# Public API
`ToolCallId` is a 12-byte session identity plus monotonic `u64`, with `new`, `session`, and `sequence`; `BoxId` and `ChatBox` expose minimal constructors/accessors for persistence codecs.
`BoxContent` has six immutable kinds: System, User, Kennedy, Attachment, KtoolCall, and KtoolReturn; Kennedy boxes are nonempty completed output stages.
`start_round` enters provider mode without appending a box. `append_stage` atomically appends optional nonempty Kennedy text followed by caller-identified Calls in provider order and returns immediately launchable `DispatchCall`s; multiple stages may precede `done`.
Provider-mode arrivals queue in memory. `flush_active_arrivals` atomically appends and returns one finite FIFO snapshot while keeping provider mode active; empty is a no-op. `done` appends optional final Kennedy text, exits provider mode, and drains only arrivals still queued.
Idle arrivals append immediately, unresolved Calls remain returnable across rounds, and unknown or duplicate Returns, duplicate Calls, invalid phases, and ID overflow reject transactionally.
`recover` validates contiguous BoxIDs from 1, nonempty Kennedy text, unique ToolCallIds, and each Return’s unique earlier originating Call; recovered state is idle and future BoxIDs continue monotonically.