feat(desktop): home app (system-only launch cap, LAUNCH_BADGE: apps+launch only), pm starts it with session (relaunch <=5); display keys F1/Alt+Tab next, F2 home, F4 close app (ROLE from launcher, terminal exempt), close returns to previous window; closed window -> app exits; shell 'name &'; launch by id; pm stack 8, storage 16 clients

docs/apps.md

@@ -91,12 +91,23 @@ optional one is simply not granted.
 | `display` | a window of its own, named from its manifest: its pixels, and the keyboard while it is in front |
 | `storage` | the user's `data/<id>/`, read-write (its own folder only) |
 | `permissions` | a management copy of the permission manager's endpoint (below) |
-| `session` | init's session copy: who is signed in (`WHO`), and signing out |
+| `session` | init's session copy: who is signed in (`WHO`), the theme, and signing out |
+| `launch` | a launcher copy of the permission manager's endpoint: `APPS` and `LAUNCH` only |
 
-`permissions` and `session` are **system only**: only an app on the system
+`permissions`, `session` and `launch` are **system only**: only an app on the system
 image (with a factory decision) has them. Installing an app that asks for
 either, required or optional, is refused (`SYSTEM_ONLY`). Settings
-(`kos.settings`) is the app that holds them.
+(`kos.settings`) holds the first two, Home (`kos.home`) the third.
+
+Home is the session's desktop: the permission manager starts it when the
+session starts (and again if it dies, five times at most), and it lists
+every app with a window and opens the one pressed, each in its own
+window, as many as there is room for (8 windows, 24 MiB between the
+apps). Its copy of the endpoint is badged `LAUNCH_BADGE`: it may list and
+launch, but pass nothing along, so what it opens gets no output and no
+folder. The shell still runs apps and waits; `name &` starts one without
+waiting (and without the current folder, which nobody would take back).
+An app is named to `LAUNCH` by its command or its id.
 
 ## Decisions