The permissions a post or a category opens with on its blog page, in its sitemap entry and wherever else a reader is let in, and those a comment is reached with:

• a category — its own, else those of the nearest parent category that names some;
• a post — its own, else those of every category it is filed under, each as that category opens with. Holding one of any of them is enough. A post in no locked category is public;
• a comment — its post's.

What a record names itself always wins over what it would take from above. A tag is only assigned to a post, so it locks nothing but its own page and has no such calculation.

A category counts while it exists, whatever its status: setting a locked category to draft does not open the posts filed under it. A deleted one counts no more. The categories are read only for the records that name nothing themselves, one read per site for the whole batch.

A record that names nothing opens with none, and reads nothing, while no category of its site names any (for a comment, while no post or category does): collections_locked? and locks_apply?, calculations of the resources, are loaded with the record, for the site the read runs for.

calculate :effective_permissions, {:array, :string}, {EffectivePermissions, kind: :post}