fix(campaign): bound operator queue polling

.gitignore

@@ -332,6 +332,8 @@ cython_debug/
 webui/.policy-test-build/
 webui/.template-preview-test-build/
 webui/.import-test-build/
+webui/.review-preview-test-build/
+webui/.report-grid-test-build/
 
 # GovOPlaN shared ignore rules from govoplan-core
 # Local WebUI test/build scratch directories
@@ -340,6 +342,7 @@ webui/.import-test-build/
 .policy-test-build/
 .template-preview-test-build/
 .import-test-build/
+.review-preview-test-build/
 webui/.component-test-build/
 webui/.module-test-build/
 *.db

AGENTS.md

@@ -26,8 +26,8 @@ PATH=/mnt/DATA/git/govoplan-core/webui/node_modules/.bin:/home/zemion/.nvm/versi
 For combined checks, run:
 
 ```bash
-cd /mnt/DATA/git/govoplan-core
-./scripts/check-focused.sh
+cd /mnt/DATA/git/govoplan
+tools/checks/check-focused.sh
 ```
 
 ## Working Rules

README.md

@@ -1,5 +1,9 @@
 # govoplan-campaign
 
+<!-- govoplan-repository-type:start -->
+**Repository type:** module (domain).
+<!-- govoplan-repository-type:end -->
+
 GovOPlaN Campaign is the campaign authoring, validation, review, sending-control, and reporting module. It bundles backend campaign APIs with the campaign WebUI package.
 
 ## Ownership
@@ -11,7 +15,7 @@ This repository owns:
 - campaign/version/job/issue/send-attempt/append-attempt models and migrations
 - campaign JSON schema, validation, message building, attachment resolution, ZIP handling, reports, queue/control services, and mock-send paths
 - WebUI package `@govoplan/campaign-webui`
-- route contributions for `/campaigns`, `/campaigns/:campaignId/*`, `/operator`, `/reports`, `/address-book`, and `/templates`
+- route contributions for `/campaigns`, `/campaigns/:campaignId/*`, `/operator`, `/reports`, and `/templates`
 
 Core owns the auth facade, RBAC/capability contracts, database/session
 primitives, CSRF/API helpers, shell layout, and route rendering. Tenancy is an
@@ -26,8 +30,16 @@ The module has one required runtime dependency:
 
 Files and mail are optional module integrations declared in the campaign manifest:
 
-- `govoplan-files` enables managed attachment selection, frozen file-version evidence, and managed-file usage tracking. Without it, campaigns can still use legacy/local attachment paths where configured.
-- `govoplan-mail` enables reusable mail profiles, delivery policy checks, SMTP sending, and IMAP append behavior. Without it, campaigns can still be authored, validated, built, and reported, but real delivery/profile features are unavailable.
+- `govoplan-files` enables managed attachment selection, frozen file-version evidence, and managed-file usage tracking. Server/API campaigns require this integration for attachments and never resolve caller-supplied local filesystem paths. Legacy file-oriented loading remains available only to explicitly trusted operator/library workflows.
+- `govoplan-mail` owns reusable profiles, encrypted SMTP/IMAP credentials, delivery policy checks, connection tests, and transport execution. Campaign JSON stores only `server.mail_profile_id`; inline transport settings and credentials are rejected. Without Mail, campaigns can still be authored, but profile validation and real delivery are unavailable.
+
+Public campaign, version, job, and report responses expose business data and
+delivery evidence, but never process-local paths, storage-backend keys, or
+worker claim tokens. Operational troubleshooting uses the dedicated job
+diagnostics endpoint and requires the tenant-level
+`campaigns:diagnostic:read` permission. The campaign sender role receives this
+permission; tenant-wide administrator scopes continue to grant it through the
+standard policy evaluator.
 
 Backend optional behavior is accessed through core-provided capabilities, not direct required imports. WebUI optional behavior uses core module metadata/capabilities so campaign pages can build and run without files or mail WebUI packages installed.
 
@@ -79,7 +91,11 @@ Platform RBAC and governance rules are documented in `govoplan-core/docs/`.
 
 ## Operations
 
+- [Campaign handbook](docs/CAMPAIGN_HANDBOOK.md) provides the adaptive user, process, governance, technical, and operations perspectives.
 - [Campaign delivery runbook](docs/CAMPAIGN_DELIVERY_RUNBOOK.md) covers queueing, local vs Celery operation, retries, reconciliation, reports, and the live SMTP/IMAP test checklist.
+- Immediate delivery is bounded to 25 exact eligible recipient jobs by default. Deployments may set `GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS` (0–500), and tenants may narrow that ceiling through `campaign_delivery_policy.synchronous_send_max_recipients` in tenant settings.
+- Report-email preview uses the selected version's stored v5 Mail-profile evidence. Live report email fails closed until [govoplan-mail#17](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17) provides a durable, idempotent Mail-owned outbox and transport-attempt ledger; per-job CSV is off by default and requires `campaigns:recipient:export` when requested.
+- [Campaign/Mail profile boundary](docs/MAIL_PROFILE_BOUNDARY.md) defines profile-only delivery, runtime resolution, execution evidence, and the fail-closed legacy migration path.
 - [Recipient import guide](docs/RECIPIENT_IMPORT_GUIDE.md) covers user/admin workflows, mapping profiles, validation, and import evidence.
 - [Recipient and address boundary](docs/RECIPIENT_ADDRESS_BOUNDARY.md) defines the split between campaign-local recipients and future reusable address management.
 - [Example campaigns and release checklist](docs/EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md) defines the maintained example scenarios and release gates.

docs/CAMPAIGN_DELIVERY_RUNBOOK.md

@@ -5,16 +5,20 @@ been validated, built, reviewed, and locked.
 
 ## Operating Modes
 
-- Local direct send: `CELERY_ENABLED=false`. Queueing stores jobs in the DB, and
-  small development runs can be processed with "Send queued now".
+- Local direct send: `CELERY_ENABLED=false`. **Send now** is available only for
+  exact built runs within the effective synchronous limit. It preflights the
+  complete batch before the first SMTP effect.
 - Worker send: `CELERY_ENABLED=true` with Redis/Celery workers running. Queueing
-  publishes delivery tasks, and the Review & Send page polls summary counters.
+  publishes durable delivery tasks, and Review and send polls their persisted
+  summary counters even after the initiating request has returned.
 - Mock send: use only for development review. It does not prove real SMTP/IMAP
   credentials or server policy.
 
 ## Before First Live Use
 
 - Use dedicated non-production SMTP/IMAP credentials.
+- Store and test those credentials in a Mail-module profile. Campaign must
+  contain only the selected `server.mail_profile_id` reference.
 - Start the repository test bed in `dev/mail-testbed/` when a local
   production-like SMTP/IMAP server is sufficient.
 - Use a dedicated mailbox/folder for append-to-Sent tests.
@@ -24,6 +28,8 @@ been validated, built, reviewed, and locked.
   ZIP before using production recipients.
 - Keep the report page open during tests; it is the operational source of truth
   for attempts, outcomes, and reconciliation.
+- Confirm the effective Send now recipient-job limit. The safe default is 25;
+  use Queue for workers for ordinary batches or any run above that limit.
 
 ## Deliverability Preflight
 
@@ -47,10 +53,15 @@ Before the first live send for a sender domain or mail-server profile:
 1. Validate the version with file checks enabled.
 2. Build the version and inspect all blocking review items.
 3. Queue only after the selected version is the intended immutable execution
-   version.
-4. In local mode, use "Send queued now" for small test runs.
+   version. Select **Queue for workers**, then verify the committed and
+   published counts.
+4. Use **Send now** only if the exact eligible count is non-zero and at or below
+   the effective deployment/tenant limit shown on the page.
 5. In worker mode, verify queue counters move from queued/claimed/sending to a
    terminal SMTP state.
+6. If a synchronous request is used, keep Review and send open: it polls the
+   durable counters while the request runs. A rejection occurs before SMTP and
+   directs oversized runs to workers.
 
 ## Outcome Handling
 
@@ -64,6 +75,13 @@ Before the first live send for a sender domain or mail-server profile:
 - `claimed` or `sending` that does not progress: treat as a worker interruption.
   Re-run worker handling or reconcile if SMTP may already have accepted the
   message.
+- IMAP `appending`: A worker owns the durable append claim. Do not start a
+  second append; if the worker cannot finish, reconcile only after checking the
+  mailbox.
+- IMAP `outcome_unknown`: Never append automatically. An operator with
+  `campaigns:campaign:reconcile` must record an evidence note and resolve it as
+  `imap_appended` or `imap_not_appended`. Only the latter becomes explicitly
+  retryable.
 
 ## Reconciliation
 
@@ -89,6 +107,8 @@ bed where possible:
 ## Reporting Checks
 
 - Partial delivery must show accepted, failed, and unknown counts separately.
+- Excluded messages must show SMTP and IMAP as `skipped`, with skipped counts
+  and filters separate from unattempted or failed delivery.
 - Accepted and unknown jobs must not appear in retry selections.
 - Reconciled accepted jobs must remain protected from resend.
 - Reconciled not-sent jobs must appear only as explicit retry candidates.

docs/CAMPAIGN_HANDBOOK.md

@@ -0,0 +1,475 @@
+# Campaign Handbook
+
+## Purpose and status
+
+This is the canonical, multi-perspective handbook for the Campaign module. It
+describes the current implementation, the operational contract it relies on,
+and the remaining work required before Campaign can be presented as GovOPlaN's
+maintained reference composition.
+
+Use the section that matches the task at hand:
+
+| Perspective | Start here |
+| --- | --- |
+| Campaign author | [Prepare a campaign](#prepare-a-campaign) |
+| Reviewer | [Review and complete review](#review-and-complete-review) |
+| Sender or delivery operator | [Deliver and resolve outcomes](#deliver-and-resolve-outcomes) |
+| Campaign or tenant administrator | [Administration and policy](#administration-and-policy) |
+| Platform operator | [Operations and recovery](#operations-and-recovery) |
+| Integrator or developer | [Composition and integration contracts](#composition-and-integration-contracts) |
+| Security, privacy, or audit reviewer | [Assurance model](#assurance-model) |
+| Release reviewer | [Reference-composition acceptance](#reference-composition-acceptance) |
+
+The shorter task documents remain useful companions:
+
+- [Campaign delivery runbook](CAMPAIGN_DELIVERY_RUNBOOK.md)
+- [Mail profile boundary](MAIL_PROFILE_BOUNDARY.md)
+- [Recipient import guide](RECIPIENT_IMPORT_GUIDE.md)
+- [Recipient and Addresses boundary](RECIPIENT_ADDRESS_BOUNDARY.md)
+- [Examples and release checklist](EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md)
+
+## What Campaign is for
+
+Campaign turns governed source data into individually built messages and then
+controls their review, delivery, and evidence. It is intentionally a
+composition module: it demonstrates how one user journey can use optional Mail,
+Files, Addresses, and Notifications capabilities alongside Core access/audit
+infrastructure without copying ownership from those modules. Policy may consume
+Campaign context through a narrow capability; Campaign does not import Policy.
+
+Campaign owns:
+
+- the communication purpose, content, campaign-local fields, and templates;
+- campaign-local recipient snapshots, exclusions, and personalization;
+- message and attachment rules for a version;
+- validation, review, build, queue, and delivery-control state;
+- the durable jobs and attempts needed to explain delivery outcomes; and
+- campaign-specific reports, shares, and frozen execution evidence.
+
+Campaign does not own:
+
+- SMTP/IMAP profiles, credentials, protocol adapters, or mailbox policy;
+- long-lived address-book master data, consent lifecycle, or deduplication;
+- managed file bytes, connector credentials, or external-file provenance;
+- general-purpose workflow definitions; or
+- global identity, organization, permission, or retention policy.
+
+Those boundaries matter in both persistence and UI. A campaign references an
+authorized Mail profile and managed file versions; it must never become a
+second secret store, file store, or address directory.
+
+## Process view
+
+The supported process is a controlled progression, not a single "send" call:
+
+```text
+create/edit
+    -> validate and resolve policy/integrations
+    -> review warnings and blockers
+    -> build exact recipient messages
+    -> complete review and queue
+    -> SMTP attempt per job
+    -> optional IMAP append per accepted job
+    -> report, retry, reconcile, or correct
+    -> archive when no active/uncertain delivery remains
+```
+
+Campaign status summarizes the whole campaign. Version workflow state describes
+the selected immutable/editable version. Each recipient job separately records
+build, validation, queue, SMTP, and IMAP state. Operators must use the job-level
+states when deciding whether another external effect is safe.
+
+Important distinctions:
+
+- **Validation lock** is the reversible lock created by a successful
+  validation/build path. Editing requires unlocking and invalidates derived
+  evidence as appropriate.
+- **User lock** is an explicit audit-safe lock. A permanently locked or
+  delivery-final version is not edited in place; create an editable successor.
+- **SMTP accepted** means the provider accepted the message. It does not prove
+  inbox delivery, reading, or business acknowledgement.
+- **Outcome unknown** means an attempt may have had an external effect. It must
+  be investigated and reconciled before retry.
+- **IMAP append** is a separate effect after SMTP acceptance. An append failure
+  is not evidence that sending failed.
+- **Archive** preserves evidence. Draft-only campaigns without built, locked,
+  or delivery evidence may be deleted where policy allows; evidence-bearing
+  campaigns are archived instead.
+
+## User tasks
+
+### Prepare a campaign
+
+1. Create a campaign and confirm its owner or owning group.
+2. Define global settings, fields, templates, and recipient data.
+3. Import one-off recipient data or select a reusable Addresses source when the
+   optional capability is installed. Review source provenance and stale-source
+   warnings; Campaign freezes the selected rows rather than following later
+   directory changes silently.
+4. Select managed attachments through Files. Server/API campaigns do not accept
+   arbitrary local paths. Preview rules and unmatched files before building.
+5. Open **Mail settings** and select an available Mail profile. The campaign
+   stores only `server.mail_profile_id`; it never accepts SMTP/IMAP settings,
+   usernames, passwords, or credential references.
+6. Save the editable version, validate the relevant sections, and resolve every
+   blocking issue. Warnings remain explicit review decisions.
+7. Build the exact messages and inspect recipient, addressing, template,
+   attachment, and generated-message evidence.
+
+If a selected optional module is absent, Campaign remains loadable and explains
+which function is unavailable. It must not fail startup because Mail, Files, or
+Addresses is not installed.
+
+### Review and complete review
+
+The reviewer should verify the immutable candidate that will be delivered, not
+just the authoring form:
+
+1. Confirm purpose, owner, selected version, and recipient count.
+2. Inspect blocking errors, warnings, exclusions, and recipients requiring
+   review.
+3. Inspect representative and exceptional rendered messages, including From,
+   To/CC/BCC, Reply-To, subject, body, and attachment evidence.
+4. Confirm the selected Mail profile is authorized for the campaign's current
+   tenant and owner context.
+5. Confirm attachment behavior when a rule matches no files, ZIP/password
+   behavior, and any recipient-specific files.
+6. Record review completion and the inspected message keys through the review
+   surface. The current baseline does not persist a distinct approve/reject
+   decision or review reason. If content, recipients, attachment inputs, owner
+   context, or non-secret transport identity changes, revalidate and rebuild.
+
+Normal readers and reviewers see business state and safe evidence. Process-local
+paths, storage keys, worker claim tokens, and raw provider diagnostics require
+the dedicated diagnostic permission and must not leak through ordinary campaign,
+version, job, or report responses.
+
+The current Campaign Report Web UI additionally requires recipient-read access
+and does not yet hide every action control that the actor lacks. The server
+still authorizes each action, but an aggregate-only reader UI remains open
+work; do not promise that experience from `campaigns:report:read` alone.
+
+### Deliver and resolve outcomes
+
+Use the [delivery runbook](CAMPAIGN_DELIVERY_RUNBOOK.md) for the detailed
+operator sequence.
+
+At a minimum:
+
+1. Queue only a validated, locked, built version. Use **Queue for workers** for
+   ordinary batches; the durable progress remains visible after leaving and
+   returning to Review and send.
+2. Use **Send now** only when the exact persisted eligible build is within the
+   effective synchronous limit shown by the UI. The default deployment limit
+   is 25 recipient jobs. The backend repeats the count and preflights every
+   message and the Mail profile revision before contacting SMTP.
+3. Treat `smtp_accepted` as protected from ordinary retry.
+4. Retry `failed_temporary` explicitly after inspecting the cause.
+5. Include `failed_permanent` only after correcting the cause and making a
+   conscious override.
+6. Never retry `outcome_unknown` blindly. Inspect SMTP/provider evidence and
+   reconcile it as **accepted** or **not sent**, with a note identifying the
+   evidence.
+7. Process append-to-Sent only for SMTP-accepted jobs and investigate append
+   failure independently. Never retry an `outcome_unknown` IMAP append blindly:
+   reconcile mailbox evidence as **appended** or **not appended** with a note.
+   Only the latter becomes explicitly retryable, and neither decision resends
+   the already SMTP-accepted message.
+8. Archive only after active and uncertain effects are resolved.
+
+Pause stops new eligible work but cannot undo a provider effect already in
+progress. Cancel marks work that has not yet produced a protected SMTP outcome;
+it cannot recall accepted mail.
+
+The deployment ceiling is configured with
+`GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS` (0 disables Send now; the
+accepted range is 0–500). A tenant may only narrow that ceiling with
+`tenant.settings.campaign_delivery_policy.synchronous_send_max_recipients`.
+The effective value and source are returned by the protected delivery-options
+API, recorded for successful/rejected synchronous commands, and stated in the
+configured handbook topic.
+
+### Test and one-message actions
+
+The current baseline includes mock send, queue dry-run, synchronous immediate
+delivery, sending one selected job, retry selection, and unattempted-job
+selection. Their audit and state behavior is not yet the final vocabulary
+accepted for issue `govoplan-campaign#69`.
+
+The intended distinction is:
+
+- **Test:** deliver once to the configured test path, audit it, and leave the
+  production job unsent.
+- **Single send:** send one unsent job, audit it, and mark its production effect
+  complete.
+- **Single resend:** intentionally send one job again regardless of an earlier
+  failure or acceptance, with distinct authority, warning, reason, and audit.
+
+Until that slice is implemented and target-tested, do not present the existing
+buttons as a complete resend policy. Ordinary retry protection remains the safe
+default.
+
+## Data and evidence model
+
+### Versions and snapshots
+
+Editable campaign JSON is versioned. Build creates recipient jobs and an
+execution snapshot. A new profile-only snapshot contains the stable Mail
+profile id, delivery policy/evidence, and opaque Mail-issued transport
+revisions. It contains no resolved SMTP/IMAP configuration or credentials.
+
+At delivery time Mail re-authorizes the profile, compares the expected opaque
+revisions, resolves credentials inside the same Mail-owned operation, and
+performs the transport effect. Campaign receives only the sanitized result it
+needs for job state and evidence. This same-call check prevents a
+validate-then-use race across the module boundary.
+
+Credential rotation that does not change the non-secret transport identity may
+continue to satisfy the snapshot. A host, account identity, protocol, sender,
+or other revisioned transport change stops delivery until the campaign is
+revalidated and rebuilt.
+
+### Existing legacy database records
+
+The current Campaign database may contain versions with inline SMTP/IMAP
+material. No separate historical Campaign JSON corpus exists. Inline transport
+material in those rows is treated as inert legacy data and is never interpreted
+as an executable Mail configuration:
+
+- public responses remove legacy transport fields and secrets;
+- validation, build, queue, retry, and delivery fail closed;
+- an editable version changes to profile-only form only through an explicit
+  Mail-settings save; and
+- a locked version is preserved and must be forked to an editable successor.
+
+Normal database backup/restore and access controls cover those rows together
+with the rest of the current database. There is no separate historical-JSON,
+backup-scanning, or inline-secret migration program. Restoring an existing
+legacy row preserves it as inert evidence and does not make it deliverable.
+
+### Recipient and attachment evidence
+
+The delivery record should be able to identify:
+
+- source/import context and the frozen recipient row;
+- effective addressing and message id;
+- template inputs and unresolved-placeholder decisions;
+- managed file/version ids, source provenance, checksums, and ZIP evidence;
+- generated EML checksum and size;
+- Mail profile reference and opaque transport revisions;
+- each SMTP and IMAP attempt, its classification, safe provider response, and
+  reconciliation note; and
+- actor/system trigger, timestamps, policy context, and corrections.
+
+An excluded recipient/message is a completed validation decision, not a
+pending delivery. Its SMTP and IMAP states are both `skipped`; it is counted and
+filterable separately from unattempted, failed, accepted, and append outcomes.
+No SMTP or IMAP attempt exists for such a row. If historical data contains
+actual transport evidence despite an exclusion marker, that evidence is
+preserved for audit and reconciliation rather than relabelled.
+
+## Administration and policy
+
+### Roles and permissions
+
+The supplied role templates deliberately separate preparation, review, and
+delivery:
+
+- **Campaign manager** prepares, validates, and builds campaigns and recipients.
+- **Campaign reviewer** inspects prepared material and records review
+  completion for the exact messages checked.
+- **Campaign sender** queues, sends, pauses/resumes/cancels, retries, reconciles,
+  reads reports, and has diagnostic access.
+
+Administrators may compose narrower roles from the declared permissions. Keep
+these separations where institutional policy requires four-eyes approval. Mail
+profile use additionally requires `mail:profile:use`; profile and credential
+administration remains a Mail permission.
+
+Campaign access is also constrained by tenant, owner/group context, and explicit
+shares. A share grants only its declared campaign permission; it does not grant
+Mail credentials, Files administration, or tenant-wide recipient access.
+
+### Configuration checklist
+
+- Install compatible Core and Campaign versions. Access and base audit are Core
+  infrastructure; install optional Mail, Files, Addresses, Notifications, and
+  Policy modules only where the configured journey requires them.
+- Configure Mail profiles and policy in Mail, not in campaign fixtures or JSON.
+- Configure Files storage/connectors and attachment permissions in Files.
+- Define role assignments and separation-of-duty policy.
+- Configure Redis/Celery for durable batch workers where production volume
+  requires it. Local execution is a development/small-run mode, not horizontal
+  worker coordination.
+- Set rate limits for the target provider. Mail may use Redis for shared
+  throttling when present and a process-local fallback in development.
+- Establish retention, deletion, archive, report-export, and diagnostic-access
+  policy before production recipient data is loaded.
+- Use non-production SMTP/IMAP identities and the maintained examples before
+  allowing a production profile.
+
+### Owner transfer
+
+Mail profile visibility can depend on campaign owner or group. Transferring an
+editable campaign with a selected profile clears/requires reselection and
+revalidation. A locked or delivery-final version is never silently rewritten;
+create an editable successor.
+
+## Operations and recovery
+
+### Health to observe
+
+- database and migration health;
+- compatible module interface versions;
+- queue publication, worker heartbeat, claim age, and backlog;
+- SMTP/IMAP profile test result and deployment egress policy;
+- Mail profile authorization/transport-revision mismatch;
+- Files resolution and frozen attachment availability;
+- counts by queue, SMTP, IMAP, and reconciliation state; and
+- audit and report generation failures.
+
+### Worker interruption
+
+A crashed worker can leave a job claimed or sending. Do not infer non-delivery
+from worker loss. If the SMTP boundary may have been crossed, classify the
+outcome as unknown and reconcile from external evidence. Only work that is
+provably unattempted may be returned to an ordinary queue.
+
+### Retry and reconciliation
+
+Retries create new attempt evidence; they do not overwrite the previous
+attempt. Reconciliation is a privileged factual correction supported by an
+operator note. Repeated automated requests should be idempotent for the same
+eligible job state; a deliberate resend is a different, not-yet-finalized
+business action and must never be disguised as a retry.
+
+### Backups and restoration
+
+Back up Campaign, Mail, Files, Core/Audit, and shared storage consistently for
+the composition. A database restore without generated EML/file storage, or file
+storage without matching metadata, does not reconstruct the evidence chain.
+After restore, keep outbound delivery paused until queue/attempt state and
+provider evidence have been reconciled; never let restored accepted jobs send
+again merely because a queue message was lost.
+
+### Incident handling
+
+1. Pause new delivery when duplicate or unknown effects are possible.
+2. Preserve database, queue, provider, worker, and audit evidence.
+3. Scope affected campaigns/jobs without exposing recipient content broadly.
+4. Reconcile uncertain jobs individually or through an approved bounded tool.
+5. Correct configuration in its owning module, then revalidate/rebuild where
+   revisioned transport inputs changed.
+6. Record the incident reference and recovery rationale in audit evidence.
+
+## Composition and integration contracts
+
+Campaign has one required platform dependency: Core. Optional module behavior
+is discovered through versioned, Core-mediated capabilities; Campaign must not
+import optional sibling ORM, services, or WebUI implementation.
+
+Current principal contracts include:
+
+| Contract | Direction | Purpose |
+| --- | --- | --- |
+| `mail.campaign_delivery` 0.2.x | Mail -> Campaign | Summarize a known reference; authorize and revision-gate it; send/append using Mail-owned configuration and credentials; return sanitized results |
+| `files.campaign_attachments` 0.1.x | Files -> Campaign | Select/materialize governed file versions and preserve campaign usage/evidence |
+| `addresses.lookup` 0.1.x | Addresses -> Campaign | Optional address suggestions |
+| `addresses.recipient_source` 0.1.x | Addresses -> Campaign | Optional versioned recipient-source snapshots |
+| `campaigns.access` 0.1.x | Campaign -> platform | Explain campaign access/existence without exporting ORM objects |
+| `campaigns.mail_policy_context` 0.1.x | Campaign -> Mail | Resolve campaign tenant/owner context for Mail policy |
+| `campaigns.delivery_tasks` 0.1.x | Campaign -> workers | Execute narrow queued send/append tasks |
+| `campaigns.retention` 0.1.x | Campaign -> retention | Apply Campaign-owned retention behavior |
+
+Breaking payload or ownership changes require an interface-version bump and a
+release-composition alignment gate. Optional absence must be tested physically,
+not only hidden in navigation.
+
+### External API expectations
+
+- Tenant and campaign access are evaluated for every operation.
+- Writes require CSRF/auth behavior supplied by Core and the specific declared
+  scope.
+- Queue/retry/reconcile endpoints operate on persisted state and return safe
+  summaries; initiating HTTP success is not proof of external delivery.
+- Delta endpoints are optimization surfaces, not a separate source of truth.
+- Report exports contain permitted business/evidence fields but no credentials,
+  local paths, storage keys, or worker claims.
+
+## Assurance model
+
+### Security invariants
+
+- No new campaign payload, fixture, response, or execution snapshot contains
+  SMTP/IMAP settings or credentials.
+- Mail resolves credentials and performs transports inside Mail-owned calls.
+- Every real connector peer is validated and pinned at connection time under
+  deployment-wide private-network policy.
+- API/server attachment paths use managed Files references; arbitrary and
+  traversal-capable local paths are rejected.
+- Public responses recursively remove infrastructure locators and secret-like
+  legacy fields.
+- Accepted and outcome-unknown jobs are protected from ordinary retry.
+- Diagnostic permission is separate from campaign read/report access.
+
+### Privacy
+
+Recipient fields and rendered messages may contain personal or sensitive data.
+Grant recipient read/export, report export, and diagnostic access separately.
+Prefer aggregate status for readers who do not need recipient detail. Define
+purpose, lawful basis, minimization, export control, and retention before the
+campaign starts; do not use Campaign as a substitute consent or address-master
+system.
+
+### Audit and destructive actions
+
+Material authoring, validation, locking, review, queueing, send, retry,
+reconciliation, sharing, owner transfer, archive, and permitted deletion actions
+emit attributable evidence. Audit details must be non-secret and should refer to
+stable ids rather than repeat message bodies or credentials.
+
+Draft deletion is allowed only while no audit-relevant build, delivery job, or
+lock exists. Evidence-bearing campaigns are archived. Destructive module
+retirement remains a separately confirmed installer operation with backup and
+retirement evidence.
+
+## Reference-composition acceptance
+
+Campaign is ready to serve as the demonstration module only when all of the
+following are repeatable in a pinned clean installation:
+
+1. The maintained examples validate and build with Mail/Files present, and
+   Campaign still starts with each optional module absent.
+2. A user can import recipients, select managed files, choose an authorized Mail
+   profile, validate, review, build, and queue without entering transport ids or
+   secrets manually.
+3. Campaign JSON and all ordinary APIs reject/omit inline transport material;
+   legacy records are visible as migration-required and cannot execute.
+4. SMTP success, temporary/permanent failure, connection loss, worker loss,
+   outcome unknown, retry, reconciliation, IMAP success, and IMAP failure have
+   tested, non-duplicating outcomes against the target environment.
+5. Author, reviewer, sender/operator, reader, and administrator views use the
+   central component system and expose only task-relevant actions.
+6. Reports and audit can reconstruct recipient/message/file/profile/attempt
+   evidence without exposing secrets or ordinary-reader infrastructure details.
+7. Clean install, upgrade, backup/restore, module permutations, version
+   alignment, security audit, and target SMTP/IMAP tests pass.
+8. This handbook and its adaptive Docs topics match the shipped UI wording and
+   distinguish implemented behavior from planned work.
+
+## Explicitly planned, not yet claimed
+
+The following are part of the selected reference journey but are not implied by
+the current baseline:
+
+- the final audited **test / single send / single resend** semantics;
+- reusable SMTP batch sessions and their measured throughput benefit;
+- durable, idempotent Campaign report delivery through a Mail-owned outbox
+  ([`govoplan-mail#17`](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17));
+- a fully packaged one-command Campaign reference composition with production
+  policy presets and target-provider certification;
+- function-bound Postbox delivery (stage 2 of the reference program);
+- generic workflow-driven campaign transitions.
+
+Each item needs an owning issue, implementation, failure tests, documentation,
+and release evidence before the wording above can move from planned to current.

docs/EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md

@@ -16,8 +16,8 @@ schema and are safe to run in non-production environments.
 - campaign with global attachments and recipient-specific attachment rules
 - campaign with password-protected ZIP attachments
 - campaign using a reusable mail profile from the mail module
-- campaign using inline SMTP/IMAP settings where policy allows campaign-local
-  settings
+- legacy inline SMTP/IMAP campaign rejected with an actionable profile-migration
+  error and no returned transport data
 - campaign with validation warnings that may be sent only after explicit review
 - campaign with blocked recipients or attachment errors that must not be sent
 - mock delivery campaign that captures SMTP and IMAP append messages in the mail
@@ -28,8 +28,8 @@ schema and are safe to run in non-production environments.
 
