# K1 Access–Kmap testkit
## API and real-stack boundary
The crate exposes only `pub fn verify() -> Result<(), String>`. It opens a
temporary real stack containing Ordering, Peering, Groups, Profiles, Access,
raw Kmap, and the Access–Kmap facade, and retains every subsystem `Arc` for
each pass. All work is synchronous local temporary-directory I/O: there are
no mocks, providers, network requests, retries, sleeps, background tasks, or
hidden raw identifiers in fixture errors. Dependency failures keep operation
labels.
## Scenarios
Fixed identities create shared, hidden, and third-party nodes. The checks cover
filtered get and Full traversal, exact generic denial of hidden direct reads,
viewer update rejection, owner update-target preflight rejection, and a
successful owner title update. They also prove that denied viewer measurement
preserves weight, authorized owner measurement changes weight without removing
the edge, unauthorized creation targets are rejected, and malformed and
wrong-subsystem wrappers return exact `node unavailable`.
The complete stack is dropped and reopened on the same directories. The
second pass proves persistence of the title and measured weight, continued
single-visible-edge filtering, and continued direct denial of the hidden node.
The facade has no hook for injecting an Access failure after successful raw
Kmap creation. That possible inaccessible creation orphan is documented rather
than fault-injected.