diff --git a/activity-definitions/binky-daily-rhythm.md b/activity-definitions/binky-daily-rhythm.md
new file mode 100644
index 0000000..4d972e5
--- /dev/null
+++ b/activity-definitions/binky-daily-rhythm.md
@@ -0,0 +1,49 @@
+---
+id: binky-daily-rhythm
+name: Binky Daily Operating Rhythm
+enabled: false
+owner: custodian-agent
+governance: custodian
+status: proposed
+trigger:
+  type: cron
+  cron_expression: "23 8 * * 1-5"   # weekdays 08:23
+  timezone: Europe/Berlin
+  misfire_policy: skip
+context_sources:
+  - type: state-hub
+    query: binky_rhythm_status
+    params:
+      repo: binky-control
+    bind_to: context.rhythm
+# Proposed resolver (not yet implemented): returns
+# {items: [{kind: "daily_brief", due: bool, date: "YYYY-MM-DD"}]} — due is
+# true when no brief exists for today in binky-control/briefs/. Implementing
+# it is part of the BINKY-WP-0003-T06 follow-up workplan proposal.
+---
+
+# Binky Daily Operating Rhythm
+
+Runs weekdays at 08:23 Berlin time. Emits one task per due rhythm item for
+the binky-control repo: queue hygiene plus the daily brief, per
+`binky-control/OperatingRhythm.md` (Decide now / Progress / Risks / Best
+next hour, one-screen cap). Replaces the workstation cron bridge
+(`binky-control/scripts/rhythm-session.sh`) once enabled — remove the
+crontab line at that point.
+
+```rule
+id: emit-daily-rhythm-task
+for_each: context.rhythm.items
+bind_as: item
+condition: 'context.item.due'
+action:
+  task_template: Run Binky daily rhythm ({context.item.kind}) for {context.item.date}
+  description: Queue hygiene + daily brief per binky-control/OperatingRhythm.md. Green/Blue lane only.
+  target_repo: binky-control
+  priority: medium
+  labels: ["binky", "rhythm", "automated"]
+```
+
+Execution target: emitted tasks land in the issue-core REST sink; actual
+execution requires an executor (llm-connect assessment,
+BINKY-WP-0003-T06) — until then the workstation bridge covers this slot.
diff --git a/activity-definitions/binky-weekly-mail-intake.md b/activity-definitions/binky-weekly-mail-intake.md
new file mode 100644
index 0000000..e1180d8
--- /dev/null
+++ b/activity-definitions/binky-weekly-mail-intake.md
@@ -0,0 +1,44 @@
+---
+id: binky-weekly-mail-intake
+name: Binky Weekly Paper-Mail Intake Check
+enabled: false
+owner: custodian-agent
+governance: custodian
+status: proposed
+trigger:
+  type: cron
+  cron_expression: "37 9 * * 1"   # Monday 09:37
+  timezone: Europe/Berlin
+  misfire_policy: skip
+context_sources:
+  - type: state-hub
+    query: binky_rhythm_status
+    params:
+      repo: binky-control
+      kind: mail_intake
+    bind_to: context.rhythm
+# Same proposed binky_rhythm_status resolver as binky-daily-rhythm; for
+# kind=mail_intake, due is true when the founder's weekly scan drop
+# (AWQ-008 pipeline, binky-control) has unprocessed items or no intake
+# ran in the last 7 days.
+---
+
+# Binky Weekly Paper-Mail Intake Check
+
+Runs Mondays at 09:37 Berlin time. Checks whether newly scanned paper mail
+for Binky Hedgehog GmbH awaits triage (AWQ-008: drop location → naming →
+obligation/deadline/receipt triage → DUO Belegablage routing) and emits one
+intake task when due.
+
+```rule
+id: emit-mail-intake-task
+for_each: context.rhythm.items
+bind_as: item
+condition: 'context.item.due'
+action:
+  task_template: Triage Binky paper-mail scans (week of {context.item.date})
+  description: Run the AWQ-008 intake pipeline in binky-control; route obligations to queues, receipts toward DUO Belegablage.
+  target_repo: binky-control
+  priority: medium
+  labels: ["binky", "mail-intake", "automated"]
+```
diff --git a/activity-definitions/binky-weekly-review-prep.md b/activity-definitions/binky-weekly-review-prep.md
new file mode 100644
index 0000000..c1311e1
--- /dev/null
+++ b/activity-definitions/binky-weekly-review-prep.md
@@ -0,0 +1,43 @@
+---
+id: binky-weekly-review-prep
+name: Binky Weekly Founder Review Prep
+enabled: false
+owner: custodian-agent
+governance: custodian
+status: proposed
+trigger:
+  type: cron
+  cron_expression: "43 16 * * 5"   # Friday 16:43
+  timezone: Europe/Berlin
+  misfire_policy: skip
+context_sources:
+  - type: state-hub
+    query: binky_rhythm_status
+    params:
+      repo: binky-control
+      kind: weekly_review
+    bind_to: context.rhythm
+# Same proposed binky_rhythm_status resolver; for kind=weekly_review, due is
+# true every Friday, and the item carries milestone_moved (bool) derived from
+# the week's progress events so the emitted task can flag RISK-005.
+---
+
+# Binky Weekly Founder Review Prep
+
+Runs Fridays at 16:43 Berlin time. Prepares the ~15-minute founder review
+(binky-control/OperatingRhythm.md): freshest daily brief plus
+SuccessMilestones delta. If two consecutive weeks show activity without
+milestone movement, the task flags RISK-005 escalation.
+
+```rule
+id: emit-review-prep-task
+for_each: context.rhythm.items
+bind_as: item
+condition: 'context.item.due'
+action:
+  task_template: Prepare Binky weekly founder review ({context.item.date})
+  description: Summarize newest brief + milestone delta; flag RISK-005 if two milestone-free weeks.
+  target_repo: binky-control
+  priority: medium
+  labels: ["binky", "weekly-review", "automated"]
+```
diff --git a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
index 9c2cfcf..b540b18 100644
--- a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
+++ b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
@@ -240,7 +240,7 @@ this host. Enable/apply gated on **T07** (extend protection to live deployed tag
 
 ```task
 id: ACTIVITY-WP-0020-T07
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "59cd05b3-1a26-4935-9131-0e4d746cb984"
 ```
@@ -257,6 +257,17 @@ Acceptance: a dry-run shows all live tags for activity-core, state-hub, and othe
 production workloads present in `skipped_protected` (or absent from `would_delete`),
 verified against the cluster. Only then are T05 enable and T06 apply unblocked.
 
+**Progress 2026-07-16:** live-tag protection implemented in the prune tool
+(`railiance-platform@`, `collect_live_cluster_versions()` — enumerates pod images
+via kubectl, protects `forgejo…/coulomb/<name>:<tag>`; on by default; unit-tested).
+Verified against the reachable production cluster (92.205.130.254): it protects
+**state-hub f2e042a**, vergabe-teilnahme, issue-core live tags — closing the
+state-hub gap. **Multi-cluster caveat:** `activity-core` (the largest delete set,
+16) does **not** run on that cluster, so its live tag is not yet covered — the
+prune must aggregate live tags across **all** production clusters/contexts (or run
+where it sees them) before enable/apply. Enable/apply remains gated until every
+production cluster's live tags are protected in one dry-run.
+
 ---
 
 ### T06 — First apply run and backup impact evidence