Newsletter Service — Backlog: Issues, Gaps & Improvement Scope

Last Updated: 2026-10-05 Status: Active Purpose: Known bugs, missing features, and improvement opportunities found during codebase analysis. Mark items ✅ with date when fixed. Do not delete fixed items.

Scorecard

Audited 2026-06-28 against apps/newsletter-service source. Overall: 8.0 / 10

The email pipeline (queue, DLQ, drain check, Durable Object scheduling) and multi-tenant isolation are excellent. The main gaps are in subscriber experience polish (customisable confirmation email, metadata-based segments, GDPR erasure automation) and missing MCP tooling that every other major service now has.

Bugs (Broken or Subtly Wrong)

B1 — Segment preview endpoint not implemented MEDIUM

Where: apps/newsletter-service/src/routes/segments.route.ts

POST /segments/:id/preview is registered in index.ts routing but the handler in segments.route.ts is missing. Calling this endpoint returns an unexpected response (likely 404 or an unhandled error). The endpoint is listed in the API spec and referenced in the dashboard compose modal.

Fix: Implement the handler — execute the segment filter query against nl_subscribers, return paginated { data: Subscriber[], count: number }. Mirror the logic from fireCampaign()'s recipient resolution.

B2 — Segment subscriber_count drifts silently LOW

Where: apps/newsletter-service/src/db/schema.ts, segments.route.ts

nl_segments.subscriber_count is cached at segment save time. When subscribers bounce, unsubscribe, or are deleted after the segment was last saved, the count is stale. The dashboard shows the cached count, which can be significantly higher than the actual sendable audience.

Fix: Either: (a) compute count live on GET /segments/:id (cheap query, small lists), or (b) add a background sync that re-computes counts after bulk subscriber state changes (bounce, import, unsubscribe).

B3 — Confirmation email is hard-coded, non-customisable LOW

Where: apps/newsletter-service/src/routes/public.route.ts

The double opt-in confirmation email HTML is hard-coded in the route handler, not a template row. Tenants can't customise the confirmation email subject, copy, or branding. The sender name and from-email come from comms sender-settings, but the body is always the same boilerplate.

Fix: Add a confirm_template_id column to nl_blog_binding (or a new nl_tenant_settings table) so tenants can point to a template for the confirmation email. Fall back to the hard-coded HTML if null.

B4 — Double opt-in skipped for manual adds and imports LOW

Where: apps/newsletter-service/src/routes/subscribers.route.ts

POST /subscribers and POST /subscribers/import set confirmed_at = NOW() immediately. Comment in code says "skip double opt-in for now." This means manually imported subscribers bypass the confirmation flow, which can cause deliverability issues if the list quality is poor.

Fix (long-term): Add an optional requireConfirmation: boolean param to /subscribers/import that triggers confirmation emails for each imported address. Default false for backwards compat.

B5 — Raw provider errors not accessible LOW

Where: apps/newsletter-service/src/lib/campaign-send.ts

Comms-service errors are classified into coarse codes (provider_4xx, provider_5xx, provider_unreachable, provider_unknown) and stored in nl_campaign_sends.error. Raw error bodies (Resend error messages, stack traces) are logged to the Worker console but never persisted. Ops must tail live logs to debug specific failures.

Fix: Add a raw_error text column to nl_campaign_sends (truncated to 500 chars) to store the first line of the provider error message for dashboard-visible debugging without log access.

B6 — Two conflicting token formats for blog-to-newsletter subject MEDIUM

Where: nl_blog_binding.subject_template vs src/lib/render.ts

The blog binding subject_template uses {{title}} and {{excerpt}} (no dot-namespace, no spaces). The campaign body renderer uses {{ post.title }} and {{ post.excerpt }} (dot-namespaced, spaces). These are two separate substitution systems for the same data.

If a tenant writes {{ post.title }} in subject_template, it renders literally (unresolved). If they write {{title}} in the campaign body, it also renders literally. No error, no warning — silent garbage output in the email subject or body.

Fix: Unify both to the same token format. Either extend render.ts to also handle {{title}} in the subject field, or migrate subject_template to use {{ post.title }} and update the DO + internal-blog route to pass post.* into the render context for the subject.

