Newsletter management (sys-scope)

Newsletter is the largest sys growth surface, engineered like a real ESP. The overview at `sys/newsletter` exposes lists, segments, templates, campaigns, automations, AI assist, deliverability, suppressions, and analytics-overview. Mutations require `sys_support`-or-better; a subset (schedule, send-now, cancel, subscriber DELETE, suppression DELETE, CSV import attestation, automation enable/disable) requires fresh-auth.

Every action writes `write_sys_audit` under `newsletter.*`. Lists support platform and tenant scope, from-domain verification, archival, and subscriber CSV export/import with operator-attested consent; GDPR subscriber delete cascades events + enrolments while preserving the suppression row. The MJML template editor is a Monaco split-pane with a live iframe preview (mobile/desktop), sample-var injector, server-side MJML→HTML/text render with cache regen, and a gallery of 12+ premium starters.

The visual segment builder renders AND/OR groups over an allow-listed vocabulary with live recipient counts via `POST /segments/preview`; saved segments reuse in the campaign wizard. The 7-step campaign wizard walks audience → template → per-language content (with AI assist) → A/B variants → schedule (absolute or send-time-optimised) → Litmus cross-client preview + spam-score → review; a test-send within 24 hours is mandatory before schedule or send-now. Lifecycle actions are test-send, schedule, send-now, pause, resume, cancel; paused state persists so resume continues exactly where the dispatcher stopped.

Analytics shows sent/delivered/opened/clicked timeline, top-clicked links, per-variant bars with Wilson CIs on open/click rate, and a winner banner once `newsletter-ab-winner-job` runs. A heatmap overlays click density on the rendered HTML with per-link tooltips. Cohort analytics slices rates by tenant, role, language, and source.

The react-flow automation builder wires trigger → wait → send → branch → exit with a drag palette and side-panel config; three preset flows (7-day onboarding, 30-day re-engagement, 90-day win-back) seed disabled and need fresh-auth to enable. AI-assist offers three tabs (subject lines, content polish, audience reaction) backed by Gemini 2.5 Pro with a 50/operator/24h quota and prompt+response-hash audit. The deliverability dashboard tracks per from-domain reputation 0–100, 30-day trend, SPF/DKIM/DMARC badges, bounce/complaint/unsub rates, and a halt-sends action firing on bounce > 2 % or complaint > 0.1 %.

The global suppression list is a DO-NOT-SEND register with reason + `source_event_id`; removals need fresh-auth + reason. Analytics-overview rolls cross-campaign growth, churn, engagement trend, and at-risk count linked to its segment. Design tokens, keyboard nav, and WCAG AA are enforced.