去除internel 访问级别

docs/DESIGN.md

@@ -218,23 +218,34 @@ This duality is intentional rather than accidental.
 
 Do not pretend that inheriting `Property_Object<T>` turns public C++ members into encapsulated properties. If a subsystem requires managed synchronization, its coding rules must require the managed path.
 
-## 11. Capabilities are views, not copies of the object model
+## 11. Intrinsic capability comes before boundary projections
 
-The same property may have different visibility under different managed modes:
+Every property first has capabilities defined by its accessor itself:
 
 ```text
-internal
-external
-persistence
+intrinsic
+├── read
+└── write
 ```
 
-Core derives those capabilities from Attributes and the accessor’s actual read/write abilities.
+Normal managed application code uses those intrinsic capabilities directly through `read()`, `write()`, locks and traversal. `internal` is therefore not a separate capability mode.
+
+External and persistence behavior are boundary projections over that same property definition:
+
+```text
+Property
+├── intrinsic: read / write
+├── external: read / write projection
+└── persistence: load / store projection
+```
+
+Core combines projection Attributes with the accessor's actual abilities. A projection may narrow intrinsic capability, but it must never invent an ability the accessor does not provide.
 
 An external view should not become a second schema. A persistence view should not become a second schema. They are projections over one schema.
 
 ### Rule
 
-**One property definition, multiple capability projections.**
+**One property definition, intrinsic capabilities, explicit boundary projections.**
 
 ## 12. Validation is metadata plus an explicit operation
 
@@ -321,7 +332,8 @@ This makes consistency explicit rather than relying on a getter that casually re
 `Property_Object_Base` intentionally provides a type-erased runtime interface using:
 
 - string key;
-- `Managed_Access_Mode`;
+- intrinsic access when no mode is supplied;
+- `Managed_Access_Mode` only when selecting the `external` or `persistence` projection;
 - `std::type_info`;
 - explicit result codes.