handoff

Voice and text are two channels over one graph, not two kinds of record.

The settings a conversation actually ran with, copied in as values.

An AI profile is not frozen into an agent's published version, so the version alone cannot say how a conversation sounded. The profile id is kept for provenance; the provider, model and voice are kept because they are the answer. used_standby records that a standby served the conversation instead of some component's first choice — the same fields still describe what was actually served — and standby_component names which one switched.

Source attribution, as recorded. kind says which of the rest is meaningful; the others stay unset.

connection_id and address are CHANNEL's pair, and they are two fields for the reason the thread itself is identified by two: "Threads are per connection; contacts are per organization" (channels.md). The connection says which of the organization's accounts the message arrived on — "reply on this thread has to know which account it leaves by" — and the address says who wrote, in whatever shape the provider's own namespace has: a phone number in E.164 on WhatsApp, an opaque user id elsewhere, "decided when each is built".

address is personal data and connection_id is not. The address is the contact — "on a channel, the contact is their address" — so the retention purge clears it exactly as it clears number, which is the same datum arriving by a different road; the connection names one of the organization's own accounts and survives, like trunk_id beside it.

provider is CHANNEL's third, and it is stored as a value rather than read off the connection. interactions.md: "a conversation that arrived on a channel names the provider it arrived on, beside the contact's address", because an address alone does not say whether the person was reached on WhatsApp, by mail or somewhere else. It is written by the channel at open, from the provider it is already speaking to, for the reason the run settings beside it are values too: a connection is what it is now, and this answers what the conversation arrived on then. It also keeps connection_id the opaque reference it is — nothing here dereferences a connection to render a row. Not personal data: it names a kind of account of the organization's own and nobody outside it, so it survives the purge exactly as connection_id does.