Delete the net and spin applets, proctest, and the launch_authority metal row

Cargo.toml

@@ -124,7 +124,6 @@ members = [
     "system/usbd",
     "tests/guest/kernelprobe",
     "tests/guest/metalprobe",
-    "tests/guest/proctest",
     "tests/guest/test-runner",
     "tests/metal",
 ]

images/system.toml

@@ -41,7 +41,6 @@ folder = "read-write"
 # its own `/state/<name>` and makes that directory first. Every other row runs
 # with the session user's home.
 [programs]
-proctest = {}
 # The installer. It holds nothing: it writes under `/apps` because `/apps` is
 # writable to it, and a row that gave it more would make that untrue.
 pkg = {}
@@ -100,7 +99,7 @@ devices = ["pci:1af4:1041"]
 [programs.sshserver]
 service = true
 receives = ["netstack"]
-starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "proctest", "sshserver", "swap", "toyfetch", "update", "grants", "/apps"]
+starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "sshserver", "swap", "toyfetch", "update", "grants", "/apps"]
 login = true
 
 # `swap` is the authority to replace a running service's binary; the build
@@ -160,7 +159,7 @@ starts = ["shell"]
 
 [programs.shell]
 receives = ["surface"]
-starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "proctest", "sshserver", "swap", "toyfetch", "update", "grants", "/apps"]
+starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "sshserver", "swap", "toyfetch", "update", "grants", "/apps"]
 
 [programs.doom]
 receives = ["compositor", "soundserver"]
@@ -199,7 +198,7 @@ receives = ["compositor", "filepicker"]
 [programs.toybox]
 receives = ["compositor", "soundserver", "surface", "power"]
 syscap = ["roster"]
-starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "proctest", "sshserver", "swap", "toyfetch", "update", "/apps"]
+starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "paint", "files", "host", "inspect", "pkg", "sshserver", "swap", "toyfetch", "update", "/apps"]
 
 # Symlinks created on ROOT at build time.
 # Keys are ROOT-relative; targets are the guest paths they resolve to.
@@ -214,14 +213,12 @@ starts = ["toybox", "shell", "terminal", "doom", "snake", "calc", "editor", "pai
 "bin/ls" = "/system/bin/toybox"
 "bin/mkdir" = "/system/bin/toybox"
 "bin/mv" = "/system/bin/toybox"
-"bin/net" = "/system/bin/toybox"
 "bin/ps" = "/system/bin/toybox"
 "bin/pwd" = "/system/bin/toybox"
 "bin/reboot" = "/system/bin/toybox"
 "bin/rm" = "/system/bin/toybox"
 "bin/screen" = "/system/bin/toybox"
 "bin/shutdown" = "/system/bin/toybox"
-"bin/spin" = "/system/bin/toybox"
 "bin/stats" = "/system/bin/toybox"
 "bin/tone" = "/system/bin/toybox"
 

issues/consent-prompts-click-on-an-open-launchers-row-made-no-launch.md

@@ -0,0 +1,35 @@
+---
+status: open
+kind: defect
+opened: 2026-10-12
+---
+
+# `consent_prompt`'s click on an open launcher's row made no launch
+
+A whole guest suite (`cargo test`) on the development host, on pull request
+#889's tree at `c24bee1db`, went red on `consent_prompt` alone, 62 of 63
+green, while the host's load average read 34.22, 38.33 and 47.31 a minute
+after it ended, on 14 cores. The suite had scaled its liveness ceilings by
+1.00x. Of what that test boots or runs, the tree differs from `main`'s at
+`ab655a115` only in a doc comment of `toyos_manifest::launch::refused`.
+
+The steps `always`, `again`, `deny` and `denied` passed. At `skip` the host
+clicked `+`, saw the launcher's row change on the panel within its 20 s, and
+clicked the row. Nothing launched: the supervisor said nothing more of
+`consentee`, no window opened, and the compositor logged only idle frames
+until the job's 600 s ceiling ended it. With no launch there was no prompt,
+so `Consent::prompt_up`, which only the prompt's line starts, never ran. The
+log:
+https://github.com/ToyOSOrg/evidence/blob/c7a625ddef468380faaca0e94f0be7ffb52dfed3/build/guest.log#L1259
+
+The host waits for the launcher before its second click because two clicks
+in one read are one click
+(`issues/two-clicks-the-compositor-reads-at-once-are-one-click.md`). That
+wait ends when any pixel of the row's rectangle changes (`Consent::begin`,
+`tests/toyos.rs`), which is not the row being drawn.
+
+Owner: the desktop track, `issues/toyos-has-a-desktop.md`.
+
+**Exit**: why a click on the open launcher's row made no launch is named and
+fixed, and the host's step reds by name, within a bound of its own, when its
+click launches nothing.

