Summary Update.

RelayServer/Models/Server/ChannelPermissions.cs

@@ -2,10 +2,24 @@ using SurrealDb.Net.Models;
 
 namespace RelayServer.Models;
 
+/// <summary>
+/// Surreal record for the `channel_permissions` table. Per-(channel, role) override of a
+/// role's base permissions.
+///
+/// Allow and Deny are independent masks (NOT a tri-state). Deny wins over Allow when both
+/// have the same flag set. Bits not set in either fall through to the role's base permissions.
+/// </summary>
 public class ChannelPermissions : Record
 {
+    /// <summary>"channels:xyz" — which channel this override applies in.</summary>
     public required string ChannelId { get; set; }
+
+    /// <summary>"roles:abc" — which role this override applies to.</summary>
     public required string RoleId { get; set; }
+
+    /// <summary>Permissions explicitly granted here (overrides "role doesn't have it" for this channel).</summary>
     public PermissionFlags Allow { get; set; }
+
+    /// <summary>Permissions explicitly denied here. Wins over Allow.</summary>
     public PermissionFlags Deny { get; set; }
 }