autonomy: the question rules are asked off the update loop, and a row without them says nothing rather than "ask me"

#919 brought the offLoop law to dev and my four call sites break it: reading the
rules when the settings page opens, writing one on a keystroke, and the two
reads behind /autonomy. Every one is a call to another process — bare `aforge`
talks to its engine over a socket — made from Update, where the window cannot
draw, take a key, or hear its own answer.

THE READ IS NOW ONE PREFETCH. app.readAutonomy is in Init's standing list, so
neither the page nor a raised question ever pays a round trip, and autonomyRuled
reads the cache and never the door. Its fold RE-STAMPS THE QUESTIONS ALREADY
OPEN, because WatchQuestions replays everything waiting the moment a surface
attaches — the ordinary resume path raises questions before the rules land, and
`ruled` is the tail of a running countdown (`start it in 9s · your rule`). A
clock with no reason on it is DESIGN.md's NEVER A HIDDEN RULE.

THE WRITE DECIDES WHAT IS SEEN IMMEDIATELY AND REPAIRS ITSELF ON A REFUSAL,
which is offloop.go's own pattern: the row moves on the keystroke, the engine is
asked off the loop, and a refusal puts the row back with the engine's sentence.

AND NIL NO LONGER MEANS TWO THINGS. It meant both "no project to keep rules in"
and "not read yet", so the page drew no rows at all in the instant before the
first answer — and coercing it to an empty map draws `ask me` on every row of a
project that may be on `decide`, which is the worst sentence this page can say.
Whether the door EXISTS is a type assertion, local and free (sheet.autonomyDoor);
what it SAYS is the call. So the rows are there from the first frame and a row
whose value has not arrived draws an empty column.

Co-Authored-By: Claude Opus 5 <[email protected]>

Author: santoshkumarradha

internal/tui3/app.go

@@ -3013,6 +3013,13 @@ func (a *app) Init() tea.Cmd {
 	standing := []tea.Cmd{a.probeGit(), a.watchTasks(), a.watchWakes(), a.watchDesigns(), a.watchTitles(),
 		a.watchRuns(), a.watchQuestions(), a.loadTasks(), a.stirLane(), a.askHeld(), a.watchDriving(), a.watchFollowing(),
 		a.linkPingTick(), a.prefetchReplayedPictures(), a.countConversations(), tea.RequestBackgroundColor,
+		// AND WHAT THIS PROJECT DOES WITH A QUESTION WHILE NOBODY IS THERE, once,
+		// here (autonomysheet.go's [app.readAutonomy]). It is a door, so it may not
+		// be asked from the update loop where it is READ — when a question is
+		// raised, and on the settings page — and reading it on the way up means
+		// neither of those ever pays a round trip. The fold re-stamps whatever
+		// questions the attach already replayed.
+		a.readAutonomy(),
 		// AND THE PULSE'S OWN BEAT, whose first reading is taken now rather than
 		// ten seconds from now (pulsebeat.go).
 		pulseNow,
@@ -6685,8 +6692,7 @@ func (a *app) slash(line string) tea.Cmd {
 		if rest != "" {
 			return a.changeAutonomy(rest)
 		}
-		a.noteBlock(a.autonomySheetText())
-		return nil
+		return a.sayAutonomy()
 
 	case "quit":
 		// /quit CLOSES THE CONVERSATION IN FRONT, and leaves only when it was the

internal/tui3/autonomysheet.go

@@ -87,14 +87,36 @@ type autonomyAgent interface {
 	Autonomy() map[session.AskKind]session.Policy
 }
 
