Split control messages by scope: the root ctl takes the session's builtins and reads the settings, a pane's ctl its own

Every builtin could only be clicked, or written to exec, and the settings
could be read only as the Config window's prose. acme keeps window verbs on
a window's ctl, and webfs and upas/fs keep session settings on a root ctl.
Each builtin now declares its scope (scope = .session; settings are all
session, the rest pane), read by the registry. The root /ctl takes session
builtins and reads every setting in the words a write takes, so its read
written back changes nothing (panel and scene effects now take on/off like
the toggles, to make that true); a pane's ctl takes the pane's builtins
beside get, lock and unlock. Writes are checked whole and refused in Plan
9's ctl words (unknown control message "X", wrong #args ...), which 9ns
now maps to EINVAL (cloud9 re-pinned at a8c7a715). A builtin that would
prompt for its argument fails the write instead, and a refusal is answered
at once, not after the frame.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/fs.zig b/src/fs.zig
index 7e387958..339910a4 100644
--- a/src/fs.zig
+++ b/src/fs.zig
@@ -1256,6 +1256,13 @@ pub const Namespace = struct {
     out: std.ArrayList(u8) = .empty,
     listeners: u16 = 0,
     origin: u8 = 'K',
+    /// A ctl write is running builtins: one that would open a prompt for
+    /// its argument refuses (`refused`), since nobody is at the prompt.
+    no_prompt: bool = false,
+    refused: bool = false,
+    /// A refusal that quotes the message it refuses, as Plan 9's cmderror
+    /// does (kernel/misc/parse.c:82); answered at once (src/9p_io.zig).
+    ename: [128]u8 = undefined,
     /// Something a held read may be waiting on changed since they were last
     /// answered: a record queued, a run answered, a pane gone.
     news: bool = false,