B7 — Rate limiter silently falls back to in-memory in local dev MEDIUM

Where: apps/newsletter-service/src/lib/rate-limit.ts

Rate limit priority: native CF Workers binding → KV namespace → in-memory Map. In-memory is per-isolate — does not persist across CF Worker instances in production. In local dev (no native binding configured), the in-memory fallback is used silently with no warning log. Developers test under a false rate limit and may never discover the fallback is active.

Fix: Add a console.warn("Rate limiter: falling back to in-memory — not safe for production") log when the in-memory path is taken. Document in wrangler.toml dev stanza that NL_SUBSCRIBE_LIMITER must be configured for accurate rate limit testing.

Gaps (Missing Features)

G1 — No GDPR right-to-erasure automation HIGH (built 2026-10-22, data-lifecycle S2; not deployed)

Where: apps/newsletter-service/src/db/schema.ts

When a subscriber is deleted, subscriber_id is set to NULL in nl_subscriber_events but the email column remains (by design, for audit trail). There is no automated path to erase the email from audit logs on GDPR erasure request. Manual DB sweep is required.

nl_suppression_list also has no retention policy and keeps emails indefinitely.

Fix: Add a POST /subscribers/:id/erase (or hook into delete) that:

1. Deletes the subscriber row
2. Pseudonymises email in nl_subscriber_events to "erased@{hash}.gdpr" or similar
3. Does NOT remove from suppression list (keeping bounce/complaint protection without PII)

G2 — No retention policy on append-only tables MEDIUM

Where: nl_subscriber_events table

The events table is explicitly append-only with a comment noting "retention policy can be enforced later by a separate sweeper." For high-volume tenants with active lists, this table can grow unbounded. No purge schedule or size cap exists.

Fix: Add a sweeper cron that deletes nl_subscriber_events rows older than 365 days. Superseded 2026-10-05: do not purge this table by age. It is the proof of consent for subscribers who still exist, and deleting it at 365 days would remove the evidence that justifies mailing them. The decided design (SES-readiness gap plan, E1/E3): the rows leave with their subscriber (the address is replaced by a keyed hash, so "we erased X" stays provable without keeping X) or with the workspace. No cron is needed, and the account has none to spare. Tracked as G35 in docs/communication/ses-production-access/gap-log.md.

G3 — Template thumbnail generation not implemented MEDIUM

Where: nl_templates.thumbnail_url column

The column exists (reserved for Phase E) but is always null. The dashboard falls back to in-browser iframe rendering of the template preview, which is slow and inconsistent across screen sizes.

Fix (Phase E): Add a server-side thumbnail renderer (Puppeteer or react-email + Cloudflare Worker compatible renderer) that fires after template save and stores a PNG/WebP screenshot URL in thumbnail_url.

G4 — nl_template_sections thumbnail not implemented LOW

Same as G3 but for reusable sections. thumbnail_url column exists in nl_template_sections, always null.

G5 — No metadata-based subscriber filtering MEDIUM

Where: apps/newsletter-service/src/routes/segments.route.ts, segment-filter.ts

Subscriber metadata is a JSONB column supporting arbitrary custom fields ({{ subscriber.metadata.* }}). However, the segment filter rules only support tags, status, and subscribedAfter. There is no way to create a segment that filters by metadata fields (e.g. metadata.plan = "pro").

Fix: Add a metadata key to filter_rules: { "metadata": { "plan": "pro", "country": "IN" } }. Implement the query using Postgres JSONB operators: metadata @> '{"plan": "pro"}'.

G6 — No A/B subject lines LOW

Not in scope for v1 (explicitly noted in templates.md). No path to test subject-line variants against a split audience. All recipients in a campaign get the same subject.

Track here for v2.

G7 — Scheduled campaign body lock has no "re-schedule" UX LOW

Where: campaigns.route.ts

Once a campaign is status=scheduled, its body is locked (only name, scheduled_at, and status can change). To edit the content, a user must cancel the scheduled campaign, edit as draft, and re-schedule — there is no single "unschedule and edit" action.

Fix: Add POST /campaigns/:id/unschedule that sets status = 'draft', clears scheduled_at, and cancels the DO alarm. This mirrors the blog-service schedule/unschedule pattern.

