fix: correct desktop and Evolution activation

docs/plans/workflow-system.md

@@ -9,18 +9,20 @@ and add no abstraction without a demonstrated repeated need.
 ## Current checkpoint
 
 - Tranche: desktop, agents, and notes
-- State: waiting for Zenith activation
+- State: waiting for follow-up Zenith activation
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-05 after the desktop, agent, runtime, and note changes;
-  only the expected dirty-tree and unknown `modules` warnings were emitted.
-  The generated project menu finds 30 live repositories without `.archive` or
+  build passed on 2026-09-05 after the live activation follow-ups; only the
+  expected dirty-tree and unknown `modules` warnings were emitted. The
+  generated project menu finds 30 live repositories without `.archive` or
   `.worktrees` entries, and the generated daily-note configuration passes an
-  isolated same-day idempotence test.
+  isolated same-day idempotence test. The managed Actual and WhatsApp entries
+  are active in the current user session and the VPN reconnects successfully.
 - Next: the user runs
   `sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith` and reports
-  whether it succeeds. Then the agent verifies live ownership before asking for
-  one bounded interactive gate at a time.
+  whether it succeeds. This persists the corrected PWA ownership and registers
+  Evolution's native data-server services. Then the agent verifies the live
+  services before asking for one bounded interactive gate at a time.
 
 ## Progress
 
@@ -29,10 +31,10 @@ and add no abstraction without a demonstrated repeated need.
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
 | Repository contracts and workbench | Waiting externally | Three contracts and read-only Kubernetes pass; API deployment/access evidence is externally blocked, while database/report scaffolding is deferred until a real investigation |
-| Desktop navigation and interaction | Active | Project discovery, Niri vocabulary cleanup, and stable Actual/WhatsApp launchers build; activation, Outlook, and two-output checks remain |
+| Desktop navigation and interaction | Active | Project discovery and Niri cleanup build; stable Actual/WhatsApp launchers are live, while Walker, Outlook, and two-output checks remain |
 | Agent workflow | Active | The instruction-only `nixos-maintainer` skill validates and builds; the Herdr pilot remains |
 | Notes | Active | Authored work notes are copied and verified in the single notebook; daily-note configuration builds, while source retirement awaits one activated sanity check |
-| PIM | Active | Evolution 3.60.2 with its native Microsoft 365 backend builds beside Thunderbird; account and daily-use gates await activation and credentials |
+| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration builds beside Thunderbird; service, account, and daily-use gates await activation and credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
 | Conditional retirement and completion | Active | OpenVPN 3, Zed, Helix, Foot, global Node.js, and global Bun are removed declaratively; other removals remain gated separately |
 
@@ -57,9 +59,11 @@ and add no abstraction without a demonstrated repeated need.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- Activate the verified Zenith generation with
+- Activate the verified follow-up Zenith generation with
   `sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith`. The agent
   attempted this non-interactively, but `sudo` requires the user's password.
+  The first switch succeeded; this follow-up incorporates fixes found by live
+  inspection of desktop-file precedence and Evolution's D-Bus registration.
 - After activation, open Walker with `Super+Space`, search for a repository,
   launch it, exit Neovim, and confirm the same Kitty window leaves a usable
   shell in that repository. Also launch Actual and WhatsApp once from Walker.
@@ -199,8 +203,8 @@ Polaris:
   Zenith results are accepted for both workstations; preserve exact deferred
   Polaris replication steps instead.
 - OpenVPN 3 is removed from the configuration. A full Zenith system build
-  passes; the next password-authorized system switch removes it from the live
-  generation.
+  passes, and the first password-authorized switch removed it from the live
+  generation. NetworkManager reconnected the VPN successfully afterward.
 - Walker's native cached Lua menu scans the four identity roots and refreshes
   when their top level changes. Its default action pipes the selected path to
   one Nix-owned `open-project` command, which starts Neovim in a detached Kitty
@@ -213,8 +217,12 @@ Polaris:
   existing `Super+A` helper remains until a two-output session can validate its
   bounded name-based replacement.
 - Home Manager now owns the existing Vivaldi launcher filenames for Actual and
-  WhatsApp, so both invoke the current package with the `Default` profile and
-  stable app ID. Outlook is not installed yet, so no ID was guessed.
+  WhatsApp at the higher-precedence user-data location, so both invoke Vivaldi
+  8.1.4087.70 with the `Default` profile and stable app ID. Direct activation
+  replaced both generated files with managed links and retained the originals
+  as adjacent `.bak` files. The entries use native forced ownership because
+  Vivaldi may regenerate those exact paths. Outlook is not installed yet, so no
+  ID was guessed.
 - The first `nixos-maintainer` skill is instruction-only, Nix-owned, and passes
   the skill-creator validator. It encodes repository-specific ownership,
   research, formatting, no-switch, and affected-host validation behavior
@@ -236,9 +244,12 @@ Polaris:
   and `/tmp/workflow-work-notes-todo-before.md` until the activated check passes.
 - Evolution 3.60.2 is composed through Nixpkgs with `evolution-ews` 3.60.2,
   whose pinned source contains the separate native Microsoft 365 mail,
-  calendar, contacts, recurrence, and OAuth backends. It is installed only as
-  a pilot beside Thunderbird; no account is preconfigured and no authority is
-  changed.
+  calendar, contacts, recurrence, and OAuth backends. Live inspection caught
+  that overriding `evolutionWithPlugins.plugins` replaced its default Evolution
+  package, and that a Home Manager package alone did not register the data
+  server on D-Bus. The pilot now uses NixOS's native `programs.evolution`
+  integration with the EWS plugin beside Thunderbird; the final build passes,
+  no account is preconfigured, and no authority is changed.
 - Named database connections and a Marimo-to-HTML report remain workbench
   evaluation evidence, not scaffolding requirements. Add them only for a real
   cross-system investigation that gives the queries and report durable value.

