# Access profiles facade
This library is the synchronous KTO and Peering facade for saved authorization profiles and built-in, saved, or inline profile resolution. Its logical subsystem is exactly `k1-profile-subsystem`.
## Public API and resolution
`K1AccessProfiles` retains its `open`, `create`, `replace`, `delete`, `get_for_user`, `list_for_user`, and `resolve` signatures. All profile-types and `SavedProfile` reexports retain their dependency identities, codecs, constructors, accessors, traits, normalization, and value semantics.
`BuiltIn` delegates to profile-types built-in resolution. `Inline` resolves its template with source `Inline` and no saved revision. `Saved(id)` reads only rows owned by `principal.user`; absence or an ownership mismatch is exactly `profile is unavailable`. A saved result resolves a snapshot with source `Saved(id)` and its current revision. Resolution never creates an Access operation.
## Mutation and reconciliation
Profile-wire 0.1.0 exclusively owns the version-1 mutation schema, encoding, parsing, byte layout, and parse errors. The facade maps its typed `ProfileMutation` losslessly to the store's `ProfileAction`; it has no private codec or alternate wire identity.
Each mutation obtains one fresh 16-byte operation ID from the OS CSPRNG, reserves correlation before encoding, and calls Peering exactly once. There are no retries except regeneration on an in-process operation-ID collision. The expected action, callback transaction ID, and store outcome are reconciled. A matching synchronous callback is authoritative even if Peering returns an error. Peering success without a callback faults the facade. Applied and unchanged outcomes return their revision; rejected outcomes return their exact message.
## Persistence, recovery, and concurrency
`open` opens the profile store with the supplied ordering instance, obtains its durable cursor, and registers `k1-profile-subsystem` after that cursor. Replay and live callbacks parse once and apply once. Reorganization invalidates the facade, clears pending correlations, then clears the derived store. Callback parsing failure, callback contradiction, store failure, and query failure fault the facade; reopening is required.
A facade mutex protects only its fault marker and pending map and is never held across randomness, encoding, Peering, callbacks, store work, queries, or waiting. The facade adds no queue, cap, timeout, polling, worker, background task, or generic framework. It performs no HTTP, authentication, Access operation, group mutation, authority decision, deployment, migration, or propagation policy.