// Package recordmutationv1 defines the transport-independent Runtime v1
// record-mutation command contract.
//
// Identity, tenant scope, AppInstallation, permissions, and security state are
// trusted transport context. They are intentionally absent from Request.
// Runtime owns authorization, metadata resolution, validation, synchronous
// automation, the database transaction, and required durable handoff.
//
// One command is one idempotency identity. Reusing a CommandID with different
// semantic content fails closed. A caller that loses the Mutate response must
// reconcile with the same CommandID; it must never infer commit outcome from a
// canceled connection or deadline alone.
package recordmutationv1