# K1 Kmap Loader
`kcode-k1-kmap-loader` provides one synchronous, stateless attention-budgeted graph traversal. It reexports `Node` and `NodeId`, and returns ordered `LoadedNode` values in `OpenResult`.
`open_node(node_id, budget, temperature, load_node, access_filter)` takes two callbacks. `load_node` reads a `NodeId` and returns `Result<Option<Node>, String>`; `None` for the root or an allowed target is an integrity error. `access_filter` decides whether a target is visible. The root is loaded directly, is assumed caller-authorized, and is never passed to the access callback. Target decisions are memoized and occur before target loading, frontier insertion, score normalization, or use of target-dependent connection data. The predicate necessarily observes candidate IDs, while denied target metadata and counts do not enter output or selection.
The root is always opened with title, navigation hint, and narrative. Each accessible root `Navigation` target is a free preview, including at budget zero. Every accessible root connection, whether `Navigation` or `Automated`, also enters the depth-one multiset frontier. An unseen target's first hit loads a preview for `PREVIEW_COST` 0.3 and leaves every occurrence in the frontier. A preview's next hit adds its narrative for `NARRATIVE_COST` 1.0, removes all of its occurrences, and adds its accessible outgoing connections at the next depth. Output follows first-visible order, contains each node once, and upgrades previews in place.
Opening also guarantees previews of accessible, previously unseen `Navigation` targets. Root guarantees are free; deeper guarantees cost 0.3 each. A preview can open only when its narrative and all new guarantees fit the remaining budget. Previously previewed guarantees are not charged again. Opened nodes are never re-added. Missing allowed targets fail the traversal.
Each occurrence has effective score `connection.weight.value * DEPTH_DECAY.powf(depth)`, with `DEPTH_DECAY` 0.7; mass is ignored and zero scores are unselectable. Positive temperature samples `effective_score^(1 / temperature)` using a numerically stable log softmax. Temperature zero samples uniformly among maximum effective-score occurrences. Randomness comes from the operating system through `getrandom`; there is no public seeded mode. Budget and temperature must be finite and nonnegative, and spending uses exact tenths with only a small floating-point comparison tolerance.
Callbacks and traversal run synchronously in the caller. Work consists of callback-driven graph exploration, repeated frontier scans, and allocation, with no finite wall-clock guarantee. This crate provides no persistence, authorization policy, authentication, network operation, retry, timeout, background work, or deployment behavior.