# K1 access profile SQLite leaf
This leaf owns the concrete SQLite representation of named, optionally colored saved access profiles. Its consumer owns callback/KTO validation, replay, registration, logging, handle policy, and failure fencing.
`ProfileDatabase::open` returns the database and a validated `Snapshot`; `apply` supports the original creation, replacement, rename, and deletion actions plus colored creation and owner-authorized color changes. Existing `Create` and `CreateNamed` actions remain colorless. Equal replacement, rename, or color operations preserve the profile revision. Ownership-filtered queries never disclose another owner's profile, use read-only WAL connections, `clear` atomically removes all rows and resets the cursor, and `rebuild` removes the database and sidecars before one fresh open attempt.
The database is exactly `profiles.sqlite3` beneath the supplied root. It uses WAL, synchronous `FULL`, and a zero busy timeout. Its exact version 2 schema stores nullable canonical `ProfileColor` text, canonical non-null profile names, 12-byte IDs, owners, revisions, nullable cursors, and canonical `kcode-k1-access-profile-codec` bytes. Any version 1 or otherwise nonexact schema is `OpenError::Rebuildable`; this KTO-derived projection is cleared and replayed rather than migrated or assigned invented defaults.
Open validates integrity, exact DDL, metadata, field widths, names, colors, canonical profile encoding, and row/cursor consistency. Invalid stored colors and other malformed derived state are `OpenError::Rebuildable`, while ordinary SQLite and filesystem availability failures are fatal. Mutations are single `BEGIN IMMEDIATE` transactions with no retries.