Autonomy app on modal shell

- wait-pr (visit 1): pass, then pr-green: held after 29 checks
- pr-green (visit 1): pass, then signoff: exit 0
- signoff (visit 1): pass, then rebase: approved by rule autonomous
- rebase (visit 1): pass, then wait-rebased: exit 0
- wait-rebased (visit 1): pass, then rebased-green: held after 23 checks
- rebased-green (visit 1): pass, then land: exit 0
- land (visit 1): pass, then wait-landed: exit 0
- wait-landed (visit 1): pass, then landed-green: held after 42 checks
- landed-green (visit 1): pass, then rebase-merge: exit 0
- rebase-merge (visit 1): pass, then wait-rebased-merge: exit 0
- wait-rebased-merge (visit 1): pass, then rebased-merge-green: held after 1 checks
- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then end: exit 0

## Leaves

- autonomy-app-toggles (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 593a965d-2302-4600-893f-01a1aaa0a03e: pass (said done)
  - attempt 1 verifier, session 460f36a0-cbf3-45ce-bfd8-01a1aaa5fc81: pass (Evidence written by the verifier)
- autonomy-app-toggles (step review/review): open
  - attempt 2 fixer in cycle 2, session e3ceab68-ffba-4ab6-ab6a-01a1aab4660d: pass (said done)
  - attempt 2 verifier in cycle 2, session 3e0de970-1afa-4058-bf8e-01a1aab6ca19: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 2ed48567-a8dc-44e1-9d82-01a1aaab1760 pass (said done)
  - round 1 (cycle 1): no findings
- quality (step review/review): passed after 2 cycles
  - cycle 1: failed, check session d7c0d92c-b75d-4718-b005-01a1aaab9766 pass (said done), critic session 3d2f6706-c7e6-42c4-9bbb-01a1aab22faf pass (said done)
  - cycle 2: passed, check session 8559fec0-cb17-45b1-8b82-01a1aaba10ae pass (said done)
  - round 1 (cycle 1): 4 findings, 1 confirmed
    - f1 major at internal/tui/autonomyapp/autonomyapp.go:93 on autonomy-app-toggles: When daemon.settings fails (or its JSON does not parse), NewModel keeps the error only for Result and builds the form from defaultValues(), so the interactive app shows all four toggles as 'owner' as if those were the real settings, with no error anywhere: Render never shows m.err and cmd/rhiza/tui.go:146-157 ignores am.err on the interactive path. The old app printed 'rhiza: <err>' above the list. The owner is shown made-up values and may submit against them; the load error should be shown (e.g. the form subtitle, or an InfoPanel/close with the error) and covered by a test with a failing fake runner. — confirmed: autonomyapp.go:91-106 builds the form from defaultValues() when daemon.settings or its JSON fails, keeping the error only in m.err; Render (line 149) shows only the form and cmd/rhiza/tui.go's interactive autonomy branch never calls am.Result(), so the owner sees all toggles as 'owner' with no error. Worse, m.initial is those defaults, so submit diffs against made-up values. The old app printed 'rhiza: <err>' (removed lines), so this is a regression.
    - f2 nit at cmd/rhiza/tui.go:151: sh.Run() already returns sh.Result(), so the second sh.Result() check is dead code, and a set error from the app comes back through Run wrapped as 'tui app: set ...' as though the program failed. Return the app's error unwrapped from one call.
    - f3 nit at internal/tui/autonomyapp/autonomyapp.go:46: The launcher's Component builds a Model with a nil Runner. It is only used for sizing today, but anything that ever drives that component to submit would panic on m.run; a comment saying it is for sizing only, or a no-op runner, would make that safe.
    - f4 nit at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:1: The header still says the app 'lists the daemon settings'; the app is now the four-toggle form and only --once prints the settings.
  - round 2 (cycle 2): 2 findings, 0 confirmed
    - f1 nit at cmd/rhiza/tui.go:154 on autonomy-app-toggles: sh.Run() already returns sh.Result(), so the second sh.Result() check is dead code, and the app's own error (a set failure, or the settings-not-loaded error) comes back through Run wrapped as 'tui app: ...' as though the program failed.
    - f2 nit at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:1 on autonomy-app-toggles: The header still says the app 'lists the daemon settings'; it is now the four-toggle form and only --once prints the settings.
- qa (step review/review): passed after 1 cycle
  - cycle 1: passed, check session fb70f168-eec2-41c0-b63a-01a1aaac1a02 pass (said done)
  - round 1 (cycle 1): no findings
- scope (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 0be8a220-bf7a-4449-b51b-01a1aaac5be0 pass (said done), critic session 6d64023b-fb27-42b9-b9a5-01a1aab2a2b9 pass (said done)
  - cycle 2: passed, check session 794f3f07-cb70-4418-87da-01a1aaba4360 pass (said done)
  - round 1 (cycle 1): 2 findings, 1 confirmed
