diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md
index 16106bc..ac7d573 100644
--- a/docs/plans/workflow-system.md
+++ b/docs/plans/workflow-system.md
@@ -9,7 +9,7 @@ and add no abstraction without a demonstrated repeated need.
 ## Current checkpoint
 
 - Tranche: desktop, agents, and notes
-- State: waiting for follow-up Zenith activation
+- State: Zenith activation verified; waiting for the desktop interaction gate
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
   build passed on 2026-09-05 after the live activation follow-ups; only the
@@ -17,12 +17,10 @@ and add no abstraction without a demonstrated repeated need.
   generated project menu finds 30 live repositories without `.archive` or
   `.worktrees` entries, and the generated daily-note configuration passes an
   isolated same-day idempotence test. The managed Actual and WhatsApp entries
-  are active in the current user session and the VPN reconnects successfully.
-- Next: the user runs
-  `sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith` and reports
-  whether it succeeds. This persists the corrected PWA ownership and registers
-  Evolution's native data-server services. Then the agent verifies the live
-  services before asking for one bounded interactive gate at a time.
+  are active in the current user session, Evolution's source registry activates
+  over D-Bus, and the VPN reconnects successfully.
+- Next: the user completes the bounded Walker/project/PWA interaction gate
+  below. Then the agent records the result and surfaces only the next gate.
 
 ## Progress
 
@@ -34,7 +32,7 @@ and add no abstraction without a demonstrated repeated need.
 | Desktop navigation and interaction | Active | Project discovery and Niri cleanup build; stable Actual/WhatsApp launchers are live, while Walker, Outlook, and two-output checks remain |
 | Agent workflow | Active | The instruction-only `nixos-maintainer` skill validates and builds; the Herdr pilot remains |
 | Notes | Active | Authored work notes are copied and verified in the single notebook; daily-note configuration builds, while source retirement awaits one activated sanity check |
-| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration builds beside Thunderbird; service, account, and daily-use gates await activation and credentials |
+| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
 | Conditional retirement and completion | Active | OpenVPN 3, Zed, Helix, Foot, global Node.js, and global Bun are removed declaratively; other removals remain gated separately |
 
@@ -48,6 +46,7 @@ and add no abstraction without a demonstrated repeated need.
 | NixOS configuration | `chore/workflow-system` | `2fb6061` | Package Garden completion declaratively |
 | NixOS configuration | `chore/workflow-system` | `ad01b9b` | Enable NetworkManager's native OpenVPN plugin |
 | NixOS configuration | `chore/workflow-system` | `c9ee688` | Advance VPN, desktop, agent, note, and PIM pilots |
+| NixOS configuration | `chore/workflow-system` | `cfa5d6d` | Correct PWA ownership and Evolution service activation |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
@@ -59,12 +58,7 @@ and add no abstraction without a demonstrated repeated need.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- Activate the verified follow-up Zenith generation with
-  `sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith`. The agent
-  attempted this non-interactively, but `sudo` requires the user's password.
-  The first switch succeeded; this follow-up incorporates fixes found by live
-  inspection of desktop-file precedence and Evolution's D-Bus registration.
-- After activation, open Walker with `Super+Space`, search for a repository,
+- Open Walker with `Super+Space`, search for a repository,
   launch it, exit Neovim, and confirm the same Kitty window leaves a usable
   shell in that repository. Also launch Actual and WhatsApp once from Walker.
 - Press `Super+N`, confirm today's file opens under `sync/notes/daily` with the
@@ -248,8 +242,9 @@ Polaris:
   that overriding `evolutionWithPlugins.plugins` replaced its default Evolution
   package, and that a Home Manager package alone did not register the data
   server on D-Bus. The pilot now uses NixOS's native `programs.evolution`
-  integration with the EWS plugin beside Thunderbird; the final build passes,
-  no account is preconfigured, and no authority is changed.
+  integration with the EWS plugin beside Thunderbird. The follow-up activation
+  succeeded, its source-registry service activates through D-Bus, no account is
+  preconfigured, and no authority is changed.
 - Named database connections and a Marimo-to-HTML report remain workbench
   evaluation evidence, not scaffolding requirements. Add them only for a real
   cross-system investigation that gives the queries and report durable value.