G8 — No campaign duplication LOW

Where: campaigns.route.ts

Templates have POST /templates/:id/duplicate but campaigns do not. There is no way to clone a sent campaign to re-use it as a draft without manually copying fields.

Fix: Add POST /campaigns/:id/duplicate — creates a new status=draft campaign with the same body, name (appended " (copy)"), but empty stats and a new ID.

G9 — Suppression list has no ops UI MEDIUM

Where: nl_suppression_list table

The suppression list is managed only via /internal/bounce. There is no admin UI or API route to:

• List suppressed addresses
• Check whether a specific email is suppressed
• Manually add an address
• Remove a mistakenly suppressed address

Fix: Add ops routes (internal-key gated): GET /internal/suppression, POST /internal/suppression, DELETE /internal/suppression/:email.

G10 — Rate limiter falls back to in-memory in dev LOW

Where: apps/newsletter-service/src/lib/rate-limit.ts

Rate limit priority: native CF Workers binding → KV namespace → in-memory Map. The in-memory fallback is per-isolate and does not persist across CF Worker instances in production. In local dev (no native binding configured), the in-memory fallback is used silently.

Fix: Add a dev warning log when falling back to in-memory. Document that in-memory rate limiting is development-only and must not be relied upon in production.

G11 — No MCP tools MEDIUM

The newsletter service has zero MCP tools. AI agents (Claude, Cursor, etc.) cannot manage subscribers, check campaign stats, fire campaigns, or query segment counts. Every other major service (blog, forms, billing) has MCP tooling. This gap grows more significant as AI-driven campaign management matures.

Fix: Wire an /mcp route group. Suggested initial set: list-subscribers, get-campaign-stats, create-campaign, fire-campaign, preview-segment, get-subscriber-count, update-blog-binding.

G12 — No subscriber growth analytics MEDIUM

Where: nl_subscriber_events (data exists), no aggregation layer

Campaign stats (total_opened, open_rate, etc.) exist on nl_campaigns. But there is no endpoint for subscriber growth — new signups per day/week, churn rate, net growth. The nl_subscriber_events table has all the data; it just isn't aggregated anywhere.

Fix: Add GET /subscribers/analytics?days=30 — groups nl_subscriber_events by day and kind, returns confirmed/unsubscribed/bounced counts and a net-growth time series.

G13 — No pause/resume for in-flight campaigns LOW

Once fireCampaign() is called, thousands of queue messages are enqueued. There is no mechanism to pause mid-send if a content error is spotted after send starts. The campaign must run to completion.

Track here for v2.

G14 — No dead-letter retry from dashboard MEDIUM

Where: apps/newsletter-service/src/consumer.ts, nl_campaign_sends

When a send job exhausts all 3 queue retries, it is marked dead_letter in nl_campaign_sends. There is no admin route or UI to retry these. The only remediation is a full manual re-send, which risks double-sends.

Fix: Add POST /campaigns/:id/retry-failed — re-enqueues all dead_letter send records (capped at 1000/call). Guard with a second idempotency key to prevent double-charge.

G15 — No unsubscribe reason collection LOW

Where: routes/public.route.ts (POST /public/unsubscribe)

Subscribers are immediately unsubscribed on link click with no reason collected ("Too frequent", "Not relevant", "Never signed up"). Standard exit reasons are essential for churn analysis and deliverability improvement.

Fix: Add optional ?reason= query param to the unsubscribe link. Store it in nl_subscriber_events.detail. Hosted unsubscribe page can show a short radio form before confirming.

G16 — Blog subject template tokens are limited and inconsistent LOW

Where: nl_blog_binding.subject_template vs lib/render.ts

subject_template only supports {{title}} and {{excerpt}} — no author name, no post URL. The body uses {{ post.title }} (dot-namespaced, spaces). Two substitution systems for the same data — see also B6.

Fix: Extend subject template substitution to all {{ post.* }} tokens, then deprecate the flat {{title}}/{{excerpt}} format in favour of the dot-namespaced form used in the body.

G17 — No per-timezone send scheduling LOW

All subscribers in a campaign receive the email at the same wall-clock moment. nl_subscribers.metadata could store a timezone; the scheduling layer doesn't use it.

Track here for v2.