    - f1 major at .rhiza/log/01M6MYPA335J1S3952RJAGZJN9: The intent ends 'retiring the capabilities of the old autonomy app it replaces', but the change set's ops only create autonomy-app-toggles and its evidence. Capability autonomy-app (01M6CS2HRAWMCTPDHFXBHFCX1C) still says the app lists every daemon setting, toggles paused, edits maxRuns and starts/stops the daemon on d. daemon-start-stop (01M6FES4J3E8VXG2KW0Y9Z1C96) still says 'the autonomy app's d key calls them', and its acceptance requires that test. The new code deletes all of that, so the model now contradicts the code. Retire autonomy-app and narrow daemon-start-stop's statement and acceptance in this change set. — confirmed: The intent says the change set retires the capabilities of the old autonomy app, but its only ops create autonomy-app-toggles plus evidence. The diff removes the d key's daemon.start/daemon.stop calls and the paused/maxRuns editing from internal/tui/autonomyapp. autonomy-app (01M6CS2H) still states and accepts all of that, and daemon-start-stop (01M6FES4) still says the autonomy app's d key calls them, with an acceptance test that no longer exists. The model contradicts the code, and fixing it is work the intent itself names.
    - f2 nit at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:1: The header comment still says the app 'lists the daemon settings'. The app is now a four-toggle form; only --once prints the settings.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 nit at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:1 on autonomy-app-toggles: The header comment still says the autonomy app 'lists the daemon settings'; it is now a four-toggle form and only --once prints the settings.
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 5fcfeb96-5670-4c3a-82d0-01a1aaac9d7b pass (said done), critic session cb530d0d-9373-4107-bf6a-01a1aab2f6e9 pass (said done)
  - cycle 2: passed, check session d17a50fa-f55c-4d16-a62a-01a1aaba7ace pass (said done)
  - round 1 (cycle 1): 5 findings, 2 confirmed
    - f1 major at .rhiza/rendered/capability/rhiza/orchestration/daemon/daemon-settings/autonomy-app.md:1 on autonomy-app-toggles: The change set's intent says it retires the capabilities of the old autonomy app it replaces, but capability autonomy-app (01M6CS2HRAWMCTPDHFXBHFCX1C) is still live: it claims the app lists every daemon and autonomy setting with value and source, toggles paused, edits numbers, and starts/stops the daemon on d. internal/tui/autonomyapp/autonomyapp.go now has only the four rhiza.autonomy.* Select fields; none of that remains. Retire autonomy-app in this change set (autonomy-app-toggles replaces it). — confirmed: Intent says the change set retires the old autonomy app's capabilities, yet autonomy-app (01M6CS2HR) is still live in the change set's view (rhiza show) and no write in the log retires it; internal/tui/autonomyapp/autonomyapp.go now carries only the four rhiza.autonomy.* toggles, so its claims (every setting, paused, maxRuns edit, d start/stop) are false.
    - f2 major at .rhiza/rendered/capability/rhiza/orchestration/daemon/daemon-start-stop.md:7: daemon-start-stop's statement ('the autonomy app's d key calls them') and acceptance ('a unit test on the autonomy app's fake runner shows d calling daemon start when stopped and daemon stop when running') describe behaviour this change removes: the new autonomyapp has no d key and no daemon.start/daemon.stop calls, and that unit test is deleted. Edit daemon-start-stop's statement and acceptance to drop the autonomy app's d key (the CLI commands remain). — confirmed: daemon-start-stop still says 'the autonomy app's d key calls them' and its acceptance cites an autonomy-app unit test for d; the rebuilt autonomyapp.go has no d key and no daemon.start/daemon.stop call, and the change set does not edit the capability.
    - f3 minor at .rhiza/rendered/capability/rhiza/orchestration/daemon/daemon-self-update.md:11: daemon-self-update says rhiza.daemon.selfUpdate is 'shown and edited in the autonomy app'; the rebuilt app shows only the four autonomy toggles, and the planned Daemon app covers only paused and maxRuns, so the setting is now edited only through rhiza daemon set.
    - f4 minor at .rhiza/rendered/decision/autonomy-app-controls.md:1: Decision autonomy-app-controls (list every setting, toggle paused, edit numbers, start/stop the daemon from key y) is overtaken by tui-five-apps for the autonomy app but is neither retired nor linked as superseded.
    - f5 nit at .rhiza/rendered/index.md on autonomy-app-toggles: autonomy-app-toggles is parented directly under the root capability rhiza, while the app it replaces sat under orchestration/daemon/daemon-settings; it would read better next to its settings.
  - round 2 (cycle 2): 3 findings, 0 confirmed
    - f1 minor at .rhiza/rendered/capability/rhiza/orchestration/daemon/daemon-self-update.md:11: daemon-self-update still says rhiza.daemon.selfUpdate is 'shown and edited in the autonomy app'; the rebuilt app (internal/tui/autonomyapp/autonomyapp.go Toggles) holds only the four rhiza.autonomy.* toggles, so the setting is now changed only through rhiza daemon set.
    - f2 minor at .rhiza/rendered/decision/autonomy-app-controls.md:1: Decision autonomy-app-controls (list every setting, toggle paused, edit numbers, start/stop the daemon from key y) still decides the now-retired autonomy-app and is not retired or superseded by tui-five-apps, so it describes an app that no longer exists.
    - f3 nit at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:1: Header comment still says the autonomy app 'lists the daemon settings'; it is now the four-toggle form and only --once prints the settings.

