Freeze one disputed control transaction
Record node identity, installed release, loaded module, manager user, source address, exact action, ActionID, conference, channel or RecordFile, raw response, related events, pre-change and post-change snapshots, timestamps, operator intent and observed symptom. Redact credentials and participant data.
Classify the earliest gap as unavailable action, denied action, wrong node, inactive room, wrong conference, unsafe channel prefix, unintended bulk target, accepted response without the expected event, later state reversal, recording-path problem or downstream caller experience.
Confirm action availability and permission first
Run the manager action inventory under the same account and session. ListCommands returns the action names and synopses available to that user; a missing control can therefore be separated from empty conference state. Confirm app_confbridge and the active room on the same node.
Preserve unknown-action and permission-denied responses. Do not grant broad manager rights or retry destructive controls until the exact module, action and authorization boundary is understood.
Resolve conference and channel scope exactly
Compare the Conference value with a completed active-room snapshot. For mute or unmute, resolve the current full channel name; the documented prefix behavior can select the first matching channel when a partial name is sent. Treat all and participants as deliberate bulk scopes, not convenient wildcards.
For kick, distinguish one channel from the documented all and participants values. Preserve whether the target was admin or non-admin, because participants excludes admins.
Compare the response with later state evidence
A success response is transaction evidence, not a guarantee that the visible state will remain changed. Correlate authorized ConfBridge events and then take a new completed room or participant snapshot. A later moderator, menu action, reconnect, leave or rejoin can legitimately change state again.
Lock does not remove current users. Mute does not remove a participant. Kick does not prove hangup or final application result outside the conference. Continue only from the first boundary that disagrees.
Trace recording through event, path and file
For start recording, retain the optional RecordFile, profile fallback and any generated filename evidence. Distinguish an already-recording error from a successful start. For stop recording, preserve the response and stop event before checking the filesystem under separate authorization.
A start or stop event does not establish that the expected file exists, is closed, retained, readable, complete or contains the intended mix. Verify directory ownership, free space, filename policy, file close, duration and controlled playback as separate checks without inferring caller consent or legal compliance.
Retest the smallest safe control
Use a disposable authorized conference with named test participants. Capture a completed pre-change snapshot, issue one narrowly scoped action with a fresh ActionID, retain the response and events, then capture a completed post-change snapshot. Avoid all, participants and recording until their exact scope is required and approved.
Repair only the demonstrated node, module, permission, target, timing, event, parser, cache, filesystem or UI fault. No PBX, module, manager account, credential, session, conference, participant, channel, lock, mute, kick, recorder, file, packet, audio or live call was inspected or tested.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.