docs: advance to Herdr pilot

docs/plans/workflow-system.md

@@ -22,7 +22,7 @@ user-level, harmless, temporary, or needed only for live verification.
 ## Current checkpoint
 
 - Tranche: desktop, agents, and notes
-- State: Walker and notes verified; unsafe Elephant restart trigger removed
+- State: Walker and notes verified; ready for the first bounded Herdr pilot
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
   build passed on 2026-09-05 with the project-root launcher change and restart
@@ -38,10 +38,11 @@ user-level, harmless, temporary, or needed only for live verification.
   in the repository. The daily-note launcher and migrated notebook contents
   also pass their live sanity check. The attempted Elephant menu restart trigger
   stopped its dependent Walker during activation without bringing Walker back,
-  so it has been removed in favor of applying rare menu changes at login.
-- Next: the user activates the trigger removal, logs out and back in, then opens
-  one repository from Walker and confirms that Neovim starts in Oil at the
-  project root.
+  so it has been removed in favor of applying rare menu changes at login. After
+  activating that removal and relogging, Walker opens normally and repository
+  selection starts Neovim in Oil at the project root.
+- Next: use Herdr for one read-only fresh-session resume check, including agent
+  state detection and detach/reattach, before adding any Herdr configuration.
 
 ## Progress
 
@@ -51,7 +52,7 @@ user-level, harmless, temporary, or needed only for live verification.
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
 | Repository contracts and workbench | Waiting externally | Three contracts and read-only Kubernetes pass; API deployment/access evidence is externally blocked, while database/report scaffolding is deferred until a real investigation |
 | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
-| Agent workflow | Active | The instruction-only `nixos-maintainer` skill validates and builds; the Herdr pilot remains |
+| Agent workflow | Active | The `nixos-maintainer` skill validates and builds; Herdr 0.8.2 is installed with only native state and awaits its first bounded live check |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
@@ -69,6 +70,8 @@ user-level, harmless, temporary, or needed only for live verification.
 | NixOS configuration | `chore/workflow-system` | `c9ee688` | Advance VPN, desktop, agent, note, and PIM pilots |
 | NixOS configuration | `chore/workflow-system` | `cfa5d6d` | Correct PWA ownership and Evolution service activation |
 | NixOS configuration | `chore/workflow-system` | `c2f48df` | Restore terminal-backed Walker actions |
+| NixOS configuration | `chore/workflow-system` | `6631889` | Open Walker projects at their repository root |
+| NixOS configuration | `chore/workflow-system` | `ca65328` | Remove the unsafe Elephant restart trigger |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
@@ -80,9 +83,11 @@ user-level, harmless, temporary, or needed only for live verification.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- After the next user-controlled activation, log out and back in, open a
-  repository from Walker, and confirm Neovim opens Oil at its root; exiting
-  Neovim should still leave a usable shell in that repository.
+- In a separate terminal, enter this repository and run `herdr`, start `codex`,
+  and ask it to read `docs/plans/workflow-system.md` without editing and report
+  the exact next implementation step. Confirm Herdr shows the agent's working
+  and waiting/done states, detach with `Ctrl+B` then `q`, reattach with `herdr`,
+  and confirm the pane survived with its output intact.
 - Run the bounded Pinta trial using a recent real edit: clipboard/open,
   selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
   basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
@@ -239,7 +244,8 @@ Polaris:
 - A custom restart trigger for Elephant proved unsafe: Walker requires Elephant,
   so activation stopped Walker with its backend but restarted only Elephant.
   The trigger is removed; relogging is the deliberately simple refresh path
-  unless real usage proves that inconvenient.
+  unless real usage proves that inconvenient. The user activated the removal,
+  relogged, and confirmed both Walker and the project-root Oil action work.
 - Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit
   and monitor-power bindings, extra screenshot modes, first/last and centering
   actions, repeated resize families, and their four shortcut-only scripts. The