docs: record pilot boundaries and OpenAPI blocker

docs/plans/workflow-system.md

@@ -26,6 +26,9 @@ restarted Kitty and closed the user's terminal session.
 - Keep repositories and worktrees outside `~/sync`; synchronize authored
   artifacts instead.
 - Keep GitHub and other repository remotes strictly read-only.
+- Treat Yookr production source as read-only. Dev-tooling changes are allowed;
+  `yookr-workbench` is the only repository whose own source may be changed for
+  these pilots.
 
 ## Current checkpoint
 
@@ -60,8 +63,11 @@ These gates do not block work on each other.
   management UI.
 - Supply one real Yookr S3 task, a least-privileged remote, and explicit permission
   for any upload. `rclone` is installed; no remote or wrapper is preconfigured.
-- Deploy a GET image exposing `/full-api-docs/openapi.json`, then rerun
-  `just openapi-refresh test`.
+- The test GET image exposes `/full-api-docs/openapi.json`. The 2026-09-06
+  refresh reached it successfully but validation found a dangling
+  `#/components/schemas/ReadParameters` reference. Have the application owner
+  correct and deploy the generated document, then rerun the refresh; do not
+  modify production source during this workflow.
 - Provide current API user credentials before the planned login and harmless
   administrator read. The recovered legacy service credentials returned 401 and
   were not repurposed.
@@ -161,6 +167,9 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
   Radicale remain the data authorities; Thunderbird and Outlook remain available.
 - GitHub and every other repository remote stay read-only. Local files, commits,
   fetches, clones, and worktrees remain available.
+- Yookr production source stays read-only during workflow pilots. Changes to
+  development tooling are allowed, and `yookr-workbench` remains the explicit
+  source-code exception.
 
 ## Next step