# Audio classification projection cache
A rebuildable local cache for canonical KTO callbacks in the exact `audio-classification` subsystem. KTO is the sole authority; cache bytes are never imported as truth. Reopen delegates callback identity, transaction parsing, subsystem, and payload proof to `kcode-k1-audio-classification-callback-proof`.
## Public API
`CachedCallback` exposes `callback_txid: TxId`, `fragment_id: TxId`, and exact `payload: Vec<u8>`. `ProjectionCache` is opaque. `open(root, ordering)` returns the cache, globally ordered retained callbacks, and the optional callback cursor. `append(callback_txid, fragment_id, payload)`, `clear()`, and `ensure_healthy()` return `Result<_, String>`; `TxId` is re-exported.
## Recovery and durability
The root owns `audio-classification-fragments/`, `audio-classification-cursor.json`, and deterministic `audio-classification-cursor.json.tmp`. The format helper owns canonical version-1 JSONL records, cursors, lowercase hexadecimal values, and fragment filenames. Each fragment has one append-only file and all files share one contiguous sequence.
Open removes legacy SQLite, WAL, and SHM files without reading them. It rejects stale temporary state, unknown or wrongly typed entries, noncanonical or incomplete records, cursor/tail disagreement, duplicates, gaps, and callbacks rejected by the delegated proof. Content corruption or KTO absence is synchronously reset to a synced empty cache and returns no cursor; filesystem and KTO query failures retain context and return errors.
Append is called only by canonical serialized KTO callback delivery. It durably syncs the addressed log, fragment directory, temporary cursor, renamed cursor, and root before publishing memory. Historical authority is checked on reopen; the cache intentionally retains no ordering reference. A persistence failure poisons the instance, with no retry, until reopen. Clear removes and recreates synced owned state and poisons on ambiguous failure.
Operations are synchronous. One mutable instance owns a root; there is no hostile-user or multi-instance locking. Independent roots do not coordinate. The package owns no semantic folding, provider, callback scheduling, migration/import, compaction, retention, networking, or encryption.