 - Examples must not contain production recipient data or production credentials.
 - Attachment examples should use deterministic small files and checksums.
-- Secret values must be represented through saved-credential placeholders or
-  secret references.
+- Mail secrets belong only to encrypted Mail profiles and must never appear in
+  a campaign fixture, placeholder, or campaign-local secret reference.
 - Examples that require optional modules must declare the required modules and
   capabilities in their README or fixture metadata.
 - Examples must stay valid when files or mail modules are physically absent,
@@ -49,8 +49,10 @@ Before tagging a campaign release:
 - Run the GreenMail SMTP/IMAP smoke for a non-production real delivery path.
 - Confirm reusable mail profile selection is revalidated after campaign owner
   transfer.
-- Confirm inline SMTP/IMAP settings are hidden or blocked when policy disables
-  campaign-local mail settings.
+- Confirm every inline SMTP/IMAP field is rejected on import/write, omitted
+  from responses, and blocked from legacy execution until explicitly migrated.
+- Confirm execution snapshots store only the Mail profile reference and
+  opaque Mail-owned transport revisions, not resolved transport material.
 - Confirm delivery reports include SMTP outcome, IMAP append outcome, latest
   error, generated EML reference, and attachment evidence.
 - Confirm retries cannot resend messages already accepted by SMTP unless an
@@ -71,6 +73,6 @@ Use the Review & Send preflight panel and the delivery runbook together:
 2. Build exact messages.
 3. Review warnings, generated recipients, body content, and attachment evidence.
 4. Run mock delivery if available for the release channel.
-5. Test SMTP and IMAP settings against non-production infrastructure.
+5. Test the selected Mail profile against non-production infrastructure.
 6. Send only after queue, rate limit, and append-to-Sent behavior are understood.
 7. Reconcile failed, unknown, or pending jobs from the report/audit surfaces.

docs/MAIL_PROFILE_BOUNDARY.md

@@ -0,0 +1,93 @@
+# Campaign and Mail Profile Boundary
+
+## Product view
+
+A campaign chooses an authorized Mail profile. It does not define a mail
+server. The Campaign module owns recipients, content, attachment rules,
+delivery intent, review state, and delivery evidence. The Mail module owns the
+SMTP/IMAP endpoints, encrypted credentials, connection tests, profile policy,
+and runtime transport adapters.
+
+The persisted campaign contract is therefore deliberately narrow:
+
+```json
+{
+  "server": {
+    "mail_profile_id": "stable-mail-profile-id"
+  }
+}
+```
+
+No `server.smtp`, `server.imap`, `server.credentials`, credential-inheritance
+override, or password is valid campaign JSON.
+
+## User journey
+
+1. A Mail administrator creates and tests a reusable profile in Mail.
+2. A campaign author opens **Mail settings** and selects one profile available
+   for the campaign's tenant, owner, and policy context.
+3. Campaign stores only the stable profile identifier.
+4. Validation asks Mail to authorize the active profile and returns only
+   availability flags plus opaque Mail-owned transport revisions. Reading that
+   summary does not decrypt credentials.
+5. Build stores the profile identifier, delivery policy, job manifest, and
+   non-secret transport revisions as execution evidence. It stores no
+   resolved host, username, password, or other transport material.
+6. A delivery worker invokes one Mail-owned effect operation. Mail re-authorizes
+   the profile, resolves credentials, compares the expected transport
+   revision, checks policy, and sends or appends without returning transport
+   material to Campaign. If the selected profile or its non-secret transport settings
+   changed after build, delivery stops until the campaign is revalidated and
+   rebuilt. A password rotation that leaves the transport identity unchanged
+   does not invalidate the build.
+7. Mail returns only Campaign-owned envelope addresses, counts, sanitized
+   refusal classifications/status codes, or the selected Sent folder. Raw
+   server banners, provider bytes, host details, and credentials never enter
+   Campaign attempts or public evidence.
+
+Non-dry Campaign report email currently fails closed. It must not bypass the
+durable job/effect model through a direct SMTP call. Re-enabling it requires the
+Mail-owned idempotent outbox, attempt, unknown-outcome, and reconciliation path
+tracked in
+[`govoplan-mail#17`](https://git.add-ideas.de/add-ideas/govoplan-mail/issues/17).
+Report generation and dry-run validation remain separate from an external
+effect; recipient-level exports require recipient-export authorization.
+
+Campaign authors need `mail:profile:use` in addition to the relevant Campaign
+permission. Profile visibility remains governed by Mail policy and campaign
+owner context.
+
+## Existing database rows and migration
+
+The current database can contain campaign versions with inline SMTP/IMAP
+settings or credentials. There is no separate historical Campaign JSON corpus
+to import or remediate. GovOPlaN treats those inline fields as inert legacy
+material and does not delete or rewrite the stored audit rows automatically:
+
+- API responses omit all legacy transport fields and secrets and expose a
+  `mail_profile_migration_required` marker.
+- validation, build, queue, retry, and delivery fail closed with an actionable
+  profile-migration error;
+- unrelated edits cannot silently scrub the legacy fields;
+- an editable version is migrated only through an explicit Mail-settings save
+  with an authorized profile; and
+- a locked version remains unchanged. Creating its editable successor records
+  the migration while retaining the locked source as audit evidence.
+
+Legacy execution snapshots are likewise retained but cannot be used for
+delivery. Revalidate and rebuild an editable profile-only version. Normal
+database backup, restore, encryption, and access controls apply to the current
+database as a whole; the product does not define a separate historical-JSON or
+inline-secret recovery workflow. A restored legacy row remains inert and
+fail-closed under the same rules.
+
+## Operator checks
+
+Before live delivery, confirm that:
+
+- the profile is active and still authorized for the campaign owner;
+- SMTP and optional IMAP profile tests pass;
+- validation and build occurred after the latest transport-identity change;
+- append-to-Sent is enabled only when the selected profile has IMAP; and
+- reports show the profile-bound snapshot revisions and delivery outcomes,
+  never credentials or resolved transport configuration.

docs/RECIPIENT_ADDRESS_BOUNDARY.md

@@ -1,8 +1,8 @@
 # Recipient And Address Management Boundary
 
-Campaigns currently own campaign-local recipient entries because sending and
-reporting need a frozen recipient snapshot. Long-lived address management is a
-separate domain and should move to `govoplan-addresses`.
+Campaigns own campaign-local recipient entries because sending and reporting
+need a frozen recipient snapshot. Long-lived address management is a separate
+domain owned by `govoplan-addresses`.
 
 ## `govoplan-campaign` Owns
 
@@ -16,7 +16,7 @@ separate domain and should move to `govoplan-addresses`.
 Campaign data is immutable once a version is built for sending. Later address
 book changes must not rewrite historical campaign evidence.
 
-## `govoplan-addresses` Should Own
+## `govoplan-addresses` Owns
 
 - Adrema-style address management
 - reusable person, organization, household, and postal-address records
@@ -27,15 +27,25 @@ book changes must not rewrite historical campaign evidence.
 - import/export of reusable address directories
 - address quality checks and change history
 
-The addresses module should provide stable DTOs and capabilities that campaigns,
-mail, forms, reporting, portal, and postbox modules can consume without direct
-imports.
+The addresses module provides the UI/module boundary for this domain and should
+grow stable DTOs and capabilities that campaigns, mail, forms, reporting,
+portal, and postbox modules can consume without direct imports.
 
-## Integration Contract
+## Current Integration Contract
 
-The campaign module should ask the platform whether the addresses module is
-installed. When present, campaign can offer address-source choices through a
-capability such as `addresses.recipientSource`.
+The campaign module asks the platform registry for address capabilities and
+keeps working when they are absent. It must not import `govoplan-addresses`
+ORM models, services, or WebUI components.
+
+When `addresses.lookup` is available, campaign recipient address fields use it
+for autocomplete. The campaign page may warm a small suggestion cache with an
+empty query and then query by typed text as the user edits sender, reply-to,
+global recipient, or per-recipient address fields.
+
+When `addresses.recipient_source` is available, campaign offers a separate
+address-book/list import flow. This is for importing reusable recipient sources
+into the campaign recipient table; normal one-off address entry still happens
+inside the address fields while typing.
 
 The capability should return snapshots, not live ORM objects:
 
@@ -49,6 +59,11 @@ Campaign stores the resolved snapshot in the campaign version. It may keep a
 reference to the address source for traceability, but the built campaign remains
 auditable even if the address source changes later.
 
+If the source revision changes after import, campaign shows a stale-source
+warning and lets the user reopen the import dialog with that source preselected.
+The user still chooses append or replace; campaign should not silently rewrite
+recipient rows.
+
 ## Non-Goals For Campaign
 
 Campaign should not become the global address book. It should not own:

docs/RECIPIENT_IMPORT_GUIDE.md

@@ -1,8 +1,8 @@
 # Recipient Import Guide
 
 Recipient import lets campaign authors turn spreadsheet-like source data into
-campaign-local recipient entries. It is intentionally campaign-local today:
-reusable address books and Adrema-style address management belong in the future
+campaign-local recipient entries. It is intentionally campaign-local:
+reusable address books and Adrema-style address management belong in the
 `govoplan-addresses` module.
 
 ## Supported Inputs
@@ -66,7 +66,7 @@ Administrators should:
 
 - define naming conventions for recurring mapping profiles
 - verify that imported fields have a lawful processing basis for the campaign
-- keep reusable address-directory ownership out of campaigns until
+- keep reusable address-directory ownership out of campaigns because
   `govoplan-addresses` owns that domain
 - use campaign reports and audit evidence to trace which source produced which
   recipient entries

examples/README.md

@@ -15,7 +15,7 @@ campaign schema and do not require production data.
 | `recipient-attachment-rules` | core, access, campaigns; optional files | Match recipient-specific attachment rules and verify per-recipient evidence. |
 | `zip-protected` | core, access, campaigns | Build password-protected AES ZIP output and verify password-source metadata. |
 | `mail-profile-send` | core, access, campaigns, mail | Select a reusable mail profile and send through the GreenMail test bed. |
-| `inline-mail-settings` | core, access, campaigns, mail | Use campaign-local SMTP/IMAP settings only when policy allows it. |
+| `legacy-inline-mail-rejected` | core, access, campaigns, mail | Confirm legacy campaign-local SMTP/IMAP data fails closed and requires explicit profile migration. |
 | `warnings-review` | core, access, campaigns | Require explicit review before queueing jobs with warnings. |
 | `blocked-send` | core, access, campaigns | Confirm blocked recipients or missing attachments cannot be queued. |
 | `mock-delivery` | core, access, campaigns, mail with dev capability | Capture messages in the development mailbox. |
@@ -26,8 +26,8 @@ campaign schema and do not require production data.
 - Do not commit real recipients, mail credentials, or production attachment
   names.
 - Keep attachments deterministic and small.
-- Store secrets as placeholders, saved-credential references, or local `.env`
-  values consumed by the test bed.
+- Store transport secrets only in encrypted Mail profiles or local `.env`
+  values consumed directly by the test bed, never in campaign JSON.
 - Declare optional module requirements in fixture metadata.
 - Fixtures must not import files or mail modules directly; optional behavior is
   discovered through core module metadata and capabilities.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/campaign-webui",
-  "version": "0.1.6",
+  "version": "0.1.10",
   "private": true,
   "type": "module",
   "main": "webui/src/index.ts",
@@ -22,7 +22,7 @@
     "read-excel-file": "9.2.0"
   },
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.6",
+    "@govoplan/core-webui": "^0.1.12",
     "lucide-react": "^1.23.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",

pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-campaign"
-version = "0.1.6"
+version = "0.1.10"
 description = "GovOPlaN campaigns module with backend and WebUI integration."
 readme = "README.md"
 requires-python = ">=3.12"
 license = { file = "LICENSE" }
 authors = [{ name = "GovOPlaN" }]
 dependencies = [
-  "govoplan-core>=0.1.6",
+  "govoplan-core>=0.1.8",
   "jsonschema>=4,<5",
   "pydantic>=2,<3",
   "SQLAlchemy>=2,<3",

src/govoplan_campaign/backend/attachments/resolver.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import fnmatch
-import re
 import time
 from dataclasses import dataclass, field
 from enum import StrEnum
@@ -13,6 +12,12 @@ from pydantic import BaseModel, ConfigDict, Field
 from govoplan_campaign.backend.campaign.entries import load_campaign_entries
 from govoplan_campaign.backend.campaign.template_values import build_template_values
 from govoplan_campaign.backend.campaign.models import AttachmentBasePathConfig, AttachmentConfig, Behavior, CampaignConfig, EntryConfig, ZipArchiveConfig, ZipRuleMode
+from govoplan_campaign.backend.path_security import (
+    CampaignPathSecurityError,
+    assert_logical_relative_path,
+    is_managed_source,
+)
+from govoplan_campaign.backend.template_rendering import render_template
 
 
 class AttachmentScope(StrEnum):
@@ -140,43 +145,8 @@ def _resolve_path(campaign_file: str | Path, raw_path: str) -> Path:
     return (campaign_path.parent / path).resolve()
 
 
-_DOLLAR_FIELD_PATTERN = re.compile(r"(?<!\\)\$\{(.*?)(?<!\\)\}")
-_BRACE_FIELD_PATTERN = re.compile(r"(?<!\\)\{\{\s*(.*?)\s*\}\}")
-
-
-def _normalize_template_key(raw: str) -> str:
-    key = raw.strip()
-    if key.startswith("fields."):
-        key = key.removeprefix("fields.")
-    elif key.startswith("local."):
-        key = "local::" + key.removeprefix("local.")
-    elif key.startswith("global."):
-        key = "global::" + key.removeprefix("global.")
-
-    if key.startswith("local::") or key.startswith("global::"):
-        return key
-    if key.startswith("local:"):
-        return "local::" + key.removeprefix("local:")
-    if key.startswith("global:"):
-        return "global::" + key.removeprefix("global:")
-    return key
-
-
-def _render_template(template: str, values: dict[str, Any]) -> str:
-    def replace(match: re.Match[str]) -> str:
-        key = _normalize_template_key(match.group(1))
-        if key in values:
-            value = values[key]
-            return "" if value is None else str(value)
-        return match.group(0)
-
-    rendered = _DOLLAR_FIELD_PATTERN.sub(replace, template)
-    rendered = _BRACE_FIELD_PATTERN.sub(replace, rendered)
-    return rendered.replace(r"\${", "${").replace(r"\}", "}")
-
-
 def _rendered_base_dir(config: AttachmentConfig, values: dict[str, Any]) -> str:
-    rendered = _render_template(config.base_dir, values).strip()
+    rendered = render_template(config.base_dir, values, keep_missing=True).strip()
     return rendered or "."
 
 
@@ -260,7 +230,7 @@ def _attachment_zip_archive(
 def _render_zip_filename(archive: ZipArchiveConfig | None, values: dict[str, Any]) -> str | None:
     if archive is None:
         return None
-    rendered = _render_template(archive.name or "attachments.zip", values).strip() or "attachments.zip"
+    rendered = render_template(archive.name or "attachments.zip", values, keep_missing=True).strip() or "attachments.zip"
     return rendered if rendered.lower().endswith(".zip") else f"{rendered}.zip"
 
 
@@ -369,6 +339,23 @@ def _match_files(directory: Path, file_filter: str, include_subdirs: bool, match
     return sorted(path for path in directory.glob(file_filter) if path.is_file())
 
 
+def _confine_managed_matches(directory: Path, matches: list[Path]) -> tuple[list[Path], bool]:
+    root = directory.resolve()
+    confined: list[Path] = []
+    rejected = False
+    for match in matches:
+        try:
+            resolved = match.resolve()
+        except (OSError, RuntimeError):
+            rejected = True
+            continue
+        if not resolved.is_relative_to(root):
+            rejected = True
+            continue
+        confined.append(match)
+    return confined, rejected
+
+
 def _issue_for_missing(config: AttachmentConfig, behavior: Behavior) -> AttachmentIssue:
     code = "missing_required_attachment" if config.required else "missing_optional_attachment"
     severity = ResolutionSeverity.ERROR if config.required and behavior == Behavior.BLOCK else ResolutionSeverity.WARNING
@@ -390,6 +377,27 @@ def _issue_for_ambiguous(config: AttachmentConfig, behavior: Behavior, match_cou
     )
 
 
+def _send_without_attachments_behavior(config: CampaignConfig) -> Behavior:
+    return config.attachments.send_without_attachments_behavior or (
+        Behavior.CONTINUE if config.attachments.send_without_attachments else Behavior.BLOCK
+    )
+
+
+def _issue_for_missing_attachment_coverage(behavior: Behavior) -> AttachmentIssue:
+    messages = {
+        Behavior.BLOCK: "No attachment file was resolved for this message, and campaign policy blocks sending without attachments.",
+        Behavior.ASK: "No attachment file was resolved for this message. Confirm the message should still be sent.",
+        Behavior.DROP: "No attachment file was resolved for this message. Campaign policy excludes messages without attachments.",
+        Behavior.WARN: "No attachment file was resolved for this message. Campaign policy allows sending with a warning.",
+    }
+    return AttachmentIssue(
+        severity=ResolutionSeverity.ERROR if behavior == Behavior.BLOCK else ResolutionSeverity.WARNING,
+        code="missing_attachment_coverage",
+        message=messages.get(behavior, "No attachment file was resolved for this message."),
+        behavior=behavior,
+    )
+
+
 def _resolve_one_config(
     *,
     campaign_file: str | Path,
@@ -401,20 +409,57 @@ def _resolve_one_config(
     match_index: AttachmentMatchIndex | None = None,
 ) -> ResolvedAttachment:
     rendered_base_dir = _rendered_base_dir(config, values)
-    rendered_file_filter = _render_template(config.file_filter, values)
+    rendered_file_filter = render_template(config.file_filter, values, keep_missing=True)
     directory, selected_base_path = _resolve_attachment_directory(
         campaign_file=campaign_file,
         campaign_config=campaign_config,
         attachment_config=config,
         rendered_base_dir=rendered_base_dir,
     )
-    matches = _match_files(directory, rendered_file_filter, config.include_subdirs, match_index)
     allow_multiple = _rule_allows_multiple(config, rendered_file_filter)
 
     issues: list[AttachmentIssue] = []
     behavior: Behavior | None = None
+    managed_source = selected_base_path is not None and is_managed_source(selected_base_path.source)
+    unsafe_managed_path = False
+    if managed_source:
+        try:
+            assert_logical_relative_path(
+                rendered_file_filter,
+                field="rendered managed attachment file_filter",
+            )
+        except CampaignPathSecurityError as exc:
+            matches = []
+            unsafe_managed_path = True
+            issues.append(
+                AttachmentIssue(
+                    severity=ResolutionSeverity.ERROR,
+                    code="unsafe_managed_attachment_path",
+                    message=str(exc),
+                    behavior=Behavior.BLOCK,
+                )
+            )
+        else:
+            matches = _match_files(directory, rendered_file_filter, config.include_subdirs, match_index)
+            matches, rejected = _confine_managed_matches(directory, matches)
+            if rejected:
+                matches = []
+                unsafe_managed_path = True
+                issues.append(
+                    AttachmentIssue(
+                        severity=ResolutionSeverity.ERROR,
+                        code="managed_attachment_path_escape",
+                        message="A managed attachment match resolved outside its materialized source directory.",
+                        behavior=Behavior.BLOCK,
+                    )
+                )
+    else:
+        matches = _match_files(directory, rendered_file_filter, config.include_subdirs, match_index)
 
-    if not matches:
+    if unsafe_managed_path:
+        status = AttachmentMatchStatus.MISSING
+        behavior = Behavior.BLOCK
+    elif not matches:
         status = AttachmentMatchStatus.MISSING
         behavior = _missing_behavior(campaign_config, config)
         issues.append(_issue_for_missing(config, behavior))
@@ -495,6 +540,15 @@ def resolve_entry_attachments(
             )
 
     issues = [issue for item in resolved for issue in item.issues]
+    missing_coverage_behavior = _send_without_attachments_behavior(config)
+    if (
+        entry.active
+        and resolved
+        and missing_coverage_behavior != Behavior.CONTINUE
+        and sum(len(item.matches) for item in resolved) == 0
+        and not any(issue.behavior == Behavior.BLOCK for issue in issues)
+    ):
+        issues.append(_issue_for_missing_attachment_coverage(missing_coverage_behavior))
     return EntryAttachmentResolution(
         entry_index=entry_index,
         entry_id=entry.id,

src/govoplan_campaign/backend/campaign/loader.py

@@ -7,6 +7,7 @@ from typing import Any
 
 from jsonschema import Draft202012Validator, FormatChecker
 
+from .mail_profile_boundary import assert_campaign_uses_mail_profile_reference
 from .models import CampaignConfig
 
 
@@ -83,6 +84,7 @@ def load_campaign_config(
     schema_path: str | Path | None = None,
 ) -> CampaignConfig:
     data = load_campaign_json(path)
+    assert_campaign_uses_mail_profile_reference(data)
     if validate_schema:
         validate_against_schema(data, schema_path=schema_path)
     return CampaignConfig.model_validate(data)

