Plan 9 idiom for the control filesystem, and the regressions a624a56 left

The 9P tree stops being a command language wearing a filesystem. /new
created a pane as a side effect of a *read*; it is now Tcreate in /pane,
with Tremove to close, which cloud9's engine has always supported and the
editor never declared: tree.zig now says
`features = .{ .create = true, .remove = true }`. Eleven pane ctl verbs
become files that can be read as well as written -- dot, limit, dirty,
mark, scroll, look, exec -- leaving ctl with `get`, the one verb no file
would say better. Root /ctl splits into a read-only /status and the
/look and /exec files whose write IS the click. stat carries real sizes
where it used to answer 0, and qid versions track a pane's revision, so a
client can poll for change without re-reading the body.

Commit a624a56 moved raw-tty keys to an early-return branch that knew only
Ctrl-B and bare Escape, and in the same edit deleted the paste branch below
it. That cost Shift-Escape (the unconditional way out of tty mode) and both
paste chords: Ctrl-V and Ctrl-Shift-V reached the child as keystrokes, so an
agent CLI running in a pane took Ctrl-V for its image-paste binding and
answered "No image found in clipboard". Both are restored, with tests.

Nested detection was not subtly broken but deleted: 60367d8 removed
nested.zig's process-ancestry walk and left "am I inside pardes" derived from
PARDES_FORWARD_LOOK, which read "0" both for --nested and for "the listener
did not come up". PARDES_PID now answers that question on its own, checked
with kill(pid, 0); PARDES_9P and PARDES_PANE answer how to reach it; the flag
is gone. The posted-9P registry also self-heals now -- a session that aborts
cannot unlink its own socket, so posting sweeps entries whose target refuses
a connection, symlinks only and on a definite ECONNREFUSED only.

Elsewhere: tty scrolling is sticky-bottom, following new output only from
the last row, with typing and entering raw mode snapping back to live; the
boot layouts are a Boot enum instead of a chain of ifs, and the bare tty
startup (Boot.tty, which main.zig names) opens an empty text pane under the
shell while tests keep Boot.tty_shell; builtins announce themselves on the
message row under a Verbose setting that is on by default; Config prints
each setting the way you would type it back, so WindowOpacity 70 rather than
"WindowOpacity: 70%"; LocationsConfig opens its window only when called bare;
every tagline puts the word that closes the thing last, and a column now
outlives its panes -- closing the last one leaves an empty pane, and only
Delcol, newly on the column tagline, takes the column away.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

1 files changed, 18 insertions, 11 deletions

diff --git a/docs/design.typ b/docs/design.typ
index 4c8956ba..f8f0b05c 100644
--- a/docs/design.typ
+++ b/docs/design.typ
@@ -1492,15 +1492,20 @@ same thread as editing.
 
 == Nested Look
 
-Pane shells inherit `PARDES_9P`, `PARDES_PANE` (the pane serial), and
-`PARDES_FORWARD_LOOK`. A child launch resolves its OS-relative argument in
-the child's working directory, then writes `look <path>` to the parent's
-`self/pane/<serial>/ctl`. Explicit `/virtual` and `/n` paths resolve in the
-parent. The ordinary filesystem update performs layout and drains host effects.
+Pane shells inherit `PARDES_PID` (the editor's process id), `PARDES_9P` and
+`PARDES_PANE` (the pane serial). The first answers whether the shell is inside
+a pardes at all, the other two answer how to reach it, and they are separate
+because a session whose listener never came up still owns its children. A child
+launch that finds a live `PARDES_PID` and no way to reach it says so instead of
+starting a second editor. Otherwise it resolves its OS-relative argument in the
+child's working directory, then writes `look <path>` to the parent's
+`pane/<serial>/ctl`. Explicit `/virtual` and `/n` paths resolve in the parent.
+The ordinary filesystem update performs layout and drains host effects.
 
-`--nested` starts a separate editor and disables forwarding from its direct
-pane shells. Its 9P socket remains available for control and plugins. There is
-no executable-name discovery or separate Look listener.
+`--nested` starts a separate editor and withholds `PARDES_PID` from its direct
+pane shells, which is the whole of the opt-out. Its 9P socket remains available
+for control and plugins, so those shells still get `PARDES_9P` and
+`PARDES_PANE`. There is no executable-name discovery or separate Look listener.
 
 Detached frontends use `pardes-detached-<name>.sock` in the same runtime
 directory. The shared Unix socket conventions live in `src/9p_io.zig`.
@@ -1928,9 +1933,11 @@ arrives bracketed, as one `paste` event.
 staged edits: Enter commits a new buffer save target, Escape cancels, and no
 disk rename or write happens until explicit Save. Terminal cwd and image/PDF
 status stay generated. Save leads the tail of every pane holding text of its own:
-`Save Tty Del Collapse` for a file or an output buffer,
-`Save Tty Del Togglettymode Filter Collapse` for a terminal, and `Tty Del Collapse`
-for an image. PDFs use `Tty Del PdfSections PdfTint Collapse`, without tint status text.
+`Save Tty Collapse Del` for a file or an output buffer,
+`Tty Save Mode Filter Collapse Del` for a terminal, and `Tty Collapse Del`
+for an image. PDFs use `Tty PdfSections PdfTint Collapse Del`, without tint status text.
+The word that closes the thing is last on every tagline, so overshooting the
+click before it cannot destroy anything.
 `Collapse` toggles a pane between its tagline alone and its expanded height;
 hidden body contents and running terminals are retained.
 An unsaved file has `*` after its name; an image tag