# K1 WebCode service
`K1WebCodeKtoolService` binds each family to a backend-selected `Authority`. Create persists a brand-new versionless document in the KTO-backed workspace subsystem. Docs and Open select an optional exact published SemVer or unpublished 12-byte ID; default Docs uses only the highest published version, while default Open uses the latest workspace unless its authored bytes are already public. Multiple workspaces remain addressable.
Overwrite validates the current session handle and authority, then always submits one workspace transaction. Published or already-published source branches to a new unpublished ID; dirty unpublished source retains its ID and advances its revision. Check always runs a fresh Podman check under the exact public SemVer or a deterministic private draft version. Publish requires an unused SemVer, runs a fresh exact-version check, preserves one exact source Object, reauthorizes disclosure, publishes through the immutable public projection, and returns a public-version handle.
Public SemVer Docs/Open need no workspace authorization; every unpublished read and every mutation, check, or publication revalidates current authority. `kcode-k1-web-code-source-selection` owns the concrete public/workspace read join, and `kcode-k1-web-code-service-errors` owns complete error classification. Session handles and per-user checking caches are disposable; workspace and public projections are authoritative. Operations perform no retry, migration, deployment, or background work.