src/govoplan_campaign/backend/campaign/mail_profile_boundary.py

@@ -0,0 +1,258 @@
+from __future__ import annotations
+
+import copy
+from typing import Any
+
+
+CAMPAIGN_MAIL_SERVER_KEYS = frozenset({"mail_profile_id"})
+CAMPAIGN_CLIENT_EDITOR_STATE_KEYS = frozenset({"created_from", "field_overrides", "opt_ins"})
+CAMPAIGN_OPT_IN_KEYS = frozenset(
+    {"campaign_address_suggestions", "remember_used_addresses", "inline_guidance"}
+)
+CAMPAIGN_REVIEW_STATE_KEYS = frozenset(
+    {
+        "build_token",
+        "inspection_complete",
+        "reviewed_message_keys",
+        "updated_at",
+        "updated_by_user_id",
+    }
+)
+
+
+class CampaignMailProfileBoundaryError(ValueError):
+    """Raised when campaign JSON owns mail transport configuration.
+
+    SMTP/IMAP endpoints and credentials are Mail-module data. Campaign JSON
+    may select one Mail-owned profile, but it must never copy or override that
+    profile's transport configuration.
+    """
+
+
+def _validated_opt_ins(value: Any) -> dict[str, bool]:
+    if not isinstance(value, dict) or any(
+        key not in CAMPAIGN_OPT_IN_KEYS for key in value
+    ):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign editor opt_ins contains unsupported fields"
+        )
+    if any(not isinstance(item, bool) for item in value.values()):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign editor opt_ins values must be booleans"
+        )
+    return copy.deepcopy(value)
+
+
+def _is_valid_field_override(key: Any, value: Any) -> bool:
+    return (
+        isinstance(key, str)
+        and bool(key.strip())
+        and len(key) <= 256
+        and isinstance(value, bool)
+    )
+
+
+def _validated_field_overrides(value: Any) -> dict[str, bool]:
+    if not isinstance(value, dict) or len(value) > 10_000:
+        raise CampaignMailProfileBoundaryError(
+            "Campaign editor field_overrides must be a bounded object"
+        )
+    if any(not _is_valid_field_override(key, item) for key, item in value.items()):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign editor field_overrides must map short field names to booleans"
+        )
+    return copy.deepcopy(value)
+
+
+def _validated_required_string(value: Any, *, max_length: int, error: str) -> str:
+    if not isinstance(value, str) or not value.strip() or len(value) > max_length:
+        raise CampaignMailProfileBoundaryError(error)
+    return value.strip()
+
+
+def validate_campaign_editor_state(
+    value: dict[str, Any] | None,
+    *,
+    allow_server_review_state: bool = False,
+) -> dict[str, Any]:
+    """Validate the bounded Campaign-owned UI metadata contract.
+
+    Arbitrary editor metadata would be a second, weakly typed persistence and
+    response channel for Mail credentials. Review evidence is server-owned and
+    cannot be supplied through ordinary version create/update requests.
+    """
+
+    if value is None:
+        return {}
+    if not isinstance(value, dict):
+        raise CampaignMailProfileBoundaryError("Campaign editor state must be an object")
+    allowed = set(CAMPAIGN_CLIENT_EDITOR_STATE_KEYS)
+    if allow_server_review_state:
+        allowed.add("review_send")
+    if any(key not in allowed for key in value):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign editor state contains unsupported or transport-owned fields"
+        )
+
+    result: dict[str, Any] = {}
+    if "created_from" in value:
+        result["created_from"] = _validated_required_string(
+            value["created_from"],
+            max_length=128,
+            error="Campaign editor created_from must be a short string",
+        )
+    if "opt_ins" in value:
+        result["opt_ins"] = _validated_opt_ins(value["opt_ins"])
+    if "field_overrides" in value:
+        result["field_overrides"] = _validated_field_overrides(
+            value["field_overrides"]
+        )
+    if "review_send" in value:
+        result["review_send"] = _validated_server_review_state(value["review_send"])
+    return result
+
+
+def public_campaign_editor_state(
+    value: Any,
+    *,
+    include_diagnostics: bool = False,
+) -> dict[str, Any]:
+    """Return only known non-secret UI metadata from current or legacy rows."""
+
+    if not isinstance(value, dict):
+        return {}
+    result: dict[str, Any] = {}
+    for key in CAMPAIGN_CLIENT_EDITOR_STATE_KEYS:
+        if key not in value:
+            continue
+        try:
+            result.update(validate_campaign_editor_state({key: value[key]}))
+        except CampaignMailProfileBoundaryError:
+            continue
+    if "review_send" in value:
+        try:
+            review_state = _validated_server_review_state(value["review_send"])
+            if not include_diagnostics:
+                review_state.pop("build_token", None)
+            result["review_send"] = review_state
+        except CampaignMailProfileBoundaryError:
+            pass
+    return result
+
+
+def campaign_editor_state_for_edit(value: Any) -> dict[str, Any]:
+    """Copy only client-owned safe metadata into a new editable version."""
+
+    state = public_campaign_editor_state(value)
+    state.pop("review_send", None)
+    return state
+
+
+def _is_valid_reviewed_message_key(value: Any) -> bool:
+    return isinstance(value, str) and bool(value.strip()) and len(value) <= 512
+
+
+def _validated_reviewed_message_keys(value: Any) -> list[str]:
+    if not isinstance(value, list) or len(value) > 100_000:
+        raise CampaignMailProfileBoundaryError(
+            "Campaign reviewed message keys are invalid"
+        )
+    if any(not _is_valid_reviewed_message_key(key) for key in value):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign reviewed message keys are invalid"
+        )
+    return list(dict.fromkeys(key.strip() for key in value))
+
+
+def _validated_review_actor(value: Any) -> str | None:
+    if value is not None and (not isinstance(value, str) or len(value) > 256):
+        raise CampaignMailProfileBoundaryError("Campaign review actor is invalid")
+    return value
+
+
+def _validated_server_review_state(value: Any) -> dict[str, Any]:
+    if not isinstance(value, dict) or any(
+        key not in CAMPAIGN_REVIEW_STATE_KEYS for key in value
+    ):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign review editor state is invalid"
+        )
+    build_token = value.get("build_token")
+    inspected = value.get("inspection_complete")
+    keys = value.get("reviewed_message_keys", [])
+    updated_at = value.get("updated_at")
+    updated_by = value.get("updated_by_user_id")
+    validated_build_token = _validated_required_string(
+        build_token,
+        max_length=256,
+        error="Campaign review build token is invalid",
+    )
+    if not isinstance(inspected, bool):
+        raise CampaignMailProfileBoundaryError(
+            "Campaign review completion state is invalid"
+        )
+    validated_keys = _validated_reviewed_message_keys(keys)
+    validated_updated_at = _validated_required_string(
+        updated_at,
+        max_length=128,
+        error="Campaign review timestamp is invalid",
+    )
+    validated_updated_by = _validated_review_actor(updated_by)
+    return {
+        "build_token": validated_build_token,
+        "inspection_complete": inspected,
+        "reviewed_message_keys": validated_keys,
+        "updated_at": validated_updated_at,
+        "updated_by_user_id": validated_updated_by,
+    }
+
+
+def campaign_mail_profile_id(raw_json: dict[str, Any] | None) -> str | None:
+    server = raw_json.get("server") if isinstance(raw_json, dict) else None
+    if not isinstance(server, dict):
+        return None
+    value = server.get("mail_profile_id")
+    if not isinstance(value, str):
+        return None
+    normalized = value.strip()
+    return normalized or None
+
+
+def campaign_mail_profile_boundary_violations(raw_json: dict[str, Any] | None) -> tuple[str, ...]:
+    server = raw_json.get("server") if isinstance(raw_json, dict) else None
+    if not isinstance(server, dict):
+        return ()
+
+    violations = [f"/server/{key}" for key in sorted(server) if key not in CAMPAIGN_MAIL_SERVER_KEYS]
+    if "mail_profile_id" in server:
+        profile_id = server["mail_profile_id"]
+        if not isinstance(profile_id, str) or not profile_id.strip():
+            violations.append("/server/mail_profile_id")
+    return tuple(violations)
+
+
+def assert_campaign_uses_mail_profile_reference(
+    raw_json: dict[str, Any] | None,
+    *,
+    require_profile: bool = False,
+) -> None:
+    violations = campaign_mail_profile_boundary_violations(raw_json)
+    if violations:
+        fields = ", ".join(violations)
+        raise CampaignMailProfileBoundaryError(
+            "Campaign JSON may only reference a Mail-module profile through "
+            f"server.mail_profile_id; remove campaign-local SMTP/IMAP settings ({fields}), "
+            "select an authorized Mail profile, and save a new campaign version."
+        )
+    if require_profile and campaign_mail_profile_id(raw_json) is None:
+        raise CampaignMailProfileBoundaryError(
+            "Campaign delivery requires server.mail_profile_id. Select an authorized, active "
+            "profile from the Mail module and validate the campaign again."
+        )
+
+
+def public_campaign_mail_server(raw_json: dict[str, Any] | None) -> dict[str, str]:
+    """Return the complete public/persisted Campaign-to-Mail contract."""
+
+    profile_id = campaign_mail_profile_id(raw_json)
+    return {"mail_profile_id": profile_id} if profile_id else {}

src/govoplan_campaign/backend/campaign/models.py

@@ -6,8 +6,6 @@ from typing import Any, Literal
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
-from govoplan_core.mail.config import ImapConfig, ImapServerConfig, SmtpConfig, SmtpServerConfig, TransportCredentials, TransportSecurity
-
 
 class StrictModel(BaseModel):
     model_config = ConfigDict(extra="forbid", populate_by_name=True)
@@ -24,7 +22,7 @@ class FieldType(StrEnum):
     INTEGER = "integer"
     DOUBLE = "double"
     DATE = "date"
-    PASSWORD = "password"
+    PASSWORD = "password"  # noqa: S105  # nosec B105 - field type vocabulary.
 
 
 class RecipientType(StrEnum):
@@ -91,6 +89,7 @@ class BuildStatus(StrEnum):
 class SendStatus(StrEnum):
     DRAFT = "draft"
     QUEUED = "queued"
+    SKIPPED = "skipped"
 
 
 class CampaignMeta(StrictModel):
@@ -108,58 +107,14 @@ class FieldDefinition(StrictModel):
     can_override: bool = True
 
 
-class MailServerCredentials(StrictModel):
-    smtp: TransportCredentials = Field(default_factory=TransportCredentials)
-    imap: TransportCredentials = Field(default_factory=TransportCredentials)
+class MailProfileCapabilities(StrictModel):
+    smtp_available: bool = False
+    imap_available: bool = False
 
 
 class ServerConfig(StrictModel):
     mail_profile_id: str | None = None
-    inherit_smtp_credentials: bool = True
-    inherit_imap_credentials: bool = True
-    smtp: SmtpServerConfig | None = None
-    imap: ImapServerConfig | None = None
-    credentials: MailServerCredentials = Field(default_factory=MailServerCredentials)
-
-    @model_validator(mode="before")
-    @classmethod
-    def normalize_legacy_credentials(cls, value: Any) -> Any:
-        if not isinstance(value, dict):
-            return value
-        data = dict(value)
-        credentials = data.get("credentials") if isinstance(data.get("credentials"), dict) else {}
-        credentials = {key: dict(item) for key, item in credentials.items() if isinstance(item, dict)}
-        for protocol in ("smtp", "imap"):
-            transport = data.get(protocol)
-            if not isinstance(transport, dict):
-                continue
-            next_transport = dict(transport)
-            next_credentials = dict(credentials.get(protocol) or {})
-            for field in ("username", "password"):
-                if field in next_transport and field not in next_credentials:
-                    next_credentials[field] = next_transport[field]
-                next_transport.pop(field, None)
-            next_transport.pop("enabled", None)
-            data[protocol] = next_transport
-            if next_credentials:
-                credentials[protocol] = next_credentials
-        if credentials:
-            data["credentials"] = credentials
-        return data
-
-    def runtime_smtp_config(self) -> SmtpConfig | None:
-        if self.smtp is None:
-            return None
-        payload = self.smtp.model_dump(mode="json")
-        payload.update(self.credentials.smtp.model_dump(mode="json", exclude_none=True))
-        return SmtpConfig.model_validate(payload)
-
-    def runtime_imap_config(self) -> ImapConfig | None:
-        if self.imap is None:
-            return None
-        payload = self.imap.model_dump(mode="json")
-        payload.update(self.credentials.imap.model_dump(mode="json", exclude_none=True))
-        return ImapConfig.model_validate(payload)
+    profile_capabilities: MailProfileCapabilities = Field(default_factory=MailProfileCapabilities)
 
 
 class RecipientConfig(StrictModel):
@@ -418,11 +373,20 @@ class AttachmentsConfig(StrictModel):
     base_paths: list[AttachmentBasePathConfig] = Field(default_factory=list)
     allow_individual: bool = False
     send_without_attachments: bool = True
+    send_without_attachments_behavior: Behavior | None = None
     zip: ZipCollectionConfig = Field(default_factory=ZipCollectionConfig)
     global_: list[AttachmentConfig] = Field(default_factory=list, alias="global")
     missing_behavior: Behavior = Behavior.ASK
     ambiguous_behavior: Behavior = Behavior.ASK
 
+    @model_validator(mode="after")
+    def normalize_send_without_attachments_behavior(self) -> "AttachmentsConfig":
+        if self.send_without_attachments_behavior is None:
+            self.send_without_attachments_behavior = Behavior.CONTINUE if self.send_without_attachments else Behavior.BLOCK
+        else:
+            self.send_without_attachments = self.send_without_attachments_behavior != Behavior.BLOCK
+        return self
+
     @property
     def individual_base_path_values(self) -> set[str]:
         return {base_path.path for base_path in self.base_paths if base_path.allow_individual}
@@ -501,7 +465,11 @@ class ImportProvenance(StrictModel):
     id: str
     imported_at: str
     mode: Literal["append", "replace"]
-    source_type: Literal["csv", "xlsx", "text"]
+    source_type: Literal["csv", "xlsx", "text", "addresses"]
+    source_id: str | None = None
+    source_label: str | None = None
+    source_revision: str | None = None
+    source_provenance: dict[str, Any] = Field(default_factory=dict)
     filename: str | None = None
     sheet_name: str | None = None
     encoding: str | None = None

src/govoplan_campaign/backend/campaign/validation.py

@@ -1,14 +1,17 @@
 from __future__ import annotations
 
 import csv
+from dataclasses import dataclass
 from enum import StrEnum
 from pathlib import Path
 from typing import Iterable
 
 from pydantic import BaseModel, ConfigDict, Field
 
+from .addressing import effective_address_lists
 from .field_values import ignored_entry_field_overrides
-from .models import AttachmentConfig, CampaignConfig, EntryConfig, FieldType, SourceType, ZipPasswordMode, ZipPasswordScope, ZipRuleMode
+from .models import AttachmentConfig, CampaignConfig, EntryConfig, FieldType, SourceType, ZipArchiveConfig, ZipPasswordMode, ZipPasswordScope, ZipRuleMode
+from ..attachments.resolver import resolve_campaign_attachments
 
 
 class Severity(StrEnum):
@@ -51,6 +54,13 @@ class SemanticReport(BaseModel):
         return self.error_count == 0
 
 
+@dataclass(frozen=True, slots=True)
+class _EntriesValidation:
+    mode: str
+    count: int | None
+    issues: list[SemanticIssue]
+
+
 def _issue(severity: Severity, code: str, message: str, path: str | None = None) -> SemanticIssue:
     return SemanticIssue(severity=severity, code=code, message=message, path=path)
 
@@ -200,57 +210,95 @@ def _attachment_path_issues(config: CampaignConfig) -> list[SemanticIssue]:
 
 def _zip_configuration_issues(config: CampaignConfig) -> list[SemanticIssue]:
     collection = config.attachments.zip
-    issues: list[SemanticIssue] = []
     if not collection.enabled:
-        return issues
+        return []
     if not collection.archives:
         return [_issue(Severity.ERROR, "zip_archive_missing", "Attachment zipping is enabled, but no ZIP archive is configured", "/attachments/zip/archives")]
 
+    issues, archive_ids, standard_count = _zip_archive_catalog_issues(config)
+    if standard_count != 1:
+        issues.append(_issue(Severity.ERROR, "zip_standard_archive_invalid", "Exactly one ZIP archive must be selected as the campaign standard", "/attachments/zip/archives"))
+    issues.extend(_zip_rule_selection_issues(config, archive_ids))
+    return issues
+
+
+def _zip_archive_catalog_issues(config: CampaignConfig) -> tuple[list[SemanticIssue], set[str], int]:
+    issues: list[SemanticIssue] = []
     archive_ids: set[str] = set()
     archive_names: set[str] = set()
     standard_count = 0
     field_definitions = {field.name: field for field in config.fields}
-    for index, archive in enumerate(collection.archives):
+    for index, archive in enumerate(config.attachments.zip.archives):
         path = f"/attachments/zip/archives/{index}"
-        if not archive.id.strip():
-            issues.append(_issue(Severity.ERROR, "zip_archive_id_missing", "ZIP archive has no identifier", f"{path}/id"))
-        elif archive.id in archive_ids:
-            issues.append(_issue(Severity.ERROR, "zip_archive_id_duplicate", f"ZIP archive id {archive.id!r} is used more than once", f"{path}/id"))
-        archive_ids.add(archive.id)
-        normalized_archive_name = _normalized_zip_archive_name(archive.name)
-        if not normalized_archive_name:
-            issues.append(_issue(Severity.ERROR, "zip_archive_name_missing", "ZIP archive has no filename", f"{path}/name"))
-        elif normalized_archive_name in archive_names:
-            issues.append(_issue(Severity.ERROR, "zip_archive_name_duplicate", f"ZIP archive filename {archive.name!r} is used more than once; archive filenames must be unique", f"{path}/name"))
-        archive_names.add(normalized_archive_name)
+        issues.extend(_zip_archive_identity_issues(archive, path, archive_ids, archive_names))
         if archive.standard:
             standard_count += 1
+        issues.extend(_zip_password_issues(config, archive, path, field_definitions))
+    return issues, archive_ids, standard_count
 
-        if not archive.password_enabled:
-            continue
-        if archive.password_mode == ZipPasswordMode.DIRECT:
-            if not (archive.password or ""):
-                issues.append(_issue(Severity.ERROR, "zip_password_missing", "A legacy fixed ZIP password is enabled, but no password is configured", f"{path}/password"))
-            continue
-        if archive.password_mode == ZipPasswordMode.TEMPLATE:
-            if not (archive.password_template or ""):
-                issues.append(_issue(Severity.ERROR, "zip_password_template_missing", "A legacy ZIP password template is enabled, but no template is configured", f"{path}/password_template"))
-            continue
 
-        field_name = (archive.password_field or "").strip()
-        field = field_definitions.get(field_name)
-        if not field_name:
-            issues.append(_issue(Severity.ERROR, "zip_password_field_missing", f"ZIP archive {archive.name!r} has password protection enabled, but no field is selected", f"{path}/password_field"))
-        elif field is None:
-            issues.append(_issue(Severity.ERROR, "zip_password_field_unknown", f"ZIP password field {field_name!r} is not declared in campaign fields", f"{path}/password_field"))
-        elif field.type != FieldType.PASSWORD:
-            issues.append(_issue(Severity.WARNING, "zip_password_field_not_password_type", f"ZIP password field {field_name!r} is not configured with field type 'password'", f"{path}/password_field"))
-        elif archive.password_scope == ZipPasswordScope.GLOBAL and config.global_values.get(field_name) in (None, ""):
-            issues.append(_issue(Severity.ERROR, "zip_global_password_value_missing", f"Global ZIP password field {field_name!r} has no campaign-wide value", f"/global_values/{field_name}"))
+def _zip_archive_identity_issues(
+    archive: ZipArchiveConfig,
+    path: str,
+    archive_ids: set[str],
+    archive_names: set[str],
+) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    if not archive.id.strip():
+        issues.append(_issue(Severity.ERROR, "zip_archive_id_missing", "ZIP archive has no identifier", f"{path}/id"))
+    elif archive.id in archive_ids:
+        issues.append(_issue(Severity.ERROR, "zip_archive_id_duplicate", f"ZIP archive id {archive.id!r} is used more than once", f"{path}/id"))
+    archive_ids.add(archive.id)
 
-    if standard_count != 1:
-        issues.append(_issue(Severity.ERROR, "zip_standard_archive_invalid", "Exactly one ZIP archive must be selected as the campaign standard", "/attachments/zip/archives"))
+    normalized_archive_name = _normalized_zip_archive_name(archive.name)
+    if not normalized_archive_name:
+        issues.append(_issue(Severity.ERROR, "zip_archive_name_missing", "ZIP archive has no filename", f"{path}/name"))
+    elif normalized_archive_name in archive_names:
+        issues.append(_issue(Severity.ERROR, "zip_archive_name_duplicate", f"ZIP archive filename {archive.name!r} is used more than once; archive filenames must be unique", f"{path}/name"))
+    archive_names.add(normalized_archive_name)
+    return issues
 
+
+def _zip_password_issues(
+    config: CampaignConfig,
+    archive: ZipArchiveConfig,
+    path: str,
+    field_definitions: dict[str, object],
+) -> list[SemanticIssue]:
+    if not archive.password_enabled:
+        return []
+    if archive.password_mode == ZipPasswordMode.DIRECT:
+        if not (archive.password or ""):
+            return [_issue(Severity.ERROR, "zip_password_missing", "A legacy fixed ZIP password is enabled, but no password is configured", f"{path}/password")]
+        return []
+    if archive.password_mode == ZipPasswordMode.TEMPLATE:
+        if not (archive.password_template or ""):
+            return [_issue(Severity.ERROR, "zip_password_template_missing", "A legacy ZIP password template is enabled, but no template is configured", f"{path}/password_template")]
+        return []
+    return _zip_password_field_issues(config, archive, path, field_definitions)
+
+
+def _zip_password_field_issues(
+    config: CampaignConfig,
+    archive: ZipArchiveConfig,
+    path: str,
+    field_definitions: dict[str, object],
+) -> list[SemanticIssue]:
+    field_name = (archive.password_field or "").strip()
+    field = field_definitions.get(field_name)
+    if not field_name:
+        return [_issue(Severity.ERROR, "zip_password_field_missing", f"ZIP archive {archive.name!r} has password protection enabled, but no field is selected", f"{path}/password_field")]
+    if field is None:
+        return [_issue(Severity.ERROR, "zip_password_field_unknown", f"ZIP password field {field_name!r} is not declared in campaign fields", f"{path}/password_field")]
+    if getattr(field, "type", None) != FieldType.PASSWORD:
+        return [_issue(Severity.WARNING, "zip_password_field_not_password_type", f"ZIP password field {field_name!r} is not configured with field type 'password'", f"{path}/password_field")]
+    if archive.password_scope == ZipPasswordScope.GLOBAL and config.global_values.get(field_name) in (None, ""):
+        return [_issue(Severity.ERROR, "zip_global_password_value_missing", f"Global ZIP password field {field_name!r} has no campaign-wide value", f"/global_values/{field_name}")]
+    return []
+
+
+def _zip_rule_selection_issues(config: CampaignConfig, archive_ids: set[str]) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
     for path, rule, _is_individual in _iter_attachment_rules(config):
         selection = (rule.zip.archive_id or ZipRuleMode.INHERIT.value).strip()
         if selection not in {"", ZipRuleMode.INHERIT.value, ZipRuleMode.INCLUDE.value, ZipRuleMode.EXCLUDE.value} and selection not in archive_ids:
@@ -276,6 +324,288 @@ def _ignored_override_issues(config: CampaignConfig, entry: EntryConfig, path_pr
     ]
 
 
+def _global_value_issues(config: CampaignConfig, declared_names: set[str]) -> list[SemanticIssue]:
+    return [
+        _issue(
+            Severity.WARNING,
+            "unknown_global_value",
+            f"global_values contains {key!r}, but it is not declared in fields",
+            f"/global_values/{key}",
+        )
+        for key in config.global_values
+        if declared_names and key not in declared_names
+    ]
+
+
+def _delivery_issues(config: CampaignConfig) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    profile_id = (config.server.mail_profile_id or "").strip()
+    if (config.campaign.mode == "send" or config.delivery.imap_append_sent.enabled) and not profile_id:
+        issues.append(
+            _issue(
+                Severity.ERROR,
+                "missing_mail_profile",
+                "Select an authorized Mail-module profile; campaigns cannot store SMTP/IMAP settings or credentials.",
+                "/server/mail_profile_id",
+            )
+        )
+    capabilities = config.server.profile_capabilities
+    if config.campaign.mode == "send" and profile_id and not capabilities.smtp_available:
+        issues.append(
+            _issue(
+                Severity.ERROR,
+                "mail_profile_without_smtp",
+                "campaign mode is 'send', but the selected Mail profile has no SMTP configuration",
+                "/server/mail_profile_id",
+            )
+        )
+    if config.delivery.imap_append_sent.enabled and profile_id and not capabilities.imap_available:
+        issues.append(
+            _issue(
+                Severity.ERROR,
+                "mail_profile_without_imap",
+                "IMAP append is enabled, but the selected Mail profile has no IMAP configuration",
+                "/server/mail_profile_id",
+            )
+        )
+    return issues
+
+
+def _sender_issues(config: CampaignConfig) -> list[SemanticIssue]:
+    """Require Campaign-owned sender data before a send-mode build."""
+
+    if config.campaign.mode != "send":
+        return []
+    if config.entries.is_inline:
+        return [
+            _issue(
+                Severity.ERROR,
+                "missing_sender",
+                "No effective From address is configured; Campaign must resolve the sender before building.",
+                f"/entries/inline/{index}/from",
+            )
+            for index, entry in enumerate(config.entries.inline or [])
+            if entry.active and not effective_address_lists(config, entry)["from"]
+        ]
+    if config.recipients.from_:
+        return []
+    defaults = config.entries.defaults
+    mapping_can_supply_sender = bool(
+        config.recipients.allow_individual_from
+        and (
+            (defaults is not None and defaults.from_)
+            or "from.email" in (config.entries.mapping or {})
+        )
+    )
+    if mapping_can_supply_sender:
+        return []
+    return [
+        _issue(
+            Severity.ERROR,
+            "missing_sender",
+            "Configure recipients.from, or allow and map an individual From address, before building a send-mode campaign.",
+            "/recipients/from",
+        )
+    ]
+
+
+def _entries_validation(
+    config: CampaignConfig,
+    *,
+    campaign_path: Path,
+    check_files: bool,
+    field_names: set[str],
+    field_definitions: dict[str, object],
+) -> _EntriesValidation:
+    if config.entries.is_inline:
+        inline_entries = config.entries.inline or []
+        issues = _inline_entries_issues(config, inline_entries)
+        return _EntriesValidation(mode="inline", count=len(inline_entries), issues=issues)
+    issues = _external_entries_issues(
+        config,
+        campaign_path=campaign_path,
+        check_files=check_files,
+        field_names=field_names,
+        field_definitions=field_definitions,
+    )
+    source_type = config.entries.source.type.value if config.entries.source else "unknown"
+    return _EntriesValidation(mode=f"external:{source_type}", count=None, issues=issues)
+
+
+def _inline_entries_issues(config: CampaignConfig, inline_entries: list[EntryConfig]) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    if not inline_entries:
+        issues.append(_issue(Severity.WARNING, "no_inline_entries", "entries.inline is empty", "/entries/inline"))
+    for index, entry in enumerate(inline_entries):
+        if entry.active:
+            issues.extend(_ignored_override_issues(config, entry, f"/entries/inline/{index}"))
+    return issues
+
+
+def _external_entries_issues(
+    config: CampaignConfig,
+    *,
+    campaign_path: Path,
+    check_files: bool,
+    field_names: set[str],
+    field_definitions: dict[str, object],
+) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    mapping = config.entries.mapping or {}
+    if not mapping:
+        issues.append(_issue(Severity.ERROR, "empty_mapping", "external entries require a non-empty mapping", "/entries/mapping"))
+    issues.extend(_mapping_issues(mapping, field_names, field_definitions))
+    if config.entries.defaults:
+        issues.extend(_ignored_override_issues(config, config.entries.defaults, "/entries/defaults"))
+    if check_files and config.entries.source:
+        issues.extend(_entries_source_file_issues(config, campaign_path, mapping))
+    return issues
+
+
+def _mapping_issues(
+    mapping: dict[str, str],
+    field_names: set[str],
+    field_definitions: dict[str, object],
+) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    for target in mapping:
+        if not _mapping_target_known(target, field_names):
+            issues.append(
+                _issue(
+                    Severity.WARNING,
+                    "unknown_mapping_target",
+                    f"mapping target {target!r} is not recognized by the current campaign model",
+                    f"/entries/mapping/{target}",
+                )
+            )
+        field_name = _mapping_target_field_name(target)
+        field = field_definitions.get(field_name or "")
+        if field_name and field is not None and not getattr(field, "can_override", True):
+            issues.append(
+                _issue(
+                    Severity.WARNING,
+                    "mapping_target_not_overridable",
+                    f"mapping target {target!r} points to a field that does not allow recipient overrides; mapped values will be ignored",
+                    f"/entries/mapping/{target}",
+                )
+            )
+    return issues
+
+
+def _entries_source_file_issues(config: CampaignConfig, campaign_path: Path, mapping: dict[str, str]) -> list[SemanticIssue]:
+    source = config.entries.source
+    if source is None:
+        return []
+    source_path = _resolve(campaign_path, source.path)
+    if not source_path.exists():
+        return [
+            _issue(
+                Severity.ERROR,
+                "entries_source_not_found",
+                f"entries source file does not exist: {source_path}",
+                "/entries/source/path",
+            )
+        ]
+    if source.type != SourceType.CSV or not source.has_header:
+        return []
+    try:
+        header = _csv_header(source_path, source.delimiter, source.encoding)
+    except OSError as exc:
+        return [_issue(Severity.ERROR, "entries_source_read_error", str(exc), "/entries/source/path")]
+    header_set = set(header or [])
+    missing_columns = sorted({source_name for source_name in mapping.values() if source_name not in header_set})
+    if not missing_columns:
+        return []
+    return [
+        _issue(
+            Severity.ERROR,
+            "mapping_columns_missing",
+            "CSV mapping refers to missing columns: " + ", ".join(missing_columns),
+            "/entries/mapping",
+        )
+    ]
+
+
+def _file_check_issues(config: CampaignConfig, campaign_path: Path) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    issues.extend(_attachment_file_check_issues(config, campaign_path))
+    issues.extend(_attachment_resolution_check_issues(config, campaign_path))
+    issues.extend(_template_source_file_issues(config, campaign_path))
+    return issues
+
+
+def _attachment_file_check_issues(config: CampaignConfig, campaign_path: Path) -> list[SemanticIssue]:
+    if config.attachments.base_paths:
+        return [
+            _issue(
+                Severity.WARNING,
+                "attachments_base_path_not_found",
+                f"attachment base path {base_path_config.name!r} does not exist: {_resolve(campaign_path, base_path_config.path)}",
+                f"/attachments/base_paths/{index}/path",
+            )
+            for index, base_path_config in enumerate(config.attachments.base_paths)
+            if not _resolve(campaign_path, base_path_config.path).exists()
+        ]
+    attachments_base_path = _resolve(campaign_path, config.attachments.base_path)
+    if attachments_base_path.exists():
+        return []
+    return [
+        _issue(
+            Severity.WARNING,
+            "attachments_base_path_not_found",
+            f"attachments.base_path does not exist: {attachments_base_path}",
+            "/attachments/base_path",
+        )
+    ]
+
+
+def _attachment_resolution_check_issues(config: CampaignConfig, campaign_path: Path) -> list[SemanticIssue]:
+    try:
+        report = resolve_campaign_attachments(config, campaign_file=campaign_path)
+    except Exception as exc:
+        return [
+            _issue(
+                Severity.ERROR,
+                "attachment_resolution_failed",
+                f"attachment rules could not be resolved: {exc}",
+                "/attachments",
+            )
+        ]
+
+    issues: list[SemanticIssue] = []
+    for entry in report.entries:
+        entry_path = f"/entries/{entry.entry_id or entry.entry_index}"
+        for issue in entry.issues:
+            if any(issue is attachment_issue for attachment in entry.attachments for attachment_issue in attachment.issues):
+                continue
+            issues.append(_issue(Severity(issue.severity.value), issue.code, issue.message, entry_path))
+        for attachment in entry.attachments:
+            attachment_path = (
+                f"/attachments/global/{attachment.index}"
+                if attachment.scope.value == "global"
+                else f"{entry_path}/attachments/{attachment.index}"
+            )
+            for issue in attachment.issues:
+                issues.append(_issue(Severity(issue.severity.value), issue.code, issue.message, attachment_path))
+    return issues
+
+
+def _template_source_file_issues(config: CampaignConfig, campaign_path: Path) -> list[SemanticIssue]:
+    issues: list[SemanticIssue] = []
+    for schema_path, raw_path in _iter_template_source_paths(config):
+        path = _resolve(campaign_path, raw_path)
+        if not path.exists():
+            issues.append(
+                _issue(
+                    Severity.ERROR,
+                    "template_source_not_found",
+                    f"template source file does not exist: {path}",
+                    schema_path,
+                )
+            )
+    return issues
+
+
 def validate_campaign_config(
     config: CampaignConfig,
     *,
@@ -289,149 +619,30 @@ def validate_campaign_config(
     field_definitions = {field.name: field for field in config.fields}
     declared_names = set(field_definitions)
 
