: JSON.stringify({ firing: [{ key: 'checklist:x' }], self_eval_updates: {} }), env: { HERMIT_NOW: NOW } }); // missing text
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(readJson(stateFile)).toEqual(JSON.parse(before));
@@ -829,7 +829,7 @@ describe('update-alert-state', () => {
   test('update-alert-state (write failure — no stdout, no side effects)', withDir(async (dir) => {
     const stateFile = hermit(dir, 'state', 'alert-state.json');
     fs.mkdirSync(stateFile); // path is a directory → write throws EISDIR
-    const r = await runScript('update-alert-state.ts', { args: [stateFile], stdin: firingPayload([{ key: 'stale-session', text: 'x' }]), env: { HERMIT_NOW: NOW } });
+    const r = await runScript('heartbeat.ts', { args: ['alert-state', stateFile], stdin: firingPayload([{ key: 'stale-session', text: 'x' }]), env: { HERMIT_NOW: NOW } });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
     expect(fs.statSync(stateFile).isDirectory()).toBe(true); // untouched
@@ -1864,8 +1864,8 @@ function seedHeartbeat(dir: string, opts: {
 }
 
 async function precheckOut(dir: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: peek ? ['--peek', hermit(dir)] : [hermit(dir)],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek', hermit(dir)] : [hermit(dir)])],
   });
   expect(r.exitCode).toBe(0);
   return r.stdout.trimEnd();
@@ -2072,8 +2072,8 @@ function seedDamper(dir: string, opts: {
 }
 
 async function precheckWithNow(dir: string, nowIso: string, peek = false): Promise<string> {
-  const r = await runScript('heartbeat-precheck.ts', {
-    args: peek ? ['--peek', hermit(dir)] : [hermit(dir)],
+  const r = await runScript('heartbeat.ts', {
+    args: ['precheck', ...(peek ? ['--peek', hermit(dir)] : [hermit(dir)])],
     env: { HERMIT_NOW: nowIso },
   });
   expect(r.exitCode).toBe(0);
@@ -2612,11 +2612,10 @@ describe('reflect-precheck', () => {
 });
 
 // -------------------------------------------------------
-// log-routine-event.sh — resolves hermit root by walking up from CWD
+// routines.ts log-event — resolves hermit root by walking up from CWD
 // -------------------------------------------------------
 
-describe('log-routine-event', () => {
-  const SCRIPT = path.join(SCRIPTS_DIR, 'log-routine-event.sh');
+describe('routines.ts log-event', () => {
 
   // Empirically confirmed (bun 1.3.14): describe.serial does not reliably
   // force sequential execution of its own child tests under --concurrent —
@@ -2631,23 +2630,23 @@ describe('log-routine-event', () => {
     });
     afterAll(() => wd.cleanup());
 
-    test.serial('log-routine-event (subdir resolves to ancestor)', async () => {
+    test.serial('log-event (subdir resolves to ancestor)', async () => {
       // Fired from a subdirectory → appends to the ancestor's state file
-      await runBash(SCRIPT, { args: ['morning-brief', 'fired'], cwd: path.join(wd.dir, 'app', 'sub') });
+      await runScript('routines.ts', { args: ['log-event', 'morning-brief', 'fired'], cwd: path.join(wd.dir, 'app', 'sub') });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"morning-brief","event":"fired"');
     });
 
-    test.serial('log-routine-event (root resolves to state file)', async () => {
+    test.serial('log-event (root resolves to state file)', async () => {
       // Fired from the hermit root → unchanged behavior
-      await runBash(SCRIPT, { args: ['weekly-review', 'skipped-waiting'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'weekly-review', 'skipped-waiting'], cwd: wd.dir });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"weekly-review","event":"skipped-waiting"');
     });
 
-    test.serial('log-routine-event (started event serializes correctly)', async () => {
+    test.serial('log-event (started event serializes correctly)', async () => {
       // started marker emitted before skill invocation — must serialize like other events
-      await runBash(SCRIPT, { args: ['daily-brief', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'daily-brief', 'started'], cwd: wd.dir });
       const content = fs.readFileSync(metrics(), 'utf-8');
       expect(content).toContain('"routine_id":"daily-brief","event":"started"');
     });
@@ -2670,16 +2669,16 @@ describe('log-routine-event', () => {
     afterAll(() => wd.cleanup());
 
     test.serial('suppresses a fired that immediately follows another fired', async () => {
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'started'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
       expect(firedCount()).toBe(1);
     });
 
     test.serial('allows the next legitimate started→fired cycle', async () => {
       const before = firedCount();
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'started'], cwd: wd.dir });
-      await runBash(SCRIPT, { args: ['heartbeat-restart', 'fired'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'started'], cwd: wd.dir });
+      await runScript('routines.ts', { args: ['log-event', 'heartbeat-restart', 'fired'], cwd: wd.dir });
       expect(firedCount()).toBe(before + 1);
     });
   });
@@ -2692,7 +2691,7 @@ describe('log-routine-event', () => {
     beforeAll(async () => {
       const nohermit = fs.mkdtempSync(path.join(os.tmpdir(), 'no-hermit-'));
       try {
-        const r = await runBash(SCRIPT, { args: ['x', 'fired'], cwd: nohermit });
+        const r = await runScript('routines.ts', { args: ['log-event', 'x', 'fired'], cwd: nohermit });
         exitCode = r.exitCode;
         stderr = r.stderr;
       } finally {

From ecb43b7e5bd351bbbc34acb3f229254e25905f83 Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 19:12:54 +0100
Subject: [PATCH 8/9] docs(claude-code-hermit): repoint comments at the
 consolidated script names

Comment-only sweep. The seven consolidation commits renamed 23 scripts; these
are the cross-references left pointing at filenames that no longer exist -
monitor shell headers, lib/ comments explaining who calls what, and test-file
headers naming the script under test. A reader following any of them found
nothing.

Two references are deliberately left naming the old spelling, and both are
load-bearing: lib/trigger-source.ts matches `log-routine-event.sh <id>` as well
as the new form, because cost attribution replays historic transcripts; and the
cost-tracker/subagent-cost test fixtures embed that old string on purpose for
the same reason.