G18 — Template preview uses canned mock data only LOW

Where: apps/seller-dashboard (template editor)

Template authors cannot preview how their email renders with specific subscriber names, metadata values, or post variables without sending a test email. Preview always uses hardcoded canned values.

Fix: Add previewData: Record<string, string> input to the template editor (stored in localStorage). Pass it through the same render.ts context for in-browser preview and test-send rendering.

Improvement Scope

Priority 1 — Fix now (correctness / compliance)

Priority 2 — Ops and trust

Priority 3 — Missing features, high user value

Priority 4 — Future / larger scope

Fixed Items

2026-10-22 — Two alarm loops that never stopped (found mapping S5)

Not deployed. RepermissionRunner left its 60-second safety alarm armed after a run finished, so every run ever started re-ticked forever, querying Postgres each time and keeping the newsletter database awake around the clock (the G78 cost pattern). CampaignScheduler returned early when its campaign row was gone (deleted, or later purged) and polled every 5 minutes forever. Both now call deleteAlarm() when there is nothing left to do: a finished, missing or non-running run; a missing campaign; an instance with no stored pointer. Tests in repermission-runner.test.ts and scheduler.test.ts; 4 deliberate breaks caught. An instance already looping stops on its first alarm after the deploy.

2026-10-22 — Subscriber erase (data-lifecycle S2, G1)

Branch data/s2-subscriber-erase, not deployed. DELETE /subscribers/:id, the MCP remove-subscriber tool and the ops "Erase a subscriber" page (/internal/admin/subscribers/erase) all run lib/erase.ts: the subscriber row, its send rows, link clicks and re-permission targets are deleted; every activity-log row for the address (including deleted rows from the old delete) gets an HMAC fingerprint instead of the address, with subscriber_id and detail cleared; one erased row records it; comms deletes its copies of the newsletter mail (/internal/erase-recipient). The global suppression list is untouched, and an unsubscribed or complained subscriber's opt-out is kept as a comms suppression entry for the workspace; if comms can't take it, the erase is refused (503) instead of losing the opt-out. Tests: test/erase.test.ts (24), comms test/recipient-erase.test.ts (9), internal-api test/subscriber-erase.test.ts (10); 29 deliberate breaks across the three services caught.

2026-09-14 — Mailbox + Newsletter audit, Phase 0 (security & money)

Branch audit/phase-0-security. Finding ids refer to the audit report (NL- newsletter worker, NF- newsletter dashboard, CM- comms transport).

2026-09-15 — Mailbox + Newsletter audit, Phase 1 (correctness hotfixes)

Branch audit/phase-1, committed not yet deployed. 9 PRs (P1–P9b); rows below cover the newsletter-service and newsletter-dashboard findings. Mailbox and comms findings are in their own backlog docs.

2026-09-29 — Newsletter dashboard Low-list (ad hoc, one item)

Branch audit/phase-5. The newsletter dashboard's own Phase 5 track (PR8–PR13: typed client, subscribers paging, campaigns/templates paging, page splits, editor history, test sweep) has not been started — this single fix was an opportunistic pickup while wrapping up the mailbox side of the same phase.

Still open from this backlog: Phases 2–6 of the audit report (.claude/plans/take-your-time-bubbly-hejlsberg.md); the newsletter dashboard's own Phase 5 PR8–PR13 track (PR8 done, see below; PR9–PR13 not started).

2026-09-29 — Newsletter dashboard Phase 5 Track N PR8 (typed client)

Branch audit/phase-5, commit 41c5b79f. First PR of the newsletter dashboard's own Phase 5 track (mailbox's Track M, PR1–PR7, is fully done). Scope was narrower than the master plan's original framing: the error-handling half of "typed client" (one NewsletterApiError, no raw fetch().json()) had already shipped in the Phase 0 pass — jsonOrThrow and NewsletterApiError already existed. What was actually missing was response-shape validation and the duplicated page-local interfaces it should have replaced.

Not done in this PR: Stat/BigStat/FieldLabel primitive duplication, RECIPIENTS_PER_CREDIT duplication (both listed in the master plan's PR11, page splits). NF-22 (subscriber list has no confirmedAt, so pending subscribers show as active) confirmed still open during this PR's schema work — it's PR9's scope, not touched here.