modules/capabilities/desktop-defaults.nix

@@ -34,6 +34,34 @@
       appCommand = id: "${command} --profile-directory=Default --app-id=${id}";
       actualId = "ahoihnifhakgijcmjlhbcgehigihinlo";
       whatsappId = "hnpfjngllnobngcgfapefoaidbinmjnm";
+      actualDesktop = pkgs.makeDesktopItem {
+        name = "vivaldi-${actualId}-Default";
+        desktopName = "Actual";
+        exec = appCommand actualId;
+        icon = "vivaldi-${actualId}-Default";
+        extraConfig.StartupWMClass = "crx_${actualId}";
+        actions = {
+          Accounts = {
+            name = "Accounts";
+            exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/accounts";
+          };
+          "Add-Transaction" = {
+            name = "Add Transaction";
+            exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/transactions/new";
+          };
+          Reports = {
+            name = "Reports";
+            exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/reports";
+          };
+        };
+      };
+      whatsappDesktop = pkgs.makeDesktopItem {
+        name = "vivaldi-${whatsappId}-Default";
+        desktopName = "WhatsApp Web";
+        exec = appCommand whatsappId;
+        icon = "vivaldi-${whatsappId}-Default";
+        extraConfig.StartupWMClass = "crx_${whatsappId}";
+      };
     in
     {
       desktop.commands.browser = [ command ];
@@ -42,30 +70,16 @@
         sessionVariables.BROWSER = command;
       };
       xdg = {
-        desktopEntries = {
-          "vivaldi-${actualId}-Default" = {
-            name = "Actual";
-            exec = appCommand actualId;
-            icon = "vivaldi-${actualId}-Default";
-            settings.StartupWMClass = "crx_${actualId}";
-            actions = {
-              Accounts.exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/accounts";
-              "Add-Transaction" = {
-                name = "Add Transaction";
-                exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/transactions/new";
+        dataFile = {
+          "applications/vivaldi-${actualId}-Default.desktop" = {
+            force = true;
+            source = "${actualDesktop}/share/applications/vivaldi-${actualId}-Default.desktop";
           };
-              Reports.exec = "${appCommand actualId} --app-launch-url-for-shortcuts-menu-item=${config.facts.services.actual.origin}/reports";
+          "applications/vivaldi-${whatsappId}-Default.desktop" = {
+            force = true;
+            source = "${whatsappDesktop}/share/applications/vivaldi-${whatsappId}-Default.desktop";
           };
         };
-
-          "vivaldi-${whatsappId}-Default" = {
-            name = "WhatsApp Web";
-            exec = appCommand whatsappId;
-            icon = "vivaldi-${whatsappId}-Default";
-            settings.StartupWMClass = "crx_${whatsappId}";
-          };
-        };
-
         mimeApps.defaultApplicationPackages = [ pkgs.vivaldi ];
       };
     };

modules/capabilities/pim.nix

@@ -8,6 +8,15 @@ let
   homeModules = config.flake.modules.homeManager;
 in
 {
+  flake.modules.nixos.evolution =
+    { pkgs, ... }:
+    {
+      programs.evolution = {
+        enable = true;
+        plugins = [ pkgs.evolution-ews ];
+      };
+    };
+
   flake.modules.homeManager.email =
     {
       config,
@@ -67,12 +76,6 @@ in
         };
     in
     {
-      home.packages = [
-        (pkgs.evolutionWithPlugins.override {
-          plugins = [ pkgs.evolution-ews ];
-        })
-      ];
-
       programs.thunderbird = {
         enable = true;
         profiles.${config.home.username} = {

modules/profiles/workstation-base.nix

@@ -13,6 +13,7 @@ in
       nixosModules.bluetooth
       nixosModules.flatpak
       nixosModules.fonts
+      nixosModules.evolution
       nixosModules.network-manager
       nixosModules.nftables-firewall
       nixosModules.niri