No behavior change. bun test 3179 pass / 0 fail; bunx tsc --noEmit exit 0.
---
 plugins/claude-code-hermit/scripts/cost-tracker.ts        | 4 ++--
 plugins/claude-code-hermit/scripts/heartbeat-monitor.sh   | 2 +-
 plugins/claude-code-hermit/scripts/lib/alert-state.ts     | 8 ++++----
 plugins/claude-code-hermit/scripts/lib/auto-close.ts      | 2 +-
 plugins/claude-code-hermit/scripts/lib/cron-match.ts      | 4 ++--
 plugins/claude-code-hermit/scripts/lib/cron-shift.ts      | 2 +-
 plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts | 4 ++--
 plugins/claude-code-hermit/scripts/lib/routines/due.ts    | 2 +-
 .../claude-code-hermit/scripts/lib/routines/registry.ts   | 2 +-
 plugins/claude-code-hermit/scripts/lib/time.ts            | 2 +-
 plugins/claude-code-hermit/scripts/routine-monitor.sh     | 4 ++--
 .../tests/alert-state-durability.test.ts                  | 2 +-
 plugins/claude-code-hermit/tests/budget-precheck.test.ts  | 2 +-
 .../claude-code-hermit/tests/cost-report-reflect.test.ts  | 4 ++--
 .../claude-code-hermit/tests/cost-report-session.test.ts  | 2 +-
 .../claude-code-hermit/tests/cost-report-today.test.ts    | 2 +-
 plugins/claude-code-hermit/tests/cron-registry.test.ts    | 2 +-
 plugins/claude-code-hermit/tests/cron-tz-shift.test.ts    | 2 +-
 plugins/claude-code-hermit/tests/routine-due.test.ts      | 2 +-
 plugins/claude-code-hermit/tests/routine-precheck.test.ts | 2 +-
 plugins/claude-code-hermit/tests/scripts.test.ts          | 8 ++++----
 21 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/plugins/claude-code-hermit/scripts/cost-tracker.ts b/plugins/claude-code-hermit/scripts/cost-tracker.ts
index 3e299b6d..61d7b607 100644
--- a/plugins/claude-code-hermit/scripts/cost-tracker.ts
+++ b/plugins/claude-code-hermit/scripts/cost-tracker.ts
@@ -338,10 +338,10 @@ function writeRuntimeFields(fields: Record<string, Json>): void {
   fs.renameSync(RUNTIME_JSON_TMP, RUNTIME_JSON);
 }
 
-// Maintains the [opened_at, closed_at] window that session-cost.ts sums cost-log
+// Maintains the [opened_at, closed_at] window that lib/cost-report/session.ts sums cost-log
 // rows over — the logical-session boundary, since cost-log rows carry the shared
 // transcript UUID (never the logical S-NNN) and one transcript holds many logical
-// sessions (see session-cost.ts). Three runtime.json fields define an arc:
+// sessions (see lib/cost-report/session.ts). Three runtime.json fields define an arc:
 //   opened_at        — arc start (first in_progress turn)
 //   closed_at        — arc end, stamped on the idle transition; null while live
 //   opened_transcript— the CC transcript/process id that owns the current arc
diff --git a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
index 0b218364..98909266 100755
--- a/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/heartbeat-monitor.sh
@@ -4,7 +4,7 @@
 #      HEARTBEAT_PRECHECK=<path> → override precheck path (tests). Still a bare
 #                                  script path called with `--peek <dir>`; the
 #                                  default now prepends heartbeat.ts's verb.
-# Polls heartbeat-precheck.ts --peek and emits a notification only when the
+# Polls `heartbeat.ts precheck` --peek and emits a notification only when the
 # LLM needs to wake up (EVALUATE, AUTO_CLOSE, or ALERT verdict). --peek means
 # the polling itself is read-only; the mutating tick happens once when
 # /heartbeat run re-runs precheck inside the EVALUATE handler.
diff --git a/plugins/claude-code-hermit/scripts/lib/alert-state.ts b/plugins/claude-code-hermit/scripts/lib/alert-state.ts
index 87f3d1dc..5c42da37 100644
--- a/plugins/claude-code-hermit/scripts/lib/alert-state.ts
+++ b/plugins/claude-code-hermit/scripts/lib/alert-state.ts
@@ -118,7 +118,7 @@ export function mutateOwnedAlerts(p: string, mutator: (alerts: Json) => void): b
 // the prior alerts{} and the set of keys firing this tick. The subagent now
 // returns only `{key, text}` pairs for items that need semantic judgment
 // (checklist/custom/waiting-timeout); this ladder is prefix-agnostic — the
-// caller (update-alert-state.ts) is responsible for only including keys it
+// caller (lib/heartbeat/alert-update.ts) is responsible for only including keys it
 // trusts in `firing` (model judgment keys plus script-derived keys — see
 // deriveMicroPendingKeys / deriveProposalPendingKeys / deriveStaleSession below).
 // ---------------------------------------------------------------------------
@@ -131,7 +131,7 @@ export interface FiringItem { key: string; text: string; channelText?: string; }
 // Keys backed by a filesystem source-of-truth (see deriveMicroPendingKeys /
 // deriveProposalPendingKeys). These are the ONLY code path that bakes a raw
 // internal id into an alert's text, so channel-safety scrubbing is scoped to
-// them. Shared with update-alert-state.ts (phantom-key filter, freeze).
+// them. Shared with lib/heartbeat/alert-update.ts (phantom-key filter, freeze).
 export const MICRO_PREFIX = 'micro-proposal-pending:';
 export const PROPOSAL_PREFIX = 'proposal-pending:';
 export const STRUCTURED_PREFIXES = [MICRO_PREFIX, PROPOSAL_PREFIX];
@@ -142,7 +142,7 @@ export const isStructuredKey = (key: string): boolean =>
 // like MICRO_PREFIX/PROPOSAL_PREFIX — its text carries no internal id, so it is
 // intentionally excluded from STRUCTURED_PREFIXES/isStructuredKey (no id-scrubbing,
 // no channel-silencing). Its model-phantom-drop is a separate exact-match check
-// in update-alert-state.ts.
+// in lib/heartbeat/alert-update.ts.
 export const STALE_KEY = 'stale-session';
 
 // Strip internal ids that must never reach the operator channel. The banned set
@@ -279,7 +279,7 @@ export function classifyTick(opts: {
 // demonstrated #594 failure). Deriving them here means the model never
 // authors them — omission or garbling by the model is simply impossible,
 // because the model's `firing` entries for these prefixes are ignored
-// (see update-alert-state.ts's phantom-key filter).
+// (see lib/heartbeat/alert-update.ts's phantom-key filter).
 //
 // `ok:false` signals an ambiguous read (not "nothing pending") — the caller
 // must not let an unreadable source-of-truth file age or resolve that
diff --git a/plugins/claude-code-hermit/scripts/lib/auto-close.ts b/plugins/claude-code-hermit/scripts/lib/auto-close.ts
index 32515d40..fa54feac 100644
--- a/plugins/claude-code-hermit/scripts/lib/auto-close.ts
+++ b/plugins/claude-code-hermit/scripts/lib/auto-close.ts
@@ -1,5 +1,5 @@
 // Shared 10-minute operator-lull threshold for daily-auto-close: the
-// session-archive.ts auto-close-decision verb, the heartbeat-precheck.ts
+// session-archive.ts auto-close-decision verb, the lib/heartbeat/precheck.ts
 // pending-close drain, and the hermit-watchdog.ts post-close-clear backoff
 // all gate on the same lull. Side-effect-free — safe to import from CLI scripts.
 export const AUTO_CLOSE_LULL_MINUTES = 10;
diff --git a/plugins/claude-code-hermit/scripts/lib/cron-match.ts b/plugins/claude-code-hermit/scripts/lib/cron-match.ts
index 2dae28bc..20c42c06 100644
--- a/plugins/claude-code-hermit/scripts/lib/cron-match.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cron-match.ts
@@ -1,5 +1,5 @@
 // Pure 5-field cron matcher. Evaluates against wall-clock parts in a target timezone —
-// used by routine-due.ts to check schedules directly in config.timezone (no shiftCron).
+// used by lib/routines/due.ts to check schedules directly in config.timezone (no shiftCron).
 //
 // Two-tier API so hot loops can hoist the invariant work out of the per-candidate scan:
 //   - makeTzFormatter(tz) once per poll, then partsFromFormatter(fmt, date) per candidate;
@@ -52,7 +52,7 @@ export function datePartsInTz(date: Date, tz: string | null): DateParts | null {
 
