Split control messages by scope: the root ctl takes the session's builtins and reads the settings, a pane's ctl its own

Every builtin could only be clicked, or written to exec, and the settings
could be read only as the Config window's prose. acme keeps window verbs on
a window's ctl, and webfs and upas/fs keep session settings on a root ctl.
Each builtin now declares its scope (scope = .session; settings are all
session, the rest pane), read by the registry. The root /ctl takes session
builtins and reads every setting in the words a write takes, so its read
written back changes nothing (panel and scene effects now take on/off like
the toggles, to make that true); a pane's ctl takes the pane's builtins
beside get, lock and unlock. Writes are checked whole and refused in Plan
9's ctl words (unknown control message "X", wrong #args ...), which 9ns
now maps to EINVAL (cloud9 re-pinned at a8c7a715). A builtin that would
prompt for its argument fails the write instead, and a refusal is answered
at once, not after the frame.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 6 insertions, 0 deletions

diff --git a/src/pardes.zig b/src/pardes.zig
index 321a6b3c..fbc3e119 100644
--- a/src/pardes.zig
+++ b/src/pardes.zig
@@ -5081,6 +5081,12 @@ pub const Pardes = struct {
         pipe: modal.Normal.PipeBehavior,
         save,
     }) void {
+        // Nobody is at the keyboard to answer a command a script wrote to a
+        // ctl file: the write fails instead (src/ninep/ctl.zig).
+        if (p.fs.no_prompt) {
+            p.fs.refused = true;
+            return;
+        }
         const marker = switch (request) {
             .search => |marker| marker,
             .save => config.save_marker,