issues/nothing-holds-that-a-child-spawned-directly-holds-no-launcher.md

@@ -0,0 +1,25 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-12
+---
+
+# Nothing holds that a child spawned directly holds no launcher
+
+The `launch_authority` metal row, deleted by the owner's ruling on pull
+request #889, ended by spawning its own binary, which no row declares, and
+asserting the child held no launcher: none under the `launcher` label, and
+none in the `svc` namespace it inherits. No test at any tier asserts that
+now.
+
+This file owes std's half of it: a direct spawn endows the child a copy of
+the caller's `svc` and only what the caller endowed, never the caller's
+launcher (`sdk/std/sys/process.rs`). The supervisor's half, a row's launcher
+endowed under `launcher` and never in `svc`, is owed by stage 2 of
+`issues/the-supervisor-is-host-tested-and-owns-the-stop.md`.
+
+**Owner**: the orchestrator.
+
+**Exit**: a test on the cheapest tier that reaches std's direct spawn holds
+that it endows the child no launcher, and a mutation named in its pull
+request reds it: a direct spawn endowing the child its caller's launcher.

issues/the-supervisor-is-host-tested-and-owns-the-stop.md

@@ -59,8 +59,12 @@ nothing.
    **Exit**: the crate's tests pass in
    `cargo test --workspace --exclude toyos-build`; a host test refuses a
    manifest whose dependencies form an undeclared cycle; each refusal and
-   each decision above has a mutation that reds a host test, named in the PR;
-   and the stage deletes each decision from `system/supervisor`, which calls
+   each decision above has a mutation that reds a host test, named in the PR,
+   namespace selection's among them: a row's launcher endowed as an entry of
+   `svc` (`launcher_namespace`), which a child its holder spawns directly
+   would inherit, and no such child holding one is what the `launch_authority`
+   metal row, deleted in #889, last asserted; and the stage deletes each
+   decision from `system/supervisor`, which calls
    the crate for it, named per decision in the PR; `toyos_manifest::launch`,
    who may start what and the launcher's badge codec, moves into the crate
    and out of `toyos-manifest`. No decision exists in two places.

lib/manifest/src/launch.rs

@@ -252,11 +252,6 @@ pub fn may_start(caller: &Program, session: Session, target: Target<'_>) -> Resu
     Ok(starts)
 }
 
-/// The supervisor's line for a refused launch, which the metal judge reads whole.
-pub fn refused(caller: &str, session: Session, target: &str, why: Refusal) -> String {
-    format!("supervisor: launcher: {caller} in {session} may not start {target}: {why}")
-}
-
 #[cfg(test)]
 mod tests {
     use std::collections::BTreeSet;

system/supervisor/src/main.rs

@@ -1903,7 +1903,7 @@ impl Supervisor<'_> {
         let (starts, binary, prepared) = match verdict {
             Ok(judged) => judged,
             Err(why) => {
-                say!("{}", authority::refused(&caller.row.name, caller.session, &program.name, why));
+                say!("supervisor: launcher: {} in {} may not start {}: {why}", caller.row.name, caller.session, program.name);
                 let _ = conn.try_signal(launch::MSG_REFUSED);
                 return;
             }

system/toybox/src/main.rs

@@ -8,14 +8,12 @@ mod locale;
 mod ls;
 mod mkdir;
 mod mv;
-mod net;
 mod ps;
 mod pwd;
 mod reboot;
 mod rm;
 mod screen;
 mod shutdown;
-mod spin;
 mod stats;
 mod tone;
 
@@ -30,7 +28,7 @@ macro_rules! commands {
     };
 }
 
-commands!(cat, cp, echo, free, grep, hexdump, locale, ls, mkdir, mv, net, ps, pwd, reboot, rm, screen, shutdown, spin, stats, tone);
+commands!(cat, cp, echo, free, grep, hexdump, locale, ls, mkdir, mv, ps, pwd, reboot, rm, screen, shutdown, stats, tone);
 
 fn main() {
     let args: Vec<String> = std::env::args().collect();