Final remediation audit · 12 July 2026 · private WREA work
What was fixed, what the fixes mean in normal language, and the remaining gates between reviewed code and live customer email.
Decision: GO for PR update and merge after CI; NO-GO for deploy or sending
The local branch is now suitable to push to PR #4464 and merge into pre_production once CI is green. It is eight commits ahead of the remote PR. This is not approval to deploy, run production migrations, enrol customers or send email.
pre_production. Keep deployment and first sending as separate approvals.The original 15 migrations passed the production-shaped MySQL rehearsal, including the 1.27 million-row entity_tags index. The new 16th migration adds four progress fields to the feature's small launch table, uses the same fail-fast metadata-lock guard, applied successfully in MySQL testing, and never alters the large msg_emails table.
The suite grew from 605 to 627 tests. It now exercises the real scheduled digest path, the real preference-form POST shape, Rescue consent, continuous discovery, cursor-based launch batches, transient retries, stale-worker ownership, explicit timing, and edit-versus-launch locking.
The system now distinguishes a normal scheduled digest from an explicitly marked mass-email queue item. The fact that agent digests use marketing IP 149.72.200.78 no longer changes their business purpose. The real scheduler-path test proves a normal digest is not blocked by marketing-only suppression, while a true mass email still is.
This affected one contact at a time, not every vendor in the CRM. On the property-owner Communication Preferences page, the browser always sends a hidden field identifying the unsubscribe form. “Ordinary save” meant that person pressed Save without selecting the visible unsubscribe from all marketing checkbox. The old controller mistook the hidden form marker for the person's choice. It now acts only on the visible all_tags selection. Tests prove hidden field alone means no suppression, no tag removal and no digest change; selecting the visible option performs the intended full unsubscribe.
“Property-derived evidence” is the seller's CRM property/enquiry record: which enquiry it was, when it was created and that the person asked WREA for agent help. The campaign required the internal scope label requested_agent_help, but the evidence object omitted that label, so a legitimate request failed a technical comparison. The evidence now carries the same narrow scope. This does not invent broader consent; it correctly labels the existing request. A real Studio preview test proves the seller can now qualify.
A separate discovery process runs every ten minutes for active Rescue campaigns only. It prioritises brand-new stalled enquiries, then uses spare capacity to reconsider temporary failures such as a previously missing email. It never automatically restarts stopped, completed, holdout, unsubscribed or permanently excluded journeys, and it pauses discovery while the initial launch is still preparing.
You explicitly asked not to fix this item. Final Review shows a current count, then background preparation recalculates eligibility. A person who newly qualifies during that period may be included; someone newly suppressed or no longer relevant is excluded. The CRM now says this honestly instead of promising a frozen audience. This is an accepted product choice, not a hidden defect or merge blocker.
Audience preparation now works in batches of 1,000 with a stored cursor, batch ownership token and cumulative counts. The job has a 600-second limit and three attempts, below production's 1,200-second queue retry window. A transient failure releases only its own claim and retries; only final retry exhaustion pauses the campaign. Replayed work reuses the existing enrolment and counts its persisted status, so it cannot duplicate people or inflate totals.
Yes, there is now a real Send now option. Send now means: after the two final confirmations, prepare the audience and make eligible messages due at the next safe opportunity. It still respects the 7:00 am to 9:00 pm local window, hourly speed limit and every suppression check; at 10:00 pm it waits until 7:00 am. Schedule requires a valid future local date and time, rechecked at Preview, Final Review and Launch. Missing, invalid or expired scheduling stops visibly and can never silently become immediate sending.
The CRM now locks the current campaign row before checking whether it is still editable and whether journeys already exist. A stale browser page cannot save an edit after another request has started launch or created enrolments. Two concurrency tests prove both cases are rejected.