 // Parse a 5-field cron expr into per-field Sets once. Returns null on a malformed expr
 // (wrong field count or an unparseable field), so callers fail closed. DOW: 7 ≡ 0
-// (cron-tz-shift.ts precedent). Expr should already be validated by validateCronSchedule
+// (lib/routines/tz-shift.ts precedent). Expr should already be validated by validateCronSchedule
 // (which additionally rejects DOM+DOW both restricted), so plain AND of all fields is correct.
 export function compileCron(expr: string): CompiledCron | null {
   const fields = expr.trim().split(/\s+/);
diff --git a/plugins/claude-code-hermit/scripts/lib/cron-shift.ts b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
index 0befd17d..f72e8939 100644
--- a/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
+++ b/plugins/claude-code-hermit/scripts/lib/cron-shift.ts
@@ -1,6 +1,6 @@
 // Timezone-aware cron shifting — the pure logic behind scripts/routines.ts tz-shift.
 //
-// Lives in lib/ so importers (cron-registry.ts, hermit-watchdog.ts, the
+// Lives in lib/ so importers (lib/routines/registry.ts, hermit-watchdog.ts, the
 // status-responder stage) don't pull in a top-level CLI script just to reach
 // two functions.
 
diff --git a/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts b/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
index 571b3ed6..dae23033 100644
--- a/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
+++ b/plugins/claude-code-hermit/scripts/lib/heartbeat-items.ts
@@ -1,5 +1,5 @@
-// Pure predicate shared by heartbeat-precheck.ts and its coherence test.
-// Extracted so both reference one definition — importing heartbeat-precheck.ts
+// Pure predicate shared by lib/heartbeat/precheck.ts and its coherence test.
+// Extracted so both reference one definition — importing lib/heartbeat/precheck.ts
 // directly would fire its top-level emit()/process.exit().
 //
 // Does a HEARTBEAT.md checklist item represent the default proposal-scan item?
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/due.ts b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
index 9939d572..ba695a25 100644
--- a/plugins/claude-code-hermit/scripts/lib/routines/due.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/due.ts
@@ -113,7 +113,7 @@ const sessionState: string | null = runtime && typeof runtime.session_state ===
 // Live-exchange signal: an operator-initiated turn is open (marker written by
 // record-operator-action.ts on kept operator prompts, cleared by stop-pipeline.ts
 // at Stop). TTL bounds a marker orphaned by a failed Stop. Absent, malformed,
-// stale, or future-dated (clock skew — heartbeat-precheck.ts precedent) all read
+// stale, or future-dated (clock skew — lib/heartbeat/precheck.ts precedent) all read
 // as no-open-turn → emit. Fail-open: a broken marker must never starve routines.
 const turnMarker: Json = readJSON(path.join(stateDir, 'operator-turn-open.json'));
 const turnAt = turnMarker && typeof turnMarker.at === 'string' ? new Date(turnMarker.at).getTime() : NaN;
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/registry.ts b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
index b3af9cf9..6539438e 100644
--- a/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
+++ b/plugins/claude-code-hermit/scripts/lib/routines/registry.ts
@@ -87,7 +87,7 @@ function resolveMachineTz(): string | null {
 
 // Wraps cron-tz-shift's shiftCron for a single routine. Returns the schedule
 // unchanged (no warn) when the machine timezone can't be resolved — the same
-// fail-open behavior cron-tz-shift.ts's CLI uses.
+// fail-open behavior lib/routines/tz-shift.ts's CLI uses.
 function shiftForRoutine(
   schedule: string, configTz: string | null, machineTz: string | null, ref: Date,
 ): { result: string; warn?: string } {
diff --git a/plugins/claude-code-hermit/scripts/lib/time.ts b/plugins/claude-code-hermit/scripts/lib/time.ts
index 867e752d..217d67ab 100644
--- a/plugins/claude-code-hermit/scripts/lib/time.ts
+++ b/plugins/claude-code-hermit/scripts/lib/time.ts
@@ -230,7 +230,7 @@ function friendlyBoundary(iso: string, timezone: string): string {
 
 // Resolves "now" as epoch ms: real wall-clock, overridable by HERMIT_NOW for
 // deterministic tests. Same override convention as archive-shell.ts/
-// session-archive.ts/routine-due.ts (which return Date) — centralized here so
+// session-archive.ts/lib/routines/due.ts (which return Date) — centralized here so
 // a caller wanting an epoch number doesn't need its own inline copy.
 function resolveHermitNowMs(): number {
   if (process.env.HERMIT_NOW) {
diff --git a/plugins/claude-code-hermit/scripts/routine-monitor.sh b/plugins/claude-code-hermit/scripts/routine-monitor.sh
index f269cfbe..22ca4aa3 100755
--- a/plugins/claude-code-hermit/scripts/routine-monitor.sh
+++ b/plugins/claude-code-hermit/scripts/routine-monitor.sh
@@ -4,12 +4,12 @@
 #      ROUTINE_DUE_SCRIPT=<path> → override routine-due path (tests). Still a bare
 #                                  script path called with `<dir>`; the default
 #                                  now prepends routines.ts's verb.
-# Polls routine-due.ts, which owns all gating/state/liveness writes and prints a
+# Polls `routines.ts due`, which owns all gating/state/liveness writes and prints a
 # ROUTINE_DUE line only when eligible routines are due. No first-iteration
 # suppression needed: routine-due initializes unseen routines to "now" and fires
 # nothing on a fresh baseline.
 #
-# routine-due.ts always exits 0, so the error branch only fires on a hard spawn
+# `routines.ts due` always exits 0, so the error branch only fires on a hard spawn
 # failure (bun missing, script renamed). To avoid a wake-notification storm, the
 # ROUTINE_MONITOR_ERROR line is throttled: emitted on the 1st failure and every
 # 60th consecutive failure thereafter; any success resets the counter.
diff --git a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
index 231a78d3..ea6a7fc4 100644
--- a/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
+++ b/plugins/claude-code-hermit/tests/alert-state-durability.test.ts
@@ -1,5 +1,5 @@
 // Durability of alert-state.json against interrupted/concurrent writes (issue #463).
-// Both writers (heartbeat-precheck.ts, update-alert-state.ts) must (a) write atomically
+// Both writers (lib/heartbeat/precheck.ts, lib/heartbeat/alert-update.ts) must (a) write atomically
 // via temp+rename so a killed write never leaves a truncated file, and (b) never reinit
 // the skill-owned alerts{}/self_eval{} over a file that exists — a present-but-unparseable
 // file is quarantined to alert-state.json.corrupt-<ts>, not silently overwritten.
diff --git a/plugins/claude-code-hermit/tests/budget-precheck.test.ts b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
index 1696070f..d742f725 100644
--- a/plugins/claude-code-hermit/tests/budget-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/budget-precheck.test.ts
@@ -1,4 +1,4 @@
-// PROP-016 budget-gate contract for heartbeat-precheck.ts.
+// PROP-016 budget-gate contract for `heartbeat.ts precheck`.
 //
 // Two mechanisms under test:
 //  1. The pause-escape gate: a budget-reason pause (action:"pause") would normally
diff --git a/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
index 72ff33e6..de4664d4 100644
--- a/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-reflect.test.ts
@@ -1,10 +1,10 @@
-// cost-reflect.ts --plain mode: the channel-safe "why is my bill high" answer
+// cost-report.ts reflect --plain mode: the channel-safe "why is my bill high" answer
 // (audit's "plain spend statement" PR). Verifies composition (total vs typical,
 // drivers named by work, cap status, notional caveat) and — the load-bearing
 // property — that the output never leaks the raw token-category vocabulary the
 // table mode uses (cache_read/cache_write, raw source strings, session ids).
 //
-// Subprocess test (via runScript): cost-reflect.ts is invoked as a standalone
+// Subprocess test (via runScript): the reflect verb is invoked as a standalone
 // script, exactly how the SKILL.md Step 1 command runs it.
 
