fix: restore terminal-backed Walker actions

docs/plans/workflow-system.md

@@ -6,10 +6,23 @@ Apply the global and repository-local `AGENTS.md` files and the ponytail skill
 at full intensity throughout. Preserve user work, prefer native capabilities,
 and add no abstraction without a demonstrated repeated need.
 
+## Non-negotiable activation boundary
+
+Only the user may switch or activate configurations. The agent must never run
+`nixos-rebuild switch`, a Home Manager activation or switch command, or any
+equivalent operation that changes the active generation. Building and
+evaluating configurations is allowed; after a successful build, give the user
+the exact activation command and wait for confirmation.
+
+On 2026-09-05 the agent violated this boundary by directly running a built Home
+Manager activation package. It restarted the Kitty service and closed the
+user's terminal session. Do not repeat this, including for changes described as
+user-level, harmless, temporary, or needed only for live verification.
+
 ## Current checkpoint
 
 - Tranche: desktop, agents, and notes
-- State: Zenith activation verified; waiting for the desktop interaction gate
+- State: terminal launch fixed; waiting for a user-controlled launcher restart
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
   build passed on 2026-09-05 after the live activation follow-ups; only the
@@ -18,9 +31,14 @@ and add no abstraction without a demonstrated repeated need.
   `.worktrees` entries, and the generated daily-note configuration passes an
   isolated same-day idempotence test. The managed Actual and WhatsApp entries
   are active in the current user session, Evolution's source registry activates
-  over D-Bus, and the VPN reconnects successfully.
-- Next: the user completes the bounded Walker/project/PWA interaction gate
-  below. Then the agent records the result and surfaces only the next gate.
+  over D-Bus, and the VPN reconnects successfully. The user activated the
+  terminal root fix: `xdg-terminal-exec` now selects Kitty correctly and Yazi
+  launches from Walker. The still-running Elephant process retained the old
+  project action, so its menu file is now an explicit restart trigger.
+- Next: after the fix is committed and built, the user restarts Elephant and
+  Walker with the exact command supplied by the agent, then repeats only the
+  project-launch test. The restart trigger takes effect on the next ordinary
+  user-controlled configuration switch.
 
 ## Progress
 
@@ -201,10 +219,20 @@ Polaris:
   generation. NetworkManager reconnected the VPN successfully afterward.
 - Walker's native cached Lua menu scans the four identity roots and refreshes
   when their top level changes. Its default action pipes the selected path to
-  one Nix-owned `open-project` command, which starts Neovim in a detached Kitty
-  window and leaves an interactive shell after Neovim exits. The generated
-  Walker configuration extends, rather than copies or replaces, the pinned
-  default provider list and prefixes.
+  one Nix-owned `open-project` command. Elephant supplies that path without a
+  terminating newline, so the launcher now accepts a successful partial read
+  instead of exiting under `errexit`. It opens Neovim through the configured
+  `xdg-terminal-exec` owner and leaves an interactive shell after Neovim exits.
+  Elephant reads menu actions only at startup, so the generated menu is also a
+  declarative service restart trigger. The generated Walker configuration
+  extends, rather than copies or replaces, the pinned default provider list and
+  prefixes.
+- The shared terminal-launch failure came from the Kitty package rewrite:
+  unanchored `sed` changed both `Exec=kitty` and `TryExec=kitty` to include
+  `-1`. Arguments are invalid in `TryExec`, causing `xdg-terminal-exec` to
+  reject the configured terminal. The rewrite now changes only `Exec`; live
+  resolver output selects `kitty.desktop` and retains `kitty -1`, and Yazi
+  launches successfully from Walker.
 - Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit
   and monitor-power bindings, extra screenshot modes, first/last and centering
   actions, repeated resize families, and their four shortcut-only scripts. The