fix: keep Walker lifecycle simple

docs/plans/workflow-system.md

@@ -22,24 +22,26 @@ user-level, harmless, temporary, or needed only for live verification.
 ## Current checkpoint
 
 - Tranche: desktop, agents, and notes
-- State: Walker and notes verified; project-root Oil launch awaits activation
+- State: Walker and notes verified; unsafe Elephant restart trigger removed
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-05 with the project-root launcher change; only the
-  expected dirty-tree and unknown `modules` warnings were emitted. The
-  generated project menu finds 30 live repositories without `.archive` or
-  `.worktrees` entries, and the generated daily-note configuration passes an
-  isolated same-day idempotence test. The managed Actual and WhatsApp entries
-  are active in the current user session, Evolution's source registry activates
-  over D-Bus, and the VPN reconnects successfully. The user activated the
+  build passed on 2026-09-05 with the project-root launcher change and restart
+  trigger removal; only the expected dirty-tree and unknown `modules` warnings
+  were emitted. The generated project menu finds 30 live repositories without
+  `.archive` or `.worktrees` entries, and the generated daily-note configuration
+  passes an isolated same-day idempotence test. The managed Actual and WhatsApp
+  entries are active in the current user session, Evolution's source registry
+  activates over D-Bus, and the VPN reconnects successfully. The user activated the
   terminal root fix: `xdg-terminal-exec` now selects Kitty correctly and Yazi
   launches from Walker. After restarting the stale Elephant and Walker
   processes, repository launch also succeeds and exiting Neovim leaves a shell
-  in the repository. The project menu remains an explicit Elephant restart
-  trigger for future configuration changes. The daily-note launcher and
-  migrated notebook contents also pass their live sanity check.
-- Next: the user activates the built configuration, opens one repository from
-  Walker, and confirms that Neovim starts in Oil at the project root.
+  in the repository. The daily-note launcher and migrated notebook contents
+  also pass their live sanity check. The attempted Elephant menu restart trigger
+  stopped its dependent Walker during activation without bringing Walker back,
+  so it has been removed in favor of applying rare menu changes at login.
+- Next: the user activates the trigger removal, logs out and back in, then opens
+  one repository from Walker and confirms that Neovim starts in Oil at the
+  project root.
 
 ## Progress
 
@@ -78,9 +80,9 @@ user-level, harmless, temporary, or needed only for live verification.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- After the next user-controlled activation, open a repository from Walker and
-  confirm Neovim opens Oil at its root; exiting Neovim should still leave a
-  usable shell in that repository.
+- After the next user-controlled activation, log out and back in, open a
+  repository from Walker, and confirm Neovim opens Oil at its root; exiting
+  Neovim should still leave a usable shell in that repository.
 - Run the bounded Pinta trial using a recent real edit: clipboard/open,
   selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
   basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
@@ -221,10 +223,9 @@ Polaris:
   terminating newline, so the launcher now accepts a successful partial read
   instead of exiting under `errexit`. It opens Neovim through the configured
   `xdg-terminal-exec` owner and leaves an interactive shell after Neovim exits.
-  Elephant reads menu actions only at startup, so the generated menu is also a
-  declarative service restart trigger. The generated Walker configuration
-  extends, rather than copies or replaces, the pinned default provider list and
-  prefixes.
+  Elephant reads menu actions only at startup, so rare declarative menu changes
+  take effect at the next login. The generated Walker configuration extends,
+  rather than copies or replaces, the pinned default provider list and prefixes.
 - The shared terminal-launch failure came from the Kitty package rewrite:
   unanchored `sed` changed both `Exec=kitty` and `TryExec=kitty` to include
   `-1`. Arguments are invalid in `TryExec`, causing `xdg-terminal-exec` to
@@ -235,6 +236,10 @@ Polaris:
   project action. The user confirmed that repository launch works and exiting
   Neovim leaves a usable shell in that repository. Passing the project root to
   Neovim now opens the configured Oil default directory explorer immediately.
+- A custom restart trigger for Elephant proved unsafe: Walker requires Elephant,
+  so activation stopped Walker with its backend but restarted only Elephant.
+  The trigger is removed; relogging is the deliberately simple refresh path
+  unless real usage proves that inconvenient.
 - Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit
   and monitor-power bindings, extra screenshot modes, first/last and centering
   actions, repeated resize families, and their four shortcut-only scripts. The

modules/capabilities/walker.nix

@@ -116,10 +116,6 @@ in
         end
       '';
 
-      systemd.user.services.elephant.Unit.X-Restart-Triggers = [
-        config.xdg.configFile."elephant/menus/projects.lua".source
-      ];
-
       programs.walker = {
         enable = true;
         runAsService = true;