Ok, you need to use saveOrUpdateCopy which will allow you to save an object rebuilt from the web-layer.
The problem with it not deleting children is that (I'm assuming), the parent-child relationship is unidirectional (child has no knowledge of the parent).  If this is the case, your mapping should look like the following:
Code:
<class name="apacs.profile.Profile" table="Profile">
    <id name="id">
        <generator class="uuid.hex"/>
    </id>
    <property name="email"/>
    <property name="address"/>
    <property name="faxNumber"/>
    <property name="firstName"/>
    <property name="lastName"/>
    <list name="permissions" lazy="false" cascade="all-delete-orphan">
        <key column="parentid"/>
        <index column="listindex" type="string"/>
        <one-to-many class="apacs.profile.ProfilePermission"/>
    </list>
</class>
The cascade must be set to all-delete-orphan if you wish the children to be "blasted".  I've got a test-case with your scenario in, and this works fine.[/code]