Consent & contact preferences

Consent is a versioned log, never a flipped flag. A withdrawal cancels queued contact immediately; history is never erased.