 import { describe, test, expect, afterAll } from 'bun:test';
diff --git a/plugins/claude-code-hermit/tests/cost-report-session.test.ts b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
index 08fc204e..6f9308e6 100644
--- a/plugins/claude-code-hermit/tests/cost-report-session.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-session.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/session-cost.ts: per-session cost summation from cost-log.jsonl.
+// Tests for cost-report.ts's session verb: per-session cost summation from cost-log.jsonl.
 
 import { describe, test, expect } from 'bun:test';
 import fs from 'node:fs';
diff --git a/plugins/claude-code-hermit/tests/cost-report-today.test.ts b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
index 01cf037d..6841261a 100644
--- a/plugins/claude-code-hermit/tests/cost-report-today.test.ts
+++ b/plugins/claude-code-hermit/tests/cost-report-today.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/today-cost.ts: today's spend summary from cost-log.jsonl.
+// Tests for cost-report.ts's today verb: today's spend summary from cost-log.jsonl.
 // Cost-path resolution must be anchored to the hermit root, not process.cwd() —
 // the calling shell (brief, invoked inline in main) persists cd across calls,
 // so a drifted cwd must not silently misreport $0.00.
diff --git a/plugins/claude-code-hermit/tests/cron-registry.test.ts b/plugins/claude-code-hermit/tests/cron-registry.test.ts
index 63e437ee..8284cd47 100644
--- a/plugins/claude-code-hermit/tests/cron-registry.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-registry.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/cron-registry.ts — the diff-based plan/commit planner behind
+// Tests for `routines.ts cron-registry` — the diff-based plan/commit planner behind
 // hermit-routines `load`. planCron/commitCron are pure (no fs, no Date.now()), so
 // these are in-process unit tests, not subprocess runs — the real boundary
 // (reading config.json/the mirror file, writing the mirror) is exercised by the
diff --git a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
index ea8e2092..b76e5c28 100644
--- a/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
+++ b/plugins/claude-code-hermit/tests/cron-tz-shift.test.ts
@@ -1,4 +1,4 @@
-// Tests for scripts/cron-tz-shift.ts — timezone-aware cron shifting
+// Tests for `routines.ts tz-shift` — timezone-aware cron shifting
 // (bun test port of cron-tz-shift.test.sh).
 //
 // Exercised as a subprocess (runScript): the machine timezone (TZ env, resolved
diff --git a/plugins/claude-code-hermit/tests/routine-due.test.ts b/plugins/claude-code-hermit/tests/routine-due.test.ts
index fe003acd..d7e47395 100644
--- a/plugins/claude-code-hermit/tests/routine-due.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-due.test.ts
@@ -1,4 +1,4 @@
-// Contract tests for scripts/routine-due.ts — the monitor-mode deterministic
+// Contract tests for `routines.ts due` — the monitor-mode deterministic
 // scheduler. Exercised as a subprocess (argv/stdout/exit-code/file writes), same
 // convention as tests/routine-precheck.test.ts.
 //
diff --git a/plugins/claude-code-hermit/tests/routine-precheck.test.ts b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
index 20275f29..ee85ec2d 100644
--- a/plugins/claude-code-hermit/tests/routine-precheck.test.ts
+++ b/plugins/claude-code-hermit/tests/routine-precheck.test.ts
@@ -1,4 +1,4 @@
-// Contract tests for scripts/routine-precheck.ts — consolidates a routine fire's
+// Contract tests for `routines.ts precheck` — consolidates a routine fire's
 // pre-dispatch gate (waiting-check + pause-check) and the `started` stamp into one
 // script call. Exercised as a subprocess (argv/stdout/exit-code/file writes), the same
 // way tests/hermit-pause.test.ts exercises hermit-pause.ts (both resolve the hermit
diff --git a/plugins/claude-code-hermit/tests/scripts.test.ts b/plugins/claude-code-hermit/tests/scripts.test.ts
index f84351d1..2164aa0e 100644
--- a/plugins/claude-code-hermit/tests/scripts.test.ts
+++ b/plugins/claude-code-hermit/tests/scripts.test.ts
@@ -676,7 +676,7 @@ describe('archive-raw', () => {
 });
 
 // -------------------------------------------------------
-// update-alert-state.ts (subprocess — stdin payload + file-write CLI contract)
+// heartbeat.ts alert-state (subprocess — stdin payload + file-write CLI contract)
 // -------------------------------------------------------
 
 describe('update-alert-state', () => {
@@ -1842,7 +1842,7 @@ describe('update-reflection-state', () => {
 });
 
 // -------------------------------------------------------
-// heartbeat-precheck.ts (subprocess — argv/stdout/state-mutation CLI contract)
+// heartbeat.ts precheck (subprocess — argv/stdout/state-mutation CLI contract)
 // -------------------------------------------------------
 
 const DEFAULT_CHECKLIST = '# Heartbeat\n- Review proposals/ for any needing attention\n';
@@ -3031,7 +3031,7 @@ describe('pricing', () => {
 });
 
 // -------------------------------------------------------
-// cost-reflect.ts (subprocess — CWD-relative cost-log read, stdout report)
+// cost-report.ts reflect (subprocess — CWD-relative cost-log read, stdout report)
 // -------------------------------------------------------
 
 async function runCostReflect(dir: string): Promise<string> {
@@ -3514,7 +3514,7 @@ describe('cost-tracker sumTurnUsage', () => {
 });
 
 // -------------------------------------------------------
-// cost-reflect.ts: source attribution tests (subprocess)
+// cost-report.ts reflect: source attribution tests (subprocess)
 // -------------------------------------------------------
 
 describe('cost-reflect source attribution', () => {

From c3d18011dd25ad4012b0c9af5e6e6aa27418a88a Mon Sep 17 00:00:00 2001
From: Gabriel Tavares <gabrieltavaresw@gmail.com>
Date: Sat, 25 Jul 2026 19:40:28 +0100
Subject: [PATCH 9/9] fix(claude-code-hermit): repair the routine path and
 prompt audit after consolidation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The verb-suffixed strings in hermit-routines' pluginRoot guard aren't paths, so
`test -f` failed on every one and `load` aborted unconditionally — no hermit
would have registered the routine monitor or the heartbeat-restart anchor again.
The shared execution template also invoked routines.ts without `bun`, which is
Permission denied now that log-routine-event.sh's shebang and exec bit are gone,
losing every `fired` event that cost attribution and the dedup guard read. The
anchor's mirror commit still pointed at the deleted cron-registry.ts.