Review fix pass, commit c74537c3: an independent review of 41c5b79f found no Critical/High issues; fixed the 3 Medium/Low findings it did raise — useSenderIdentity's hook itself had zero test coverage (only its module-level cache functions did), so the settled-vs-loaded!==null distinction the hook exists for was unverified; added 3 renderHook cases mirroring mailbox's useUnreadCounts.test.ts precedent (mutation-checked: reverted the check, confirmed the new "mounts after a failed load" test fails, restored). fetchBlogBinding/upsertBlogBinding/deleteBlogBinding still hand-rolled their own error handling instead of the shared jsonOrThrow path everything else uses — folded in (fetchBlogBinding's 404→null branch stays ahead of it), plus 6 new tests (these 3 functions had none before). Removed dead unused schema exports (SignupFormDetailSchema, CampaignCountsResponse) that nothing called yet — they'll come back defined against a real call site when PR9/PR10 actually need them. Dashboard suite 279→287, full suite 642 green.

Still open: PR9 (subscribers: server search, cursor paging, pending status, chunked import), PR10 (campaigns/templates paging, honest Overview, segments, settings), PR11 (page splits + shared primitives), PR12 (editor undo/redo history + canvas fixes), PR13 (test sweep + docs).

2026-09-30 — Newsletter dashboard Phase 5 Track N PR9 (subscribers: search, cursor, pending, chunked import)

Branch audit/phase-5, four commits: backend 6a72d173, typed client 8ae2bd5f, parse-contacts fixes 66d105c1, page wiring 657b9224.

Also added (not a finding, a UX gap the runner surfaces): a Stop button during an in-progress chunked import, checked between chunks — chunks already sent still complete, the rest aren't.

Not done in this PR: apps/newsletter-service/scripts/lib/contacts-transform.mjs (the ops CLI) still derives names from email and lacks first/last-name columns — intentionally divergent from the dashboard path now, bringing it in line is a separate follow-up. Dead code found and left alone: fetchBlogBinding (still exported, genuinely has no caller anywhere in the dashboard — noticed while touching the same file in the prior PR8 review-fix pass, out of scope here).

Tests: newsletter-service suite 988 → 1019; dashboard suite 287 → 314. Full dashboard suite (newsletter + mailbox + lib) 667 green throughout. tsc clean on both apps at every step; eslint zero new findings on the dashboard (newsletter-service has no lint setup).

Review fix pass, commit c9aa28a1: an independent review of the four PR9 commits found one High and one Medium issue, both fixed.

• High — GET /subscribers's total silently shrank on every cursor page instead of staying the whole filtered list's size (a count(*) OVER () window function was scoped to the same WHERE clause as the cursor's keysetBefore predicate, so it only ever counted rows remaining after the cursor — contradicting the route's own comment, the dashboard schema's comment, and the commit's own design claim). Fixed by splitting into a cursor-free count() query (always runs, in parallel with the row fetch) scoped to tenant+status+tag+q only. New regression test asserts total stays at 8 across three consecutive cursor pages; mutation-checked by reproducing the exact reported shape of the bug (total 8→6 instead of staying 8).
• Medium — a paste-box line without an @ was counted in the toast but never reached the persistent rejected-rows report (gated only on the server run's own array) — a paste-only run with malformed lines would toast "N rejected" and then auto-close the panel, leaving no way to see or download which line failed. Fixed by giving paste-rejected lines a synthetic {index, email: <raw line>, reason: "no_at_sign"} entry merged with the server's rejected array before deciding whether to keep the panel open. 2 new tests (mixed paste+server rejections merging into one report; an all-paste-rejected case that previously auto-closed), both mutation-checked.
• Low (folded into the Medium fix) — the original "chunked import" test mocked the runner's return value unconditionally and never verified the real paste→rows pipeline despite its name claiming to; rewritten to assert on the runner's actual call arguments.

newsletter-service suite 1019 → 1020; dashboard SubscribersPage.test.tsx 5 → 6 (one test rewritten, one added), full dashboard suite 671 green.

2026-10-02 — Newsletter dashboard Phase 5 Track N PR10 (campaigns/templates paging, honest Overview, segments, settings)

Branch audit/phase-5, eight commits: backend 8e17edc2, typed client 6166993b, CampaignsPage wiring b6f9ced6, templates+picker paging 38f9d0e7, Overview 99d515bc, Segments ed9e489e, blog-post variables d4a66905, timezone select e3fdc0f2, SenderDefaultsForm extraction a56e3a14.

