# Consumer contract
`K1RustProjection::open(projection_root, control_root, ordering, peering)` registers `k1-rust-libs`, resumes a fully canonical compact snapshot, or rebuilds through a sibling staging projection and atomic promotion. The UTF-8 snapshot is only `K1RUSTPROJECTION1`, a canonical cursor or `-`, and sorted `winner-txid|24-hex-authority|logical-name|canonical-semver` lines; each cursor and winner must remain in ordering, and each winner must exact-load from materialized source. Missing, malformed, noncanonical, unavailable, or disagreeing snapshot state rebuilds. Opens over 100 milliseconds emit a secret-free warning.
Callbacks accept only canonical Rust publication payloads. Malformed payloads are cursor-only successful no-ops; the first claim wins, equal claims are idempotent, different claims conflict, and exact already-materialized replay succeeds. Materialization rejects non-UTF-8 paths and symlinks or non-ordinary entries, checks authority/name directories component by component, stages files, and atomically renames. Filesystem or control failure faults availability; reorganization marks the projection unavailable. `load(id)` returns the exact package or `None`. `resolve(family, requirement)` returns the exact source for the highest published stable version in that authority-qualified family matching the Cargo semantic-version requirement, or `None`. Both reject unavailable state. `cursor()` returns the last callback transaction and also rejects unavailable state. `is_available()` reports availability.
`publish(package)` checks availability before calling `K1Peering` without holding the mutex. `PublishOutcome` exposes private results through const `status()`, `winning()`, and `submitted()` accessors; `PublishStatus` is `Published`, `Idempotent`, or `Conflict`. There are no retries or background tasks. Snapshot work is linear in coordinates, compatible resolution is linear in published coordinates, and materialization is linear in files and bytes.