- Shipped
- August 15, 2026 at 12:34 AM UTC
- Author
- Kamo
- Commit
- a3fa293
Bytes arrive through ConversionService (which owns ffmpeg and the scanner); everything afterwards is here, where the session and the scoping rules already live. All three shelves come back in one response for the same reason the profiles do — a member picking a tone is offered the platform's, their organization's and their own together. Managing and hearing are deliberately different permissions. A member must be able to HEAR the organization sound their administrator assigned to them without being able to rename or delete it, so mayHear is wider than assertMayManage. Deletes are soft and the object is left in place. Something may still be assigned to that sound — possibly in a layer this caller cannot see — and a hard delete would turn that assignment into a 404 at the moment the event fires. Resolution treats an unknown sound as "inherit", so a retired sound degrades to the layer beneath it rather than to silence. Audio is streamed, not presigned: a presigned URL is a bearer token for the object that outlives the request and cannot be withdrawn when someone leaves an organization. These are a few kilobytes. Cached immutably, because the bytes at an id never change — a re-upload is a new asset — and a cached buffer is what lets an assigned sound play the instant an event fires rather than after a round trip. 620 tests pass.