-// autonomySheetText is the whole sheet as one block of prose, which is how a
-// slash command answers on this surface.
-func (a *app) autonomySheetText() string {
+// sayAutonomy is `/autonomy` with nothing after it: the rows read off the loop
+// and then written into the conversation as one block.
+//
+// THE READ IS THE COMMAND'S WHOLE WORK, so there is nothing to draw
+// optimistically and nothing to put back if it refuses — unlike a keystroke that
+// changes a row, which decides what a person sees immediately and repairs itself
+// on a refusal (offloop.go). A command that has not answered yet has simply not
+// printed yet, which is what every other slash command that asks the engine does.
+func (a *app) sayAutonomy() tea.Cmd {
 	agent, ok := a.agent.(autonomyAgent)
 	if !ok {
-		return autonomyNoProjectWord
+		a.noteBlock(autonomyNoProjectWord)
+		return nil
 	}
-	rules := agent.Autonomy()
+	return a.offLoop(func() func(bool) tea.Cmd {
+		rules := agent.Autonomy()
+		return func(here bool) tea.Cmd {
+			if !here {
+				return nil
+			}
+			a.noteBlock(a.autonomySheetText(rules))
+			return nil
+		}
+	})
+}
+
+// autonomySheetText is the whole sheet as one block of prose, which is how a
+// slash command answers on this surface. The rows are handed in because reading
+// them is a door ([app.sayAutonomy]).
+func (a *app) autonomySheetText(rules map[session.AskKind]session.Policy) string {
 	lines := make([]string, 0, len(autonomyKinds)+2)
 	lines = append(lines, autonomyHeadWord)
 	for _, kind := range autonomyKinds {
@@ -237,10 +259,16 @@ func autonomyKindNamed(word string) session.AskKind {
 // shape of question. It is what puts `· your rule` on a running clock
 // ([app.questionClockWord]).
 //
-// IT IS READ WHEN A QUESTION IS RAISED AND NEVER ON THE DRAW PATH. The rows
-// live in a file, and the draw path is rebuilt from nothing on every frame; a
-// read per frame would be a file opened sixty times a second to answer a
-// question whose answer changes when somebody types a slash command.
+// IT READS THE CACHE AND NEVER THE DOOR. The rules are a call to another
+// process — bare `aforge` talks to its engine over a socket like every hosted
+// window does — and this is asked from the update loop, where a surface may not
+// wait on a network (offloop.go's law, and its structural test). So the ask is
+// [app.readAutonomy], fired once on [app.Init] and again whenever a rule is
+// written, and this line only ever reads what came back.
+//
+// AND IT IS READ WHEN A QUESTION IS RAISED AND NEVER ON THE DRAW PATH. The draw
+// path is rebuilt from nothing on every frame; the answer changes when somebody
+// types a slash command.
 //
 // AND AN ABSENT DOOR IS NO RULE RATHER THAN AN UNKNOWN ONE. A surface with no
 // autonomy door — a fake in a test, a conversation with no project — has no
@@ -249,21 +277,44 @@ func (a *app) autonomyRuled(kind session.AskKind) bool {
 	if kind == "" {
 		return false
 	}
-	if a.autonomyRules == nil {
-		agent, ok := a.agent.(autonomyAgent)
-		if !ok {
-			return false
-		}
-		rules := agent.Autonomy()
-		if rules == nil {
-			rules = map[session.AskKind]session.Policy{}
-		}
-		a.autonomyRules = rules
-	}
 	rule, ok := a.autonomyRules[kind]
 	return ok && rule.Kind != "" && rule.Kind != session.PolicyAsk
 }
 
