diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md
index 1238b01..1576d41 100644
--- a/docs/plans/workflow-system.md
+++ b/docs/plans/workflow-system.md
@@ -33,13 +33,13 @@ artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
 ## Current checkpoint
 
 - Tranche: autonomous consolidation across repositories, tools, and pilots
-- State: autonomous implementation exhausted; external and real-use gates await
-  their inputs
+- State: autonomous implementation exhausted; one final Zenith activation and
+  external or real-use gates await the user
 - Branch: `chore/workflow-system`
-- Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-06 after the invocation-scoped credential changes;
-  only the expected dirty-tree and unknown `modules`
-  warnings were emitted. The generated project menu finds 30 live repositories
+- Baseline: `nix flake check --no-build --quiet` and no-link Zenith and Orion
+  system builds passed on 2026-09-06 after making Orion the sole transcription
+  owner; only the expected dirty-tree and unknown `modules` warnings were
+  emitted. The generated project menu finds 30 live repositories
   without `.archive` or `.worktrees` entries, and the generated daily-note
   configuration passes an isolated same-day idempotence test. The managed Actual
   and WhatsApp entries are active in the current user session, Evolution's
@@ -72,19 +72,21 @@ artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
   mode 0600, the exposed key is revoked, and a live resolve-and-query round trip
   passes through the activated runtime header helper. Pinta passed its real-edit
   trial, and Outlook's installed PWA exposed stable app ID
-  `eoficlgicibekocmfdomjbfnjmehnhcd`; GIMP removal and the managed Outlook
-  launcher pass both affected-host builds. A stopped 10.28-second Fossify M4A
+  `eoficlgicibekocmfdomjbfnjmehnhcd`; after activation, GIMP is absent and the
+  managed Outlook launcher is the live store-backed entry. A stopped
+  10.28-second Fossify M4A
   transferred intact into `sync/recordings`, establishing its actual format and
   path. The user selected Fossify's native `recordings/inbox` destination, and
-  the new event-driven Orion CPU pipeline passes an isolated transcription of
-  that recording without modifying or exposing its contents. A pathological
+  the event-driven Orion CPU pipeline passes both an isolated transcription and
+  a live remote run of that recording without exposing its contents. Orion
+  waited for the full settlement interval, archived the byte-identical original,
+  published the expected fallback Markdown, and exited successfully. A pathological
   synchronized repository tree was removed from the Pixel. Repositories are now
   explicitly outside the Syncthing boundary instead of relying on an expanding
   generated-directory ignore list.
-- Next: activate and validate the Orion transcription owner, then retire the
-  retained Zenith timer. Activate the batched Zenith desktop changes once that
-  migration is ready, while independent external pilots continue as inputs
-  arrive.
+- Next: activate Zenith once more to remove its stopped timer declaratively.
+  Orion already evaluates to its deployed generation and needs no second
+  activation. Then continue independent external pilots as inputs arrive.
 
 ## Progress
 
@@ -93,12 +95,12 @@ artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
 | Bootstrap and repository ownership | Complete | Repository reconciliation, local plaintext credential cleanup, and Context7 rotation pass |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
 | Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
-| Desktop navigation and interaction | Waiting for user | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; the managed Outlook launcher awaits activation and the two-output check awaits a docked session |
+| Desktop navigation and interaction | Waiting externally | Walker project and terminal actions plus stable Actual, WhatsApp, and Outlook launchers work; the two-output check awaits a docked session |
 | Agent workflow | Waiting externally | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, invocation-scoped credentials, and organization Projects pass; a real Monday ticket remains external |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Deferred | Evolution 3.60.2 with Microsoft 365 support remains available beside Thunderbird; the user deferred account setup and uses Thunderbird plus Outlook meanwhile |
-| Transcription | Waiting for user | Real Fossify transfer and isolated CPU transcription pass; Orion activation and end-to-end runtime validation remain |
-| Conditional retirement and completion | Active | Superseded tools are removed and Pinta passed; GIMP removal awaits activation, while Bruno, DBeaver, and PIM clients remain behind separate gates |
+| Transcription | Waiting for user | Real Fossify transfer, settlement, CPU transcription, archive, and fallback pass on Orion; the stopped Zenith timer awaits declarative removal, while diarization and a real meeting remain external |
+| Conditional retirement and completion | Active | Superseded tools and GIMP are absent and Pinta passed; Bruno, DBeaver, and PIM clients remain behind separate gates |
 
