// Package permissionauthoringv1 defines the transport-free Runtime contract
// for reading and atomically saving one permission-set authoring aggregate.
//
// Profile and PermissionSet are closed NexusCRM platform permission-metamodel
// target concepts, not application-specific transport DTOs. TargetProfile
// addresses a Profile baseline through its one owned PermissionSet;
// TargetPermissionSet addresses an ordinary additive PermissionSet. Runtime
// rejects a target whose canonical root belongs to the other domain.
//
// Object grant snapshots report stored access bits without enforcing new-write
// dependencies or enabling additional access. Historical values remain visible
// for repair. Save validates only changed final images; ModifyAll applies to
// existing records and does not require Create. Read, Edit, Delete and ViewAll
// remain its dependencies. Identity, binding, ordering and size checks apply
// to both stored snapshots and commands.
//
// RecordType authoring preserves three different facts: stored-row presence,
// the row's visible value, and the object-level Profile baseline mode. Snapshot
// therefore publishes only real stored RecordType rows for active Catalog
// identities, including explicit false rows. For a Profile, no rows on an
// object means every active RecordType is visible by default; once any row is
// present, an omitted sibling is not visible. An ordinary PermissionSet is
// additive, so absence means no grant and false is represented by deletion.
//
// A Profile command that touches one RecordType must carry the final visible
// value of every transaction-current active sibling on that resource object.
// L1 constructs this complete object group from Snapshot; Runtime validates it
// against the current Catalog before any write. Each change binds the identity
// to the resource object observed in that Snapshot, making reparenting visible
// at the transaction boundary. A higher Catalog revision is not itself a
// conflict: MinCatalogRevision remains only a serving floor. A touched object's
// changed active membership is a conflict, while an unknown or inactive
// requested identity is an invalid change.
//
// RecordTypeObjectGroupsCapabilityName is a separate deploy-time compatibility
// fence because SemanticMappingRevision protects compiled semantic/wire peers,
// not an independently deployed Runtime that still advertises the older v1
// behavior. A release selecting these semantics requires both capabilities and
// must not cross the cutover with an active nonterminal command accepted under
// the prior semantic revision.
//
// This capability defines no product route, envelope, or UI grammar; L1 maps
// those product surfaces onto the semantic target. Tenant, AppInstallation,
// principal identity, authorization, persistence, and transport remain trusted
// Runtime context.
package permissionauthoringv1