kcode-k1-chat-thread-rust-code-session 0.1.1

Own one K1 chat thread's Rust code integration session
Documentation
# K1 chat-thread Rust code session 0.1.1

`RustCodeSession` is the one-consumer Session Actor owner for one conversation's Rust code authorization mirror, recovered task state, FIFO execution lane, retained completion, durable output correlation, and restart replacement.

## Public API

```rust
pub fn is_rust_code_tool(name: &str) -> bool;
pub enum PersistCompletion { Committed(Option<PreparedMailboxFlush>), Buffered }

impl RustCodeSession {
    pub fn recover(
        service: Arc<RustCodeKtoolService>,
        boxes: &[ChatBox],
    ) -> Result<Self, String>;
    pub fn accept_user(
        &mut self,
        durable: &mut DurableThread,
        context: AccessContext,
        profile_id: ProfileId,
        policy: AccessPolicy,
        contents: String,
    ) -> Result<(), TransitionError>;
    pub fn clear_authorization(&mut self, durable: &mut DurableThread);
    pub fn clear_authorization_mirror(&mut self);
    pub fn enqueue(
        &mut self,
        durable: &DurableThread,
        id: ToolCallId,
        name: String,
        arguments: String,
    ) -> Result<(), String>;
    pub fn can_receive(&self) -> bool;
    pub fn has_completion(&self) -> bool;
    pub fn is_busy(&self) -> bool;
    pub async fn receive(&mut self) -> Result<(), String>;
    pub fn persist_completion(
        &mut self,
        durable: &mut DurableThread,
        job: u64,
    ) -> Result<PersistCompletion, String>;
    pub fn restart(
        &mut self,
        durable: &mut DurableThread,
        service: Arc<RustCodeKtoolService>,
        context: AccessContext,
        profile_id: ProfileId,
        policy: AccessPolicy,
    ) -> Result<(), String>;
    pub fn abort(&mut self);
}
```

The exact recognized names are `RustCodeCreate`, `RustCodeDocs`, `RustCodeOpen`, `RustCodeOverwrite`, `RustCodeCheck`, and `RustCodePublish`. Recovery scans canonical history without service calls, restores source message IDs, and maps unknown future check markers to no restored check so publication checks freshly.

`accept_user` changes the mirror only after `DurableThread::accept_user` succeeds. `clear_authorization` clears the durable authorization and mirror together. `clear_authorization_mirror` clears only the session mirror after an exact durable transition has already cleared authorization. `enqueue` requires that mirror and exactly one matching canonical Tool Call v1 whose name and arguments are unchanged.

`receive` retains one completion. The actor checks `has_completion` before `can_receive` or `is_busy`, and calls `persist_completion` only after any earlier prepared mailbox flush commits. Persistence accepts ordered canonical Tool Messages and one Tool Result v2 exactly once. `Buffered` retains accepted output until canonical boxes materialize; a later call correlates actual message box IDs and commits the lane without accepting the output again. `Committed` carries only a newly prepared flush, when present. Task output remains plain text and v2 metadata is empty. Partial persistence, malformed correlation, or lane-commit failure aborts the session and is not retryable.

`restart` recovers replacement state directly from `durable.boxes()` before calling the exact durable restart transition. Failure leaves the existing session and authorization mirror unchanged. Success installs the supplied context and replacement, then aborts the old lane. `abort` performs lane teardown only and does not claim that durable authorization was cleared.

The session performs no provider launch, WebSearch routing, actor selection, retries, migration, HTTP, deployment, or telemetry. Full FIFO, persistence, active-flush buffering, restart, and teardown integration proof belongs to the downstream Session Actor.