docs: advance desktop and transcription pilots

docs/plans/workflow-system.md

@@ -67,10 +67,18 @@ not make it the global next step while another pilot can still progress.
   `gh` identifies the work account and Git reads a private Cargo dependency;
   the complete yookr-api contract passes. The replacement Context7 key is
   mode 0600, the exposed key is revoked, and a live resolve-and-query round trip
-  passes through the activated runtime header helper.
+  passes through the activated runtime header helper. Pinta passed its real-edit
-- Next: use the first real Monday ticket to test the native
+  trial, and Outlook's installed PWA exposed stable app ID
-  Project-to-issue-to-local-branch workflow and continue the remaining external
+  `eoficlgicibekocmfdomjbfnjmehnhcd`; GIMP removal and the managed Outlook
-  pilots as inputs arrive.
+  launcher pass both affected-host builds. A stopped 10.28-second Fossify M4A
+  transferred intact into `sync/recordings`, establishing its actual format and
+  path. The user selected Fossify's native `recordings/inbox` destination, and
+  the new event-driven Orion CPU pipeline passes an isolated transcription of
+  that recording without modifying or exposing its contents.
+- Next: activate and validate the Orion transcription owner, then retire the
+  retained Zenith timer. Activate the batched Zenith desktop changes once that
+  migration is ready, while independent external pilots continue as inputs
+  arrive.
 
 ## Progress
 
@@ -79,12 +87,12 @@ not make it the global next step while another pilot can still progress.
 | Bootstrap and repository ownership | Complete | Repository reconciliation, local plaintext credential cleanup, and Context7 rotation pass |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
 | Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
-| Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
+| Desktop navigation and interaction | Waiting for user | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; the managed Outlook launcher awaits activation and the two-output check awaits a docked session |
 | Agent workflow | Waiting externally | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, invocation-scoped credentials, and organization Projects pass; a real Monday ticket remains external |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
-| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
+| PIM | Deferred | Evolution 3.60.2 with Microsoft 365 support remains available beside Thunderbird; the user deferred account setup and uses Thunderbird plus Outlook meanwhile |
-| Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
+| Transcription | Waiting for user | Real Fossify transfer and isolated CPU transcription pass; Orion activation and end-to-end runtime validation remain |
-| Conditional retirement and completion | Active | Superseded HTTP/database/note tools are removed with earlier retirements; Bruno, DBeaver, image editors, and PIM clients remain behind separate gates |
+| Conditional retirement and completion | Active | Superseded tools are removed and Pinta passed; GIMP removal awaits activation, while Bruno, DBeaver, and PIM clients remain behind separate gates |
 
