# Recording Playback and Download

Marvel playback is a same-origin authorized proxy:

```text
authenticated Vtiger request
→ MarvelPBX and PBXManager record permission
→ recording.play capability
→ deterministic UCM resolution
→ exact REC catalog match
→ bounded RIFF/WAVE validation
→ private no-store audio response
```

The response uses `audio/x-wav`, `nosniff`, private/no-store caching and a server-generated filename. `mode=play` uses inline disposition. `mode=download` uses attachment disposition and independently requires `recording.download`. Browser requests cannot name a UCM directory or filename.

## UI behavior

- `AVAILABLE`: show an audio player and Play; show Download only with its capability.
- `PENDING`: show Pending.
- `NOT_FOUND`: show No recording available.
- `UNAVAILABLE`: show a temporary-unavailability message.
- `AMBIGUOUS`: do not guess; show a controlled administrator-review state.
- `REJECTED`: expose no media control.

List view treats a call reference as a pending candidate. Detail view performs the authoritative probe. This avoids the previous false availability signal where any non-empty `sourceuuid` produced a Play control even if UCM resolution or package configuration was unavailable.

## Operational validation

For a known safe PBXManager test record:

1. run the read-only sync/resolution command and confirm `resolved` without printing personal data;
2. verify the installed Marvel package version contains `RecordingProxy` and recording settings are enabled;
3. open the authorized detail view and confirm `AVAILABLE`;
4. play through the same-origin proxy and confirm a browser-compatible WAV response;
5. confirm the audit contains one safe `recording.play` grant;
6. confirm an otherwise identical user without `recording.download` receives no Download control and a denied direct download request;
7. confirm no UCM URL, physical path or credential appears in HTML, response headers or audit.

The current REC transport buffers into a bounded temporary stream before sending headers. Range requests are not advertised. Browser-display parity requires deployment of the updated package; Phase 9R1 does not modify a running production Vtiger installation automatically.