row 166: strike the unserved plane FFI subprocess spawn path (its env secret resolved at the spawn)

crates/busbar-kernel/src/plane_host/egress.rs

@@ -555,11 +555,12 @@ pub(crate) extern "C-unwind" fn egress_open(
             // socket rather than a child's stdio. The governance path is identical (resolve-then-pin,
             // SPKI, mTLS, breaker, meter); joining it is append-only (no ABI change). Refused honestly.
             EgressKind::RawConn => StatusClass::Unsupported,
-            // A governed child process, its stdin/stdout the duplex `PipeId` — spawned ONLY under the
-            // HOST program allowlist. FFI-F3: no operator config wires a subprocess program allowlist
-            // over the FFI seam today, so the host authorizes NO program (`&[]`) and every plane-driven
-            // subprocess open is REFUSED at the allowlist. See [`super::pipe`].
-            EgressKind::Subprocess => super::pipe::open_subprocess(state, d, &[], out),
+            // A governed child process. FFI-F3: no operator configuration wires a subprocess program
+            // allowlist over the FFI seam, so the host authorizes NO program and every plane-driven
+            // subprocess open is REFUSED, before anything on the descriptor is decoded or resolved.
+            // The spawning path it once reached ran in no served path and is struck (row 166, F11):
+            // see [`super::pipe`].
+            EgressKind::Subprocess => StatusClass::Refused,
         }
     })
 }

crates/busbar-kernel/src/plane_host/egress_tests.rs

@@ -287,8 +287,8 @@ fn open_and_poll_fail_closed_on_null_and_bad_kind() {
                 StatusClass::Unsupported
             );
         }
-        // Subprocess IS wired (the pipe tier), so a non-command target is REFUSED at the host command
-        // allowlist (undecodable blob / not an absolute program), never spawned.
+        // Subprocess is REFUSED at the seam: the host authorizes no plane-driven program (FFI-F3), so
+        // nothing on the descriptor is decoded, resolved or spawned.
         {
             let url = b"http://example.test/".to_vec();
             let mut d = http_desc(&url);