-    for key in config.global_values:
-        if declared_names and key not in declared_names:
-            issues.append(_issue(
-                Severity.WARNING,
-                "unknown_global_value",
-                f"global_values contains {key!r}, but it is not declared in fields",
-                f"/global_values/{key}",
-            ))
-
+    issues.extend(_global_value_issues(config, declared_names))
     issues.extend(_attachment_path_issues(config))
     issues.extend(_zip_configuration_issues(config))
+    issues.extend(_delivery_issues(config))
+    issues.extend(_sender_issues(config))
 
-    runtime_imap = config.server.runtime_imap_config()
-    if config.delivery.imap_append_sent.enabled:
-        if runtime_imap is None:
-            issues.append(_issue(
-                Severity.WARNING,
-                "delivery_imap_enabled_without_server_imap",
-                "delivery.imap_append_sent is enabled, but no server.imap configuration is present",
-                "/delivery/imap_append_sent/enabled",
-            ))
-        else:
-            missing = [name for name in ["host", "port", "username", "password"] if getattr(runtime_imap, name) in (None, "")]
-            if missing:
-                issues.append(_issue(
-                    Severity.ERROR,
-                    "incomplete_imap_config",
-                    "IMAP append is enabled, but these IMAP settings are missing: " + ", ".join(missing),
-                    "/server/imap",
-                ))
-
-    runtime_smtp = config.server.runtime_smtp_config()
-    if config.campaign.mode == "send" and not runtime_smtp:
-        issues.append(_issue(
-            Severity.ERROR,
-            "missing_smtp_config",
-            "campaign mode is 'send', but no server.smtp configuration is present",
-            "/server/smtp",
-        ))
-
-    if runtime_smtp:
-        missing = [name for name in ["host", "port"] if getattr(runtime_smtp, name) in (None, "")]
-        if missing:
-            issues.append(_issue(
-                Severity.WARNING,
-                "incomplete_smtp_config",
-                "SMTP settings are present, but these settings are missing: " + ", ".join(missing),
-                "/server/smtp",
-            ))
-
-    if config.entries.is_inline:
-        inline_entries = config.entries.inline or []
-        entries_count = len(inline_entries)
-        entries_mode = "inline"
-        if entries_count == 0:
-            issues.append(_issue(Severity.WARNING, "no_inline_entries", "entries.inline is empty", "/entries/inline"))
-        for index, entry in enumerate(inline_entries):
-            if entry.active:
-                issues.extend(_ignored_override_issues(config, entry, f"/entries/inline/{index}"))
-    else:
-        entries_count = None
-        entries_mode = f"external:{config.entries.source.type.value if config.entries.source else 'unknown'}"
-        mapping = config.entries.mapping or {}
-        if not mapping:
-            issues.append(_issue(Severity.ERROR, "empty_mapping", "external entries require a non-empty mapping", "/entries/mapping"))
-        for target in mapping:
-            if not _mapping_target_known(target, field_names):
-                issues.append(_issue(
-                    Severity.WARNING,
-                    "unknown_mapping_target",
-                    f"mapping target {target!r} is not recognized by the current campaign model",
-                    f"/entries/mapping/{target}",
-                ))
-            field_name = _mapping_target_field_name(target)
-            if field_name and field_name in field_definitions and not field_definitions[field_name].can_override:
-                issues.append(_issue(
-                    Severity.WARNING,
-                    "mapping_target_not_overridable",
-                    f"mapping target {target!r} points to a field that does not allow recipient overrides; mapped values will be ignored",
-                    f"/entries/mapping/{target}",
-                ))
-        if config.entries.defaults:
-            issues.extend(_ignored_override_issues(config, config.entries.defaults, "/entries/defaults"))
-        if check_files and config.entries.source:
-            source_path = _resolve(campaign_path, config.entries.source.path)
-            if not source_path.exists():
-                issues.append(_issue(
-                    Severity.ERROR,
-                    "entries_source_not_found",
-                    f"entries source file does not exist: {source_path}",
-                    "/entries/source/path",
-                ))
-            elif config.entries.source.type == SourceType.CSV and config.entries.source.has_header:
-                try:
-                    header = _csv_header(source_path, config.entries.source.delimiter, config.entries.source.encoding)
-                    header_set = set(header or [])
-                    missing_columns = sorted({source_name for source_name in mapping.values() if source_name not in header_set})
-                    if missing_columns:
-                        issues.append(_issue(
-                            Severity.ERROR,
-                            "mapping_columns_missing",
-                            "CSV mapping refers to missing columns: " + ", ".join(missing_columns),
-                            "/entries/mapping",
-                        ))
-                except OSError as exc:
-                    issues.append(_issue(Severity.ERROR, "entries_source_read_error", str(exc), "/entries/source/path"))
+    entries = _entries_validation(
+        config,
+        campaign_path=campaign_path,
+        check_files=check_files,
+        field_names=field_names,
+        field_definitions=field_definitions,
+    )
+    issues.extend(entries.issues)
 
     if check_files:
-        if config.attachments.base_paths:
-            for index, base_path_config in enumerate(config.attachments.base_paths):
-                attachments_base_path = _resolve(campaign_path, base_path_config.path)
-                if not attachments_base_path.exists():
-                    issues.append(_issue(
-                        Severity.WARNING,
-                        "attachments_base_path_not_found",
-                        f"attachment base path {base_path_config.name!r} does not exist: {attachments_base_path}",
-                        f"/attachments/base_paths/{index}/path",
-                    ))
-        else:
-            attachments_base_path = _resolve(campaign_path, config.attachments.base_path)
-            if not attachments_base_path.exists():
-                issues.append(_issue(
-                    Severity.WARNING,
-                    "attachments_base_path_not_found",
-                    f"attachments.base_path does not exist: {attachments_base_path}",
-                    "/attachments/base_path",
-                ))
-        for schema_path, raw_path in _iter_template_source_paths(config):
-            path = _resolve(campaign_path, raw_path)
-            if not path.exists():
-                issues.append(_issue(
-                    Severity.ERROR,
-                    "template_source_not_found",
-                    f"template source file does not exist: {path}",
-                    schema_path,
-                ))
+        issues.extend(_file_check_issues(config, campaign_path))
 
     report = SemanticReport(
         campaign_id=config.campaign.id,
         campaign_name=config.campaign.name,
         issues=issues,
-        entries_mode=entries_mode,
-        entries_count=entries_count,
+        entries_mode=entries.mode,
+        entries_count=entries.count,
         attachments_base_path=_attachment_base_path_report_value(config),
         rate_limit=f"{config.delivery.rate_limit.messages_per_minute}/min, concurrency {config.delivery.rate_limit.concurrency}",
         imap_append_enabled=config.delivery.imap_append_sent.enabled,

src/govoplan_campaign/backend/change_tracking.py

@@ -3,10 +3,17 @@ from __future__ import annotations
 from datetime import datetime
 from typing import Any
 
-from sqlalchemy import event, inspect
+from sqlalchemy import event
 from sqlalchemy.orm import Session as OrmSession
 
 from govoplan_core.core.change_sequence import record_change
+from govoplan_core.core.sqlalchemy_change_tracking import (
+    ensure_object_id,
+    has_attr_changes,
+    object_state,
+    operation_for_object,
+    previous_value,
+)
 from govoplan_campaign.backend.db.models import (
     Campaign,
     CampaignIssue,
@@ -85,10 +92,10 @@ def _record_campaign_change(session: OrmSession, campaign: Campaign) -> None:
 
 
 def _record_share_visibility_change(session: OrmSession, share: CampaignShare) -> None:
-    state = inspect(share)
+    state = object_state(share)
     if not share.campaign_id:
         return
-    if not state.deleted and not state.pending and not _has_attr_changes(
+    if not state.deleted and not state.pending and not has_attr_changes(
         state,
         ("campaign_id", "target_type", "target_id", "permission", "revoked_at"),
     ):
@@ -271,12 +278,12 @@ def _record_attempt_change(session: OrmSession, attempt: SendAttempt | ImapAppen
 
 
 def _operation_for_campaign(obj: Campaign, *, changed_attrs: tuple[str, ...]) -> str | None:
-    state = inspect(obj)
+    state = object_state(obj)
     if state.pending:
         return "created"
     if state.deleted:
         return "deleted"
-    if not _has_attr_changes(state, changed_attrs):
+    if not has_attr_changes(state, changed_attrs):
         return None
     status_history = state.attrs.status.history
     if status_history.has_changes() and any(value == "deleted" for value in status_history.added):
@@ -285,38 +292,11 @@ def _operation_for_campaign(obj: Campaign, *, changed_attrs: tuple[str, ...]) ->
 
 
 def _operation_for_object(obj: object, *, changed_attrs: tuple[str, ...]) -> str | None:
-    state = inspect(obj)
-    if state.pending:
-        return "created"
-    if state.deleted:
-        return "deleted"
-    if not _has_attr_changes(state, changed_attrs):
-        return None
-    return "updated"
-
-
-def _has_attr_changes(state: Any, attrs: tuple[str, ...]) -> bool:
-    return any(name in state.attrs and state.attrs[name].history.has_changes() for name in attrs)
-
-
-def _previous_value(obj: object, attr_name: str) -> str | None:
-    state = inspect(obj)
-    if attr_name not in state.attrs:
-        return None
-    history = state.attrs[attr_name].history
-    if not history.has_changes() or not history.deleted:
-        return None
-    value = history.deleted[0]
-    return str(value) if value is not None else None
+    return operation_for_object(obj, changed_attrs=changed_attrs)
 
 
 def _ensure_id(obj: object) -> str:
-    resource_id = getattr(obj, "id", None)
-    if resource_id:
-        return str(resource_id)
-    resource_id = new_uuid()
-    setattr(obj, "id", resource_id)
-    return resource_id
+    return ensure_object_id(obj, new_uuid)
 
 
 def _campaign_payload(campaign: Campaign | None) -> dict[str, Any]:
@@ -326,12 +306,12 @@ def _campaign_payload(campaign: Campaign | None) -> dict[str, Any]:
         "campaign_id": campaign.id,
         "owner_user_id": campaign.owner_user_id,
         "owner_group_id": campaign.owner_group_id,
-        "previous_owner_user_id": _previous_value(campaign, "owner_user_id"),
-        "previous_owner_group_id": _previous_value(campaign, "owner_group_id"),
+        "previous_owner_user_id": previous_value(campaign, "owner_user_id"),
+        "previous_owner_group_id": previous_value(campaign, "owner_group_id"),
         "status": campaign.status,
-        "previous_status": _previous_value(campaign, "status"),
+        "previous_status": previous_value(campaign, "status"),
         "current_version_id": campaign.current_version_id,
-        "previous_current_version_id": _previous_value(campaign, "current_version_id"),
+        "previous_current_version_id": previous_value(campaign, "current_version_id"),
     }
 
 

src/govoplan_campaign/backend/db/models.py

@@ -78,6 +78,7 @@ class JobQueueStatus(StrEnum):
 
 class JobSendStatus(StrEnum):
     NOT_QUEUED = "not_queued"
+    SKIPPED = "skipped"
     QUEUED = "queued"
     CLAIMED = "claimed"
     SENDING = "sending"
@@ -92,7 +93,9 @@ class JobSendStatus(StrEnum):
 class JobImapStatus(StrEnum):
     NOT_REQUESTED = "not_requested"
     PENDING = "pending"
+    APPENDING = "appending"
     APPENDED = "appended"
+    OUTCOME_UNKNOWN = "outcome_unknown"
     FAILED = "failed"
     SKIPPED = "skipped"
 
@@ -161,8 +164,6 @@ class RecipientImportMappingProfile(Base, TimestampMixin):
     value_separators: Mapped[str] = mapped_column(String(50), default=",;|", nullable=False)
     mappings: Mapped[list[dict[str, Any]]] = mapped_column(JSON, default=list, nullable=False)
 
-    owner: Mapped["User"] = relationship("User")
-
 
 class CampaignVersion(Base, TimestampMixin):
     __tablename__ = "campaign_versions"
@@ -212,9 +213,17 @@ class CampaignVersion(Base, TimestampMixin):
     execution_snapshot: Mapped[dict[str, Any] | None] = mapped_column(JSON, nullable=True)
     execution_snapshot_hash: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
     execution_snapshot_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    delivery_mode: Mapped[str | None] = mapped_column(String(30), nullable=True, index=True)
+    delivery_mode_selected_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
     campaign: Mapped[Campaign] = relationship(back_populates="versions")
 
+    @property
+    def mail_profile_migration_required(self) -> bool:
+        from govoplan_campaign.backend.campaign.mail_profile_boundary import campaign_mail_profile_boundary_violations
+
+        return bool(campaign_mail_profile_boundary_violations(self.raw_json))
+
 
 class CampaignJob(Base, TimestampMixin):
     __tablename__ = "campaign_jobs"
@@ -234,6 +243,7 @@ class CampaignJob(Base, TimestampMixin):
     eml_local_path: Mapped[str | None] = mapped_column(String(1000))
     eml_size_bytes: Mapped[int | None] = mapped_column(Integer)
     eml_sha256: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
+    execution_input_sha256: Mapped[str | None] = mapped_column(String(64), nullable=True)
 
     build_status: Mapped[str] = mapped_column(String(50), default=JobBuildStatus.PENDING.value, nullable=False, index=True)
     validation_status: Mapped[str] = mapped_column(String(50), default=JobValidationStatus.NEEDS_REVIEW.value, nullable=False, index=True)
@@ -248,6 +258,8 @@ class CampaignJob(Base, TimestampMixin):
     claim_token: Mapped[str | None] = mapped_column(String(36), nullable=True, index=True)
     smtp_started_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     outcome_unknown_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    imap_claimed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    imap_claim_token: Mapped[str | None] = mapped_column(String(36), nullable=True, index=True)
     sent_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
     resolved_recipients: Mapped[dict[str, Any] | None] = mapped_column(JSON, nullable=True)
@@ -317,10 +329,14 @@ class SendAttempt(Base, TimestampMixin):
 
 class ImapAppendAttempt(Base, TimestampMixin):
     __tablename__ = "imap_append_attempts"
+    __table_args__ = (
+        UniqueConstraint("job_id", "attempt_number", name="uq_imap_append_attempts_job_attempt"),
+    )
 
     id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
     job_id: Mapped[str] = mapped_column(ForeignKey("campaign_jobs.id", ondelete="CASCADE"), nullable=False, index=True)
     attempt_number: Mapped[int] = mapped_column(Integer, nullable=False)
+    claim_token: Mapped[str | None] = mapped_column(String(36), nullable=True)
     folder: Mapped[str | None] = mapped_column(String(500))
     status: Mapped[str] = mapped_column(String(50), nullable=False)
     error_message: Mapped[str | None] = mapped_column(Text)

src/govoplan_campaign/backend/delivery_policy.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import Any, Mapping
+
+from sqlalchemy.orm import Session
+
+from govoplan_core.tenancy.scope import Tenant
+
+
+DEFAULT_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS = 25
+ABSOLUTE_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS = 500
+SYNCHRONOUS_SEND_MAX_ENV = "GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS"
+CAMPAIGN_DELIVERY_POLICY_SETTINGS_KEY = "campaign_delivery_policy"
+SYNCHRONOUS_SEND_MAX_SETTINGS_KEY = "synchronous_send_max_recipients"
+
+
+class CampaignDeliveryPolicyError(RuntimeError):
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class SynchronousSendPolicy:
+    max_recipient_jobs: int
+    source: str
+    deployment_max_recipient_jobs: int
+    tenant_max_recipient_jobs: int | None = None
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "max_recipient_jobs": self.max_recipient_jobs,
+            "source": self.source,
+            "deployment_max_recipient_jobs": self.deployment_max_recipient_jobs,
+            "tenant_max_recipient_jobs": self.tenant_max_recipient_jobs,
+            "deployment_setting": SYNCHRONOUS_SEND_MAX_ENV,
+            "tenant_setting": (
+                f"tenant.settings.{CAMPAIGN_DELIVERY_POLICY_SETTINGS_KEY}."
+                f"{SYNCHRONOUS_SEND_MAX_SETTINGS_KEY}"
+            ),
+        }
+
+
+def effective_synchronous_send_policy(
+    session: Session,
+    *,
+    tenant_id: str,
+    environ: Mapping[str, str] | None = None,
+) -> SynchronousSendPolicy:
+    env = os.environ if environ is None else environ
+    deployment_value = _configured_limit(
+        env.get(SYNCHRONOUS_SEND_MAX_ENV),
+        source=SYNCHRONOUS_SEND_MAX_ENV,
+        default=DEFAULT_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS,
+    )
+    tenant = session.get(Tenant, tenant_id)
+    tenant_raw = _tenant_limit_value(tenant.settings if tenant is not None else None)
+    if tenant_raw is None:
+        return SynchronousSendPolicy(
+            max_recipient_jobs=deployment_value,
+            source=("deployment" if env.get(SYNCHRONOUS_SEND_MAX_ENV) not in (None, "") else "deployment_default"),
+            deployment_max_recipient_jobs=deployment_value,
+        )
+
+    tenant_value = _configured_limit(
+        tenant_raw,
+        source=(
+            f"tenant.settings.{CAMPAIGN_DELIVERY_POLICY_SETTINGS_KEY}."
+            f"{SYNCHRONOUS_SEND_MAX_SETTINGS_KEY}"
+        ),
+    )
+    effective_value = min(deployment_value, tenant_value)
+    return SynchronousSendPolicy(
+        max_recipient_jobs=effective_value,
+        source="tenant" if tenant_value <= deployment_value else "deployment_ceiling",
+        deployment_max_recipient_jobs=deployment_value,
+        tenant_max_recipient_jobs=tenant_value,
+    )
+
+
+def _tenant_limit_value(settings: Mapping[str, Any] | None) -> object | None:
+    if not isinstance(settings, Mapping):
+        return None
+    policy = settings.get(CAMPAIGN_DELIVERY_POLICY_SETTINGS_KEY)
+    if not isinstance(policy, Mapping):
+        return None
+    return policy.get(SYNCHRONOUS_SEND_MAX_SETTINGS_KEY)
+
+
+def _configured_limit(value: object, *, source: str, default: int | None = None) -> int:
+    if value is None or (isinstance(value, str) and not value.strip()):
+        if default is not None:
+            return default
+        raise CampaignDeliveryPolicyError(f"{source} must be configured as an integer")
+    if isinstance(value, bool):
+        raise CampaignDeliveryPolicyError(f"{source} must be an integer, not a boolean")
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError) as exc:
+        raise CampaignDeliveryPolicyError(f"{source} must be an integer") from exc
+    if str(parsed) != str(value).strip() and not isinstance(value, int):
+        raise CampaignDeliveryPolicyError(f"{source} must be an integer")
+    if parsed < 0 or parsed > ABSOLUTE_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS:
+        raise CampaignDeliveryPolicyError(
+            f"{source} must be between 0 and {ABSOLUTE_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS}"
+        )
+    return parsed

src/govoplan_campaign/backend/dev/mock_campaign.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from dataclasses import dataclass
 from email import policy
 from email.message import EmailMessage
 from typing import Any
@@ -13,12 +14,37 @@ from govoplan_campaign.backend.persistence.campaigns import load_campaign_config
 from govoplan_campaign.backend.messages.builder import build_campaign_messages
 from govoplan_campaign.backend.messages.models import MessageAddress, MessageDraft, MessageValidationStatus
 from govoplan_campaign.backend.integrations import files_integration, mail_integration
+from govoplan_campaign.backend.path_security import assert_server_safe_campaign_paths
 
 
 class MockCampaignSendError(RuntimeError):
     pass
 
 
+@dataclass(slots=True)
+class _MockSendOutcome:
+    row: dict[str, Any]
+    sent_count: int = 0
+    failed_count: int = 0
+    skipped_count: int = 0
+    imap_appended_count: int = 0
+    imap_failed_count: int = 0
+
+
+@dataclass(slots=True)
+class _MockSendBatch:
+    results: list[dict[str, Any]]
+    sent_count: int = 0
+    failed_count: int = 0
+    skipped_count: int = 0
+    imap_appended_count: int = 0
+    imap_failed_count: int = 0
+
+    @property
+    def attempted_count(self) -> int:
+        return self.sent_count + self.failed_count
+
+
 def _mock_mailbox() -> Any | None:
     return mail_integration().mock_mailbox()
 
@@ -116,6 +142,394 @@ def _can_mock_send(
     return False, f"Validation status is {message.validation_status.value}"
 
