- Shipped
- September 12, 2026 at 8:56 PM UTC
- Author
- Kamo
- Commit
- bc86267
"All leads / accounts / applications" is a rule, not a list. It is stored with the campaign (the bulk-provider blob, campaignAudiences — no DDL), runs on the access of whoever set it or pressed Send, and is gathered by the dispatcher sweep only a few thousand recipients ahead of what the outbound hosts can take, so an audience of billions never exists as a list anywhere. - Reach: exactly what the member could read unmasked — the lead screens' rule (own leads; others' with View contact info of others; unassigned also needs View unassigned leads or a free-for-all product), accounts with View Accounts that agreed to marketing, applications with a pipeline. - Reading: small organizations through their own index by id; large ones by hash-bucket sweep of the table (yb_hash_code on the primary key, pinned with a hint) — the only range these hash-sharded tables can seek. - Counting: exact for small organizations, inferred for large ones from random hash buckets with a 95% range, refined live over NATS (email-audience) and cached per reach in Redis. - Gathered rows are ordinary recipients, opt-out checked, inserted ON CONFLICT DO NOTHING (never an address twice) and marked so unticking a source takes back only what it staged. A campaign is not finished while its audience is still being gathered; cancelling everything left stops it. - The send list is paged (/recipients/page, a seek on the address index) and changed in slices (/recipients/append, /recipients/remove); delete and duplicate no longer load it, and release times are assigned a page at a time. - Preview: /campaigns/audience/browse pages an audience with an id lookup and a time-boxed search. - PHI tenants get the lead grid's per-record access trail for every lead an audience reads.