- Shipped
- August 24, 2026 at 11:16 PM UTC
- Author
- Kamo
- Commit
- af137a5
PhiPlaybackAuthorizer gated PHI call playback on VIEW_CALL_LOGS. That was the whole check because ServiceType.VOIP mapped to the blocked VOIP_RECORDING module, so a PHI tenant could not have the phone system at all and this class never ran for one. The capability split made VOIP itself permitted — call handling is in-cluster — while VOIP_RECORDING stayed BLOCKED_PENDING_WORK for reasons that have not changed: playback performs no clearance check, transcripts ride in metadata, and there is no retention or deletion path. Left alone that would have been a straight weakening: a PHI tenant could enable the phone system and, with one right granted, play back everything. So PhiCapabilityGuard runs FIRST and its refusal is final. It takes no caller parameter, so for a PHI tenant no right lifts it — and neither does an active god session, which is the property that matters most. **************** is now **************** Three tests encoded the old contract and are rewritten rather than deleted, each recording why the expectation flipped. The voicemail refusal message no longer blames the missing right, which is usually not the reason any more. 152 tests green.