 
+def _mock_send_batch(
+    *,
+    config: Any,
+    built_messages: list[Any],
+    mailbox: Any | None,
+    send: bool,
+    include_warnings: bool,
+    include_needs_review: bool,
+    append_sent: bool,
+) -> _MockSendBatch:
+    batch = _MockSendBatch(results=[])
+    for built in built_messages:
+        outcome = _mock_send_message(
+            config=config,
+            built=built,
+            mailbox=mailbox,
+            send=send,
+            include_warnings=include_warnings,
+            include_needs_review=include_needs_review,
+            append_sent=append_sent,
+        )
+        batch.results.append(outcome.row)
+        batch.sent_count += outcome.sent_count
+        batch.failed_count += outcome.failed_count
+        batch.skipped_count += outcome.skipped_count
+        batch.imap_appended_count += outcome.imap_appended_count
+        batch.imap_failed_count += outcome.imap_failed_count
+    return batch
+
+
+def _mock_send_message(
+    *,
+    config: Any,
+    built: Any,
+    mailbox: Any | None,
+    send: bool,
+    include_warnings: bool,
+    include_needs_review: bool,
+    append_sent: bool,
+) -> _MockSendOutcome:
+    draft = built.draft
+    row = _mock_send_row(draft)
+    can_send, skip_reason = _can_mock_send(
+        draft,
+        include_warnings=include_warnings,
+        include_needs_review=include_needs_review,
+    )
+    if not can_send or built.mime is None:
+        row.update({"status": "skipped", "message": skip_reason or "Message has no MIME output"})
+        return _MockSendOutcome(row=row, skipped_count=1)
+
+    recipients = _recipient_emails(draft)
+    envelope_from = _envelope_from(draft)
+    if not recipients:
+        row.update({"status": "skipped", "message": "No envelope recipients"})
+        return _MockSendOutcome(row=row, skipped_count=1)
+    if not send:
+        row.update({
+            "status": "ready",
+            "message": f"Would send to {len(recipients)} recipient(s)",
+            "envelope_from": envelope_from,
+            "envelope_recipients": recipients,
+        })
+        return _MockSendOutcome(row=row)
+    return _send_mock_smtp_message(
+        config=config,
+        built=built,
+        mailbox=mailbox,
+        row=row,
+        recipients=recipients,
+        envelope_from=envelope_from,
+        append_sent=append_sent,
+    )
+
+
+def _mock_send_row(draft: MessageDraft) -> dict[str, Any]:
+    return {
+        "entry_index": draft.entry_index,
+        "entry_id": draft.entry_id,
+        "subject": draft.subject,
+        "validation_status": draft.validation_status.value,
+        "build_status": str(draft.build_status.value if hasattr(draft.build_status, "value") else draft.build_status),
+        "to": _message_addresses_payload(draft.to),
+        "attachments": _attachment_payloads(draft),
+        "issues": _issue_payloads(draft),
+    }
+
+
+def _send_mock_smtp_message(
+    *,
+    config: Any,
+    built: Any,
+    mailbox: Any | None,
+    row: dict[str, Any],
+    recipients: list[str],
+    envelope_from: str,
+    append_sent: bool,
+) -> _MockSendOutcome:
+    try:
+        if mailbox is not None and mailbox.consume_fail_next_smtp():
+            raise MockCampaignSendError("Configured mock failure: next SMTP delivery fails")
+        rejected = _smtp_rejection_matches(recipients)
+        if rejected and len(rejected) == len(recipients):
+            raise MockCampaignSendError(f"Configured mock failure: all recipients rejected ({', '.join(rejected)})")
+
+        accepted = [recipient for recipient in recipients if recipient not in rejected]
+        smtp_record = mailbox.record_smtp_delivery(
+            built.mime,
+            envelope_from=envelope_from,
+            envelope_recipients=accepted,
+            smtp_host="mock.smtp.local",
+        )
+        row.update({
+            "status": "sent",
+            "message": f"Mock SMTP captured as {smtp_record.id}",
+            "smtp_message_id": smtp_record.id,
+            "envelope_from": envelope_from,
+            "envelope_recipients": accepted,
+            "refused_recipients": rejected,
+        })
+        imap_appended, imap_failed = _append_mock_sent_message(config, built, mailbox, row, append_sent=append_sent)
+        return _MockSendOutcome(row=row, sent_count=1, imap_appended_count=imap_appended, imap_failed_count=imap_failed)
+    except Exception as exc:
+        row.update({"status": "failed", "message": str(exc), "envelope_from": envelope_from, "envelope_recipients": recipients})
+        return _MockSendOutcome(row=row, failed_count=1)
+
+
+def _append_mock_sent_message(
+    config: Any,
+    built: Any,
+    mailbox: Any | None,
+    row: dict[str, Any],
+    *,
+    append_sent: bool,
+) -> tuple[int, int]:
+    if not append_sent:
+        return 0, 0
+    try:
+        if mailbox is not None and mailbox.consume_fail_next_imap():
+            raise MockCampaignSendError("Configured mock failure: next IMAP append fails")
+        folder = _mock_sent_folder(config)
+        imap_record = mailbox.record_imap_append(_raw_message_bytes(built.mime), folder=folder, imap_host="mock.imap.local")
+        row.update({"imap_status": "appended", "imap_message_id": imap_record.id, "imap_folder": folder})
+        return 1, 0
+    except Exception as exc:
+        row.update({"imap_status": "failed", "imap_error": str(exc)})
+        return 0, 1
+
+
+def _mock_sent_folder(config: Any) -> str:
+    if config.delivery.imap_append_sent.folder and config.delivery.imap_append_sent.folder != "auto":
+        return config.delivery.imap_append_sent.folder
+    if config.server.imap and config.server.imap.sent_folder and config.server.imap.sent_folder != "auto":
+        return config.server.imap.sent_folder
+    return "Sent"
+
+
+def _mock_campaign_version(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    version_id: str | None,
+) -> tuple[Campaign, CampaignVersion]:
+    campaign = (
+        session.query(Campaign)
+        .filter(Campaign.id == campaign_id, Campaign.tenant_id == tenant_id)
+        .one_or_none()
+    )
+    if not campaign:
+        raise MockCampaignSendError("Campaign not found or not accessible")
+    wanted_version_id = version_id or campaign.current_version_id
+    if not wanted_version_id:
+        raise MockCampaignSendError("Campaign has no current version")
+    version = session.get(CampaignVersion, wanted_version_id)
+    if not version or version.campaign_id != campaign.id:
+        raise MockCampaignSendError(
+            "Campaign version not found or not part of campaign"
+        )
+    return campaign, version
+
+
+def _mock_mailbox_for_run(*, send: bool, clear_mailbox: bool) -> Any | None:
+    mailbox = _require_mock_mailbox() if send or clear_mailbox else _mock_mailbox()
+    if clear_mailbox and mailbox is not None:
+        mailbox.clear_records()
+    return mailbox
+
+
+def _build_mock_campaign_run(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign: Campaign,
+    version: CampaignVersion,
+    mailbox: Any | None,
+    send: bool,
+    include_warnings: bool,
+    include_needs_review: bool,
+    append_sent: bool,
+    check_files: bool,
+) -> tuple[Any, Any, _MockSendBatch]:
+    files = files_integration()
+    raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    assert_server_safe_campaign_paths(
+        raw_json,
+        managed_files_available=files.available,
+    )
+    with files.prepared_campaign_snapshot(
+        session,
+        tenant_id=tenant_id,
+        campaign_id=campaign.id,
+        raw_json=raw_json,
+        include_bytes=True,
+        prefix="govoplan-mock-send-",
+    ) as prepared:
+        prepared_raw = load_campaign_json(prepared.path)
+        config = load_campaign_config_from_json(
+            session,
+            tenant_id=tenant_id,
+            raw_json=prepared_raw,
+            campaign_id=campaign.id,
+        )
+        validation_report = validate_campaign_config(
+            config,
+            campaign_file=prepared.path,
+            check_files=check_files,
+        )
+        build_result = build_campaign_messages(
+            config,
+            campaign_file=prepared.path,
+            write_eml=False,
+        )
+        files.annotate_built_messages_with_managed_files(
+            build_result.built_messages,
+            prepared.managed_files_by_local_path,
+        )
+        send_batch = _mock_send_batch(
+            config=config,
+            built_messages=build_result.built_messages,
+            mailbox=mailbox,
+            send=send,
+            include_warnings=include_warnings,
+            include_needs_review=include_needs_review,
+            append_sent=append_sent,
+        )
+    return validation_report, build_result, send_batch
+
+
+def _mock_validation_payload(validation_report: Any) -> dict[str, Any]:
+    payload = validation_report.model_dump(mode="json")
+    payload.update(
+        {
+            "ok": validation_report.ok,
+            "error_count": validation_report.error_count,
+            "warning_count": validation_report.warning_count,
+        }
+    )
+    return payload
+
+
+def _mock_build_payload(build_result: Any) -> dict[str, Any]:
+    report = build_result.report
+    payload = report.model_dump(mode="json")
+    payload.update(
+        {
+            "built_count": report.built_count,
+            "queueable_count": report.queueable_count,
+            "needs_review_count": report.needs_review_count,
+            "blocked_count": report.blocked_count,
+            "warning_count": report.warning_count,
+            "ready_count": report.ready_count,
+            "messages": [_message_payload(message) for message in report.messages],
+        }
+    )
+    return payload
+
+
+def _mock_send_steps(
+    *,
+    validation_report: Any,
+    validation_payload: dict[str, Any],
+    build_report: Any,
+    send_batch: _MockSendBatch,
+    send: bool,
+    append_sent: bool,
+) -> list[dict[str, Any]]:
+    return [
+        {
+            "key": "validate",
+            "label": "Validate campaign JSON",
+            "status": "ok" if validation_report.ok else "needs_review",
+            "summary": validation_payload,
+        },
+        {
+            "key": "build",
+            "label": "Build messages",
+            "status": "ok" if build_report.queueable_count else "needs_review",
+            "summary": {
+                "built": build_report.built_count,
+                "queueable": build_report.queueable_count,
+                "needs_review": build_report.needs_review_count,
+                "blocked": build_report.blocked_count,
+            },
+        },
+        {
+            "key": "send",
+            "label": "Mock SMTP delivery",
+            "status": (
+                "skipped"
+                if not send
+                else "ok"
+                if send_batch.failed_count == 0
+                else "needs_review"
+            ),
+            "summary": {
+                "attempted": send_batch.attempted_count,
+                "sent": send_batch.sent_count,
+                "failed": send_batch.failed_count,
+                "skipped": send_batch.skipped_count,
+            },
+        },
+        {
+            "key": "imap",
+            "label": "Mock IMAP Sent append",
+            "status": (
+                "skipped"
+                if not send or not append_sent
+                else "ok"
+                if send_batch.imap_failed_count == 0
+                else "needs_review"
+            ),
+            "summary": {
+                "appended": send_batch.imap_appended_count,
+                "failed": send_batch.imap_failed_count,
+            },
+        },
+    ]
+
+
+def _mock_campaign_send_response(
+    *,
+    campaign: Campaign,
+    version: CampaignVersion,
+    mailbox: Any | None,
+    validation_report: Any,
+    validation_payload: dict[str, Any],
+    build_result: Any,
+    build_payload: dict[str, Any],
+    send_batch: _MockSendBatch,
+    send: bool,
+    include_warnings: bool,
+    include_needs_review: bool,
+    append_sent: bool,
+) -> dict[str, Any]:
+    return {
+        "campaign_id": campaign.id,
+        "version_id": version.id,
+        "version_number": version.version_number,
+        "send_requested": send,
+        "include_warnings": include_warnings,
+        "include_needs_review": include_needs_review,
+        "append_sent": append_sent,
+        "steps": _mock_send_steps(
+            validation_report=validation_report,
+            validation_payload=validation_payload,
+            build_report=build_result.report,
+            send_batch=send_batch,
+            send=send,
+            append_sent=append_sent,
+        ),
+        "validation": validation_payload,
+        "build": build_payload,
+        "send": {
+            "attempted_count": send_batch.attempted_count,
+            "sent_count": send_batch.sent_count,
+            "failed_count": send_batch.failed_count,
+            "skipped_count": send_batch.skipped_count,
+            "imap_appended_count": send_batch.imap_appended_count,
+            "imap_failed_count": send_batch.imap_failed_count,
+            "results": send_batch.results,
+        },
+        "mailbox": {
+            "messages": mailbox.list_records(limit=200) if mailbox is not None else []
+        },
+    }
+
+
 def run_mock_campaign_send(
     session: Session,
     *,
@@ -137,155 +551,38 @@ def run_mock_campaign_send(
     mailbox only when send=True.
     """
 
-    campaign = session.query(Campaign).filter(Campaign.id == campaign_id, Campaign.tenant_id == tenant_id).one_or_none()
-    if not campaign:
-        raise MockCampaignSendError("Campaign not found or not accessible")
-    wanted_version_id = version_id or campaign.current_version_id
-    if not wanted_version_id:
-        raise MockCampaignSendError("Campaign has no current version")
-    version = session.get(CampaignVersion, wanted_version_id)
-    if not version or version.campaign_id != campaign.id:
-        raise MockCampaignSendError("Campaign version not found or not part of campaign")
-
-    mailbox = _require_mock_mailbox() if send or clear_mailbox else _mock_mailbox()
-    if clear_mailbox and mailbox is not None:
-        mailbox.clear_records()
-
-    files = files_integration()
-    with files.prepared_campaign_snapshot(
+    campaign, version = _mock_campaign_version(
         session,
         tenant_id=tenant_id,
-        campaign_id=campaign.id,
-        raw_json=version.raw_json if isinstance(version.raw_json, dict) else {},
-        include_bytes=True,
-        prefix="multimailer-mock-send-",
-    ) as prepared:
-        prepared_raw = load_campaign_json(prepared.path)
-        config = load_campaign_config_from_json(session, tenant_id=tenant_id, raw_json=prepared_raw, campaign_id=campaign.id)
-        validation_report = validate_campaign_config(config, campaign_file=prepared.path, check_files=check_files)
-        build_result = build_campaign_messages(config, campaign_file=prepared.path, write_eml=False)
-        files.annotate_built_messages_with_managed_files(build_result.built_messages, prepared.managed_files_by_local_path)
-
-        send_results: list[dict[str, Any]] = []
-        sent_count = 0
-        failed_count = 0
-        skipped_count = 0
-        imap_appended_count = 0
-        imap_failed_count = 0
-
-        for built in build_result.built_messages:
-            draft = built.draft
-            can_send, skip_reason = _can_mock_send(draft, include_warnings=include_warnings, include_needs_review=include_needs_review)
-            row: dict[str, Any] = {
-                "entry_index": draft.entry_index,
-                "entry_id": draft.entry_id,
-                "subject": draft.subject,
-                "validation_status": draft.validation_status.value,
-                "build_status": str(draft.build_status.value if hasattr(draft.build_status, "value") else draft.build_status),
-                "to": _message_addresses_payload(draft.to),
-                "attachments": _attachment_payloads(draft),
-                "issues": _issue_payloads(draft),
-            }
-
-            if not can_send or built.mime is None:
-                skipped_count += 1
-                row.update({"status": "skipped", "message": skip_reason or "Message has no MIME output"})
-                send_results.append(row)
-                continue
-
-            recipients = _recipient_emails(draft)
-            envelope_from = _envelope_from(draft)
-            if not recipients:
-                skipped_count += 1
-                row.update({"status": "skipped", "message": "No envelope recipients"})
-                send_results.append(row)
-                continue
-
-            if not send:
-                row.update({"status": "ready", "message": f"Would send to {len(recipients)} recipient(s)", "envelope_from": envelope_from, "envelope_recipients": recipients})
-                send_results.append(row)
-                continue
-
-            try:
-                if mailbox is not None and mailbox.consume_fail_next_smtp():
-                    raise MockCampaignSendError("Configured mock failure: next SMTP delivery fails")
-                rejected = _smtp_rejection_matches(recipients)
-                if rejected and len(rejected) == len(recipients):
-                    raise MockCampaignSendError(f"Configured mock failure: all recipients rejected ({', '.join(rejected)})")
-
-                accepted = [recipient for recipient in recipients if recipient not in rejected]
-                smtp_record = mailbox.record_smtp_delivery(built.mime, envelope_from=envelope_from, envelope_recipients=accepted, smtp_host="mock.smtp.local")
-                sent_count += 1
-                row.update({
-                    "status": "sent",
-                    "message": f"Mock SMTP captured as {smtp_record.id}",
-                    "smtp_message_id": smtp_record.id,
-                    "envelope_from": envelope_from,
-                    "envelope_recipients": accepted,
-                    "refused_recipients": rejected,
-                })
-
-                if append_sent:
-                    try:
-                        if mailbox is not None and mailbox.consume_fail_next_imap():
-                            raise MockCampaignSendError("Configured mock failure: next IMAP append fails")
-                        folder = "Sent"
-                        if config.delivery.imap_append_sent.folder and config.delivery.imap_append_sent.folder != "auto":
-                            folder = config.delivery.imap_append_sent.folder
-                        elif config.server.imap and config.server.imap.sent_folder and config.server.imap.sent_folder != "auto":
-                            folder = config.server.imap.sent_folder
-                        imap_record = mailbox.record_imap_append(_raw_message_bytes(built.mime), folder=folder, imap_host="mock.imap.local")
-                        imap_appended_count += 1
-                        row.update({"imap_status": "appended", "imap_message_id": imap_record.id, "imap_folder": folder})
-                    except Exception as exc:
-                        imap_failed_count += 1
-                        row.update({"imap_status": "failed", "imap_error": str(exc)})
-
-            except Exception as exc:
-                failed_count += 1
-                row.update({"status": "failed", "message": str(exc), "envelope_from": envelope_from, "envelope_recipients": recipients})
-
-            send_results.append(row)
-
-    validation_json = validation_report.model_dump(mode="json")
-    validation_json.update({"ok": validation_report.ok, "error_count": validation_report.error_count, "warning_count": validation_report.warning_count})
-    build_report = build_result.report
-    build_json = build_report.model_dump(mode="json")
-    build_json.update({
-        "built_count": build_report.built_count,
-        "queueable_count": build_report.queueable_count,
-        "needs_review_count": build_report.needs_review_count,
-        "blocked_count": build_report.blocked_count,
-        "warning_count": build_report.warning_count,
-        "ready_count": build_report.ready_count,
-        "messages": [_message_payload(message) for message in build_report.messages],
-    })
-
-    attempted_count = sum(1 for row in send_results if row.get("status") in {"sent", "failed"})
-    return {
-        "campaign_id": campaign.id,
-        "version_id": version.id,
-        "version_number": version.version_number,
-        "send_requested": send,
-        "include_warnings": include_warnings,
-        "include_needs_review": include_needs_review,
-        "append_sent": append_sent,
-        "steps": [
-            {"key": "validate", "label": "Validate campaign JSON", "status": "ok" if validation_report.ok else "needs_review", "summary": validation_json},
-            {"key": "build", "label": "Build messages", "status": "ok" if build_report.queueable_count else "needs_review", "summary": {"built": build_report.built_count, "queueable": build_report.queueable_count, "needs_review": build_report.needs_review_count, "blocked": build_report.blocked_count}},
-            {"key": "send", "label": "Mock SMTP delivery", "status": "skipped" if not send else ("ok" if failed_count == 0 else "needs_review"), "summary": {"attempted": attempted_count, "sent": sent_count, "failed": failed_count, "skipped": skipped_count}},
-            {"key": "imap", "label": "Mock IMAP Sent append", "status": "skipped" if not send or not append_sent else ("ok" if imap_failed_count == 0 else "needs_review"), "summary": {"appended": imap_appended_count, "failed": imap_failed_count}},
-        ],
-        "validation": validation_json,
-        "build": build_json,
-        "send": {
-            "attempted_count": attempted_count,
-            "sent_count": sent_count,
-            "failed_count": failed_count,
-            "skipped_count": skipped_count,
-            "imap_appended_count": imap_appended_count,
-            "imap_failed_count": imap_failed_count,
-            "results": send_results,
-        },
-        "mailbox": {"messages": mailbox.list_records(limit=200) if mailbox is not None else []},
-    }
+        campaign_id=campaign_id,
+        version_id=version_id,
+    )
+    mailbox = _mock_mailbox_for_run(send=send, clear_mailbox=clear_mailbox)
+    validation_report, build_result, send_batch = _build_mock_campaign_run(
+        session,
+        tenant_id=tenant_id,
+        campaign=campaign,
+        version=version,
+        mailbox=mailbox,
+        send=send,
+        include_warnings=include_warnings,
+        include_needs_review=include_needs_review,
+        append_sent=append_sent,
+        check_files=check_files,
+    )
+    validation_payload = _mock_validation_payload(validation_report)
+    build_payload = _mock_build_payload(build_result)
+    return _mock_campaign_send_response(
+        campaign=campaign,
+        version=version,
+        mailbox=mailbox,
+        validation_report=validation_report,
+        validation_payload=validation_payload,
+        build_result=build_result,
+        build_payload=build_payload,
+        send_batch=send_batch,
+        send=send,
+        include_warnings=include_warnings,
+        include_needs_review=include_needs_review,
+        append_sent=append_sent,
+    )