-// autonomyChanged forgets the cached rows, so the next question raised reads
-// what was just written rather than what was there before it.
-func (a *app) autonomyChanged() { a.autonomyRules = nil }
+// readAutonomy asks this project's question rules off the update loop and folds
+// them in. It is [app.Init]'s and nothing else's to call on the way up.
+//
+// AND IT RE-STAMPS THE QUESTIONS ALREADY OPEN. `WatchQuestions` replays
+// everything still waiting the moment a surface attaches, so the ordinary resume
+// path raises questions BEFORE this answer lands — and [questionShown.ruled] is
+// consumed as the tail of a running countdown (`start it in 9s · your rule`). A
+// question that drew without that tail is a clock a person cannot see the reason
+// for, which is the one thing DESIGN.md calls NEVER A HIDDEN RULE. So the fold
+// stamps what is already on screen rather than only what arrives next.
+func (a *app) readAutonomy() tea.Cmd {
+	agent, ok := a.agent.(autonomyAgent)
+	if !ok {
+		return nil
+	}
+	return a.offLoop(func() func(bool) tea.Cmd {
+		rules := agent.Autonomy()
+		return func(here bool) tea.Cmd {
+			if !here {
+				return nil
+			}
+			if rules == nil {
+				rules = map[session.AskKind]session.Policy{}
+			}
+			a.autonomyRules = rules
+			for i := range a.questions {
+				a.questions[i].ruled = a.autonomyRuled(a.questions[i].question.Ask)
+			}
+			a.touch()
+			return nil
+		}
+	})
+}
+
+// autonomyChanged reads the rows again, so the next question raised wears what
+// was just written rather than what was there before it.
+func (a *app) autonomyChanged() tea.Cmd { return a.readAutonomy() }

internal/tui3/settings.go

@@ -906,11 +906,24 @@ type sheet struct {
 	sessionModel string
 
 	// autonomy is what this project does with a question of each shape while
-	// nobody is there, read when the page opens (settingsautonomy.go). It is nil
-	// for a conversation with no project to keep rules in, and the section then
-	// draws nothing at all.
+	// nobody is there (settingsautonomy.go). It is the conversation's own
+	// reading, taken on the way up and refreshed after every write, and it is
+	// nil until that first answer lands.
 	autonomy map[session.AskKind]session.Policy
 
+	// autonomyDoor says this conversation HAS somewhere to keep question rules.
+	//
+	// IT IS A DIFFERENT QUESTION FROM `autonomy == nil` AND THE TWO WERE ONE
+	// FIELD ONCE, which is the bug this exists to prevent: nil meant both "no
+	// project to keep rules in" and "the rules have not come back yet", so a page
+	// opened in the instant before the first answer landed drew no rows — and a
+	// page that drew them anyway would have had to invent values. Whether the
+	// door exists is a type assertion on the agent, which is local and free; what
+	// it SAYS is a call to another process. So the rows are decided by this and
+	// the words by the map above, and a row whose value has not arrived draws an
+	// empty right-hand column rather than a guess.
+	autonomyDoor bool
+
 	// items is the current list — one tab's rows, or every tab's matches under
 	// their headings while a search is on. cursor indexes it and skips headings.
 	items  []sheetItem
@@ -1165,12 +1178,15 @@ func (a *app) raiseSettings() {
 	a.sheet = sheet{
 		registry:   a.registry(),
 		profileDir: a.profileDir,
-		// AND WHAT THIS PROJECT DOES WITH A QUESTION WHILE NOBODY IS THERE, read
-		// once for the visit like every other live reading on this page: the rows
-		// are the engine's rather than the registry's (settingsautonomy.go), and
-		// a page that asked the engine per frame would be paying for an answer
-		// that changes only when somebody changes it.
-		autonomy:     a.autonomyReading(),
+		// AND WHAT THIS PROJECT DOES WITH A QUESTION WHILE NOBODY IS THERE. The
+		// rows are the engine's rather than the registry's (settingsautonomy.go),
+		// and a page that asked the engine per frame would be paying for an
+		// answer that changes only when somebody changes it — so this is the
+		// conversation-wide reading taken on the way up and refreshed after every
+		// write ([app.readAutonomy]), not a door asked here. Opening a page is on
+		// the update loop, where a surface may not wait on a network.
+		autonomy:     a.autonomyRules,
+		autonomyDoor: a.hasAutonomyDoor(),
 		conns:        a.conns,
 		modelRows:    a.modelConnectionRows,
 		sources:      a.sources,
@@ -1935,8 +1951,7 @@ func (a *app) activate() tea.Cmd {
 	}
 	s.msg = ""
 	if item.autonomy != nil {
-		a.autonomyRowNext(item.autonomy)
-		return nil
+		return a.autonomyRowNext(item.autonomy)
 	}
 	if item.role != nil {
 		// A ROLE IS A MODEL CHOICE, so it opens the picker the class rows open

internal/tui3/settingsautonomy.go

@@ -4,6 +4,8 @@ import (
 	"strings"
 	"time"
 
