# Saved access profile store
This library owns policy and orchestration for saved authorization profiles in the logical KTO subsystem `k1-profile-subsystem`. `ProfileName`, `ProfileColor`, `SavedProfile`, `ProfileAction`, and `ApplyOutcome` are the exact identities exported by `kcode-k1-access-profile-sqlite` 0.3.0. Profile values and identities are direct reexports of `kcode-k1-access-profile-types` 0.4.0.
## Public API
`ProfileStore::open`, `apply`, `get_for_user`, `list_for_user`, and `clear` retain their established signatures. `AuthorizationProfile`, `ProfileId`, `ProfileRevision`, `TxId`, and `UserId` retain their public crate paths. `ProfileName` and `ProfileColor` are available directly from this crate.
The original `Create`, `CreateNamed`, `Replace`, `Rename`, and `Delete` actions retain their exact field shapes and behavior. `CreateNamedColored` creates a named profile with an optional supported color, while `SetColor` owner-authorizedly replaces or clears only the color. Old creation actions remain colorless. Create actions use the callback transaction ID as both profile ID and initial revision. Duplicate creation is rejected as `profile already exists`.
Replace, Rename, SetColor, and Delete disclose an unknown or differently owned profile only as `profile is unavailable`. Equal replacement, rename, or color operations are unchanged and preserve the existing revision. Every returned apply outcome advances the durable callback cursor.
The owner validates replay cursors and callback transactions as canonical transactions assigned to `k1-profile-subsystem`. Invalid replay state is recoverable by clearing and rebuilding; KTO query failures and ordinary filesystem or SQLite failures are fatal. Persistence contradictions disable a handle until reopen. Apply and Clear share one lane; reads are coherent owner-filtered database snapshots.
A complete open over 100 ms emits exactly:
```text
level=warn module=kcode-k1-access-profile-store operation=open elapsed_us=<integer> outcome=<ready|error>
```
The SQLite leaf owns `profiles.sqlite3`, exact schema version 2, nullable canonical color tokens, WAL/FULL durability, row operations, and rebuild mechanics. A version-1 or otherwise nonexact derived database is rebuilt and replayed from KTO rather than migrated or assigned an invented color. Detailed schema and corruption recovery coverage belongs to `kcode-k1-access-profiles-recovery-testkit`.
Open and validation are linear in the complete retained profile snapshot plus KTO lookups. Apply uses one synchronous SQLite transaction and one callback-transaction validation. Owner-filtered reads are linear in the returned rows, with indexed owner lookup. This crate adds no retry, timeout, polling, background work, HTTP, authentication, Access creation, migration, or disclosure policy.