App-wide layer isolation: ingest → decide → render as one-directional, grep-able folders #493

Problem

The renderer already has three real architectural layers — ingest (channels → clean object), decide (clean object → ordered rows), render (rows → JSX) — but they are not isolated. They're smeared across directories and reach into each other's internals, so the codebase reads as "everything mixed into everything," which is the exact thing that makes it un-maintainable as it grows.

Goal: each layer becomes one grep-able folder with a one-directional dependency (ingest → decide → render), so a service can be understood, changed, or replaced without touching the others.

The layers today (evidence)

INGEST — the normalization layer. The single translator from the raw, per-provider, multi-channel event firehose into one provider-neutral per-session object (SessionRuntime). It does six jobs:

Its output is SessionRuntime, and its discipline is already sound: "one session ⇒ one reducer; every surface selects from runtime.*, never opens its own transport." The isolation exists conceptually — it just isn't isolated physically.

DECIDE — the ledger. src/renderer/src/rendering/ (adapter → observations → model → view). Mostly its own dir, produces neutral RenderRow[].

RENDER — the feed. src/renderer/src/features/feed/ (Feed + rows → JSX). Consumes the ledger.

What's actually wrong (the isolation violations)

1. Ingest has no home. Stages 3–6 live in workspace/ next to the UI (tile-tree/, dispatch/, ~40 UI files). There is no ingest/ folder.
2. The clean object is fat. SessionRuntime (workspaceState.ts:285) conflates render-input (entries, semantic, ghosts, streamPhase, conditions, screen, totalEntries) with per-pane UI state (draftInput, draftImages, paneToast, unreadSince, picker, promptSuggestion, pendingRewindUndo). The ledger only wants the first half — and collectLedgerInput's RuntimeLedgerSlices already picks exactly that, but as an ad-hoc pick, not a declared contract.
3. DECIDE reaches both ways. rendering/ imports ingest internals (workspace/semantic/foldEvent, workspace/ghosts, workspace/semantic/streamPhaseMachine) and render internals (features/feed/model/renderModel ×4, features/feed/ui/semantic/renderUnits, features/feed/lib/agentSpawnTools). A clean decide layer imports one input contract and one output contract, nothing else.
4. The output seam is inverted. FeedRenderItem (the render contract) lives in features/feed/ but the ledger's bridge (rendering/view/ledgerFeedItems.ts) imports it — so rendering/ → features/feed, the wrong direction.

Proposed structural moves (each a separate, behavior-preserving PR)

PR-1 — extract the ingest layer. New src/renderer/src/session-runtime/ holding stages 3–6 (foldEvent, streamPhaseMachine, helpers, summarize, ghosts, mergedEntries, the runtime-mutating ingress action) + the SessionRuntime type (split out of workspaceState.ts; WorkspaceState/tile/layout stays in workspace/). Stages 1–2 stay under providers/+shared/ (provider/boundary-owned) but are documented as ingest's front-end. Path aliases mean few import fixes (like the testing/ colocation).

PR-2 — declare the input contract. Split the output type: RuntimeRenderInput (the 7 render fields) vs PaneUiState (draft/toast/unread/picker/…). Make RuntimeRenderInput the type the ledger consumes, and cut the rendering/ → foldEvent/ghosts/streamPhaseMachine back-edges. Move groupSemanticActivity (currently in features/feed/renderUnits, imported by the bridge since #492) into rendering/view/ — it's a decide-layer view concern.

PR-3 — flip the output seam. Move the RenderRow → FeedRenderItem bridge + the FeedRenderItem type into features/feed/, so rendering/ emits only neutral RenderRow[] and never imports features/feed. Dependency becomes strictly feed → rendering.

Acceptance

• Three folders: session-runtime/ (ingest), rendering/ (decide), features/feed/ (render).
• Dependency direction is one-way — rendering/ imports neither features/feed nor workspace/ internals; session-runtime/ imports no UI. (Verified by a one-off grep, not a CI lock.)
• The ledger consumes exactly RuntimeRenderInput and emits exactly RenderRow[].
• No behavior change — pure moves + contract typing; full gates + corpus green.

Related: the headless-package channel triplication (Semantic*/Screen*/Committed* ×3) is the SEPARATE provider-plug-and-play / neutral-hub refactor (#394) and is out of scope here. The rendering rewrite (#442/#483/#492) delivered the DECIDE layer; this issue isolates its neighbors.