# Public API
`ToolCallId` is a 12-byte session identity plus monotonic `u64`, with `new`, `session`, and `sequence`; `BoxId` and `ChatBox` expose minimal constructors/accessors for persistence codecs.
`BoxContent` has six immutable kinds: System, User, Kennedy, Attachment, KtoolCall, and KtoolReturn; Kennedy boxes are nonempty completed output stages.
`start_round` enters provider mode without appending a box. `append_stage` atomically appends optional nonempty Kennedy text followed by caller-identified Calls in provider order and returns immediately launchable `DispatchCall`s; multiple stages may precede `done`.
Provider-mode system, user, attachment, and Return arrivals queue in memory. `done` appends optional final Kennedy text, exits provider mode, and drains arrivals FIFO; idle arrivals append immediately and unresolved Calls remain returnable across rounds.
`recover` validates contiguous BoxIDs from 1, nonempty Kennedy text, unique ToolCallIds, and each Return’s unique earlier originating Call; recovered state is idle and future BoxIDs continue monotonically.
Unknown or duplicate Returns, duplicate Calls, invalid phases, and ID overflow reject transactionally.