Sender-enabled source candidate — not a claim of deployment or delivery. Release
still requires reviewed migration, old-runtime containment/drain and normal gates.
Gift-recipient email/SMS is production-runtime-only; staging, development and
unknown deployment identity remain held even if provider credentials exist.
This does not turn staging into a sandbox for ordinary or giver notifications.

Gift sales and manual issue remain silent unless staff explicitly choose delivery.
Email and SMS are separate actions after the purchase. Each channel shows whether
it is waiting, accepted by its provider, delivered, unavailable or awaiting review.
Provider acceptance alone is not a delivery receipt.

A retry keeps the original recipient and delivery identity. Starting another
delivery requires an explicit new action after the preceding outcome is known.
When a provider may have accepted a message but its response was lost, the system
holds that attempt for verified reconciliation instead of sending another copy.
Push remains unavailable without an actual recipient/device binding.

Gift SMS opt-outs keep their correct venue even when general delivery logs omit
recipient details. Verified permanent email bounces and complaints also preserve
suppression after a lost provider response. Privacy deletion cannot be undone by
a later delivery callback or an ordinary gift-record update.

Previously purchased gifts, receipts and redemption remain accessible when new
gift issuance is disabled. Business delivery forms wait for valid venue/channel
availability, respect suppression, and discard stale account or venue results.
Consumer and Branded gift purchase/redemption retain their existing web-reader
boundaries; this change does not introduce native in-app gift checkout.

Stored delivery render/contact snapshots are access-restricted and handled by the
existing verified privacy workflow and a dedicated retention policy. Removing
those snapshots does not revoke a paid gift. No new messaging provider is added.

Local automated checks do not prove hosted deliverability or signed-device
behavior. Release review must first establish that the former recipient sender
has drained, then apply migration93 through normal staging-first gates.
# Integration additions — not yet released

Gift confirmation now distinguishes delivery pending from delivery needing
review while preserving the original purchase. It never asks the buyer to pay
again. A gift requiring several channels only becomes ready after all original
delivery requirements are met; verified callbacks can finish that work even if
the original page closed. Accepted by a provider is not proof of delivery.
Privacy exports include the minimal activation record under the customer's
actual gift/venue scope, without voucher content or provider replay credentials.

Business desk issuance now binds a supported app's original request permanently
to its gift. A lost response resumes that gift instead of issuing another one.
Older desk clients need the companion app update before new issuance; unresolved
older requests require review, not replacement. This ordered compatibility
cutover still needs release-owner acceptance. Existing gift value, redemption,
ordinary POS sales and receipts are not converted into new gift purchases.

Supported Business app versions keep interrupted gift details in encrypted
device storage and retain minimal local return intent. Accepted account erasure
clears both journals with local-only retry and prevents delayed writes restoring
them; ordinary sign-out preserves unresolved attempts. The public privacy page
explains those records, deletion markers and separate server retention duties.