Not done in this PR: the campaign list's source filter (manual vs. from-blog) stays client-side — there's no backend sourceKind query param and the master plan doesn't ask for one.

Tests: newsletter-service suite 1020 → 1030 (backend commit). Dashboard suite grew from 314 (after PR9) across all seven dashboard commits; full dashboard suite (newsletter + mailbox + blog + lib) 671 → 731 green throughout this PR. tsc clean on both apps at every step; eslint zero new findings.

Review fix pass, commit 8ad96ff6: an independent review of all nine PR10 commits found no Critical/High/Medium issues and three Low ones. Fixed the one that is a real race: StartFromPicker's Saved tab reloads page 1 on every entry, but a "Load more" still in flight from the previous visit had no guard — leave for Layouts and come back while it's pending and its rows landed on top of the fresh page 1 with its (now meaningless) cursor replacing the fresh one. A page-walk sequence ref now drops it (1 new test, mutation-checked). The other two are accepted residuals, not fixed: (a) GET /templates pages over the mutable updated_at (by design — "recently updated first"), so a template edited mid-walk jumps past the cursor and is skipped until a reload; never duplicated. (b) segment-filter-rules.ts encodes a date boundary as the setting browser's local midnight, so an editor in a different IANA zone sees the picked day off by one in the edit form (and would re-anchor it to their own midnight if they save untouched) — strictly less wrong than the UTC-slice behaviour it replaced, and only affects teams spanning zones. Full dashboard suite 731 → 732.

2026-10-03 — Newsletter dashboard Phase 5 Track N PR11 (page splits, shared primitives)

Branch audit/phase-5, ten commits: primitives bd39c64d, then structural splits a2aba8d4 (SubscribersPage), a92da8d3 (CampaignsPage), 9bcbd396 (TemplateEditor), 56c2d73b (SegmentsPage), a850e933 (SignupFormsPage, OverviewPage), 6c8c7459 (TemplatesPage, CampaignReportPage), bc2422bc (newsletter.api.ts/.schemas.ts by domain), cce6b10e (useCampaignDraft, block-prop-editors, BlockCanvas, EmailComposer), 0784812f (SubscribersPage 449 → 393). No behaviour change in any of them.

Result: no non-test file under modules/newsletter exceeded 400 lines at the end of PR11b (largest 393). It was broken again by PR12's own additions and restored in PR13 (see below).

2026-10-05 — Newsletter dashboard Phase 5 Track N PR12 (editor history and canvas)

Branch audit/phase-5, eight commits: reducer 5eeede95, canvas 939ea205, clearing fields e0dca980, double submit 10cd2a79, column operations in email-blocks d1ea90c6, columns UI ef94f7fe, Custom HTML sizing 3c3483ac, saved sections 4b35b57c.

Also: the repo-wide vitest.setup.ts now polyfills CSS.escape (jsdom lacks it; use-anchored-rect calls it once a block is selected on desktop, which made a test throw from a requestAnimationFrame callback). insertAfter with a missing anchor used to select and start editing a block that was never inserted; it and the new insertAt now return the state untouched.

Not covered by an automated test, to be checked on a device: the exit criterion "a block moves into an empty column on iOS Safari". The flow uses only click targets, so there is no gesture behaviour to differ, but it has not been run on a phone.

2026-10-05 — Newsletter dashboard Phase 5 Track N PR13 (test sweep, axe gate, docs)

Branch audit/phase-5, six commits: editor accessibility fixes c423562c, axe gate 16d2b787, schema tolerance and raw-switch safety 88136567, slash/dark-inbox unit tests 31ad4c07, back under 400 lines 476525d4, and these docs.

Plan items not built as written: useAutosave was not extracted (autosave stays inline in TemplateEditor; its behaviour is covered through the TemplateEditor tests, including the autosave path for NF-21, and extracting a hook only to test it would be churn); the plan's slash-commands.test.ts is email-slash-items.test.ts; buildFilterRules.test.ts is segment-filter-rules.test.ts (PR10).