src/govoplan_campaign/backend/documentation.py

@@ -0,0 +1,755 @@
+from __future__ import annotations
+
+from govoplan_core.core.modules import DocumentationCondition, DocumentationContext, DocumentationLink, DocumentationTopic
+
+from govoplan_campaign.backend.delivery_policy import (
+    CampaignDeliveryPolicyError,
+    effective_synchronous_send_policy,
+)
+
+
+_CAMPAIGN_USER_SCOPES = (
+    "campaigns:campaign:read",
+    "campaigns:campaign:create",
+    "campaigns:campaign:update",
+    "campaigns:campaign:copy",
+    "campaigns:campaign:archive",
+    "campaigns:campaign:delete",
+    "campaigns:campaign:share",
+    "campaigns:campaign:validate",
+    "campaigns:campaign:build",
+    "campaigns:campaign:review",
+    "campaigns:campaign:send_test",
+    "campaigns:campaign:queue",
+    "campaigns:campaign:control",
+    "campaigns:campaign:send",
+    "campaigns:campaign:retry",
+    "campaigns:campaign:reconcile",
+    "campaigns:recipient:read",
+    "campaigns:recipient:write",
+    "campaigns:recipient:import",
+    "campaigns:recipient:export",
+    "campaigns:report:read",
+    "campaigns:report:export",
+    "campaigns:report:send",
+)
+
+_CAMPAIGN_HELP_CONTEXTS = (
+    "campaigns.list",
+    "campaign.overview",
+)
+
+_FILES_INTEGRATION = "files.campaign_attachments"
+_MAIL_INTEGRATION = "mail.campaign_delivery"
+_ADDRESSES_LOOKUP_INTEGRATION = "addresses.lookup"
+_ADDRESSES_SOURCE_INTEGRATION = "addresses.recipient_source"
+_NOTIFICATIONS_INTEGRATION = "notifications.dispatch"
+
+
+def _workflow_topic(
+    *,
+    topic_id: str,
+    title: str,
+    summary: str,
+    body: str,
+    order: int,
+    audience: tuple[str, ...],
+    required_scopes: tuple[str, ...],
+    route: str,
+    screen: str,
+    help_contexts: tuple[str, ...],
+    prerequisites: tuple[str, ...],
+    steps: tuple[str, ...],
+    outcome: str,
+    verification: str,
+    related_topic_ids: tuple[str, ...] = (),
+    required_modules: tuple[str, ...] = ("campaigns",),
+    required_capabilities: tuple[str, ...] = (),
+    links: tuple[DocumentationLink, ...] = (DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),),
+    related_modules: tuple[str, ...] = (),
+    limitations: tuple[str, ...] = (),
+) -> DocumentationTopic:
+    metadata: dict[str, object] = {
+        "kind": "workflow",
+        "route": route,
+        "screen": screen,
+        "help_contexts": list(help_contexts),
+        "prerequisites": list(prerequisites),
+        "steps": list(steps),
+        "outcome": outcome,
+        "verification": verification,
+        "related_topic_ids": list(related_topic_ids),
+    }
+    if limitations:
+        metadata["limitations"] = list(limitations)
+    return DocumentationTopic(
+        id=topic_id,
+        title=title,
+        summary=summary,
+        body=body,
+        layer="configured",
+        documentation_types=("user",),
+        audience=audience,
+        order=order,
+        conditions=(
+            DocumentationCondition(
+                required_modules=required_modules,
+                required_capabilities=required_capabilities,
+                required_scopes=required_scopes,
+            ),
+        ),
+        links=links,
+        related_modules=related_modules,
+        unlocks=(outcome,),
+        source_module_id="campaigns",
+        metadata=metadata,
+    )
+
+
+CAMPAIGN_USER_DOCUMENTATION = (
+    _workflow_topic(
+        topic_id="campaigns.workflow.create-campaign",
+        title="Create a campaign",
+        summary="Start a governed campaign as an editable draft and complete its purpose and ownership before adding delivery data.",
+        body="A new campaign starts with one editable working version. Creating it does not grant access to Mail profiles, managed files, address sources, or delivery actions; those remain separately authorized.",
+        order=30,
+        audience=("campaign_manager", "campaign_author"),
+        required_scopes=("campaigns:campaign:read", "campaigns:campaign:create"),
+        route="/campaigns",
+        screen="Campaigns",
+        help_contexts=("campaigns.list",),
+        prerequisites=("You may create campaigns in the active tenant.",),
+        steps=(
+            "Open Campaigns and select New campaign.",
+            "Use the creation wizard to enter a clear name, identifier, and purpose.",
+            "Open the new campaign and confirm its owner before adding recipient or delivery data.",
+            "Continue through the preparation sections and save the editable working version.",
+        ),
+        outcome="An owned campaign draft with an editable working version.",
+        verification="The Campaign overview shows the new campaign as a draft and identifies its current working version.",
+        related_topic_ids=("campaigns.workflow.prepare-validate-and-build", "campaigns.workflow.import-recipients"),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.create-editable-successor",
+        title="Create an editable successor",
+        summary="Continue work after a permanent or delivery-final lock without rewriting the preserved version.",
+        body="Create editable copy means creating the campaign's next working version. Validation locks and temporary user locks are removed in place instead; they must not create parallel drafts.",
+        order=31,
+        audience=("campaign_manager", "campaign_author"),
+        required_scopes=("campaigns:campaign:read", "campaigns:campaign:copy", "campaigns:recipient:read"),
+        route="/campaigns/{campaign_id}",
+        screen="Campaign workspace",
+        help_contexts=("campaign.overview", "campaign.audit"),
+        prerequisites=(
+            "You have write access to the selected campaign.",
+            "Its current version is permanently user-locked or delivery-final.",
+        ),
+        steps=(
+            "Open the locked current version and review the reason it is read-only.",
+            "Select Create editable copy in the locked-version notice.",
+            "If the notice instead offers an unlock action, unlock that validation or temporary user lock rather than creating a successor.",
+            "Review the new working version, reselect any Mail profile when requested, and validate and build again before delivery.",
+        ),
+        outcome="A new editable working version while the source version and its evidence remain unchanged.",
+        verification="The Campaign overview identifies a new current version number and the earlier version remains in history.",
+        related_topic_ids=("campaigns.workflow.prepare-validate-and-build", "campaigns.mail-profile-user-journey"),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.import-recipients",
+        title="Import recipients into a campaign",
+        summary="Turn a text, CSV, or spreadsheet table into reviewed campaign-local recipient rows with source provenance.",
+        body="Import copies valid rows into the editable campaign version. Invalid rows stay visible during preview instead of disappearing, and later changes to the source file do not silently change the saved campaign.",
+        order=33,
+        audience=("campaign_manager", "campaign_author"),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:campaign:update",
+            "campaigns:recipient:read",
+            "campaigns:recipient:write",
+            "campaigns:recipient:import",
+        ),
+        route="/campaigns/{campaign_id}/recipients",
+        screen="Recipient data",
+        help_contexts=("campaign.recipients", "campaign.recipient-data"),
+        prerequisites=(
+            "The current campaign version is editable and you have write access to it.",
+            "The source is tabular and contains only data needed for this campaign.",
+        ),
+        steps=(
+            "Open Recipient data and select Import.",
+            "Upload or paste the table, then confirm its encoding, sheet, header rows, and separator where applicable.",
+            "Map address and campaign fields, choose append or replace, and review every invalid or excluded row.",
+            "Select Import valid rows, inspect the resulting recipient table, and save the campaign page.",
+        ),
+        outcome="A campaign-local recipient snapshot with mapping and source evidence.",
+        verification="Reopen Recipient data, confirm the expected row count and addressing, then validate before building messages.",
+        related_topic_ids=("campaigns.workflow.import-address-source", "campaigns.workflow.prepare-validate-and-build"),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.import-address-source",
+        title="Import a recipient source from Addresses",
+        summary="Copy a permitted reusable address book or list into the campaign as a traceable versioned snapshot.",
+        body="Campaign does not follow the address source live. It records the selected source revision and warns when a newer source revision is available, so re-import is always an explicit author action.",
+        order=32,
+        audience=("campaign_manager", "campaign_author"),
+        required_modules=("campaigns", "addresses"),
+        required_capabilities=(_ADDRESSES_SOURCE_INTEGRATION,),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:campaign:update",
+            "campaigns:recipient:read",
+            "campaigns:recipient:write",
+            "campaigns:recipient:import",
+        ),
+        route="/campaigns/{campaign_id}/recipients",
+        screen="Recipient data",
+        help_contexts=("campaign.recipients", "campaign.recipient-data"),
+        prerequisites=(
+            "Addresses offers at least one source visible to you.",
+            "The current campaign version is editable and you have write access to it.",
+        ),
+        steps=(
+            "Open Recipient data and select Import address book/list.",
+            "Choose the permitted source and review the returned snapshot and its revision.",
+            "Choose append or replace, import the snapshot, inspect the recipient rows, and save.",
+            "When a stale-source warning appears later, compare the source and re-import deliberately if the campaign should use the new revision.",
+        ),
+        outcome="A campaign-local recipient snapshot whose Addresses source and revision can be traced.",
+        verification="Recipient data records the source provenance, and a later source revision does not alter the saved rows until you re-import it.",
+        related_topic_ids=("campaigns.workflow.import-recipients", "campaigns.workflow.prepare-validate-and-build"),
+        related_modules=("addresses",),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.use-managed-attachments",
+        title="Use managed files as campaign attachments",
+        summary="Select governed file versions, preview rule matches, and preserve exactly which files were used for the campaign build.",
+        body="Managed attachments remain owned by Files. Campaign stores governed references and frozen build evidence; it does not copy Files administration authority or accept arbitrary server paths.",
+        order=34,
+        audience=("campaign_manager", "campaign_author"),
+        required_modules=("campaigns", "files"),
+        required_capabilities=(_FILES_INTEGRATION,),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:campaign:update",
+            "campaigns:campaign:validate",
+            "campaigns:recipient:read",
+            "files:file:read",
+            "files:file:share",
+        ),
+        route="/campaigns/{campaign_id}/files",
+        screen="Attachments",
+        help_contexts=("campaign.attachments",),
+        prerequisites=(
+            "The current campaign version is editable and you have write access to it.",
+            "The required file versions exist in Files and may be shared with this campaign.",
+        ),
+        steps=(
+            "Open Attachments and choose managed files or patterns from Files.",
+            "Define campaign-wide and recipient-specific rules, including unmatched-file and archive behavior.",
+            "Preview the matches and link the exact managed versions to the campaign.",
+            "Save, validate, and build, then inspect the resolved attachment evidence in Review and send.",
+        ),
+        outcome="Governed file versions linked to the campaign and frozen into the exact build evidence.",
+        verification="Confirm the expected filenames, paths, matches, and link state in the Campaign UI. Exact managed versions and checksums remain retained in build evidence for authorized supporting tools.",
+        related_topic_ids=("campaigns.workflow.prepare-validate-and-build",),
+        links=(
+            DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+            DocumentationLink(label="Files", href="/files", kind="runtime"),
+        ),
+        related_modules=("files",),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.queue-delivery",
+        title="Queue a campaign for controlled delivery",
+        summary="Place an exact reviewed build into the worker queue while preserving recipient-level state and retry protection.",
+        body="Queueing is a controlled state change, not proof of delivery. Ordinary batches should use background workers, and accepted or outcome-unknown effects remain protected from blind retry.",
+        order=35,
+        audience=("campaign_sender", "campaign_operator"),
+        required_modules=("campaigns", "mail"),
+        required_capabilities=(_MAIL_INTEGRATION,),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:campaign:queue",
+            "campaigns:recipient:read",
+            "mail:profile:use",
+        ),
+        route="/campaigns/{campaign_id}/review",
+        screen="Review and send",
+        help_contexts=(),
+        prerequisites=(
+            "The selected version is validated, locked, built, and reviewed.",
+            "Its Mail profile remains available and authorized for the current campaign context.",
+            "You have write access to the selected campaign.",
+        ),
+        steps=(
+            "Open Review and send and confirm the selected version, build, recipients, warnings, and review completion.",
+            "Select Queue for workers and confirm the exact durable execution that will be committed.",
+            "Remain on Review and send or leave and return later; both views read the same durable job states.",
+            "Use the delivery controls to pause, resume, cancel unsent work, or retry eligible failures without requeueing accepted or uncertain outcomes.",
+        ),
+        outcome="Eligible jobs queued with an auditable execution snapshot and protected delivery state.",
+        verification="The Report shows the selected version's jobs as queued or progressing, without changing any accepted job back to retryable.",
+        related_topic_ids=("campaigns.workflow.complete-review", "campaigns.workflow.retry-and-reconcile"),
+        links=(
+            DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+            DocumentationLink(label="Campaign operator queue", href="/operator", kind="runtime"),
+        ),
+        related_modules=("mail", "notifications"),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.send-small-controlled-run",
+        title="Send a campaign immediately",
+        summary="Run the eligible jobs synchronously only after deliberately confirming that the reviewed campaign is small enough for an interactive request.",
+        body="Send now is protected by an effective deployment/tenant recipient-job maximum. The server counts the exact persisted eligible build, rejects an oversized or empty run before SMTP, and preflights every message and the Mail profile revision before the first provider effect.",
+        order=36,
+        audience=("campaign_sender", "campaign_operator"),
+        required_modules=("campaigns", "mail"),
+        required_capabilities=(_MAIL_INTEGRATION,),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:campaign:send",
+            "campaigns:recipient:read",
+            "mail:profile:use",
+        ),
+        route="/campaigns/{campaign_id}/review",
+        screen="Review and send",
+        help_contexts=("campaign.review-send",),
+        prerequisites=(
+            "The selected version is validated, locked, built, and reviewed.",
+            "The exact eligible recipient-job count is within the effective limit shown on Review and send.",
+            "Its Mail profile remains available and authorized for the current campaign context.",
+        ),
+        steps=(
+            "Open Review and send and inspect the exact build and delivery readiness checks.",
+            "Review the effective synchronous limit and exact eligible count; use Queue for workers when Send now is unavailable or for an ordinary batch.",
+            "Select Send now and confirm the protected delivery action.",
+            "Open Report and inspect each resulting delivery state before attempting any recovery action.",
+        ),
+        outcome="A synchronous real delivery run with recipient-level attempt and outcome evidence.",
+        verification="The Report distinguishes accepted, failed, unattempted, cancelled, and outcome-unknown jobs and retains their attempt history.",
+        related_topic_ids=("campaigns.workflow.queue-delivery", "campaigns.workflow.retry-and-reconcile"),
+        related_modules=("mail",),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.view-aggregate-delivery-report",
+        title="Review aggregate campaign outcomes",
+        summary="Inspect privacy-protected Campaign totals without receiving recipient rows, message content, delivery diagnostics, or export authority.",
+        body="The aggregate Reports view exposes only approved campaign-level business outcomes. Positive cells below the configured threshold are suppressed together with a complementary value or the denominator when needed, so totals cannot be subtracted to recover a small group.",
+        order=37,
+        audience=("campaign_aggregate_reader", "campaign_reader", "campaign_manager"),
+        required_scopes=("campaigns:report:read",),
+        route="/reports",
+        screen="Reports",
+        help_contexts=("campaign.report",),
+        prerequisites=("The campaign is owned by or explicitly shared with you, or you hold tenant-wide authority.",),
+        steps=(
+            "Open Reports and select a campaign available to you.",
+            "Read the stated denominator before comparing accepted, failed, unknown, active, excluded, cancelled, and unattempted outcomes.",
+            "Treat Suppressed as an intentional privacy boundary rather than zero or missing data.",
+            "Request separately authorized recipient-level access only when the task genuinely requires individual evidence.",
+        ),
+        outcome="A business-level Campaign outcome view with small-group and recipient privacy preserved.",
+        verification="No row, address, message, attachment, diagnostic, filter, drill-down, or export action is available from the aggregate view.",
+        related_topic_ids=("campaigns.workflow.view-delivery-report",),
+        links=(DocumentationLink(label="Aggregate Campaign reports", href="/reports", kind="runtime"),),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.view-delivery-report",
+        title="Review campaign delivery details",
+        summary="Inspect delivery totals and recipient-level job evidence in the current Campaign Report UI.",
+        body="The recipient-aware Campaign Report requires campaign-read, report-read, and recipient-read authority. Infrastructure diagnostics remain separately authorized, and the server checks every direct detail route independently of the interface.",
+        order=38,
+        audience=("campaign_reader", "campaign_manager", "campaign_reviewer", "campaign_sender"),
+        required_scopes=("campaigns:campaign:read", "campaigns:report:read", "campaigns:recipient:read"),
+        route="/campaigns/{campaign_id}/report",
+        screen="Campaign Report",
+        help_contexts=("campaign.report",),
+        prerequisites=("You may read the selected campaign and its report.",),
+        steps=(
+            "Open the campaign and select Report.",
+            "Review totals for queued, accepted, failed, cancelled, excluded/skipped, unattempted, and outcome-unknown jobs.",
+            "Inspect the authorized recipient-level rows and attempt history.",
+            "Treat outcome-unknown jobs as unresolved and hand them to an authorized operator for evidence-backed reconciliation.",
+        ),
+        outcome="A recipient-aware view of delivery progress and outcomes with diagnostics still separately protected.",
+        verification="The report totals and job rows match the selected campaign version, and infrastructure diagnostics are absent unless separately authorized.",
+        related_topic_ids=("campaigns.workflow.view-aggregate-delivery-report", "campaigns.workflow.retry-and-reconcile", "campaigns.workflow.export-delivery-report"),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.export-delivery-report",
+        title="Export recipient delivery results",
+        summary="Download an authorized CSV snapshot of recipient-level campaign delivery results for controlled downstream use.",
+        body="A report export contains personal and delivery evidence. Store, transmit, retain, and delete it according to the campaign's purpose and the applicable export and retention policy.",
+        order=39,
+        audience=("campaign_report_exporter", "campaign_auditor"),
+        required_scopes=(
+            "campaigns:campaign:read",
+            "campaigns:report:read",
+            "campaigns:report:export",
+            "campaigns:recipient:read",
+            "campaigns:recipient:export",
+        ),
+        route="/campaigns/{campaign_id}/report",
+        screen="Campaign Report",
+        help_contexts=("campaign.report", "campaign.audit"),
+        prerequisites=(
+            "You may export both campaign reports and recipient data.",
+            "The export has an approved purpose and destination.",
+        ),
+        steps=(
+            "Open the campaign Report and select the intended version.",
+            "Confirm that recipient-level export is necessary for the task.",
+            "Select Download CSV and store the result only in the approved location.",
+            "Verify the selected version and row counts, then apply the required retention or deletion rule to the downloaded copy.",
+        ),
+        outcome="A point-in-time CSV export of authorized campaign job results.",
+        verification="The downloaded file identifies the intended campaign/version and contains business evidence without credentials or ordinary-reader infrastructure details.",
+        related_topic_ids=("campaigns.workflow.view-delivery-report",),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.share-campaign",
+        title="Share a campaign",
+        summary="Grant a user or group explicit view or write access to one campaign without widening their platform permissions.",
+        body="A share can only narrow access to the selected campaign within the recipient's existing role. It never grants Mail profile use, Files authority, tenant-wide recipient access, or a missing Campaign action.",
+        order=39,
+        audience=("campaign_owner", "campaign_access_manager"),
+        required_scopes=("campaigns:campaign:read", "campaigns:campaign:share"),
+        route="/campaigns/{campaign_id}/global-settings",
+        screen="Ownership and sharing",
+        help_contexts=("campaign.overview", "campaign.global-settings"),
+        prerequisites=(
+            "You have write access to the selected campaign.",
+            "The target user or group already has an appropriate Campaign role for the intended actions.",
+        ),
+        steps=(
+            "Open Global settings and find Ownership and sharing.",
+            "Select Share, choose a user or group, and choose Can view or Can edit and operate.",
+            "Save the share and verify the target appears in the sharing table with the intended level.",
+            "Use the row action to revoke the explicit share when it is no longer needed.",
+        ),
+        outcome="Explicit campaign access for the selected subject, bounded by that subject's existing permissions.",
+        verification="The sharing table shows the active target and level; revocation removes its explicit access while preserving the audit record.",
+        related_topic_ids=("campaigns.reference.composition-assurance",),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.archive-campaign",
+        title="Archive a campaign",
+        summary="Remove a completed campaign from active work while preserving its versions, outcomes, and audit evidence.",
+        body="Archive only after queued, sending, and outcome-unknown work has been resolved. Archiving preserves evidence and is the correct lifecycle action for any campaign with build, lock, or delivery history.",
+        order=40,
+        audience=("campaign_owner", "campaign_records_manager"),
+        required_scopes=("campaigns:campaign:read", "campaigns:campaign:archive"),
+        route="/campaigns/{campaign_id}",
+        screen="Campaign lifecycle",
+        help_contexts=("campaign.overview", "campaign.report", "campaign.audit"),
+        prerequisites=(
+            "You have write access to the selected campaign.",
+            "No delivery job is queued, sending, or awaiting uncertain-outcome reconciliation.",
+        ),
+        steps=(
+            "Open Report and resolve every active or outcome-unknown delivery state.",
+            "Confirm that the campaign should leave active work while its evidence remains retained.",
+            "Invoke the authorized Archive action from a supporting client.",
+            "Reopen or query the campaign and confirm its state is Archived.",
+        ),
+        outcome="An archived campaign whose versions, reports, and audit evidence remain preserved.",
+        verification="The campaign state is Archived and its report remains available. Ask an authorized audit reader to verify the platform audit event.",
+        related_topic_ids=("campaigns.workflow.view-delivery-report", "campaigns.workflow.delete-untouched-draft"),
+        limitations=(
+            "The current Campaign Web UI does not yet expose the archive action; use an authorized supporting client or API.",
+            "The Campaign-local Audit page is not integrated yet; audit verification uses the platform audit surface or API.",
+        ),
+    ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.delete-untouched-draft",
+        title="Delete an untouched campaign draft",
+        summary="Immediately remove a draft that has no protected build, lock, publication, snapshot, or delivery evidence.",
+        body="Deletion is deliberately narrower than archive. It marks an eligible draft deleted and emits an audit record; it cannot erase a campaign that already carries evidence that must be retained.",
+        order=41,
+        audience=("campaign_owner", "campaign_records_manager"),
+        required_scopes=("campaigns:campaign:read", "campaigns:campaign:delete"),
+        route="/campaigns/{campaign_id}",
+        screen="Campaign lifecycle",
+        help_contexts=("campaign.overview", "campaign.audit"),
+        prerequisites=(
+            "You have write access to the selected campaign.",
+            "The campaign is still a draft and has no jobs, locks, published version, or execution snapshot.",
+        ),
+        steps=(
+            "Confirm that the draft is not needed and contains no evidence that should be retained.",
+            "Invoke the authorized Delete action from a supporting client and confirm the destructive action.",
+            "If deletion is refused because protected evidence exists, archive the campaign after resolving any active delivery state.",
+            "Verify that the deleted draft no longer appears in active Campaigns and that the audit event exists.",
+        ),
+        outcome="An eligible untouched draft removed from active Campaigns with attributable deletion evidence.",
+        verification="The draft is no longer returned as an active campaign. Ask an authorized audit reader to verify who deleted it and when through the platform audit surface.",
+        related_topic_ids=("campaigns.workflow.archive-campaign",),
+        limitations=(
+            "The current Campaign Web UI does not yet expose the delete action; use an authorized supporting client or API.",
+            "The Campaign-local Audit page is not integrated yet; audit verification uses the platform audit surface or API.",
+        ),
+    ),
+)
+
+
+def documentation_topics(context: DocumentationContext) -> tuple[DocumentationTopic, ...]:
+    """Describe the current Campaign composition without resolving module data.
+
+    The provider deliberately uses only the actor's permission evaluator and the
+    registry's declared contracts. Resource access, policy decisions, and
+    campaign state remain authoritative at the point where an action is used.
+    """
+
+    if context.documentation_type != "user":
+        return ()
+    principal = context.principal
+    if principal is None or not _has_any_scope(principal, _CAMPAIGN_USER_SCOPES):
+        return ()
+
+    mail_available = _integration_available(context.registry, _MAIL_INTEGRATION)
+    current_configuration = list(_actor_capabilities(principal, mail_available=mail_available))
+    integration_configuration, integration_limitations = _integration_summary(context.registry, principal)
+    current_configuration.extend(integration_configuration)
+    delivery_configuration, delivery_limitations = _delivery_policy_summary(context)
+    current_configuration.extend(delivery_configuration)
+    limitations = [
+        "Access to a particular campaign still depends on its owner or sharing rules and on the campaign's current state.",
+        "Profile, file, and address pickers re-evaluate the actual resources visible in the selected campaign; this overview does not claim that an eligible item currently exists.",
+        *integration_limitations,
+        *delivery_limitations,
+    ]
+
+    return (
+        DocumentationTopic(
+            id="campaigns.current-composition",
+            title="Your Campaign role and installed composition",
+            summary="This guide separates actions authorized by your role from optional services connected to Campaign in this installation.",
+            body=_composition_body(current_configuration, limitations),
+            layer="configured",
+            documentation_types=("user",),
+            audience=("campaign_user",),
+            order=29,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    any_scopes=_CAMPAIGN_USER_SCOPES,
+                ),
+            ),
+            links=(DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),),
+            related_modules=("mail", "files", "addresses", "notifications"),
+            source_module_id="campaigns",
+            metadata={
+                "kind": "reference",
+                "route": "/campaigns",
+                "screen": "Campaigns",
+                "help_contexts": list(_CAMPAIGN_HELP_CONTEXTS),
+                "current_configuration": current_configuration,
+                "limitations": limitations,
+            },
+        ),
+    )
+
+
+def _actor_capabilities(principal: object, *, mail_available: bool) -> tuple[str, ...]:
+    capabilities: list[str] = []
+    _append_if(capabilities, principal, ("campaigns:campaign:read",), "Open campaigns shared with you and inspect their business state.")
+    _append_if(capabilities, principal, ("campaigns:campaign:create",), "Create new campaigns.")
+    _append_if(capabilities, principal, ("campaigns:campaign:update",), "Edit eligible working campaign versions.")
+    _append_if(capabilities, principal, ("campaigns:campaign:copy",), "Create an editable successor from an eligible existing version.")
+    _append_if(capabilities, principal, ("campaigns:recipient:read",), "Inspect recipients and recipient-specific campaign data.")
+    _append_if(capabilities, principal, ("campaigns:recipient:write",), "Add and edit recipient rows.")
+    _append_if(capabilities, principal, ("campaigns:recipient:import",), "Import recipient snapshots.")
+    _append_if(capabilities, principal, ("campaigns:campaign:validate",), "Validate campaign inputs and resolve blocking issues.")
+    _append_if(capabilities, principal, ("campaigns:campaign:build",), "Build exact recipient messages for review.")
+    _append_if(capabilities, principal, ("campaigns:campaign:review",), "Record review completion for an exact build.")
+    if mail_available:
+        _append_if(capabilities, principal, ("campaigns:campaign:send_test",), "Run authorized delivery verification tools.")
+        _append_if(capabilities, principal, ("campaigns:campaign:queue",), "Queue an eligible reviewed campaign for controlled delivery.")
+    _append_if(capabilities, principal, ("campaigns:campaign:control",), "Pause, resume, or cancel eligible delivery jobs.")
+    if mail_available:
+        _append_if(capabilities, principal, ("campaigns:campaign:send",), "Start an eligible real delivery run.")
+        _append_if(capabilities, principal, ("campaigns:campaign:retry",), "Retry delivery jobs whose recorded state permits a retry.")
+        _append_if(capabilities, principal, ("campaigns:campaign:reconcile",), "Reconcile delivery effects whose outcome is uncertain.")
+    _append_if(capabilities, principal, ("campaigns:report:read",), "View authorized campaign delivery reports.")
+    _append_if(
+        capabilities,
+        principal,
+        ("campaigns:report:export", "campaigns:recipient:export"),
+        "Export authorized delivery and recipient report data.",
+        require_all=True,
+    )
+    _append_if(capabilities, principal, ("campaigns:campaign:share",), "Manage explicit access to eligible campaigns.")
+    _append_if(capabilities, principal, ("campaigns:campaign:archive",), "Archive eligible campaigns while retaining their evidence.")
+    _append_if(capabilities, principal, ("campaigns:campaign:delete",), "Delete eligible untouched drafts.")
+    if mail_available:
+        _append_if(
+            capabilities,
+            principal,
+            ("campaigns:report:send", "campaigns:report:read", "mail:profile:use"),
+            "Send an authorized campaign report through a Mail profile.",
+            require_all=True,
+        )
+    return tuple(capabilities)
+
+
+def _integration_summary(registry: object, principal: object) -> tuple[tuple[str, ...], tuple[str, ...]]:
+    configured: list[str] = []
+    limitations: list[str] = []
+
+    mail_available = _integration_available(registry, _MAIL_INTEGRATION)
+    can_select_mail_profile = _has_all_scopes(
+        principal,
+        ("campaigns:campaign:read", "campaigns:campaign:update", "mail:profile:use"),
+    )
+    can_deliver_with_mail = _has_scope(principal, "mail:profile:use") and _has_any_scope(
+        principal,
+        ("campaigns:campaign:queue", "campaigns:campaign:send", "campaigns:campaign:retry"),
+    )
+    if mail_available and can_select_mail_profile:
+        configured.append("Installed composition: Campaign can open Mail's actor-filtered profile picker while you edit; eligible profiles are resolved in the selected campaign context.")
+    elif mail_available and can_deliver_with_mail:
+        configured.append("Installed composition: Mail-backed Campaign delivery is connected, and the selected profile is re-authorized for each delivery action.")
+    elif mail_available:
+        limitations.append("Mail delivery is configured, but selecting a Mail profile is not included in your current tasks.")
+    else:
+        limitations.append("Mail-backed Campaign delivery is not available in the current composition.")
+
+    files_available = _integration_available(registry, _FILES_INTEGRATION)
+    can_preview_files = _has_all_scopes(
+        principal,
+        ("campaigns:campaign:read", "campaigns:recipient:read", "files:file:read"),
+    )
+    can_link_files = _has_all_scopes(
+        principal,
+        (
+            "campaigns:campaign:read",
+            "campaigns:campaign:update",
+            "campaigns:campaign:validate",
+            "campaigns:recipient:read",
+            "files:file:read",
+            "files:file:share",
+        ),
+    )
+    if files_available and can_link_files:
+        configured.append("Installed composition: Managed file versions can be selected, previewed, and linked as governed campaign attachments when the selected campaign and files pass their resource checks.")
+    elif files_available and can_preview_files:
+        configured.append("Installed composition: Managed campaign attachments can be previewed; linking a version requires campaign-update, validation, and attachment-sharing authority.")
+    elif files_available:
+        limitations.append("Managed attachments are configured, but they are not included in your current Campaign tasks.")
+    else:
+        limitations.append("Managed file attachments are not available in the current composition; campaign-owned uploads remain separate.")
+
+    lookup_available = _integration_available(registry, _ADDRESSES_LOOKUP_INTEGRATION)
+    source_available = _integration_available(registry, _ADDRESSES_SOURCE_INTEGRATION)
+    if lookup_available and _has_scope(principal, "campaigns:recipient:read"):
+        configured.append("Installed composition: Address records can be looked up while preparing recipients.")
+    elif lookup_available:
+        limitations.append("Address lookup is configured, but recipient inspection is not included in your current Campaign tasks.")
+    else:
+        limitations.append("Connected address lookup is not available in the current composition.")
+    can_import_source = _has_all_scopes(
+        principal,
+        (
+            "campaigns:campaign:read",
+            "campaigns:campaign:update",
+            "campaigns:recipient:read",
+            "campaigns:recipient:write",
+            "campaigns:recipient:import",
+        ),
+    )
+    if source_available and can_import_source:
+        configured.append("Installed composition: The actor-filtered Addresses source picker can copy a selected source into a campaign as a traceable recipient snapshot.")
+    elif source_available:
+        limitations.append("Connected recipient sources are configured, but source import is not included in your current Campaign tasks.")
+    else:
+        limitations.append("Connected recipient-source snapshots are not available; direct campaign imports remain available when authorized.")
+
+    if _integration_available(registry, _NOTIFICATIONS_INTEGRATION):
+        configured.append("Installed composition: In-app notifications can report important Campaign delivery status changes.")
+    else:
+        limitations.append("Automatic in-app Campaign status notifications are not configured.")
+
+    return tuple(configured), tuple(limitations)
+
+
+def _delivery_policy_summary(context: DocumentationContext) -> tuple[tuple[str, ...], tuple[str, ...]]:
+    session = context.session
+    tenant_id = str(getattr(context.principal, "tenant_id", "") or "").strip()
+    if session is None or not tenant_id:
+        return (), ("The effective synchronous Campaign limit could not be resolved for this documentation request.",)
+    try:
+        policy = effective_synchronous_send_policy(session, tenant_id=tenant_id)  # type: ignore[arg-type]
+    except CampaignDeliveryPolicyError as exc:
+        return (), (f"Synchronous Campaign delivery is disabled until its policy configuration is corrected: {exc}",)
+    return (
+        (
+            "Delivery policy: Send now is limited to "
+            f"{policy.max_recipient_jobs} eligible recipient job(s) for this tenant. "
+            "The exact built count and Queue for workers alternative are shown before confirmation."
+        ),
+    ), ()
+
+
+def _append_if(
+    target: list[str],
+    principal: object,
+    scopes: tuple[str, ...],
+    text: str,
+    *,
+    require_all: bool = False,
+) -> None:
+    allowed = _has_all_scopes(principal, scopes) if require_all else _has_any_scope(principal, scopes)
+    if allowed:
+        target.append(f"Role authorization: {text}")
+
+
+def _has_scope(principal: object, scope: str) -> bool:
+    checker = getattr(principal, "has", None)
+    if not callable(checker):
+        return False
+    try:
+        return bool(checker(scope))
+    except Exception:
+        return False
+
+
+def _has_any_scope(principal: object, scopes: tuple[str, ...]) -> bool:
+    return any(_has_scope(principal, scope) for scope in scopes)
+
+
+def _has_all_scopes(principal: object, scopes: tuple[str, ...]) -> bool:
+    return all(_has_scope(principal, scope) for scope in scopes)
+
+
+def _integration_available(registry: object, interface_name: str) -> bool:
+    return _registry_has_interface(registry, interface_name) and _registry_has_capability(registry, interface_name)
+
+
+def _registry_has_interface(registry: object, interface_name: str) -> bool:
+    manifests_provider = getattr(registry, "manifests", None)
+    if not callable(manifests_provider):
+        return False
+    try:
+        manifests = tuple(manifests_provider())
+    except Exception:
+        return False
+    return any(
+        getattr(provider, "name", None) == interface_name
+        for manifest in manifests
+        for provider in (getattr(manifest, "provides_interfaces", ()) or ())
+    )
+
+
+def _registry_has_capability(registry: object, capability_name: str) -> bool:
+    capability_checker = getattr(registry, "has_capability", None)
+    if not callable(capability_checker):
+        return False
+    try:
+        return bool(capability_checker(capability_name))
+    except Exception:
+        return False
+
+
+def _composition_body(current_configuration: list[str], limitations: list[str]) -> str:
+    del current_configuration, limitations
+    return "The facts below are calculated for the current actor and installed module contracts. They do not bypass campaign ownership, sharing, state, or operation-time resource and policy checks."

src/govoplan_campaign/backend/integrations.py

@@ -34,9 +34,16 @@ class ImapConfigurationError(RuntimeError):
 
 
 class ImapAppendError(RuntimeError):
-    def __init__(self, message: str, *, temporary: bool | None = None) -> None:
+    def __init__(
+        self,
+        message: str,
+        *,
+        temporary: bool | None = None,
+        outcome_unknown: bool = False,
+    ) -> None:
         super().__init__(message)
         self.temporary = temporary
+        self.outcome_unknown = outcome_unknown
 
 
 class MailProfileError(OptionalModuleUnavailable):
@@ -50,6 +57,7 @@ class _PreparedCampaignSnapshot:
         self.raw_json = raw_json
         self.managed_files_by_local_path: dict[str, Any] = {}
         self.shared_assets: list[Any] = []
+        self.candidate_assets: list[Any] = []
 
     def cleanup(self) -> None:
         shutil.rmtree(self._directory, ignore_errors=True)
@@ -107,6 +115,11 @@ class FilesCampaignIntegration:
             raise OptionalModuleUnavailable("Files module is not available")
         return self._delegate.current_version_and_blob(session, asset)
 
+    def share_assets_with_campaign(self, session: Any, **kwargs: Any) -> list[dict[str, Any]]:
+        if self._delegate is None:
+            raise OptionalModuleUnavailable("Files module is not available")
+        return self._delegate.share_assets_with_campaign(session, **kwargs)
+
     def mark_job_attachment_uses_sent(self, session: Any, job: Any) -> None:
         if self._delegate is not None:
             self._delegate.mark_job_attachment_uses_sent(session, job)
@@ -133,17 +146,6 @@ class MailCampaignIntegration:
             raise MailProfileError("Mail module is not available")
         return self._delegate
 
-    def materialize_campaign_mail_profile_config(self, session: Any, **kwargs: Any) -> dict[str, Any]:
-        if self._delegate is None:
-            raw_json = kwargs.get("raw_json")
-            if self.mail_profile_id_from_campaign_json(raw_json if isinstance(raw_json, dict) else {}):
-                raise MailProfileError("Campaign mail-server profiles require the mail module")
-            return dict(raw_json) if isinstance(raw_json, dict) else {}
-        try:
-            return self._delegate.materialize_campaign_mail_profile_config(session, **kwargs)
-        except getattr(self._delegate, "MailProfileError", MailProfileError) as exc:
-            raise MailProfileError(str(exc)) from exc
-
     def assert_campaign_mail_policy_allows_json(self, session: Any, **kwargs: Any) -> None:
         if self._delegate is None:
             raw_json = kwargs.get("raw_json")
@@ -156,72 +158,50 @@ class MailCampaignIntegration:
         except getattr(self._delegate, "MailProfileError", MailProfileError) as exc:
             raise MailProfileError(str(exc)) from exc
 
-    def assert_mail_policy_allows_send(self, session: Any, **kwargs: Any) -> None:
-        delegate = self._require()
-        try:
-            return delegate.assert_mail_policy_allows_send(session, **kwargs)
-        except getattr(delegate, "MailProfileError", MailProfileError) as exc:
-            raise MailProfileError(str(exc)) from exc
-
     def mail_profile_id_from_campaign_json(self, raw_json: dict[str, Any]) -> str | None:
         if self._delegate is not None:
             return self._delegate.mail_profile_id_from_campaign_json(raw_json)
         server = raw_json.get("server") if isinstance(raw_json, dict) else None
         profile_id = server.get("mail_profile_id") if isinstance(server, dict) else None
-        if profile_id is None and isinstance(server, dict):
-            profile_id = server.get("profile_id")
         return str(profile_id).strip() if profile_id else None
 
-    def ensure_mail_profile_allowed_for_campaign(self, session: Any, **kwargs: Any) -> Any:
+    def campaign_profile_delivery_summary(self, session: Any, **kwargs: Any) -> dict[str, Any]:
         delegate = self._require()
         try:
-            return delegate.ensure_mail_profile_allowed_for_campaign(session, **kwargs)
+            return delegate.campaign_profile_delivery_summary(session, **kwargs)
         except getattr(delegate, "MailProfileError", MailProfileError) as exc:
             raise MailProfileError(str(exc)) from exc
 
