- Shipped
- September 13, 2026 at 5:25 PM UTC
- Author
- Kamo
- Commit
- ea6db4b
- Tracking: the composer wraps a campaign's web links in a signed redirect (<base>/c/<token>?u=&s=) and adds an open pixel (<base>/o/<token>), as each org chooses (Settings > Email > Deliverability; platform defaults bulk-email.tracking.*). The unsubscribe link, mailto/tel/anchor links and anything already ours are never wrapped, and a link whose signature is not ours goes nowhere. Each recipient's open and click counts once (Redis), shown on the campaign against delivered mail. - Complaints: POST /api/internal/complaints/mail reads feedback-loop reports (ARF) and abuse@ forwards from the mail server's complaints sidecar, finds the recipient by the token the original message carried, and suppresses the address as a spam complaint for that org, counted once. Every campaign message carries a Feedback-ID. - Outbox: due and retrying are counted up to 10,000 (dueCapped/retryingCapped); the host view's due likewise. - Opt Out: toChange passes personAsked to the ledger, which now enforces it for every member change; the local guard is gone.