[omartelo]

Summary

The RPC had no contract a compiler could check. A client named a method by string and passed ...any, the backend matched the arguments by position through reflection, and the window's types were hand-written mirrors of the backend's. Two strings swapped in a call compiled, and a JSON tag renamed on one side broke the other at run time.

Every method is now declared once, in a new public package, api:

var ThemesSelect = define[SelectThemeOptions, None]("themes.Select")

• Backend: rpc.Handle(d, api.ThemesSelect, fn) only compiles when fn takes and returns those types. The routes live in internal/routes, one function per service. Reflection, Register and the denyInternal list are gone: a method nothing routes cannot be reached, so the methods kept out for Go callers stay out by construction (the package doc names them).
• Clients: lich, lich mcp and the window call callMethod(ctx, c, api.X, opts). It is the only way either client posts, so a call by name no longer exists to get wrong.
• One options object per call: the window's calls were positional; every request is now one struct, as the CLI's already were. On the wire the envelope is the same ([options] or []), so a lich of another release still talks to this backend, and a route reads an empty list as the zero options.
• Events too: every /events event is an api.Event[T] (api/events.go, payloads in api/eventpayloads.go). The backend emits with events.Send(emit, api.SessionTitleEvent, payload), which only compiles with that payload type, and the window reads with backend.Decode(ev, api.SessionTitleEvent), which refuses an event of another name. Names and payloads on the wire are unchanged.
• No more mirrors: native/backend aliases api's types for both the RPC and the events. The one deliberate exception is the footer's session-usage reader, which stays field by field on purpose: an incomplete report is not a report, and an unreadable cost reads as absent.
• Golden: api/testdata/contract.golden records every method's name, options and result, and every event's name and payload, with each JSON field. A type that encodes itself shows the struct its MarshalJSON writes (RevertResult: patch, indexPatch as base64), checked against what it really writes. A change to the contract shows up there in review (go test ./api -update), and TestEveryRequestIsOneObject keeps positional arguments out.
• CI: ci.yml gets an API contract step. A PR that moves the contract without the golden fails there by name, with the golden's diff in the log.
• native/lichclient is renamed to native/backend.

Test plan

• api: the golden, one struct per request, the envelope Args writes, a duplicate declaration refused.
• api: an event family names one event per session; a duplicate event refused; the wire shape of a type with its own MarshalJSON is what it writes.
• internal/events: Send names the event and carries its payload, None as no data.
• native/: every event the window takes is read through backend.Decode; its tests and fakes use api's payloads.
• API contract step: run locally against a golden with one field renamed (fails, prints the diff) and against the real one (passes).
• internal/rpc: options decoded by name, an empty list as zero options, None answered as null, anything but one object refused with 400, the service's error as 500, the request's context handed over, an unknown method as 404.
• internal/routes: every method api declares has a route, per service, and every xdgprofile provider has its profile methods declared.
• internal/cli/wire_test.go posts as a client of another release through the production routes.
• native/: the window's tests and fakes read the options objects.
• Rig on its own backend and display: the window loads the workspace, runs a shell and takes typed input, opens a project, lists and previews files, searches text, shows the review, lists pull requests with their overview and files, and opens Settings (providers, profiles and plan usage, appearance, sandbox, version control, updates). lich version, sessions, theme list, theme switch, open, worktrees and lich mcp (list_sessions, list_worktrees) answer; the backend log shows no refused call.
• Local gate: gofmt, go vet ./..., go test ./... on the backend and in native/; backend coverage 90.5%.