Open findings from the new gate (not fixed here, deliberately):

• NF-46 — block settings controls have no programmatic labels. Field in prop-fields.tsx renders its label as a <div> that is not associated with the control, so every range, colour picker and text input in the block settings panel has no accessible name (axe label, critical). The sheet's own action row (Move/Duplicate/Delete) is named; the fields under it are not. Fixing it means labelling about 20 controls across prop-fields.tsx and block-prop-editors.tsx and needs care (wrapping Field in a <label> would make clicking a field's title press its first button, e.g. the alignment picker's "left"). Recorded as it.todo in editor.a11y.test.tsx.
• NF-47 — VariableInsertButton uses the same role="menu"/role="menuitem" pattern the Insert menu had. Not yet audited with axe; likely the same two errors.

Pre-existing, noted while linting the whole module (untouched by this phase): eslint src/modules/newsletter reports three react-hooks/set-state-in-effect errors in components/TemplateThumbnail.tsx, hooks/useCompiledEmail.ts and pages/SettingsPage.tsx; they and the lint config are unchanged since before PR11.

Tests: dashboard suite 732 (after PR11) → 945 passed + 1 todo across 92 files; email-blocks package 84 → 103. tsc clean at every step; eslint zero new findings.

2026-10-05 — Review fix pass for PR11–PR13

Three independent read-only reviews ran after PR13 (PR11 page splits; editor logic for PR12/13; sandboxed iframe, schema tolerance, raw switch, axe gate and the dependency for PR13). Each finding was checked against the code, and where it concerned layout or browser behaviour, in real Chrome (the repo's playwright-core against the installed Chrome), before anything was changed. Nine commits on audit/phase-5: cd2dcced, 7980f626, 7076c906, 0e0e115f, 81440865, b090bbef, 9ba5d4c3, 6499924e, e0ef4db4. Every fix has tests and was mutation-checked: 69 mutants, all killed in the end; 2 escaped on their first run and each led to a better test (noted in the table).

Also: StatStrip's doc comment moved back above StatStrip; the two TemplateEditor test files got a 15s test timeout (the first raw-switch test had exceeded the 5s default in a loaded full run).

Verified clean by the reviewers (no change needed): reducer purity and StrictMode, edit-session accounting, the history cap, moveBetween/insertInto/locateBlock semantics including cycles, move-mode state transitions, the useCampaignDraft save guard, NF-21 semantics on all three call sites, 476525d4 being a pure move, the sandbox flags (allow-scripts only, never allow-same-origin), the hash gating (sandbox, CSP and script derive from one value), readHeightReport, the viewer refactor, the lockfile diff (exactly the 3-line importer entry), and the Insert menu's ARIA.

Accepted residuals, not fixed:

• A Custom HTML preview can still reach a remote document with scripts through <meta refresh> or a click on a link. It stays confined to an opaque origin (no cookies, storage, parent or top access, popups or modals; all checked in Chrome), can send requests and post data to the parent, and can move the frame's height within its clamp. Only the template author's own team sees the preview. The full fix is to never give the content allow-scripts: measure it from a trusted outer frame through an inner script-less frame (same-origin through the opaque origin). Larger than a fix pass; a decision for Phase 6, or sooner if previews ever render content from outside the team.
• The a11y gate runs only where someone runs it. There is no CI workflow for seller-dashboard and no pre-commit hook. Adding the workflow is what would make it a gate.
• switchToRaw: edits made in the few milliseconds the compile is in flight can be dropped (the dialog is closed while it awaits).
• Hand-crafted block trees with duplicate ids break the move/insert invariants (verified: a block inserted into both of two Columns blocks sharing an id). Layouts and saved sections mint fresh ids and no production source of duplicates was found; trees authored through the MCP or API were not checked.
• Legacy widths are normalised to 680 on the next save of a template or campaign that had another width (expected from the tolerance rule).
• Not checked on a device: keyboard focus after a move starts or ends (the activated toolbar button becomes hidden and the target unmounts, so focus probably falls to the page), and the empty-column move on iOS Safari. Firefox and Safari were not tested for the iframe behaviours.
• NF-46 and NF-47 stay open as above.

Still open: the rollout (see docs/mailbox/backlog.md for the Track M closing notes).