user-prompt-pipeline's new 1 MiB stdin cap cuts mid-JSON, and the null-prompt
return then skipped every stage — an over-cap paste got no timestamp and no
recorded turn, so heartbeat's AUTO_CLOSE gate could read the operator as silent.
It now falls through with an empty prompt; the stages that match on prompt text
fail closed on it.
---
 .../claude-code-hermit/docs/always-on-ops.md  |  4 +--
 .../claude-code-hermit/docs/architecture.md   |  2 +-
 plugins/claude-code-hermit/docs/security.md   |  2 +-
 .../scripts/lib/routines/event.ts             |  0
 .../scripts/user-prompt-pipeline.ts           | 19 ++++++++----
 .../claude-code-hermit/skills/brief/SKILL.md  |  2 +-
 .../skills/hermit-evolution/SKILL.md          |  2 +-
 .../skills/hermit-routines/SKILL.md           |  8 ++---
 .../tests/hooks.contract.test.ts              |  2 +-
 .../tests/shutdown-gate.test.ts               |  8 +++--
 .../tests/user-prompt-pipeline.test.ts        | 30 ++++++++++++++++++-
 11 files changed, 59 insertions(+), 20 deletions(-)
 mode change 100755 => 100644 plugins/claude-code-hermit/scripts/lib/routines/event.ts

diff --git a/plugins/claude-code-hermit/docs/always-on-ops.md b/plugins/claude-code-hermit/docs/always-on-ops.md
index 5337bffa..ff79148e 100644
--- a/plugins/claude-code-hermit/docs/always-on-ops.md
+++ b/plugins/claude-code-hermit/docs/always-on-ops.md
@@ -185,11 +185,11 @@ Manage with `/claude-code-hermit:hermit-settings routines`. Changes take effect
 
 **Monitor mode (tried first).** Registers one persistent Monitor subprocess (`scripts/routine-monitor.sh`, 60s poll) running `scripts/routines.ts due`, which reads `config.routines` directly, evaluates each enabled non-anchor routine's schedule against `state/routine-schedule.json` cursors, applies the pause/waiting/idle gates itself, and prints a single `ROUTINE_DUE [hermit-routine:<id>] ...` line only for routines that should actually wake the session — a routine that's due-but-skipped costs zero model tokens. `hermit-routines run <ids>` handles the wake: it re-runs `scripts/routines.ts precheck` for the `started` stamp, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`. The anchor (`heartbeat-restart`) still registers via a single `CronCreate`, kept fresh by the same diff-planner (`scripts/routines.ts cron-registry`) described below, scoped to that one routine.
 
-**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/routines.ts cron-registry plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `cron-tz-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routines.ts precheck`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
+**CronCreate fallback** (Monitor tool unavailable, or the subprocess fails to spawn): every enabled routine, anchor included, registers as its own per-session CronCreate. `scripts/routines.ts cron-registry plan` diffs against `state/cron-registry.json` (a derived mirror, keyed to the current boot via `state/.boot-id`) — unchanged (`KEEP`), re-registered (`DELETE`+`CREATE`) on a schedule/metadata edit, or re-registered regardless of config changes once aging toward CC's 7-day auto-expiry cliff. The schedule shift (`config.timezone` → machine local time, via `lib/cron-shift.ts`) happens inside this step — monitor-mode routines skip it, evaluating directly in `config.timezone`. Each `CREATE` gets a prompt that runs `scripts/routines.ts precheck`, invokes the skill on `PROCEED`, and logs to `state/routine-metrics.jsonl`; each `DELETE` tears down the matching `[hermit-routine:*]` entry first. On an unchanged, fresh config this is a no-op with zero `CronList`/`CronCreate`/`CronDelete` calls. CronCreate fires only between REPL turns — never mid-task; a fire that comes due during `in_progress` is deferred (not dropped) until idle.
 
 `/claude-code-hermit:hermit-routines load --reset` bypasses both diffs and does an unconditional sweep — the escape hatch for suspected drift.
 
-`routines.ts precheck` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routine-due.ts` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
+`routines.ts precheck` gates every fire regardless of delivery mechanism: it suppresses `run_during_waiting: false` routines with a `skipped-waiting` event when `session_state == "waiting"`, and any routine with a `skipped-paused` event when the binding pause flag is set; otherwise it stamps `started` and returns `PROCEED`. In monitor mode, `routines.ts due` applies the same two gates itself before ever waking the session, plus an operator-turn defer (Stop-cleared `state/operator-turn-open.json` marker, 60-min TTL backstop) approximating the idle gate CronCreate gets for free from the harness.
 
 **`heartbeat-restart`** fires at 4am daily and re-invokes `load`, which re-registers the heartbeat Monitor and re-arms the routine monitor (or, in fallback mode, the routine CronCreates — which expire after 7 days without this daily re-arm).
 
