Grace before an incomplete recording is assembled as Partial.
The session conversation's per-session scope id, for the anonymous-guest half of the access decision.
Reads an already-loaded session's conversation ExternalID (the anonymous scope id) under contextUser;
null when there is no conversation or it cannot be read (logged). For callers that loaded the session
through another gate and only need the scope half of AuthorizeSessionAccess's subject.
Loads a session under the caller's identity and enforces ownership (UserID === contextUser.ID). It
deliberately does NOT reject Closed sessions: the final channel-state flush and the recording terminal
signal legitimately arrive after the session closed. A scoped-anonymous widget guest owns the session it
minted, so the same check covers it; loading as the caller also applies the entity's row-level security.
The server's system user, or null when it is not available. Deciding whether a recording is ready reads the shard entity, which callers (UI users, widget guests) deliberately cannot read; that read is the server's own scheduling decision, made after the caller was authorized, so it runs as this user. With none, nothing is scheduled and the session janitor assembles the recording.
The ledger for one request; contextUser is the caller (used for logging by the procs).
The authenticated caller, or null (answered 401).
Dependencies of CreateRealtimeRecordingRouter; injectable so the routes can be tested without a database.