-    def smtp_config_from_profile(self, profile: Any) -> Any:
-        return self._require().smtp_config_from_profile(profile)
-
-    def imap_config_from_profile(self, profile: Any) -> Any:
-        return self._require().imap_config_from_profile(profile)
-
-    def effective_profile_credentials_inherited(self, session: Any, **kwargs: Any) -> bool:
-        return self._require().effective_profile_credentials_inherited(session, **kwargs)
-
-    def apply_campaign_credentials(self, profile_payload: dict[str, Any], server: dict[str, Any], protocol: str) -> dict[str, Any]:
-        return self._require().apply_campaign_credentials(profile_payload, server, protocol)
-
     def wait_for_rate_limit(self, **kwargs: Any) -> None:
         if self._delegate is None:
             return None
         return self._delegate.wait_for_rate_limit(**kwargs)
 
-    def send_email_bytes(self, *args: Any, **kwargs: Any) -> Any:
+    def send_campaign_email_bytes(self, *args: Any, **kwargs: Any) -> Any:
         delegate = self._require()
         try:
-            return delegate.send_email_bytes(*args, **kwargs)
+            return delegate.send_campaign_email_bytes(*args, **kwargs)
         except getattr(delegate, "SmtpSendError", SmtpSendError) as exc:
             raise SmtpSendError(str(exc), temporary=bool(getattr(exc, "temporary", False)), outcome_unknown=bool(getattr(exc, "outcome_unknown", False))) from exc
         except getattr(delegate, "SmtpConfigurationError", SmtpConfigurationError) as exc:
             raise SmtpConfigurationError(str(exc)) from exc
+        except getattr(delegate, "MailProfileError", MailProfileError) as exc:
+            raise MailProfileError(str(exc)) from exc
 
-    def append_message_to_sent(self, *args: Any, **kwargs: Any) -> Any:
+    def append_campaign_message_to_sent(self, *args: Any, **kwargs: Any) -> Any:
         delegate = self._require()
         try:
-            return delegate.append_message_to_sent(*args, **kwargs)
+            return delegate.append_campaign_message_to_sent(*args, **kwargs)
         except getattr(delegate, "ImapAppendError", ImapAppendError) as exc:
-            raise ImapAppendError(str(exc), temporary=getattr(exc, "temporary", None)) from exc
+            raise ImapAppendError(
+                str(exc),
+                temporary=getattr(exc, "temporary", None),
+                outcome_unknown=bool(getattr(exc, "outcome_unknown", False)),
+            ) from exc
         except getattr(delegate, "ImapConfigurationError", ImapConfigurationError) as exc:
             raise ImapConfigurationError(str(exc)) from exc
-
-    def send_email_message(self, *args: Any, **kwargs: Any) -> Any:
-        delegate = self._require()
-        try:
-            return delegate.send_email_message(*args, **kwargs)
-        except getattr(delegate, "SmtpSendError", SmtpSendError) as exc:
-            raise SmtpSendError(str(exc), temporary=bool(getattr(exc, "temporary", False)), outcome_unknown=bool(getattr(exc, "outcome_unknown", False))) from exc
-        except getattr(delegate, "SmtpConfigurationError", SmtpConfigurationError) as exc:
-            raise SmtpConfigurationError(str(exc)) from exc
+        except getattr(delegate, "MailProfileError", MailProfileError) as exc:
+            raise MailProfileError(str(exc)) from exc
 
     def mock_mailbox(self) -> Any | None:
         if self._delegate is None or not hasattr(self._delegate, "mock_mailbox"):

src/govoplan_campaign/backend/manifest.py

@@ -12,6 +12,9 @@ from govoplan_core.core.campaigns import (
 )
 from govoplan_core.core.module_guards import drop_table_retirement_provider, persistent_table_uninstall_guard
 from govoplan_core.core.modules import (
+    DocumentationCondition,
+    DocumentationLink,
+    DocumentationTopic,
     FrontendModule,
     MigrationSpec,
     ModuleContext,
@@ -25,6 +28,7 @@ from govoplan_core.core.modules import (
 from govoplan_core.db.base import Base
 from govoplan_campaign.backend.change_tracking import register_campaign_change_tracking
 from govoplan_campaign.backend.db import models as campaign_models  # noqa: F401 - populate Campaign ORM metadata
+from govoplan_campaign.backend.documentation import CAMPAIGN_USER_DOCUMENTATION, documentation_topics
 
 register_campaign_change_tracking()
 
@@ -53,13 +57,14 @@ PERMISSIONS = (
     _permission("campaigns:campaign:share", "Share campaigns", "Grant or revoke explicit campaign access.", "Campaigns"),
     _permission("campaigns:campaign:validate", "Validate campaigns", "Run technical validation and manage validation locks.", "Campaigns"),
     _permission("campaigns:campaign:build", "Build campaigns", "Build exact messages and attachment evidence.", "Campaigns"),
-    _permission("campaigns:campaign:review", "Approve campaign review", "Approve or reject built messages and review conditions.", "Campaigns"),
+    _permission("campaigns:campaign:review", "Complete campaign review", "Record review completion and the exact built messages inspected.", "Campaigns"),
     _permission("campaigns:campaign:send_test", "Mock-send campaigns", "Use mock delivery and verification tools.", "Campaigns"),
     _permission("campaigns:campaign:queue", "Queue campaigns", "Place approved executions into the delivery queue.", "Campaigns"),
     _permission("campaigns:campaign:control", "Control delivery", "Pause, resume or cancel queued and sending jobs.", "Campaigns"),
     _permission("campaigns:campaign:send", "Send campaigns", "Start real SMTP delivery.", "Campaigns"),
     _permission("campaigns:campaign:retry", "Retry delivery", "Retry failed or unattempted delivery jobs.", "Campaigns"),
-    _permission("campaigns:campaign:reconcile", "Reconcile delivery", "Resolve outcome-unknown SMTP attempts after inspection.", "Campaigns"),
+    _permission("campaigns:campaign:reconcile", "Reconcile delivery", "Resolve outcome-unknown SMTP or IMAP attempts after inspection.", "Campaigns"),
+    _permission("campaigns:diagnostic:read", "View campaign diagnostics", "Inspect worker claims and internal storage locators for campaign delivery troubleshooting.", "Campaign operations"),
     _permission("campaigns:recipient:read", "View recipients", "Read recipient lists and recipient-specific campaign data.", "Recipients"),
     _permission("campaigns:recipient:write", "Edit recipients", "Create and edit recipient rows and field values.", "Recipients"),
     _permission("campaigns:recipient:import", "Import recipients", "Bulk-import recipient lists.", "Recipients"),
@@ -70,6 +75,14 @@ PERMISSIONS = (
 )
 
 ROLE_TEMPLATES = (
+    RoleTemplate(
+        slug="campaign_aggregate_reader",
+        name="Campaign aggregate reader",
+        description="View privacy-protected outcome totals without recipient or delivery diagnostics.",
+        permissions=(
+            "campaigns:report:read",
+        ),
+    ),
     RoleTemplate(
         slug="campaign_manager",
         name="Campaign manager",
@@ -90,7 +103,7 @@ ROLE_TEMPLATES = (
     RoleTemplate(
         slug="campaign_reviewer",
         name="Campaign reviewer",
-        description="Inspect and approve prepared campaign messages.",
+        description="Inspect prepared campaign messages and record review completion.",
         permissions=(
             "campaigns:campaign:read",
             "campaigns:campaign:validate",
@@ -111,6 +124,7 @@ ROLE_TEMPLATES = (
             "campaigns:campaign:send",
             "campaigns:campaign:retry",
             "campaigns:campaign:reconcile",
+            "campaigns:diagnostic:read",
             "campaigns:recipient:read",
             "campaigns:report:read",
             "campaigns:report:send",
@@ -142,9 +156,9 @@ def _campaigns_router(context: ModuleContext):
 manifest = ModuleManifest(
     id="campaigns",
     name="Campaigns",
-    version="0.1.6",
+    version="0.1.10",
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
-    optional_dependencies=("files", "mail"),
+    optional_dependencies=("files", "mail", "notifications", "addresses"),
     provides_interfaces=(
         ModuleInterfaceProvider(name="campaigns.access", version="0.1.6"),
         ModuleInterfaceProvider(name="campaigns.delivery_tasks", version="0.1.6"),
@@ -161,6 +175,18 @@ manifest = ModuleManifest(
         ),
         ModuleInterfaceRequirement(
             name="mail.campaign_delivery",
+            version_min="0.2.0",
+            version_max_exclusive="0.3.0",
+            optional=True,
+        ),
+        ModuleInterfaceRequirement(
+            name="addresses.lookup",
+            version_min="0.1.0",
+            version_max_exclusive="0.2.0",
+            optional=True,
+        ),
+        ModuleInterfaceRequirement(
+            name="addresses.recipient_source",
             version_min="0.1.0",
             version_max_exclusive="0.2.0",
             optional=True,
@@ -175,17 +201,17 @@ manifest = ModuleManifest(
         NavItem(
             path="/operator",
             label="Operator Queue",
-            icon="activity",
+            icon="radio-tower",
+            required_all=("campaigns:campaign:read",),
             required_any=(
                 "campaigns:campaign:queue",
                 "campaigns:campaign:retry",
                 "campaigns:campaign:reconcile",
                 "campaigns:campaign:control",
-                "campaigns:campaign:send",
             ),
             order=30,
         ),
-        NavItem(path="/reports", label="Reports", icon="reports", required_any=("campaigns:report:read",), order=70),
+        NavItem(path="/reports", label="Reports", icon="clipboard-pen-line", required_any=("campaigns:report:read",), order=70),
     ),
     frontend=FrontendModule(
         module_id="campaigns",
@@ -195,19 +221,18 @@ manifest = ModuleManifest(
             NavItem(
                 path="/operator",
                 label="Operator Queue",
-                icon="activity",
+                icon="radio-tower",
+                required_all=("campaigns:campaign:read",),
                 required_any=(
                     "campaigns:campaign:queue",
                     "campaigns:campaign:retry",
                     "campaigns:campaign:reconcile",
                     "campaigns:campaign:control",
-                    "campaigns:campaign:send",
                 ),
                 order=30,
             ),
-            NavItem(path="/reports", label="Reports", icon="reports", required_any=("campaigns:report:read",), order=70),
-            NavItem(path="/address-book", label="Address Book", icon="users", order=80),
-            NavItem(path="/templates", label="Templates", icon="form", order=90),
+            NavItem(path="/reports", label="Reports", icon="clipboard-pen-line", required_any=("campaigns:report:read",), order=70),
+            NavItem(path="/templates", label="Templates", icon="layout-template", order=90),
         ),
     ),
     migration_spec=MigrationSpec(
@@ -245,6 +270,307 @@ manifest = ModuleManifest(
             label="Campaigns",
         ),
     ),
+    documentation=(
+        *CAMPAIGN_USER_DOCUMENTATION,
+        DocumentationTopic(
+            id="campaigns.mail-profile-user-journey",
+            title="Choose a Mail profile for campaign delivery",
+            summary="Campaigns reference an authorized Mail profile and never store SMTP/IMAP settings or credentials.",
+            body="Open the campaign Mail settings, select an available profile, test it through Mail, and save. Validation and delivery recheck profile authorization. A changed transport identity requires a new validation and build.",
+            layer="available",
+            documentation_types=("user",),
+            audience=("campaign_manager", "campaign_reviewer", "campaign_sender"),
+            order=46,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns", "mail"),
+                    required_scopes=("campaigns:campaign:update", "mail:profile:use"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+                DocumentationLink(label="Mail profiles", href="/settings?section=mail-profiles", kind="runtime"),
+                DocumentationLink(label="Campaign handbook", href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md", kind="repository"),
+            ),
+            related_modules=("mail",),
+            unlocks=("Profile-backed SMTP delivery and optional IMAP append-to-Sent.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/campaigns/{campaign_id}/mail-settings",
+                "screen": "Campaign Mail settings",
+                "help_contexts": ["campaign.server-settings"],
+                "prerequisites": [
+                    "Campaign and Mail are installed.",
+                    "You may edit the current campaign version and use at least one authorized Mail profile.",
+                ],
+                "steps": [
+                    "Open the campaign and go to Mail settings.",
+                    "Select an available Mail profile; Campaign stores only its stable identifier.",
+                    "Test SMTP and, when configured, IMAP through the Mail module.",
+                    "Save, validate, and build the campaign before queueing delivery.",
+                ],
+                "outcome": "The editable campaign version references an authorized Mail-owned delivery profile without copying transport settings or credentials.",
+                "verification": "Reopen Mail settings, confirm the selected profile, then run validation and verify that the build completes without profile-drift errors.",
+                "related_topic_ids": [
+                    "campaigns.mail-profile-governance",
+                    "campaigns.mail-profile-operations",
+                    "mail.profile-ownership-and-consumers",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.mail-profile-governance",
+            title="Govern Campaign-to-Mail profile references",
+            summary="Mail owns transport definitions and encrypted credentials; Campaign owns only the selected profile reference and delivery evidence.",
+            body="Grant mail:profile:use to campaign authors, constrain profile availability through Mail policy, and keep effective credential inheritance enabled. Inline transport fields are rejected. Legacy records remain unchanged until an explicit, audited profile migration creates or updates an editable version.",
+            layer="configured",
+            documentation_types=("admin",),
+            audience=("tenant_admin", "mail_admin", "campaign_admin"),
+            order=47,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns", "mail"),
+                    any_scopes=("mail:profile:write", "admin:policies:read", "system:settings:read"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Mail profiles", href="/settings?section=mail-profiles", kind="runtime"),
+                DocumentationLink(label="Campaign schema", href="/api/v1/campaigns/schema", kind="api"),
+                DocumentationLink(label="Mail profile boundary", href="govoplan-campaign/docs/MAIL_PROFILE_BOUNDARY.md", kind="repository"),
+            ),
+            related_modules=("mail", "access"),
+            unlocks=("Auditable, reusable transport configuration across campaigns.",),
+            metadata={
+                "kind": "reference",
+                "route": "/campaigns/{campaign_id}/mail-policy",
+                "screen": "Campaign Mail policy",
+                "section": "Profile authorization and credential inheritance",
+                "related_topic_ids": [
+                    "campaigns.mail-profile-user-journey",
+                    "campaigns.mail-profile-operations",
+                    "mail.profile-ownership-and-consumers",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.mail-profile-operations",
+            title="Operate profile-backed campaign delivery",
+            summary="Workers re-authorize and resolve Mail profiles at execution time while Campaign retains only opaque Mail-owned revisions and outcomes.",
+            body="A legacy snapshot, unauthorized or inactive profile, profile-reference mismatch, or changed SMTP/IMAP transport revision stops delivery. Preserve the record, migrate or correct the profile selection, revalidate, rebuild, and only then queue again. Password-only rotation remains possible without copying secrets into Campaign. Uncertain SMTP and IMAP effects remain blocked until an evidence-backed operator reconciliation.",
+            layer="configured",
+            documentation_types=("admin",),
+            audience=("campaign_sender", "campaign_operator", "mail_admin"),
+            order=48,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns", "mail"),
+                    any_scopes=("campaigns:diagnostic:read", "campaigns:campaign:reconcile", "mail:profile:test"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaign operator queue", href="/operator", kind="runtime"),
+                DocumentationLink(label="Campaign reports", href="/reports", kind="runtime"),
+                DocumentationLink(label="Campaign delivery runbook", href="govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md", kind="repository"),
+            ),
+            related_modules=("mail", "audit"),
+            unlocks=("Fail-closed recovery without exposing Mail credentials.",),
+            metadata={
+                "kind": "reference",
+                "route": "/operator",
+                "screen": "Campaign operator queue",
+                "section": "Profile-backed delivery recovery",
+                "related_topic_ids": [
+                    "campaigns.mail-profile-user-journey",
+                    "campaigns.mail-profile-governance",
+                    "mail.profile-ownership-and-consumers",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.workflow.prepare-validate-and-build",
+            title="Prepare, validate, and build a campaign",
+            summary="Turn governed recipient, template, attachment, and Mail-profile inputs into exact built messages for review.",
+            body="Prepare each input in its owning surface, resolve every blocking validation issue, and build exact recipient messages before review. Campaign freezes recipient and attachment evidence for the selected version; later source changes do not silently alter that build.",
+            layer="configured",
+            documentation_types=("user",),
+            audience=("campaign_manager", "campaign_author"),
+            order=49,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    required_scopes=("campaigns:campaign:update", "campaigns:campaign:validate", "campaigns:campaign:build"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+                DocumentationLink(label="Campaign handbook", href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md", kind="repository"),
+                DocumentationLink(label="Recipient import guide", href="govoplan-campaign/docs/RECIPIENT_IMPORT_GUIDE.md", kind="repository"),
+            ),
+            related_modules=("addresses", "files", "mail"),
+            unlocks=("A reviewable build whose exact recipient-specific effects can be inspected before delivery.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/campaigns/{campaign_id}/global-settings",
+                "screen": "Campaign workspace",
+                "help_contexts": [
+                    "campaign.overview",
+                    "campaign.settings",
+                    "campaign.fields",
+                    "campaign.template",
+                    "campaign.attachments",
+                    "campaign.recipients",
+                    "campaign.recipient-data",
+                    "campaign.server-settings",
+                    "campaign.global-settings",
+                    "campaign.review-send",
+                    "campaign.json",
+                ],
+                "prerequisites": [
+                    "The campaign has an owner and a clear communication purpose.",
+                    "You may edit, validate, and build the selected campaign version.",
+                    "Optional source modules needed by this campaign are installed and authorized.",
+                ],
+                "steps": [
+                    "Set campaign-wide fields and purpose, then define the recipient fields and templates.",
+                    "Import or select recipients and inspect provenance, exclusions, and review-required rows.",
+                    "Select managed attachment versions and an authorized Mail profile when those capabilities are used.",
+                    "Validate the relevant sections and resolve every blocker without hiding warnings.",
+                    "Build the selected version and inspect representative and exceptional rendered messages.",
+                ],
+                "outcome": "The selected version has exact built messages and frozen source evidence ready for an independent review.",
+                "verification": "Open Review, confirm the build belongs to the intended version, and inspect counts, warnings, recipients, addressing, rendered content, and attachment evidence.",
+                "related_topic_ids": [
+                    "campaigns.workflow.complete-review",
+                    "campaigns.mail-profile-user-journey",
+                    "files.workflow.import-managed-snapshot",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.workflow.complete-review",
+            title="Inspect built messages and complete review",
+            summary="Review the exact immutable candidate and record which built messages were inspected before delivery is enabled.",
+            body="Review completion records the inspected message keys for the selected build. The current baseline does not persist a separate approve/reject decision or review reason, so do not present completion as a richer decision record. Any material input or non-secret transport-identity change requires validation and a new build.",
+            layer="configured",
+            documentation_types=("user",),
+            audience=("campaign_reviewer",),
+            order=50,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    required_scopes=("campaigns:campaign:read", "campaigns:campaign:review"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaigns", href="/campaigns", kind="runtime"),
+                DocumentationLink(label="Campaign handbook", href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md", kind="repository"),
+            ),
+            related_modules=("files", "mail"),
+            unlocks=("An attributable review-completion record for the exact built messages inspected.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/campaigns/{campaign_id}/review",
+                "screen": "Review and send",
+                "help_contexts": ["campaign.review-send"],
+                "prerequisites": [
+                    "The selected campaign version is validated and built.",
+                    "You may read the campaign and complete its review.",
+                ],
+                "steps": [
+                    "Confirm the campaign, owner, selected version, recipient count, warnings, and exclusions.",
+                    "Inspect representative and exceptional messages, addressing, templates, and attachment evidence.",
+                    "Confirm that the selected Mail profile is suitable and authorized for the current context.",
+                    "Record review completion for the exact message keys inspected.",
+                ],
+                "outcome": "The reviewed build is eligible for a separately authorized queue or send action.",
+                "verification": "Reload Review and confirm completion is tied to the same version and message build; changed inputs must invalidate or supersede it.",
+                "related_topic_ids": [
+                    "campaigns.workflow.prepare-validate-and-build",
+                    "campaigns.workflow.retry-and-reconcile",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.workflow.retry-and-reconcile",
+            title="Retry only known failures and reconcile uncertain effects",
+            summary="Keep safe-to-retry failures separate from SMTP or IMAP effects whose outcome is unknown.",
+            body="A retry creates new attempt evidence and is valid only for an explicitly eligible state. Never blindly retry an unknown SMTP or IMAP effect. Inspect external evidence, reconcile SMTP as accepted or not sent, and reconcile IMAP as appended or not appended; repairing Sent never resends accepted SMTP mail.",
+            layer="evidence",
+            documentation_types=("admin", "user"),
+            audience=("campaign_sender", "campaign_operator"),
+            order=51,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    any_scopes=("campaigns:campaign:retry", "campaigns:campaign:reconcile", "campaigns:diagnostic:read"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaign operator queue", href="/operator", kind="runtime"),
+                DocumentationLink(label="Campaign delivery runbook", href="govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md", kind="repository"),
+            ),
+            related_modules=("mail", "audit"),
+            unlocks=("Evidence-backed recovery without accidental duplicate external effects.",),
+            metadata={
+                "kind": "workflow",
+                "route": "/operator",
+                "screen": "Campaign operator queue",
+                "help_contexts": ["campaign.review-send", "campaign.report", "campaign.audit"],
+                "prerequisites": [
+                    "You may perform the selected retry or reconciliation action.",
+                    "Provider, mailbox, worker, and campaign evidence has been preserved.",
+                ],
+                "steps": [
+                    "Classify the job and latest SMTP and IMAP attempts independently.",
+                    "Retry only an explicitly temporary, permanent-with-override, or unattempted eligible state.",
+                    "For an unknown effect, inspect provider or mailbox evidence and record the factual reconciliation with a note.",
+                    "Verify the resulting protected state before allowing more work for that job.",
+                ],
+                "outcome": "Every investigated job is either protected as effected, explicitly retryable, or still visibly unresolved.",
+                "verification": "Confirm the previous attempt remains in history, a retry has a new attempt number, and no accepted SMTP effect was repeated to repair IMAP state.",
+                "related_topic_ids": [
+                    "campaigns.mail-profile-operations",
+                    "campaigns.reference.composition-assurance",
+                ],
+            },
+        ),
+        DocumentationTopic(
+            id="campaigns.reference.composition-assurance",
+            title="Assure the Campaign reference composition",
+            summary="Release Campaign only with aligned contracts, role-safe surfaces, durable effect evidence, optional-module isolation, and recoverable data.",
+            body="Campaign is a reference composition only when Core, Mail, Files, Addresses, workers, storage, policies, and documentation are tested in the exact installed combination. Normal readers see business state rather than paths, storage keys, worker claims, or raw provider diagnostics; diagnostic and export authority remain separate.",
+            layer="evidence",
+            documentation_types=("admin",),
+            audience=("platform_operator", "security_reviewer", "release_reviewer", "integrator"),
+            order=52,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    any_scopes=("campaigns:diagnostic:read", "campaigns:report:read", "system:settings:read", "admin:modules:read"),
+                ),
+            ),
+            links=(
+                DocumentationLink(label="Campaign handbook", href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md", kind="repository"),
+                DocumentationLink(label="Reference examples and release checklist", href="govoplan-campaign/docs/EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md", kind="repository"),
+            ),
+            related_modules=("mail", "files", "addresses", "audit"),
+            unlocks=("A repeatable, supportable Campaign demonstration rather than an unverified module assembly.",),
+            metadata={
+                "kind": "reference",
+                "route": "/campaigns",
+                "screen": "Campaign reference composition",
+                "section": "Release, security, integration, and recovery assurance",
+                "verification": "Run the maintained examples, module-permutation tests, migration and restore drills, target SMTP/IMAP checks, version-alignment gate, WebUI/i18n checks, and full security audit for the pinned composition.",
+                "related_topic_ids": [
+                    "campaigns.workflow.prepare-validate-and-build",
+                    "campaigns.workflow.complete-review",
+                    "campaigns.workflow.retry-and-reconcile",
+                    "mail.reference.credentials-egress-retirement",
+                ],
+            },
+        ),
+    ),
+    documentation_providers=(documentation_topics,),
     capability_factories={
         CAPABILITY_CAMPAIGNS_ACCESS: lambda context: __import__(
             "govoplan_campaign.backend.capabilities",

src/govoplan_campaign/backend/messages/builder.py

@@ -36,6 +36,10 @@ from govoplan_campaign.backend.campaign.models import (
 )
 from govoplan_campaign.backend.campaign.template_values import build_template_values
 from govoplan_campaign.backend.services.zip_service import create_zip_archive
+from govoplan_campaign.backend.template_rendering import (
+    find_unresolved_placeholders as _find_unresolved_placeholders,
+    render_template as _render_template,
+)
 
 from .models import (
     CampaignBuildReport,
@@ -47,28 +51,6 @@ from .models import (
     MessageValidationStatus,
 )
 
-_DOLLAR_FIELD_PATTERN = re.compile(r"(?<!\\)\$\{(.*?)(?<!\\)\}")
-_BRACE_FIELD_PATTERN = re.compile(r"(?<!\\)\{\{\s*(.*?)\s*\}\}")
-
-
-def _normalize_template_key(raw: str) -> str:
-    key = raw.strip()
-    if key.startswith("fields."):
-        key = key.removeprefix("fields.")
-    elif key.startswith("local."):
-        key = "local::" + key.removeprefix("local.")
-    elif key.startswith("global."):
-        key = "global::" + key.removeprefix("global.")
-
-    if key.startswith("local::") or key.startswith("global::"):
-        return key
-    if key.startswith("local:"):
-        return "local::" + key.removeprefix("local:")
-    if key.startswith("global:"):
-        return "global::" + key.removeprefix("global:")
-    return key
-
-
 @dataclass(slots=True)
 class BuiltMessage:
     draft: MessageDraft
@@ -81,6 +63,33 @@ class CampaignBuildResult:
     built_messages: list[BuiltMessage]
 
 
+@dataclass(slots=True)
+class _EntryMessageContext:
+    resolution: EntryAttachmentResolution
+    senders: list[RecipientConfig]
+    sender: RecipientConfig | None
+    recipients: dict[str, list[RecipientConfig]]
+    issues: list[MessageIssue]
+    validation_status: MessageValidationStatus
+
+
+@dataclass(slots=True)
+class _RenderedMessageTemplate:
+    subject: str
+    text_body: str | None
+    html_body: str | None
+    body_mode: str
+    values: dict[str, Any]
+
+
+@dataclass(slots=True)
+class _MimeBuildResult:
+    message: EmailMessage | None
+    build_status: BuildStatus
+    validation_status: MessageValidationStatus
+    attachment_count: int
+
+
 def _resolve(campaign_file: str | Path, raw_path: str) -> Path:
     campaign_path = Path(campaign_file).resolve()
     path = Path(raw_path).expanduser()
@@ -96,29 +105,6 @@ def _read_text(campaign_file: str | Path, raw_path: str | None, encoding: str =
     return path.read_text(encoding=encoding)
 
 
-def _render_template(template: str, values: dict[str, Any], *, keep_missing: bool = True) -> str:
-    def replace(match: re.Match[str]) -> str:
-        key = _normalize_template_key(match.group(1))
-        if key in values:
-            value = values[key]
-            return "" if value is None else str(value)
-        return match.group(0) if keep_missing else ""
-
-    rendered = _DOLLAR_FIELD_PATTERN.sub(replace, template)
-    rendered = _BRACE_FIELD_PATTERN.sub(replace, rendered)
-    return rendered.replace(r"\${", "${").replace(r"\}", "}")
-
-
-def _find_unresolved_placeholders(text: str | None) -> set[str]:
-    if not text:
-        return set()
-    return {
-        _normalize_template_key(match.group(1))
-        for pattern in (_DOLLAR_FIELD_PATTERN, _BRACE_FIELD_PATTERN)
-        for match in pattern.finditer(text)
-    }
-
-
 def _message_address(recipient: RecipientConfig | None) -> MessageAddress | None:
     if recipient is None:
         return None
@@ -218,6 +204,26 @@ def _message_issues_from_attachment_resolution(resolution: EntryAttachmentResolu
     ]
 
