- Shipped
- August 26, 2026 at 2:48 AM UTC
- Author
- Kamo
- Commit
- 4543f76
The level most people mean when they say "this customer's calls". The spine is already keyed on an owner, so the account endpoint is the same merged, component renders it with nothing but a different base. CommsSubjectResolver decides which owners a timeline may read, and it is the one place that answer is allowed to be wider than the subject asked about. Only ACCOUNT expands. A lead does not inherit a sibling lead's traffic: the two may be assigned to different people. A patient inherits nothing at all, whatever the account graph says — a chart showing a CRM lead's messages would be a disclosure, and that test exists to keep it that way. The rollup is capped at 25 owners and the response says when the cap bit. A rollup that silently drops owners is a timeline missing messages for no visible reason, which is worse than one that admits it is partial. Cross-org and missing accounts get the same 404 so the response cannot be used to probe which accounts exist, and the miss is audited too. resolveOrgId rather than a new synonym: the endpoint ratchet recognises that name, and it reads one method body without following calls, so a helper it cannot see reads as an unguarded endpoint.