The exportable record every call leaves behind, including the calls the platform refused to place.
It records which checks ran, which were waived, and on whose signature. A check that did not run is written as a named election carrying its attestation reference and its signer — never as an absent row, and never as a check that found nothing. That last distinction is the whole design: an empty result and a stage nobody performed look identical in most systems, and they are the difference between a record that helps you and a record that hurts you.
It carries the calling-policy values that bound the attempt together with the provenance of each one, so the file says who set the window and the caps and when they set them. A value the platform applied never reads as a value the platform vouched for.
It also holds the consent record relied on with its content hash, the quiet-hour and attempt-cap evaluations computed against the callee’s own local clock, the pinned agent version and the model identifiers, and, where the call connected, confirmation that the AI-disclosure opener actually played. The conversation itself is kept as turns and a transcript.
Every attempt produces exactly one of these, connected or not, and a call with no attempt behind it carries its snapshot on the call record instead — one home per call, never both. They live on an append-only store that no application role can update or delete: a correction is a new row referencing the corrected one, and they are excluded from tenant-initiated deletion because they are the platform’s own defense record rather than tenant content. Given a phone number and a date range — the exact shape of a demand letter — the platform assembles the bundle as an export job. A worked example is on the evidence page.