[turinglambdaai]

Outcome

Extract the AI session/history/provider-worker lifecycle from the RVT1 assembly module into a product-owned service while preserving every public RPC, State, Event, row shape, and free BYOK/plugin behavior.

Closes #89.

Boundary and coordination

• Starting source SHA: 8fdcc8ca4ecda80573f605aa52fc9c7680b4ad9e
• Refreshed integration base: e48e8ea9d9c45106000d7560f93d582177e12bcb
• Central policy SHA read: 79a2b705a37a8c428c3d1a184d9f331d66624361 (PRODUCT-STANDARD.md, PORTFOLIO.md, and DOCUMENTATION-LANGUAGES.md)
• Rivet pin exercised: a92877c02b6453b1826bfd061d7bbe70647ce5fa
• Owned files: app/backend.rkt, app/core/ai-session.rkt, tests/ai-session-test.rkt
• Coordinated around merged PRs chore: move the Rivet pin to a92877c (linux-formats release fix) #91 and fix(macos): author the DMG background at 1x so Finder shows it whole #92; neither overlapped these files.
• No schema/client/UI/commercial/authorization change. 2026-10-auth-1 and the existing free BYOK scope remain untouched.

What changed

• Add one explicit AI session service with start, busy rejection, cancel, reset, undo, and close lifecycle operations.
• Own the provider worker and all of its child threads with a per-run custodian.
• Linearize start/delta/terminal callbacks with cancel/close so no late stream update or terminal callback crosses a completed lifecycle boundary.
• Keep transcript/last-answer persistence local-only and atomic; provider keys are never persisted by the service.
• Reduce backend.rkt to settings/search-row composition plus an adapter to the existing AiStream State and ai-finished Event.
• Close the service when the RVT1 serve loop exits.

Evidence

• raco test tests/ — 133 tests passed on Windows after rebasing onto e48e8ea.
• raco test tests/ai-session-test.rkt tests/ai-test.rkt tests/backend-wire-test.rkt — 13 tests passed.
• Direct service tests cover success, streaming, exactly-one terminal result, provider failure, persisted history, key non-persistence, concurrent rejection, cancellation, reset, close, stale-delta suppression, and death of both the provider worker and a child thread.
• raco rivet schema check rivet-schema.json --json — compatible: true, breaking-changes: []; reported binding additions predate this change.
• raco rivet acceptance --json — contract and embedded-wire suites passed locally. Native build/package/UI were not run successfully because this machine has no Visual Studio C++ Build Tools / lib.exe; CI must supply the real packaged Windows/macOS/Linux evidence. This is recorded as unverified, not passed.

Rollback

Revert this single commit. No data format, wire schema, generated client, host, or release file changed.