 ## Repository checkpoints
 
@@ -105,6 +113,8 @@ not make it the global next step while another pilot can still progress.
 | NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
 | NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential |
 | NixOS configuration | `chore/workflow-system` | `422a1ea` | Scope GitHub and Context7 credentials to their callers |
+| NixOS configuration | `chore/workflow-system` | `ec54ddd` | Own Outlook's stable launcher and select Pinta over GIMP |
+| NixOS configuration | `chore/workflow-system` | `656f144` | Prepare event-driven CPU transcription on Orion |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
 | `yookr-dashboard-new` | `feat/gogv2` | `c99f8b6` | Move runtime configuration to its machine-local owner |
@@ -120,17 +130,12 @@ not make it the global next step while another pilot can still progress.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- Run the bounded Pinta trial using a recent real edit: clipboard/open,
+- After the next Zenith activation, launch Outlook from Walker and confirm it
-  selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
+  opens the installed PWA; also confirm GIMP is absent. Pinta already passed.
-  basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
-  replaces GIMP; one of the two will then be removed.
-- Install Outlook from its signed-in page as a Vivaldi web app, then tell the
-  agent so its generated desktop entry can be identified and replaced by a
-  stable Home Manager owner.
 - During a docked Zenith session, tell the agent the external display is
   attached so its stable identity and the two-output `Super+A` pilot can be
   completed. The current session exposes only `eDP-1`.
-- After activation, launch Evolution and add accounts without removing any
+- When the user resumes the deferred Evolution pilot, add accounts without removing any
   existing client or changing authority: personal and old-personal through
   their existing IMAP/SMTP service, university and work through the
   `Microsoft 365` account type, and Radicale through native CalDAV, CardDAV,
@@ -140,9 +145,10 @@ step to the user only when it blocks the current task.
 - On Android, complete the DAVx5/Radicale and Tasks.org pilots described in the
   discovery plan, including correct default accounts, recurrence, reminders,
   and Microsoft To Do within its documented limits.
-- Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
+- Configure Fossify's native save location as `recordings/inbox`. Before the
-  rename or move it manually; the agent must first observe the real write and
+  first Orion runtime test, stop Zenith's retained transcription timer so both
-  settlement behavior before implementing Orion automation.
+  machines cannot consume the same synchronized inbox. Activate Orion, then use
+  the observed sample for the end-to-end CPU and settlement test.
 - Supply one real Yookr S3 task plus a least-privileged remote and authorize one
   bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
 - Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
@@ -331,13 +337,14 @@ Polaris:
   actions, repeated resize families, and their four shortcut-only scripts. The
   existing `Super+A` helper remains until a two-output session can validate its
   bounded name-based replacement.
-- Home Manager now owns the existing Vivaldi launcher filenames for Actual and
+- Home Manager owns the existing Vivaldi launcher filenames for Actual and
   WhatsApp at the higher-precedence user-data location, so both invoke Vivaldi
   8.1.4087.70 with the `Default` profile and stable app ID. Direct activation
   replaced both generated files with managed links and retained the originals
   as adjacent `.bak` files. The entries use native forced ownership because
-  Vivaldi may regenerate those exact paths. Outlook is not installed yet, so no
+  Vivaldi may regenerate those exact paths. The installed Outlook PWA identified
-  ID was guessed.
+  itself as `eoficlgicibekocmfdomjbfnjmehnhcd`; its prepared managed launcher
+  preserves mailto handling and the calendar, compose, and new-event actions.
 - The first `nixos-maintainer` skill is instruction-only, Nix-owned, and passes
   the skill-creator validator. It encodes repository-specific ownership,
   research, formatting, no-switch, and affected-host validation behavior
@@ -414,8 +421,8 @@ Polaris:
 - In zsh, never use lowercase `path` as a loop or local variable: it is tied to
   `PATH`. A diagnostic command temporarily hid normal executables by doing so;
   the declarative session environment was correct and needed no patch.
-- Pinta is added beside GIMP only for its bounded trial; neither outcome is
+- Pinta passed the bounded real-edit trial and is selected; GIMP is removed from
-  preselected before real editing evidence.
+  the prepared workstation package set.
 - `sync/notes` is now the sole declarative notebook owner, with `daily`,
   `meetings`, and `transcripts` directories, a native `zk daily` alias, and a
   `Super+N` dedicated Kitty/Neovim launcher. The five unique authored work notes
@@ -425,6 +432,22 @@ Polaris:
   contents, then explicitly approved moving the intact `sync/work/notes`
   rollback copy to desktop Trash. The pre-merge todo copies in `/tmp` may now
   expire normally.
+- The Fossify pilot produced a 10.28-second, mono 48 kHz AAC/M4A named
+  `20260906_004200.m4a`. Zenith's Syncthing log records its completed transfer at
+  00:44:12, after the recording stopped, and the received file remains stable
+  and media-readable. Fossify will write future recordings directly into
+  `recordings/inbox`; this is a native one-time producer setting, not a manual
+  filing step. Orion now owns the CPU `whisper-cpp` consumer through a systemd
+  path unit. The scanner waits for five minutes of unchanged size, nanosecond
+  mtime, and inode, validates media duration, archives without clobbering, and
+  publishes an unlabeled transcript when diarization is unavailable. A copied
+  sample passes that complete CPU fallback path in an isolated sync tree. Keep
+  Zenith's live Vulkan timer until the Orion runtime and next-morning gate pass,
+  and stop it during the shared-inbox pilot to prevent two consumers racing. A
+  read-only Orion check confirms the identical sample is synchronized there,
+  neither transcription unit exists in the current generation, and the gated
+  diarization model is not installed; the first runtime pass will therefore
+  exercise the intentional unlabeled fallback.
 - Evolution 3.60.2 is composed through Nixpkgs with `evolution-ews` 3.60.2,
   whose pinned source contains the separate native Microsoft 365 mail,
   calendar, contacts, recurrence, and OAuth backends. Live inspection caught
@@ -433,7 +456,8 @@ Polaris:
   server on D-Bus. The pilot now uses NixOS's native `programs.evolution`
   integration with the EWS plugin beside Thunderbird. The follow-up activation
   succeeded, its source-registry service activates through D-Bus, no account is
-  preconfigured, and no authority is changed.
+  preconfigured, and no authority is changed. The user deferred account setup;
+  Thunderbird and the Outlook PWA remain the working clients meanwhile.
 - Named database connections and a Marimo-to-HTML report remain workbench
   evaluation evidence, not scaffolding requirements. Add them only for a real
   cross-system investigation that gives the queries and report durable value.

docs/workflow-discovery.md

@@ -1,6 +1,7 @@
 # Workflow system blueprint
 
-Status: authoritative design; discovery complete, implementation pending
+Status: authoritative design; discovery complete, implementation tracked in
+[`plans/workflow-system.md`](plans/workflow-system.md)
 
 Last revised: 2026-09-05