| Existing path | Current audited result | Required position before deploy |
|---|---|---|
| Scheduled agent digests | PROTECTED Queue-backed operational digests remain operational even on the marketing IP. | Real scheduler-path regression proves both normal digest and explicit mass-email directions. |
| Vendor preference save | PROTECTED Hidden form marker alone cannot create suppression. | Only the person's visible unsubscribe-all choice triggers contact-wide marketing suppression. |
| Campaign Studio large audience | BOUNDED Preparation uses 1,000-person batches, stored progress and safe retries. | Keep the production queue timeout and retry settings in the verified order. |
| Transactional and unclassified workflow email | UNCHANGED These remain outside marketing suppression and frequency caps. | Inspect delayed jobs before the eventual worker restart as an operational precaution. |
| Separate legacy mass-email tooling | OUTSIDE THIS FEATURE Campaign Studio does not rewrite that older screen. | It is not a blocker for this merge; review separately before using it for a new large send. |
| Area | Result | Evidence and meaning |
|---|---|---|
| MySQL compatibility | PASS | The original 15 migrations applied to a disposable production-schema database on MySQL 8.0.45. Migration 16 affects only the small feature launch table, applied in MySQL testing and carries the same fail-fast metadata-lock guard. No production write occurred. |
| Large existing-table index | PASS | Rehearsed after copying all 1,265,977 current production entity_tags rows; completed successfully using the intended online shape. |
| Automated suite | PASS | 627 tests / 1,971 assertions passed after the final reliability correction. This includes every newly identified real path and the full existing application suite. |
| PHP and diff hygiene | PASS | Changed PHP files linted cleanly and git diff --check passed. |
| Deployment ordering | PASS | Latest Forge output shows maintenance mode, code update, forced migrations, cache rebuild, queue restart and application recovery in the right order. |
| Launch queue design | PASS | Preparation is no longer one unbounded 60-second job. Stored cursors, ownership tokens, 600-second job timeout, three attempts and final-failure handling were tested together. |
| SendGrid signed events | ACTIVE | Production configuration has verification enabled and recent signed webhook events are being recorded. |
| Independent review | PASS | Claude reviewed the full branch, then separately reviewed the final retry correction. Its final finding ledger is empty. |
| Release readiness | GO FOR MERGE AFTER CI | No code-level merge blocker remains. Deploy and sending remain separately gated. |
Every requested fix against the actual branch, including existing digest isolation, unsubscribe behavior, consent scope, MySQL migration guards, batching, retry ownership, timing and scheduler behavior. It found no critical or high issue and gave a final GO.
The full application suite and all seven remediation commits. Codex challenged Claude's first description of transient retries, found that retries would still stop too early, corrected the lifecycle, and added four more tests. Claude then reviewed that delta and confirmed the issue closed.
The earlier Claude addendum remains useful history, but the final full-branch review and post-retry delta review are the canonical positions.
pre_production only: merge proof is not deployment proof.trpersonal@gmail.com and thomasroberts@whichrealestateagent.com.au, verify headers and one-click unsubscribe end to end.| Finding | Implementation | Proof |
|---|---|---|
| 1. Scheduled digest purpose | ContactService now uses an explicit mass-email marker rather than the existence of a queue row. | PASS Real scheduler test proves operational digest and true mass-email behavior in both directions. Commit 8dbad08cf. |
| 2. Preference save | MarketingTagLinkController acts on the visible all_tags selection, not hidden form identity. | PASS HTTP tests cover ordinary Save and explicit full unsubscribe. Commit e6ae41a1e. |
| 3. Rescue consent scope | ConsentEvidence::fromProperty() records requested_agent_help; Campaign Studio uses the same constant. | PASS Integrated Studio Rescue preview qualifies a real property enquiry. Commit 8fa931b85. |
| 4. Continuous Rescue | RescueDiscoveryService plus email-nurture:discover-rescue, every ten minutes with overlap protection. | PASS New-first priority, idempotency, temporary recovery, permanent exclusions, launch race, utility exclusion and scheduler tests. Commit 094cbe9fa. |
| 5. Audience drift | No code change by owner decision. UI now states that the audience is calculated during preparation. | ACCEPTED Not treated as frozen; live suppressions and relevance still apply. |
| 6. Large launch | 1,000-row batches, persisted cursor/counts, UUID claim token, 600-second timeout, three attempts and final failure callback. | PASS Exact-multiple, replay counts, stale ownership, transient retry, final failure and completed-race tests. Commits c08db4ffb and f1713fc12. |
| 7. Timing | Explicit send_mode=now|schedule; shared validator; invalid schedule throws instead of falling back. | PASS Immediate daytime, next-morning window, expired launch, legacy draft and strict save tests. Commit 9e515b09f. |
| 8. Edit/launch race | Status and enrolment checks happen after lockForUpdate(). | PASS Stale status and stale enrolment edit tests. Commit c46cde7b8. |
Approve pushing the eight remediation commits to PR #4464. If CI remains green and Felix finds no new blocker, approve merge to pre_production. Do not combine that decision with deployment or customer sending; those retain the operational gates above.