diff --git a/plugins/claude-code-hermit/docs/architecture.md b/plugins/claude-code-hermit/docs/architecture.md
index 00bfb637..a6a7dd62 100644
--- a/plugins/claude-code-hermit/docs/architecture.md
+++ b/plugins/claude-code-hermit/docs/architecture.md
@@ -195,7 +195,7 @@ One writer per state file. No shared mutation bus. (Exception: `state/micro-prop
 | `state/heartbeat-monitor.runtime.json` | heartbeat skill only                        | heartbeat-start (write), heartbeat-stop (clear), heartbeat-restart (rewrite) |
 | `state/heartbeat-liveness.json` | heartbeat-monitor.sh (every poll iteration)         | doctor-check.ts (heartbeat liveness check), heartbeat status  |
 | `state/cc-stop-snapshot.json`  | stop-pipeline.ts only                               | doctor-check.ts (scheduler/background-task health check)      |
-| `state/operator-turn-open.json` | record-operator-action.ts (opens, on kept operator prompts + `--force`); stop-pipeline.ts (clears at Stop — the only deleter) | routine-due.ts (defer gate, 60-min TTL backstop against a marker orphaned by a failed Stop) |
+| `state/operator-turn-open.json` | record-operator-action.ts (opens, on kept operator prompts + `--force`); stop-pipeline.ts (clears at Stop — the only deleter) | routines.ts due (defer gate, 60-min TTL backstop against a marker orphaned by a failed Stop) |
 | `state/.heartbeat`             | heartbeat-touch.ts only                             | heartbeat (detect activity gaps)                              |
 | `state/.lifecycle.lock`        | hermit-start.ts only                                | hermit-stop.ts (cleanup)                                      |
 | `state/cost-index.json`        | cost-tracker.ts only                                | cost-tracker.ts (writeCostSummary, getCumulativeCost fallback), doctor-check.ts |
diff --git a/plugins/claude-code-hermit/docs/security.md b/plugins/claude-code-hermit/docs/security.md
index 218e53ad..d646ece2 100644
--- a/plugins/claude-code-hermit/docs/security.md
+++ b/plugins/claude-code-hermit/docs/security.md
@@ -228,7 +228,7 @@ Beyond the always-on baseline above, `/claude-code-hermit:docker-security` is an
 - **Three artifact pages publish session-derived content to claude.ai — default on, per-page opt-out.** `config.artifacts.dashboard`/`proposals`/`weekly_review` (default `true`) each publish a rendered page — status/latest-brief/proposals/weekly-evolution, open-proposal full text, and the compiled weekly review, respectively — via Claude Code's built-in Artifacts feature, not a hermit-authored HTTP call. Same publish path as any other Artifact a session creates, so it's governed by Claude Code's own controls (`disableArtifact`, `CLAUDE_CODE_DISABLE_ARTIFACT`, `permissions.deny`), not the docker-security DNS allowlist. Private to the publishing account on Pro/Max; Team/Enterprise can additionally Share within the org, never across it. Every automatic publish is a deterministic render of enumerated state files — with one caveat: the dashboard's latest-brief section embeds `state/last-brief.json`, whose `text` field is itself model-composed by the `brief` skill, so that one section is not exclusively machine-generated content. On-demand publish of a compiled doc or proposal (operator-initiated, no config gate) is likewise a direct file publish, no model authorship. See `docs/config-reference.md#artifacts` and `docs/artifacts.md`.
 - **`permissions.allow: ["Artifact"]` is a sanctioned pre-approval of an outward-publishing tool for autonomous use.** Applied via the `artifacts.publish_authorized` config flag (§ Auto-mode Classifier above) so unattended sessions don't stall on the first-publish permission ask (a headless "ask" is an effective deny) — a channel reply sets the flag only, and `hermit-start`'s boot-time grant, running outside any session, is what actually writes the permission (needed because the classifier blocks a session from widening its own `permissions.allow`, even attended-seeded). Re-ensured every boot, so a hand-wiped entry heals itself; revoke via `/hermit-settings artifact-authorization`. Assessment: on Pro/Max, artifacts are private to the publishing account with no share option, so a prompt-injected publish is persistence/noise, not exfiltration — the attacker cannot view the page, and `channel-send.ts` (above) remains the materially riskier egress. The real cost is losing the human checkpoint before irreversible external persistence: there is no tool-side delete, and published content may be cached even after removal from the gallery, so a mistaken publish (e.g. a render that embeds a secret that leaked into state) can't be fully recalled. Mitigation: every automatic-path publish is a deterministic render of enumerated state files (no free-form model-authored pages on the automatic path — see the brief-text caveat above); operators who decline the flag get the same outcome via setup-time banking (first publish happens inline, attended, at hatch/evolve time) instead of a standing grant.
 - **Egress filtering is opt-in.** Bridge networking isolates from localhost but the container can still reach the internet by default. A successful prompt injection can exfiltrate data to external hosts. **Mitigation available**: `/claude-code-hermit:docker-security` adds LAN containment + DNS policy via a firewall sidecar with kernel-level port-53 redirect for real enforcement. **Remaining gap**: direct public-IP egress (hardcoded IPs, no DNS) is not blocked even with the wizard — v1.1 may add nftset-driven IP allowlisting. See [Docker Security](docker-security.md).
-- **No input sanitization for fetched content.** Content fetched from external APIs enters Claude's context unsanitized. Deny patterns cannot catch injection via fetched content — that's an instruction-following boundary, not a mechanical one. **The scheduled-wake surface is now scanned.** HEARTBEAT.md is model-editable and feeds the autonomous evaluation subagent verbatim, so a poisoned checklist item written in one session could steer every future wake. `heartbeat-precheck.ts` scans it pre-wake for three pattern classes (instruction-override phrases, context-marker tags, decode-pipes); a hit converts the tick into an operator alert and suspends checklist evaluation until the file is edited. The suspension is scoped to checklist evaluation only — deterministic operator-safety notifications still fire (a pending budget alert pierces the announced-damper; a due stale auto-close still runs), since neither reads HEARTBEAT.md. This breaks the self-persistence path but is defense-in-depth, not a boundary — the PreToolUse/permissions chokepoint remains the actual guard during any wake turn.
+- **No input sanitization for fetched content.** Content fetched from external APIs enters Claude's context unsanitized. Deny patterns cannot catch injection via fetched content — that's an instruction-following boundary, not a mechanical one. **The scheduled-wake surface is now scanned.** HEARTBEAT.md is model-editable and feeds the autonomous evaluation subagent verbatim, so a poisoned checklist item written in one session could steer every future wake. `heartbeat.ts precheck` scans it pre-wake for three pattern classes (instruction-override phrases, context-marker tags, decode-pipes); a hit converts the tick into an operator alert and suspends checklist evaluation until the file is edited. The suspension is scoped to checklist evaluation only — deterministic operator-safety notifications still fire (a pending budget alert pierces the announced-damper; a due stale auto-close still runs), since neither reads HEARTBEAT.md. This breaks the self-persistence path but is defense-in-depth, not a boundary — the PreToolUse/permissions chokepoint remains the actual guard during any wake turn.
 - **Deny patterns are a blocklist.** They catch commands you anticipated. Equivalent commands not on the list execute normally. Bind mount scope and network isolation are stronger defenses for novel attacks. The runtime hook (`enforce-deny-patterns.ts`) additionally normalizes each Bash candidate (whole command and every compound segment) before matching — collapsing horizontal whitespace runs, backslash-newline continuations, and unquoted `$IFS`/`${IFS}` — so a pattern like `rm -rf` also catches `rm  -rf`, `rm${IFS}-rf`, and the same hidden behind `&&`/`;`/`|`. Deliberately **not** implemented: Unicode normalization (NFKC), ANSI/NUL stripping, base64/decode-pipe detection, or general flag-order canonicalization. Bash does not treat those as equivalent to the canonical spelling — e.g. a fullwidth `ｓudo` is a distinct token that fails with "command not found," not an executable bypass — so folding them would close a non-threat while adding false-positive surface on legitimate unicode/binary arguments. This mirrors a full deobfuscation pipeline (as competitor agents implement as their *only* execution boundary) being disproportionate here: it sits behind the bash sandbox and container hardening layers above, not in front of an unsandboxed process.
 - **Episodic channel-log (PROP-010) stores raw DM text locally.** `state/channel-log.sqlite` holds the operator's Discord/Telegram DM text verbatim — capture is gated by the same `channels.<channel>.allowed_users` allowlist channel-responder enforces (envelope source normalized to the bare channel key, same as above; unauthorized senders are never logged), but authorized senders' full message text is retained until weekly-review consolidation and its retention window prune it. Storage is deliberately unsanitized (fidelity for consolidation), but the `/recall` read path (`search.ts`) runs recalled text through `safeForLLM` — the same control-char/tag-impersonation defusal `lib/prompt-stages/channel-reply-reminder.ts` already applies to the envelope's `source`/`chat_id` — before it reaches model context. Treat it as untrusted external input regardless: it's the operator's own words, but unreviewed. The file is local-only, covered by the standard `state/` gitignore, and never committed. Disable capture with `knowledge.channel_log_enabled: false` if this tradeoff isn't wanted.
 
