SEND_CHOICES

Choices that authorize spend.

Lives with the enum so callers restate the set in one place only. A new variant is excluded until added here, which fails closed: an unlisted choice is treated as cancel rather than silently sending.

Membership is the required spelling rather than a property on the enum, because the value under test is ColdCacheChoice | None -- a programmatic pop dismisses with None, and None in SEND_CHOICES is safely False where an attribute access would raise.