# K1 chat-thread Rust code session 0.1.2
`RustCodeSession` is the one-consumer Session Actor owner for one conversation's Rust code authorization mirror, recovered task state, FIFO execution lane, retained completion, durable output correlation, and restart replacement.
## Public API
```rust
pub fn is_rust_code_tool(name: &str) -> bool;
pub enum PersistCompletion { Committed(Option<PreparedMailboxFlush>), Buffered }
impl RustCodeSession {
pub fn recover(
service: Arc<RustCodeKtoolService>,
boxes: &[ChatBox],
) -> Result<Self, String>;
pub fn accept_user(
&mut self,
durable: &mut DurableThread,
context: AccessContext,
profile_id: ProfileId,
policy: AccessPolicy,
contents: String,
) -> Result<(), TransitionError>;
pub fn clear_authorization(&mut self, durable: &mut DurableThread);
pub fn clear_authorization_mirror(&mut self);
pub fn enqueue(
&mut self,
durable: &DurableThread,
id: ToolCallId,
name: String,
arguments: String,
) -> Result<(), String>;
pub fn can_receive(&self) -> bool;
pub fn has_completion(&self) -> bool;
pub fn is_busy(&self) -> bool;
pub async fn receive(&mut self) -> Result<(), String>;
pub fn persist_completion(
&mut self,
durable: &mut DurableThread,
job: u64,
) -> Result<PersistCompletion, String>;
pub fn restart(
&mut self,
durable: &mut DurableThread,
service: Arc<RustCodeKtoolService>,
context: AccessContext,
profile_id: ProfileId,
policy: AccessPolicy,
) -> Result<(), String>;
pub fn abort(&mut self);
}
```
The exact recognized names are `RustCodeCreate`, `RustCodeDocs`, `RustCodeOpen`, `RustCodeOverwrite`, `RustCodeCheck`, and `RustCodePublish`. Recovery scans canonical history without service calls, restores source message IDs, and maps unknown future check markers to no restored check so publication checks freshly.
`accept_user` changes the mirror only after `DurableThread::accept_user` succeeds. The mirror retains the exact `AccessContext` and `policy.authority()` supplied by the backend-selected profile; the authority is never taken from model arguments. `clear_authorization` clears the durable authorization and mirror together. `clear_authorization_mirror` clears only the session mirror after an exact durable transition has already cleared authorization. `enqueue` requires that mirror and exactly one matching canonical Tool Call v1 whose name and arguments are unchanged, then carries the mirrored context and authority unchanged into the RustCode lane.
`receive` retains one completion. The actor checks `has_completion` before `can_receive` or `is_busy`, and calls `persist_completion` only after any earlier prepared mailbox flush commits. Persistence accepts ordered canonical Tool Messages and one Tool Result v2 exactly once. `Buffered` retains accepted output until canonical boxes materialize; a later call correlates actual message box IDs and commits the lane without accepting the output again. `Committed` carries only a newly prepared flush, when present. Task output remains plain text and v2 metadata is empty. Partial persistence, malformed correlation, or lane-commit failure aborts the session and is not retryable.
`restart` recovers replacement state directly from `durable.boxes()` before calling the exact durable restart transition. Failure leaves the existing session and authorization mirror unchanged. Success installs the supplied context and `policy.authority()` together with the replacement, then aborts the old lane. An active recovered source whose authority differs from a later selected profile remains recoverable but is rejected by RustCode Tasks when used. `abort` performs lane teardown only and does not claim that durable authorization was cleared.
The session performs no provider launch, WebSearch routing, actor selection, retries, migration, HTTP, deployment, or telemetry. Full FIFO, persistence, active-flush buffering, restart, authority switching, and teardown integration proof belongs to the downstream Session Actor.