diff --git a/plugins/claude-code-hermit/scripts/lib/routines/event.ts b/plugins/claude-code-hermit/scripts/lib/routines/event.ts
old mode 100755
new mode 100644
diff --git a/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
index 38a8a04b..6fc892e6 100644
--- a/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
+++ b/plugins/claude-code-hermit/scripts/user-prompt-pipeline.ts
@@ -65,15 +65,22 @@ async function stage(name: string, fn: (ctx: StageContext) => any, ctx: StageCon
 async function main(raw: string): Promise<void> {
   // Defensive parse: stages that don't need the payload still run on bad input,
   // exactly as stop-pipeline.ts does.
-  let payload: any = {};
+  let prompt: string | null = null;
   try {
-    payload = JSON.parse(raw);
+    const payload = JSON.parse(raw);
+    prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
   } catch {
-    process.stderr.write('[user-prompt-pipeline] malformed stdin — continuing with empty payload\n');
+    process.stderr.write('[user-prompt-pipeline] malformed stdin — continuing with an empty prompt\n');
+    // A parse failure on non-empty stdin means a prompt did arrive and was
+    // mangled — MAX_STDIN_BYTES truncation cuts mid-JSON. Carry on with an empty
+    // prompt rather than returning: the audit and timestamp stages don't need the
+    // text, and every prompt-matching stage below fails closed on ''. Returning
+    // here would leave the turn unrecorded and let heartbeat's AUTO_CLOSE gate
+    // read the operator as silent.
+    if (raw.length === 0) return;
+    prompt = '';
   }
-
-  const prompt = payload && typeof payload.prompt === 'string' ? payload.prompt : null;
-  if (prompt === null) return;
+  if (prompt === null) return; // parsed, but no prompt for the stages to act on
 
   const dir = hermitDir();
 
diff --git a/plugins/claude-code-hermit/skills/brief/SKILL.md b/plugins/claude-code-hermit/skills/brief/SKILL.md
index dc0a8987..99e337bc 100644
--- a/plugins/claude-code-hermit/skills/brief/SKILL.md
+++ b/plugins/claude-code-hermit/skills/brief/SKILL.md
@@ -29,7 +29,7 @@ For dispatching modes: invoke `claude-code-hermit:skill-eval-runner` pointed at
 
 **Boundary rule:** `sessions/SHELL.md` is the live session document — it stays in main, never goes to the runner. Archived `sessions/S-*-REPORT.md` bodies, `cost-summary.md`, `proposals/*.md` frontmatter, `OPERATOR.md`, and `NEXT-TASK.md` go to the runner.
 
-**Failure policy:** if the runner returns null or malformed JSON, fail-open — compose the brief from whatever live data main holds (TaskList, SHELL.md, `today-cost.ts` output) and skip the runner-derived lines. Note nothing fatal to the operator.
+**Failure policy:** if the runner returns null or malformed JSON, fail-open — compose the brief from whatever live data main holds (TaskList, SHELL.md, `cost-report.ts today` output) and skip the runner-derived lines. Note nothing fatal to the operator.
 
 **Eval runner return schema** — the runner returns a JSON object conforming to this block. The schema is byte-identical in `reference.md` (producer) and here (consumer); a contract test asserts this.
 
diff --git a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
index c72ddc2c..5a007282 100644
--- a/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-evolution/SKILL.md
@@ -12,7 +12,7 @@ If this skill was invoked from a channel-arrived message (the inbound prompt con
 
 ## Step 1 — Dispatch the eval runner
 
-Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal.ts metrics` and `cost-reflect.ts` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
+Dispatch `claude-code-hermit:skill-eval-runner` pointed at `${CLAUDE_PLUGIN_ROOT}/skills/hermit-evolution/reference.md`. The runner reads the weekly review files, proposal metrics, config, session reports, and OPERATOR.md — and runs `proposal.ts metrics` and `cost-report.ts reflect` — in an isolated context, then returns the assembled evolution report. This keeps those heavy reads off this session's inherited context.
 
 Pass `plugin_root: ${CLAUDE_PLUGIN_ROOT}` in the dispatch prompt — the runner reads `reference.md` as file content, where `${CLAUDE_PLUGIN_ROOT}` is never substituted, so it needs the resolved absolute path to run the scripts and read template/skill paths.
 
diff --git a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
index 65ba8e70..4528be96 100644
--- a/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
+++ b/plugins/claude-code-hermit/skills/hermit-routines/SKILL.md
@@ -26,7 +26,7 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
 
 1. Resolve the plugin root path: derive it from this skill's **Base directory**, which the harness injects into the invocation context as `<plugin_root>/skills/hermit-routines`. Strip the trailing `/skills/hermit-routines` to get `pluginRoot`. This works in both installed and `--plugin-dir` modes. (`$CLAUDE_PLUGIN_ROOT` is NOT a Bash env var at runtime — evaluating it in Bash always returns empty. The braced `${CLAUDE_PLUGIN_ROOT}` form is text-substituted in skill markdown only in installed mode. Neither is reliable here — always use the Base-directory derivation.) The resolved `pluginRoot` must be baked into the Monitor `command` and into any CronCreate-delivered prompt at registration — it is not available inside either subprocess or cron-delivered prompts.
 
-   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or any of `<pluginRoot>/scripts/routines.ts log-event`, `<pluginRoot>/scripts/routines.ts precheck`, `<pluginRoot>/scripts/routine-monitor.sh`, `<pluginRoot>/scripts/routines.ts cron-registry` does not exist (`test -f`), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
+   **Validate `pluginRoot` before proceeding.** If `pluginRoot` is empty, or either of `<pluginRoot>/scripts/routines.ts` (the `log-event`/`precheck`/`cron-registry` verbs all live in it) or `<pluginRoot>/scripts/routine-monitor.sh` does not exist (`test -f` — pass the bare file path, never a path with a verb appended), abort `load` immediately — do not register/delete anything — and log one line: `Routine load aborted: plugin scripts not found at "<pluginRoot>". No routines registered or reset.`
 2. Read `config.routines`, filter `enabled: true`, split into the anchor (`id === "heartbeat-restart"`) and everyone else ("scheduled routines").
 