+	tea "charm.land/bubbletea/v2"
+
 	"github.com/Agent-Field/aforge-v2/internal/session"
 )
 
@@ -51,29 +53,6 @@ const (
 		"kept for this project · /autonomy <kind> ask · recommend <duration> · decide"
 )
 
-// autonomyReading is the rules this project keeps, or nil where they could not
-// be read at all. It is the ONE read this page does — the command's own door
-// ([autonomyAgent]) — taken when the page opens.
-//
-// NIL AND EMPTY ARE TWO DIFFERENT ANSWERS AND THE PAGE MUST NOT CONFUSE THEM.
-// An EMPTY map is a real reading: a project that has written no rule yet, whose
-// every kind is therefore on `ask me`, and the page is exactly where somebody
-// comes to write the first one — so it draws all the rows. NIL is not a reading:
-// there is no door, or the engine refused the call because it is an older aforge
-// than this surface (remote/wire.go's version paragraph). A nil coerced into an
-// empty map would put `ask me` on every row of a page nobody could read, and
-// what the row claims is WHAT HAPPENS WITHOUT A PERSON — an engine quietly on
-// `decide` drawn as one that asks is the worst sentence this page could say. So
-// nil travels through and [sheet.autonomyItems] draws no rows at all, which is
-// the emptiness law: rules that cannot be read are not drawn as rules that are.
-func (a *app) autonomyReading() map[session.AskKind]session.Policy {
-	agent, ok := a.agent.(autonomyAgent)
-	if !ok {
-		return nil
-	}
-	return agent.Autonomy()
-}
-
 // autonomyRow is one question kind as the settings page holds it, hung off
 // [sheetItem] exactly as a role or an account is: the cursor walk, the scroll,
 // the pointer and the hover need to know nothing about it.
@@ -95,13 +74,23 @@ type autonomyRow struct {
 // over a setting that is stored per project: rules that cannot be kept are not
 // drawn as rules that are.
 func (s *sheet) autonomyItems(query string) []sheetItem {
-	rules := s.autonomy
-	if rules == nil {
+	if !s.autonomyDoor {
 		return nil
 	}
 	items := make([]sheetItem, 0, len(autonomyKinds))
 	for _, kind := range autonomyKinds {
-		row := &autonomyRow{kind: kind, word: autonomyPersonWord(rules[kind])}
+		// A ROW WHOSE VALUE HAS NOT ARRIVED SAYS NOTHING IN ITS VALUE COLUMN.
+		// The rules are a call to another process and the rows are not, so the
+		// section is here from the first frame and fills in a moment later —
+		// which is the emptiness law rather than a gap: `ask me` printed over a
+		// project that turns out to be on `decide` is the one sentence this page
+		// must never say, and it is what a nil read coerced to an empty map says
+		// on every row.
+		word := ""
+		if s.autonomy != nil {
+			word = autonomyPersonWord(s.autonomy[kind])
+		}
+		row := &autonomyRow{kind: kind, word: word}
 		switch kind {
 		case session.AskConfirmation:
 			row.word, row.fixed = autonomyAskWord+" · "+autonomyAlwaysWord, true
@@ -166,15 +155,15 @@ func (s *sheet) autonomyRowLines(row *autonomyRow, selected, hovered bool, width
 // and over a clarification, in its own words, and a key that walked the value and
 // then watched it snap back would be this page arguing with the engine in front
 // of somebody.
-func (a *app) autonomyRowNext(row *autonomyRow) {
+func (a *app) autonomyRowNext(row *autonomyRow) tea.Cmd {
 	if row.fixed {
 		a.sheet.msg = autonomyFixedWord
-		return
+		return nil
 	}
