When should a messaging specialist take over?¶

Hand over when the next action may consume, synchronise, expose or remotely alter important messages and the correct capture route is uncertain.

Escalate volatile platform behaviour¶

Single-view content, read receipts, linked devices, encryption, remote deletion and provider-only records require platform-specific judgement. An unlocked device nearing lock or an active remote user increases urgency.

Record service, account, participants, screen, message status, connections, battery and prior interaction.

Brief the evidential question¶

Explain whether the risk is disappearance, safeguarding, malware, attribution, synchronisation or provider preservation. A generic request to “download messages” does not define what must survive.

Record takeover, advice and resulting actions. If urgent harm cannot wait, preserve the visible state and use the least destructive effective control.