    **Empty scheduled-routine set does not early-exit** — an operator disabling every routine mid-session must not leave a live monitor/anchor/crons behind. Reconcile: TaskStop any `routine-monitor` task (ignore not-found), delete `state/routine-monitor-liveness.json` and `state/routine-monitor.runtime.json`, run the anchor-only planner leg (Step 3's `--ids heartbeat-restart`, which with nothing else enabled emits `DELETE:` for every tracked id including the anchor if it too is disabled) and execute its deletes, then log "No enabled routines in config." and stop.
@@ -35,7 +35,7 @@ Called automatically by `hermit-start.ts` on always-on launches. Can also be cal
    - **Register:** call the Monitor tool — `description: "routine-monitor"` (reserved slot), `command: "bash <pluginRoot>/scripts/routine-monitor.sh 60 $PWD/.claude-code-hermit"`, `timeout_ms: 86400000` (schema-required boilerplate on a persistent monitor — it does not expire on this deadline; the daily anchor re-arm exists to recover from monitor *death* and session restarts, not a timeout), `persistent: true`.
    - **Liveness-verify:** wait 5s, then check `state/routine-monitor-liveness.json` exists. Absent → the subprocess likely failed to spawn (seccomp/nested-userns) — `TaskStop` the task just registered and go to Step 3-F.
    - On success: write `state/routine-monitor.runtime.json`: `{"description":"routine-monitor","task_id":"<id>","command":"<cmd>","interval":60,"started_at":"<ISO now>","mode":"monitor"}`. If there are zero scheduled routines but the anchor is enabled, skip registering the Monitor and record `"routines":0` in the runtime file instead — go straight to anchor registration below.
-   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `... cron-registry.ts commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
+   - **Anchor registration:** run the diff planner scoped to the anchor alone: `bun <pluginRoot>/scripts/routines.ts cron-registry plan .claude-code-hermit <pluginRoot> --ids heartbeat-restart`. Execute its `DELETE:`/`CREATE:` lines exactly as Step 3-F's fallback flow does below — the `DELETE:` lines are what sweep any formerly-tracked non-anchor CronCreate; no separate sweep step needed. Commit with `bun <pluginRoot>/scripts/routines.ts cron-registry commit .claude-code-hermit <pluginRoot> "<succeeded-csv>" --ids heartbeat-restart` (`--ids` must match on both calls — `commit` replans internally). Skip the WAKESPREAD advisory in monitor mode (meaningless over one routine).
    - **First-transition sweep only** (runtime file was absent, or `mode` just changed to `monitor`): also call `CronList` and `CronDelete` every entry whose prompt contains `[hermit-routine:` except `[hermit-routine:heartbeat-restart]` — covers live crons from an in-process upgrade that the mirror no longer tracks (duplicate-fire hazard).
    - Log: `Routines: monitor registered (<N> scheduled), anchor re-armed.` or the `routines:0`/first-transition variants.
 4. **Step 3-F — fallback** (Monitor unavailable, registration failed, or liveness-verify failed): run the **CronCreate flow** below against the full enabled set (scheduled routines + anchor), then write `state/routine-monitor.runtime.json`: `{"mode":"croncreate-fallback","started_at":"<ISO now>"}`.
@@ -63,7 +63,7 @@ Base execution, one routine, `<delivery>` = `cron-create` (fallback prompt) or `
 ```
 Run: bun <pluginRoot>/scripts/routines.ts precheck <id> <rdw> <delivery>
 If the output is SKIP, stop. If PROCEED, then invoke /<skill> (or dispatch per the model-override rule above). After it completes, run:
-<pluginRoot>/scripts/routines.ts log-event <id> fired <delivery>
+bun <pluginRoot>/scripts/routines.ts log-event <id> fired <delivery>
 ```
 Replace `<pluginRoot>`, `<id>`, `<rdw>` (`true`/`false`; default `false`), and `<skill>` (passed verbatim to the slash invocation — `claude-code-hermit:brief --morning` becomes `/claude-code-hermit:brief --morning`).
 
@@ -134,7 +134,7 @@ Routines (config.json):
 
 ### CronCreate fallback details
 
-- **Timezone.** CronCreate flow shifts each cron from `config.timezone` to machine-local (CronCreate only knows machine time) at minute granularity — half-hour/45-minute zones (Kolkata, Adelaide, Kathmandu) work. Null `config.timezone` passes through unchanged. Monitor mode needs no shift — `routine-due.ts` evaluates directly in `config.timezone`.
+- **Timezone.** CronCreate flow shifts each cron from `config.timezone` to machine-local (CronCreate only knows machine time) at minute granularity — half-hour/45-minute zones (Kolkata, Adelaide, Kathmandu) work. Null `config.timezone` passes through unchanged. Monitor mode needs no shift — `routines.ts due` evaluates directly in `config.timezone`.
 - **DST.** Recomputed every `load`; `heartbeat-restart`'s daily reload self-corrects within 24h. On the transition day, one fallback-mode fire may land at the wrong hour. Inexpressible-after-shift schedules pass through unchanged with a `WARN:` line.
 - **`durable: false`.** CronCreates die with the session; re-registered on every always-on launch.
 - **7-day auto-expiry depends on `heartbeat-restart`.** CC's recurring-task expiry is a hard 7-day cliff, reset only by re-creating. The diff planner re-registers any routine whose age crosses a conservative threshold even with unchanged config; `heartbeat-restart`'s daily `load` is what crosses it. Disable it in fallback mode and routine CronCreates expire after 7 days.
diff --git a/plugins/claude-code-hermit/tests/hooks.contract.test.ts b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
index 78ee12e9..f00f4a35 100644
--- a/plugins/claude-code-hermit/tests/hooks.contract.test.ts
+++ b/plugins/claude-code-hermit/tests/hooks.contract.test.ts
@@ -1534,7 +1534,7 @@ describe('channel-reply-reminder', () => {
   test('channel-reply-reminder (malformed JSON)', withDir(async (dir) => {
     const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: dir });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain(NO_REMINDER);
   }));
 
   test('channel-reply-reminder (no envelope)', withDir(async (dir) => {
diff --git a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
index 0de13118..c6f334ed 100644
--- a/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
+++ b/plugins/claude-code-hermit/tests/shutdown-gate.test.ts
@@ -125,11 +125,15 @@ describe('shutdown-gate', () => {
     expect(r.stdout.toLowerCase()).toContain('shutdown is in progress');
   });
 
-  test('malformed stdin → exit 0, no output', async () => {
+  test('malformed stdin → exit 0, no relay and no block', async () => {
+    // The payload-independent stages still run (that is what emits `[Now:`), but
+    // with no parseable envelope the gate has no chat to answer on, so it stays
+    // silent rather than relaying into the void.
     const wd = setupChannelWorkdir();
     writeRuntime(wd, PENDING);
     const r = await runScript('user-prompt-pipeline.ts', { stdin: 'not json', cwd: wd.dir, env: {} });
     expect(r.exitCode).toBe(0);
-    expect(r.stdout.trim()).toBe('');
+    expect(r.stdout).not.toContain('"decision":"block"');
+    expect(r.stdout.toLowerCase()).not.toContain('shutdown is in progress');
   });
 });
diff --git a/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
index 5a5acfe3..d487490d 100644
--- a/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
+++ b/plugins/claude-code-hermit/tests/user-prompt-pipeline.test.ts
@@ -139,13 +139,41 @@ describe('user-prompt-pipeline: shutdown is terminal', () => {
 });
 
 describe('user-prompt-pipeline: fail-open contract', () => {
-  test('malformed stdin exits 0 and emits nothing', async () => {
+  test('malformed stdin exits 0 and still runs the payload-independent stages', async () => {
+    // A prompt did arrive — MAX_STDIN_BYTES truncation is what cuts it mid-JSON —
+    // so the turn must still be recorded and timestamped.
     const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
     const r = await runScript('user-prompt-pipeline.ts', { stdin: '{broken', cwd: wd.dir });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'operator-turn-open.json'))).toBe(true);
+  });
+
+  test('empty stdin exits 0 and emits nothing', async () => {
+    const wd = setupWorkdir();
+    const r = await runScript('user-prompt-pipeline.ts', { stdin: '', cwd: wd.dir });
     expect(r.exitCode).toBe(0);
     expect(r.stdout.trim()).toBe('');
   });
 
+  test('an over-cap prompt is truncated but still recorded', async () => {
+    const wd = setupWorkdir();
+    fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));
+
+    const r = await runScript('user-prompt-pipeline.ts', {
+      stdin: JSON.stringify({ prompt: 'x'.repeat(1024 * 1024 + 512) }),
+      cwd: wd.dir,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain('[Now:');
+    expect(fs.existsSync(hermit(wd.dir, 'state', 'last-operator-action.json'))).toBe(true);
+  });
+
   test('an ordinary prompt still records the operator-action markers', async () => {
     const wd = setupWorkdir();
     fs.writeFileSync(hermit(wd.dir, 'config.json'), JSON.stringify({ timezone: 'UTC' }));