 	agent, ok := a.agent.(autonomyAgent)
 	if !ok {
 		a.sheet.msg = autonomyNoProjectWord
-		return
+		return nil
 	}
 	// WHAT IT IS NOW COMES FROM THE PAGE'S OWN READING, not from a second ask.
 	//
@@ -197,22 +186,48 @@ func (a *app) autonomyRowNext(row *autonomyRow) {
 	default:
 		next.Kind, next.After = session.PolicyRecommendThenAuto, autonomyRowStep
 	}
-	if err := agent.SetAutonomy(row.kind, next); err != nil {
-		// The engine's refusal is the person's to read, whole.
-		a.sheet.msg = err.Error()
-		return
-	}
-	a.autonomyChanged()
-	// AND THE PAGE'S READING MOVES WITH THE WRITE RATHER THAN BEING FETCHED
-	// AGAIN. The engine took this exact rule — it said so by not refusing — so
-	// re-asking would be a second round trip to be told what this line already
-	// knows. A refusal returns above without touching it.
+	// THE ROW MOVES ON THE KEYSTROKE AND THE WRITE GOES OFF THE LOOP. This is a
+	// call over a connection — on the ordinary launch the surface talks to its
+	// own engine process — and a row that sat unchanged for a round trip is a row
+	// somebody presses twice (offloop.go's law, and the whole account of why).
+	// So what a person sees is decided here, immediately, and the rare road — the
+	// engine refusing — puts it back with the engine's own sentence.
+	was, had := a.sheet.autonomy[row.kind]
+	wasWord := row.word
 	if a.sheet.autonomy == nil {
 		a.sheet.autonomy = map[session.AskKind]session.Policy{}
 	}
 	a.sheet.autonomy[row.kind] = next
 	row.word = autonomyPersonWord(next)
 	a.sheet.msg = string(row.kind) + " · " + row.word + " · for this project"
+	return a.offLoop(func() func(bool) tea.Cmd {
+		err := agent.SetAutonomy(row.kind, next)
+		return func(here bool) tea.Cmd {
+			if !here || err == nil {
+				// AND THE PAGE'S READING MOVES WITH THE WRITE RATHER THAN BEING
+				// FETCHED AGAIN. The engine took this exact rule — it said so by
+				// not refusing — so re-asking would be a round trip to be told
+				// what this press already knows. The conversation-wide cache is
+				// a different reading and is refreshed, because a question raised
+				// after this must wear the rule that now exists.
+				if err == nil {
+					return a.autonomyChanged()
+				}
+				return nil
+			}
+			// The engine's refusal is the person's to read, whole — and the row
+			// goes back to what it was, because it never became what it said.
+			if had {
+				a.sheet.autonomy[row.kind] = was
+			} else {
+				delete(a.sheet.autonomy, row.kind)
+			}
+			row.word = wasWord
+			a.sheet.msg = err.Error()
+			a.touch()
+			return nil
+		}
+	})
 }
 
 // autonomyFixedWord is what a fixed row says when somebody presses it. It names
@@ -223,3 +238,12 @@ const autonomyFixedWord = "this shape always asks you · " + autonomyAlwaysWord
 // `recommend then go`. It is the sheet's own default rather than a number chosen
 // here, and `/autonomy <kind> recommend <duration>` is how a person names another.
 const autonomyRowStep = 30 * time.Second
+
+// hasAutonomyDoor reports whether this conversation has somewhere to keep
+// question rules. It is a type assertion on the agent and nothing else — local,
+// free, and safe to ask on the update loop — which is exactly why it is a
+// separate question from what the rules SAY ([sheet.autonomyDoor]).
+func (a *app) hasAutonomyDoor() bool {
+	_, ok := a.agent.(autonomyAgent)
+	return ok
+}