Split control messages by scope: the root ctl takes the session's builtins and reads the settings, a pane's ctl its own

Every builtin could only be clicked, or written to exec, and the settings
could be read only as the Config window's prose. acme keeps window verbs on
a window's ctl, and webfs and upas/fs keep session settings on a root ctl.
Each builtin now declares its scope (scope = .session; settings are all
session, the rest pane), read by the registry. The root /ctl takes session
builtins and reads every setting in the words a write takes, so its read
written back changes nothing (panel and scene effects now take on/off like
the toggles, to make that true); a pane's ctl takes the pane's builtins
beside get, lock and unlock. Writes are checked whole and refused in Plan
9's ctl words (unknown control message "X", wrong #args ...), which 9ns
now maps to EINVAL (cloud9 re-pinned at a8c7a715). A builtin that would
prompt for its argument fails the write instead, and a refusal is answered
at once, not after the frame.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 9 insertions, 2 deletions

diff --git a/.agents/skills/pardes-9p/SKILL.md b/.agents/skills/pardes-9p/SKILL.md
index 5e2280f9..5540db5f 100644
--- a/.agents/skills/pardes-9p/SKILL.md
+++ b/.agents/skills/pardes-9p/SKILL.md
@@ -53,6 +53,8 @@ $m/log        recent events, then EOF: new|del|rename|save <serial> <name>, msg
 $m/screen     the rendered screen as JSON, frozen per open
 $m/listeners  this session's dial addresses
 $m/focus      the serial of the pane with the keyboard; echo a serial into it to move the keyboard
+$m/ctl        the settings, one a line as a write takes them; write a setting or a session builtin
+              (Newcol, Dump, Kill, Theme x); a pane's builtins (Del, Save f) go to $m/pane/<n>/ctl
 $m/pane/new   open it to make a pane, read names it; rmdir $m/pane/<n> closes it
 $m/os/        the host filesystem
 ```
@@ -131,8 +133,13 @@ written until someone writes or truncates it, so writing an address and reading
 it back evaluates it, and two clients addressing the same pane will interfere.
 `$pane/ctl` reads acme's window status line — serial, tag length, body length,
 a reserved zero, the dirty flag, the width in cells, the font and the tab
-width, then `current` or `notcurrent` — and takes `get` (reload from disk) and
-`lock`/`unlock`. The lock binds only clients that take it, and is held by the
+width, then `current` or `notcurrent` — and takes `get` (reload from disk),
+`lock`/`unlock`, and any builtin that acts on a pane (`Del`, `Save f`,
+`Collapse`). Session builtins and settings go to the root `ctl`, which reads
+back every setting in the syntax it takes. A ctl write is checked whole
+first and refused as `unknown control message "X"` (EINVAL) and the like; a
+builtin that would open a prompt (`Save` on a scratch, bare `Find`) fails
+there instead of prompting. The lock binds only clients that take it, and is held by the
 open that wrote it, so a shell holds an fd across the edit:
 `exec 3>$pane/ctl; echo lock >&3; ...; exec 3>&-`.