 ## Repository checkpoints
 
@@ -121,6 +123,7 @@ artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
 | NixOS configuration | `chore/workflow-system` | `422a1ea` | Scope GitHub and Context7 credentials to their callers |
 | NixOS configuration | `chore/workflow-system` | `ec54ddd` | Own Outlook's stable launcher and select Pinta over GIMP |
 | NixOS configuration | `chore/workflow-system` | `656f144` | Prepare event-driven CPU transcription on Orion |
+| NixOS configuration | `chore/workflow-system` | `01c8855` | Make Orion the sole transcription owner after its live pass |
 | NixOS configuration | `chore/workflow-system` | `fa17d77` | Exclude generated devenv state from Syncthing |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
@@ -137,8 +140,8 @@ artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- After the next Zenith activation, launch Outlook from Walker and confirm it
-  opens the installed PWA; also confirm GIMP is absent. Pinta already passed.
+- Activate the latest Zenith configuration once to remove its already stopped
+  transcription timer declaratively: `cd ~/.config/nixos && nh os switch`.
 - During a docked Zenith session, tell the agent the external display is
   attached so its stable identity and the two-output `Super+A` pilot can be
   completed. The current session exposes only `eDP-1`.
@@ -152,10 +155,10 @@ step to the user only when it blocks the current task.
 - On Android, complete the DAVx5/Radicale and Tasks.org pilots described in the
   discovery plan, including correct default accounts, recurrence, reminders,
   and Microsoft To Do within its documented limits.
-- Configure Fossify's native save location as `recordings/inbox`. Before the
-  first Orion runtime test, stop Zenith's retained transcription timer so both
-  machines cannot consume the same synchronized inbox. Activate Orion, then use
-  the observed sample for the end-to-end CPU and settlement test.
+- Keep Fossify's native save location at `recordings/inbox`. On Orion, install
+  the gated diarization model with `prepare-transcription-diarization-model`
+  after accepting its Hugging Face terms, then validate a real Dutch/English
+  meeting through the next morning. The unlabeled fallback already passes.
 - Supply one real Yookr S3 task plus a least-privileged remote and authorize one
   bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
 - Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
@@ -380,8 +383,8 @@ Polaris:
   MongoDB Compass, pgModeler, tbls, global `usql`, and global MariaDB are
   removed; Dadbod and wrapper-local clients remain, while DBeaver stays through
   its gate. Obsidian, Planify, and Calcure are removed after note and task
-  authority was established. Pinta/GIMP and the Evolution-era PIM clients remain
-  independently gated.
+  authority was established. Pinta replaces GIMP; the Evolution-era PIM clients
+  remain independently gated.
 - `rclone` is installed as the only preparation for the selected S3 pilot. No
   remote, wrapper, or interactive browser is added before a real task and
   least-privileged credentials exist.
@@ -441,8 +444,8 @@ Polaris:
 - In zsh, never use lowercase `path` as a loop or local variable: it is tied to
   `PATH`. A diagnostic command temporarily hid normal executables by doing so;
   the declarative session environment was correct and needed no patch.
-- Pinta passed the bounded real-edit trial and is selected; GIMP is removed from
-  the prepared workstation package set.
+- Pinta passed the bounded real-edit trial and is selected; GIMP is absent from
+  the active workstation package set.
 - `sync/notes` is now the sole declarative notebook owner, with `daily`,
   `meetings`, and `transcripts` directories, a native `zk daily` alias, and a
   `Super+N` dedicated Kitty/Neovim launcher. The five unique authored work notes
@@ -461,13 +464,17 @@ Polaris:
   path unit. The scanner waits for five minutes of unchanged size, nanosecond
   mtime, and inode, validates media duration, archives without clobbering, and
   publishes an unlabeled transcript when diarization is unavailable. A copied
-  sample passes that complete CPU fallback path in an isolated sync tree. Keep
-  Zenith's live Vulkan timer until the Orion runtime and next-morning gate pass,
-  and stop it during the shared-inbox pilot to prevent two consumers racing. A
-  read-only Orion check confirms the identical sample is synchronized there,
-  neither transcription unit exists in the current generation, and the gated
-  diarization model is not installed; the first runtime pass will therefore
-  exercise the intentional unlabeled fallback.
+  sample passed that complete CPU fallback path in an isolated sync tree. The
+  user deployed Orion with
+  `nixos-rebuild switch --target-host orion --flake ~/.config/nixos#orion`,
+  activated Zenith's desktop changes, and stopped Zenith's old timer before the
+  shared-inbox test. Moving only the observed sample into Orion's inbox triggered
+  the path unit; after the full settlement interval, roughly two minutes of CPU
+  inference produced a 563-byte fallback transcript and archived the original
+  at its unchanged 126741-byte size with no failure artifact. The results synced
+  back to Zenith, and Orion's current generation exactly matches the simplified
+  configuration. Orion is now the sole declarative transcription owner; the
+  gated diarization model and real Dutch/English meeting remain later gates.
 - Evolution 3.60.2 is composed through Nixpkgs with `evolution-ews` 3.60.2,
   whose pinned source contains the separate native Microsoft 365 mail,
   calendar, contacts, recurrence, and OAuth backends. Live inspection caught