## Change-set fixes

- cycle 2 (step review/review): fixer session 7b5f7cf5-20a0-4e5c-a9be-01a1aab6fd67: pass, commit 9f3df106d2d5 (said done)

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session 593a965d-2302-4600-893f-01a1aaa0a03e: tokens input 28, output 9737, cache creation 59569, cache read 947833; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 460f36a0-cbf3-45ce-bfd8-01a1aaa5fc81: tokens input 18, output 3110, cache creation 33165, cache read 478860; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2ed48567-a8dc-44e1-9d82-01a1aaab1760: tokens input 14, output 1842, cache creation 41528, cache read 407452; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session d7c0d92c-b75d-4718-b005-01a1aaab9766: tokens input 16, output 4001, cache creation 53669, cache read 486453; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fb70f168-eec2-41c0-b63a-01a1aaac1a02: tokens input 28, output 6106, cache creation 47571, cache read 910657; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 0be8a220-bf7a-4449-b51b-01a1aaac5be0: tokens input 14, output 2695, cache creation 46720, cache read 407500; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 5fcfeb96-5670-4c3a-82d0-01a1aaac9d7b: tokens input 24, output 4964, cache creation 41866, cache read 701831; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 3d2f6706-c7e6-42c4-9bbb-01a1aab22faf: tokens input 14, output 2126, cache creation 28627, cache read 341835; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 6d64023b-fb27-42b9-b9a5-01a1aab2a2b9: tokens input 14, output 2189, cache creation 31563, cache read 350943; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session cb530d0d-9373-4107-bf6a-01a1aab2f6e9: tokens input 16, output 2028, cache creation 27101, cache read 391409; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e3ceab68-ffba-4ab6-ab6a-01a1aab4660d: tokens input 24, output 4388, cache creation 32496, cache read 646267; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 3e0de970-1afa-4058-bf8e-01a1aab6ca19: tokens input 16, output 3000, cache creation 33348, cache read 423993; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 7b5f7cf5-20a0-4e5c-a9be-01a1aab6fd67: tokens input 20, output 2732, cache creation 31903, cache read 530747; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 8559fec0-cb17-45b1-8b82-01a1aaba10ae: tokens input 14, output 2868, cache creation 36482, cache read 378336; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 794f3f07-cb70-4418-87da-01a1aaba4360: tokens input 12, output 1968, cache creation 51890, cache read 348914; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session d17a50fa-f55c-4d16-a62a-01a1aaba7ace: tokens input 26, output 4107, cache creation 41395, cache read 783895; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 298, output 57861, cache creation 638893, cache read 8536925; helper tokens input 0, output 0, cache creation 0, cache read 0