 
+def _append_no_attachment_coverage_issue(issues: list[MessageIssue]) -> None:
+    if any(issue.code == "missing_attachment_coverage" for issue in issues):
+        return
+    issues.append(
+        MessageIssue(
+            severity="error",
+            code="missing_attachment_coverage",
+            message="No attachment file was resolved for this message, and sending without attachments is not allowed.",
+            behavior=Behavior.BLOCK.value,
+            source="attachments",
+        )
+    )
+
+
+def _send_without_attachments_behavior(config: CampaignConfig) -> Behavior:
+    return config.attachments.send_without_attachments_behavior or (
+        Behavior.CONTINUE if config.attachments.send_without_attachments else Behavior.BLOCK
+    )
+
+
 def _safe_filename(value: str | None, fallback: str) -> str:
     raw = value or fallback
     safe = re.sub(r"[^A-Za-z0-9_.-]+", "_", raw).strip("._")
@@ -364,6 +370,7 @@ def _attach_files(
     for attachment in resolution.attachments:
         attachment.message_filenames = []
         attachment.zip_entry_names = []
+        attachment.zip_filename = None
 
     for attachment in resolution.attachments:
         if attachment.status != AttachmentMatchStatus.OK or not attachment.matches:
@@ -408,6 +415,7 @@ def _attach_files(
             work_dir / "_zip" / f"entry-{entry_index:04d}" / _safe_filename(archive.id, "archive") / filename,
             members,
             password,
+            archive.method.value,
         )
         data, maintype, subtype = _attachment_bytes(archive_path)
         message.add_attachment(data, maintype=maintype, subtype=subtype, filename=filename)
@@ -431,6 +439,355 @@ def _write_eml(message: EmailMessage, output_dir: Path, entry: EntryConfig, entr
     return str(path), path.stat().st_size
 
 
+def _entry_message_context(
+    *,
+    config: CampaignConfig,
+    campaign_file: str | Path,
+    entry: EntryConfig,
+    entry_index: int,
+    attachment_match_index: AttachmentMatchIndex | None,
+) -> _EntryMessageContext:
+    resolution = resolve_entry_attachments(
+        config=config,
+        campaign_file=campaign_file,
+        entry=entry,
+        entry_index=entry_index,
+        match_index=attachment_match_index,
+    )
+    effective_addresses = effective_address_lists(config, entry)
+    senders = effective_addresses["from"]
+    sender = senders[0] if senders else None
+    recipients = {key: value for key, value in effective_addresses.items() if key != "from"}
+    issues = _message_issues_from_attachment_resolution(resolution)
+    validation_status = _validation_status_from_attachment_status(resolution.status)
+    validation_status = _apply_ignored_field_override_issues(config, entry, issues, validation_status)
+    return _EntryMessageContext(
+        resolution=resolution,
+        senders=senders,
+        sender=sender,
+        recipients=recipients,
+        issues=issues,
+        validation_status=validation_status,
+    )
+
+
+def _apply_ignored_field_override_issues(
+    config: CampaignConfig,
+    entry: EntryConfig,
+    issues: list[MessageIssue],
+    validation_status: MessageValidationStatus,
+) -> MessageValidationStatus:
+    ignored_field_overrides = ignored_entry_field_overrides(config, entry)
+    if not ignored_field_overrides:
+        return validation_status
+    issues.append(
+        MessageIssue(
+            severity="warning",
+            code="field_override_not_allowed",
+            message=(
+                "Recipient field value(s) ignored because the campaign field does not allow overrides: "
+                + ", ".join(ignored_field_overrides)
+            ),
+            behavior="warn",
+            source="fields",
+        )
+    )
+    if validation_status == MessageValidationStatus.READY:
+        return MessageValidationStatus.WARNING
+    return validation_status
+
+
+def _message_draft(
+    *,
+    config: CampaignConfig,
+    entry: EntryConfig,
+    entry_index: int,
+    context: _EntryMessageContext,
+    build_status: BuildStatus,
+    validation_status: MessageValidationStatus,
+    send_status: SendStatus = SendStatus.DRAFT,
+    imap_status: ImapStatus | None = None,
+    subject: str | None = None,
+    attachment_count: int = 0,
+    issues: list[MessageIssue] | None = None,
+    eml_path: str | None = None,
+    eml_size: int | None = None,
+) -> MessageDraft:
+    if validation_status == MessageValidationStatus.EXCLUDED:
+        # Exclusion is a completed validation decision, not a pending delivery.
+        # Keep both transport projections explicit so reports never imply that
+        # SMTP or IMAP work is still expected for this row.
+        send_status = SendStatus.SKIPPED
+        imap_status = ImapStatus.SKIPPED
+    if imap_status is None:
+        imap_status = _imap_initial_status(config) if build_status == BuildStatus.BUILT else ImapStatus.SKIPPED
+    return MessageDraft(
+        entry_index=entry_index,
+        entry_id=entry.id,
+        active=entry.active,
+        build_status=build_status,
+        validation_status=validation_status,
+        send_status=send_status,
+        imap_status=imap_status,
+        subject=subject,
+        from_=_message_address(context.sender),
+        from_all=_message_addresses(context.senders),
+        to=_message_addresses(context.recipients["to"]),
+        cc=_message_addresses(context.recipients["cc"]),
+        bcc=_message_addresses(context.recipients["bcc"]),
+        reply_to=_message_addresses(context.recipients["reply_to"]),
+        bounce_to=_message_addresses(context.recipients["bounce_to"]),
+        disposition_notification_to=_message_addresses(context.recipients["disposition_notification_to"]),
+        attachment_count=attachment_count,
+        attachments=_attachment_summaries(context.resolution),
+        issues=issues if issues is not None else context.issues,
+        eml_path=eml_path,
+        eml_size_bytes=eml_size,
+    )
+
+
+def _inactive_entry_message(
+    *,
+    config: CampaignConfig,
+    entry: EntryConfig,
+    entry_index: int,
+    context: _EntryMessageContext,
+) -> BuiltMessage:
+    draft = _message_draft(
+        config=config,
+        entry=entry,
+        entry_index=entry_index,
+        context=context,
+        build_status=BuildStatus.BUILD_FAILED,
+        validation_status=MessageValidationStatus.INACTIVE,
+        imap_status=ImapStatus.SKIPPED,
+        issues=[
+            MessageIssue(
+                severity="info",
+                code="inactive_entry",
+                message="Entry is inactive",
+                behavior=config.validation_policy.inactive_entry.value,
+                source="entry",
+            )
+        ],
+    )
+    return BuiltMessage(draft=draft, mime=None)
+
+
+def _validate_required_recipients(
+    config: CampaignConfig,
+    recipients: dict[str, list[RecipientConfig]],
+    issues: list[MessageIssue],
+    validation_status: MessageValidationStatus,
+) -> MessageValidationStatus:
+    if recipients["to"]:
+        return validation_status
+    behavior = config.validation_policy.missing_email.value
+    issues.append(
+        _issue_from_behavior(
+            code="missing_email",
+            message="No effective To recipient is configured",
+            behavior=behavior,
+            source="recipients",
+        )
+    )
+    if behavior == MissingAddressBehavior.BLOCK.value:
+        return MessageValidationStatus.BLOCKED
+    return MessageValidationStatus.EXCLUDED
+
+
+def _validate_required_sender(
+    senders: list[RecipientConfig],
+    issues: list[MessageIssue],
+    validation_status: MessageValidationStatus,
+) -> MessageValidationStatus:
+    if senders:
+        return validation_status
+    issues.append(
+        MessageIssue(
+            severity="error",
+            code="missing_sender",
+            message="No effective From address is configured; Campaign must resolve the sender before building.",
+            behavior="block",
+            source="recipients",
+        )
+    )
+    return MessageValidationStatus.BLOCKED
+
+
+def _render_message_template(
+    config: CampaignConfig,
+    campaign_file: str | Path,
+    entry: EntryConfig,
+) -> _RenderedMessageTemplate:
+    subject_template, text_template, html_template = _load_template_parts(config, campaign_file)
+    body_mode = _template_body_mode(config)
+    values = build_template_values(config, entry)
+    keep_missing_placeholders = not config.validation_policy.ignore_empty_fields
+    subject = _render_template(subject_template, values, keep_missing=keep_missing_placeholders)
+    text_body = None
+    html_body = None
+    if text_template is not None:
+        text_body = _render_template(text_template or "", values, keep_missing=keep_missing_placeholders)
+    if html_template is not None:
+        html_body = _render_template(html_template or "", values, keep_missing=keep_missing_placeholders)
+    return _RenderedMessageTemplate(
+        subject=subject,
+        text_body=text_body,
+        html_body=html_body,
+        body_mode=body_mode,
+        values=values,
+    )
+
+
+def _unresolved_template_fields(rendered: _RenderedMessageTemplate) -> list[str]:
+    unresolved_fields = _find_unresolved_placeholders(rendered.subject)
+    if rendered.body_mode in {TemplateBodyMode.TEXT.value, TemplateBodyMode.BOTH.value}:
+        unresolved_fields |= _find_unresolved_placeholders(rendered.text_body)
+    if rendered.body_mode in {TemplateBodyMode.HTML.value, TemplateBodyMode.BOTH.value}:
+        unresolved_fields |= _find_unresolved_placeholders(rendered.html_body)
+    return sorted(unresolved_fields)
+
+
+def _validate_rendered_template(
+    config: CampaignConfig,
+    rendered: _RenderedMessageTemplate,
+    issues: list[MessageIssue],
+    validation_status: MessageValidationStatus,
+) -> MessageValidationStatus:
+    unresolved = _unresolved_template_fields(rendered)
+    if not unresolved:
+        return validation_status
+    behavior = config.validation_policy.template_error.value
+    issues.append(
+        _issue_from_behavior(
+            code="template_error",
+            message="Unresolved template placeholder(s): " + ", ".join(unresolved),
+            behavior=behavior,
+            source="template",
+        )
+    )
+    if behavior == MissingAddressBehavior.BLOCK.value:
+        return MessageValidationStatus.BLOCKED
+    return MessageValidationStatus.EXCLUDED
+
+
+def _populate_message_headers(
+    message: EmailMessage,
+    *,
+    senders: list[RecipientConfig],
+    recipients: dict[str, list[RecipientConfig]],
+    subject: str,
+) -> None:
+    message["Date"] = formatdate(localtime=True)
+    message["Message-ID"] = make_msgid()
+    if senders:
+        message["From"] = _format_recipient_header(senders)
+        if len(senders) > 1:
+            # RFC 5322 requires a singular Sender when From contains more
+            # than one mailbox. The first effective From address remains
+            # the SMTP envelope sender and compatibility primary value.
+            message["Sender"] = _format_recipient(senders[0])
+    if recipients["to"]:
+        message["To"] = _format_recipient_header(recipients["to"])
+    if recipients["cc"]:
+        message["Cc"] = _format_recipient_header(recipients["cc"])
+    # Bcc deliberately remains envelope-only and is tracked in MessageDraft.
+    if recipients["reply_to"]:
+        message["Reply-To"] = _format_recipient_header(recipients["reply_to"])
+    if recipients["disposition_notification_to"]:
+        message["Disposition-Notification-To"] = _format_recipient_header(
+            recipients["disposition_notification_to"]
+        )
+    # bounce_to is tracked but not emitted as Return-Path. That should be the SMTP envelope sender.
+    message["Subject"] = subject
+
+
+def _populate_message_body(message: EmailMessage, rendered: _RenderedMessageTemplate) -> None:
+    effective_html_body = rendered.html_body if rendered.html_body and rendered.html_body.strip() else None
+    if rendered.body_mode == TemplateBodyMode.HTML.value:
+        message.set_content(effective_html_body or "", subtype="html")
+    elif rendered.body_mode == TemplateBodyMode.TEXT.value:
+        message.set_content(rendered.text_body or "")
+    elif effective_html_body is not None:
+        message.set_content(rendered.text_body or "")
+        message.add_alternative(effective_html_body, subtype="html")
+    else:
+        message.set_content(rendered.text_body or "")
+
+
+def _build_mime_message(
+    *,
+    config: CampaignConfig,
+    entry: EntryConfig,
+    entry_index: int,
+    output_dir: Path | None,
+    work_dir: Path | None,
+    context: _EntryMessageContext,
+    rendered: _RenderedMessageTemplate,
+) -> _MimeBuildResult:
+    message = EmailMessage()
+    try:
+        _populate_message_headers(
+            message,
+            senders=context.senders,
+            recipients=context.recipients,
+            subject=rendered.subject,
+        )
+        _populate_message_body(message, rendered)
+        if work_dir is None:
+            work_dir = output_dir or Path(tempfile.mkdtemp(prefix="govoplan-build-"))
+        attachment_count = _attach_files(
+            message=message,
+            config=config,
+            entry=entry,
+            entry_index=entry_index,
+            resolution=context.resolution,
+            values=rendered.values,
+            work_dir=work_dir,
+        )
+        if attachment_count == 0 and context.resolution.attachments and _send_without_attachments_behavior(config) == Behavior.BLOCK:
+            _append_no_attachment_coverage_issue(context.issues)
+            return _MimeBuildResult(
+                message=None,
+                build_status=BuildStatus.BUILD_FAILED,
+                validation_status=MessageValidationStatus.BLOCKED,
+                attachment_count=0,
+            )
+        return _MimeBuildResult(
+            message=message,
+            build_status=BuildStatus.BUILT,
+            validation_status=context.validation_status,
+            attachment_count=attachment_count,
+        )
+    except ZipBuildError as exc:
+        context.issues.append(
+            MessageIssue(
+                severity="error",
+                code=exc.code,
+                message=str(exc),
+                behavior="block",
+                source="attachments",
+            )
+        )
+    except Exception as exc:
+        context.issues.append(
+            MessageIssue(
+                severity="error",
+                code="build_failed",
+                message=str(exc),
+                behavior="block",
+                source="builder",
+            )
+        )
+    return _MimeBuildResult(
+        message=None,
+        build_status=BuildStatus.BUILD_FAILED,
+        validation_status=MessageValidationStatus.BLOCKED,
+        attachment_count=0,
+    )
+
+
 def build_entry_message(
     *,
     config: CampaignConfig,
@@ -442,169 +799,62 @@ def build_entry_message(
     work_dir: Path | None = None,
     attachment_match_index: AttachmentMatchIndex | None = None,
 ) -> BuiltMessage:
-    resolution = resolve_entry_attachments(config=config, campaign_file=campaign_file, entry=entry, entry_index=entry_index, match_index=attachment_match_index)
-    effective_addresses = effective_address_lists(config, entry)
-    senders = effective_addresses["from"]
-    sender = senders[0] if senders else None
-    recipients = {key: value for key, value in effective_addresses.items() if key != "from"}
-    issues = _message_issues_from_attachment_resolution(resolution)
-    validation_status = _validation_status_from_attachment_status(resolution.status)
-
-    ignored_field_overrides = ignored_entry_field_overrides(config, entry)
-    if ignored_field_overrides:
-        issues.append(
-            MessageIssue(
-                severity="warning",
-                code="field_override_not_allowed",
-                message="Recipient field value(s) ignored because the campaign field does not allow overrides: " + ", ".join(ignored_field_overrides),
-                behavior="warn",
-                source="fields",
-            )
-        )
-        if validation_status == MessageValidationStatus.READY:
-            validation_status = MessageValidationStatus.WARNING
-
+    context = _entry_message_context(
+        config=config,
+        campaign_file=campaign_file,
+        entry=entry,
+        entry_index=entry_index,
+        attachment_match_index=attachment_match_index,
+    )
     if not entry.active:
-        draft = MessageDraft(
-            entry_index=entry_index,
-            entry_id=entry.id,
-            active=False,
-            build_status=BuildStatus.BUILD_FAILED,
-            validation_status=MessageValidationStatus.INACTIVE,
-            send_status=SendStatus.DRAFT,
-            imap_status=ImapStatus.SKIPPED,
-            from_=_message_address(sender),
-            from_all=_message_addresses(senders),
-            to=_message_addresses(recipients["to"]),
-            cc=_message_addresses(recipients["cc"]),
-            bcc=_message_addresses(recipients["bcc"]),
-            reply_to=_message_addresses(recipients["reply_to"]),
-            bounce_to=_message_addresses(recipients["bounce_to"]),
-            disposition_notification_to=_message_addresses(recipients["disposition_notification_to"]),
-            attachments=_attachment_summaries(resolution),
-            issues=[MessageIssue(severity="info", code="inactive_entry", message="Entry is inactive", behavior=config.validation_policy.inactive_entry.value, source="entry")],
-        )
-        return BuiltMessage(draft=draft, mime=None)
+        return _inactive_entry_message(config=config, entry=entry, entry_index=entry_index, context=context)
 
-    if not recipients["to"]:
-        behavior = config.validation_policy.missing_email.value
-        issues.append(_issue_from_behavior(code="missing_email", message="No effective To recipient is configured", behavior=behavior, source="recipients"))
-        validation_status = MessageValidationStatus.BLOCKED if behavior == MissingAddressBehavior.BLOCK.value else MessageValidationStatus.EXCLUDED
-
-    subject_template, text_template, html_template = _load_template_parts(config, campaign_file)
-    body_mode = _template_body_mode(config)
-    values = build_template_values(config, entry)
-    keep_missing_placeholders = not config.validation_policy.ignore_empty_fields
-    subject = _render_template(subject_template, values, keep_missing=keep_missing_placeholders)
-    text_body = _render_template(text_template or "", values, keep_missing=keep_missing_placeholders) if text_template is not None else None
-    html_body = _render_template(html_template or "", values, keep_missing=keep_missing_placeholders) if html_template is not None else None
-
-    unresolved_fields = _find_unresolved_placeholders(subject)
-    if body_mode in {TemplateBodyMode.TEXT.value, TemplateBodyMode.BOTH.value}:
-        unresolved_fields |= _find_unresolved_placeholders(text_body)
-    if body_mode in {TemplateBodyMode.HTML.value, TemplateBodyMode.BOTH.value}:
-        unresolved_fields |= _find_unresolved_placeholders(html_body)
-    unresolved = sorted(unresolved_fields)
-    if unresolved:
-        behavior = config.validation_policy.template_error.value
-        issues.append(
-            _issue_from_behavior(
-                code="template_error",
-                message="Unresolved template placeholder(s): " + ", ".join(unresolved),
-                behavior=behavior,
-                source="template",
-            )
-        )
-        validation_status = MessageValidationStatus.BLOCKED if behavior == MissingAddressBehavior.BLOCK.value else MessageValidationStatus.EXCLUDED
-
-    message = EmailMessage()
-    try:
-        message["Date"] = formatdate(localtime=True)
-        message["Message-ID"] = make_msgid()
-        if senders:
-            message["From"] = _format_recipient_header(senders)
-            if len(senders) > 1:
-                # RFC 5322 requires a singular Sender when From contains more
-                # than one mailbox. The first effective From address remains
-                # the SMTP envelope sender and compatibility primary value.
-                message["Sender"] = _format_recipient(senders[0])
-        if recipients["to"]:
-            message["To"] = _format_recipient_header(recipients["to"])
-        if recipients["cc"]:
-            message["Cc"] = _format_recipient_header(recipients["cc"])
-        # Bcc deliberately remains envelope-only and is tracked in MessageDraft.
-        if recipients["reply_to"]:
-            message["Reply-To"] = _format_recipient_header(recipients["reply_to"])
-        if recipients["disposition_notification_to"]:
-            message["Disposition-Notification-To"] = _format_recipient_header(recipients["disposition_notification_to"])
-        # bounce_to is tracked but not emitted as Return-Path. That should be the SMTP envelope sender.
-        message["Subject"] = subject
-
-        effective_html_body = html_body if html_body and html_body.strip() else None
-        if body_mode == TemplateBodyMode.HTML.value:
-            message.set_content(effective_html_body or "", subtype="html")
-        elif body_mode == TemplateBodyMode.TEXT.value:
-            message.set_content(text_body or "")
-        elif effective_html_body is not None:
-            message.set_content(text_body or "")
-            message.add_alternative(effective_html_body, subtype="html")
-        else:
-            message.set_content(text_body or "")
-
-        if work_dir is None:
-            work_dir = output_dir or Path(tempfile.mkdtemp(prefix="multimailer-build-"))
-        attachment_count = _attach_files(
-            message=message,
-            config=config,
-            entry=entry,
-            entry_index=entry_index,
-            resolution=resolution,
-            values=values,
-            work_dir=work_dir,
-        )
-        build_status = BuildStatus.BUILT
-    except ZipBuildError as exc:
-        issues.append(MessageIssue(severity="error", code=exc.code, message=str(exc), behavior="block", source="attachments"))
-        validation_status = MessageValidationStatus.BLOCKED
-        build_status = BuildStatus.BUILD_FAILED
-        attachment_count = 0
-        message = None  # type: ignore[assignment]
-    except Exception as exc:
-        issues.append(MessageIssue(severity="error", code="build_failed", message=str(exc), behavior="block", source="builder"))
-        validation_status = MessageValidationStatus.BLOCKED
-        build_status = BuildStatus.BUILD_FAILED
-        attachment_count = 0
-        message = None  # type: ignore[assignment]
+    context.validation_status = _validate_required_sender(
+        context.senders,
+        context.issues,
+        context.validation_status,
+    )
+    context.validation_status = _validate_required_recipients(
+        config,
+        context.recipients,
+        context.issues,
+        context.validation_status,
+    )
+    rendered = _render_message_template(config, campaign_file, entry)
+    context.validation_status = _validate_rendered_template(
+        config,
+        rendered,
+        context.issues,
+        context.validation_status,
+    )
+    mime_result = _build_mime_message(
+        config=config,
+        entry=entry,
+        entry_index=entry_index,
+        output_dir=output_dir,
+        work_dir=work_dir,
+        context=context,
+        rendered=rendered,
+    )
 
     eml_path: str | None = None
     eml_size: int | None = None
-    if write_eml and output_dir is not None and message is not None:
-        eml_path, eml_size = _write_eml(message, output_dir, entry, entry_index)
+    if write_eml and output_dir is not None and mime_result.message is not None:
+        eml_path, eml_size = _write_eml(mime_result.message, output_dir, entry, entry_index)
 
-    draft = MessageDraft(
+    draft = _message_draft(
+        config=config,
+        entry=entry,
         entry_index=entry_index,
-        entry_id=entry.id,
-        active=entry.active,
-        build_status=build_status,
-        validation_status=validation_status,
-        send_status=SendStatus.DRAFT,
-        imap_status=_imap_initial_status(config) if build_status == BuildStatus.BUILT else ImapStatus.SKIPPED,
-        subject=subject,
-        from_=_message_address(sender),
-        from_all=_message_addresses(senders),
-        to=_message_addresses(recipients["to"]),
-        cc=_message_addresses(recipients["cc"]),
-        bcc=_message_addresses(recipients["bcc"]),
-        reply_to=_message_addresses(recipients["reply_to"]),
-        bounce_to=_message_addresses(recipients["bounce_to"]),
-        disposition_notification_to=_message_addresses(recipients["disposition_notification_to"]),
-        attachment_count=attachment_count,
-        attachments=_attachment_summaries(resolution),
-        issues=issues,
+        context=context,
+        build_status=mime_result.build_status,
+        validation_status=mime_result.validation_status,
+        subject=rendered.subject,
+        attachment_count=mime_result.attachment_count,
         eml_path=eml_path,
-        eml_size_bytes=eml_size,
+        eml_size=eml_size,
     )
-    return BuiltMessage(draft=draft, mime=message)
+    return BuiltMessage(draft=draft, mime=mime_result.message)
 
 
 
@@ -680,7 +930,7 @@ def build_campaign_messages(
 
     started = time.perf_counter()
     attachment_match_index = AttachmentMatchIndex()
-    with tempfile.TemporaryDirectory(prefix="multimailer-build-") as tmp:
+    with tempfile.TemporaryDirectory(prefix="govoplan-build-") as tmp:
         work_dir = output_path or Path(tmp)
         built_messages = [
             build_entry_message(

src/govoplan_campaign/backend/migrations/dev_versions/3c4d5e6f8192_imap_append_claim.py

@@ -0,0 +1,67 @@
+"""add durable IMAP append claim and attempt idempotency
+
+Revision ID: 3c4d5e6f8192
+Revises: 2c3d4e5f7081
+Create Date: 2026-07-21 00:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "3c4d5e6f8192"
+down_revision = "2c3d4e5f7081"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.add_column(sa.Column("imap_claimed_at", sa.DateTime(timezone=True), nullable=True))
+        batch.add_column(sa.Column("imap_claim_token", sa.String(length=36), nullable=True))
+        batch.create_index("ix_campaign_jobs_imap_claim_token", ["imap_claim_token"], unique=False)
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.add_column(sa.Column("claim_token", sa.String(length=36), nullable=True))
+    _renumber_attempts()
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.create_unique_constraint(
+            "uq_imap_append_attempts_job_attempt",
+            ["job_id", "attempt_number"],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.drop_constraint("uq_imap_append_attempts_job_attempt", type_="unique")
+        batch.drop_column("claim_token")
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.drop_index("ix_campaign_jobs_imap_claim_token")
+        batch.drop_column("imap_claim_token")
+        batch.drop_column("imap_claimed_at")
+
+
+def _renumber_attempts() -> None:
+    """Make historical attempt numbers unique per job before constraining them."""
+
+    bind = op.get_bind()
+    rows = list(
+        bind.execute(
+            sa.text(
+                "SELECT id, job_id FROM imap_append_attempts "
+                "ORDER BY job_id, created_at, id"
+            )
+        ).mappings()
+    )
+    per_job: dict[str, int] = {}
+    for row in rows:
+        job_id = str(row["job_id"])
+        attempt_number = per_job.get(job_id, 0) + 1
+        per_job[job_id] = attempt_number
+        bind.execute(
+            sa.text(
+                "UPDATE imap_append_attempts SET attempt_number = :attempt_number "
+                "WHERE id = :attempt_id"
+            ),
+            {"attempt_number": attempt_number, "attempt_id": row["id"]},
+        )

src/govoplan_campaign/backend/migrations/dev_versions/4d5e6f7a9203_execution_input_seal.py

@@ -0,0 +1,26 @@
+"""seal each campaign delivery job's immutable execution input
+
+Revision ID: 4d5e6f7a9203
+Revises: 3c4d5e6f8192
+Create Date: 2026-07-21 00:00:01.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "4d5e6f7a9203"
+down_revision = "3c4d5e6f8192"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.add_column(sa.Column("execution_input_sha256", sa.String(length=64), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.drop_column("execution_input_sha256")

src/govoplan_campaign/backend/migrations/dev_versions/c7a2f91e4b60_delivery_mode.py

@@ -0,0 +1,30 @@
+"""persist the selected Campaign delivery mode
+
+Revision ID: c7a2f91e4b60
+Revises: 4d5e6f7a9203
+Create Date: 2026-07-22 09:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "c7a2f91e4b60"
+down_revision = "4d5e6f7a9203"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_versions") as batch:
+        batch.add_column(sa.Column("delivery_mode", sa.String(length=30), nullable=True))
+        batch.add_column(sa.Column("delivery_mode_selected_at", sa.DateTime(timezone=True), nullable=True))
+        batch.create_index("ix_campaign_versions_delivery_mode", ["delivery_mode"], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("campaign_versions") as batch:
+        batch.drop_index("ix_campaign_versions_delivery_mode")
+        batch.drop_column("delivery_mode_selected_at")
+        batch.drop_column("delivery_mode")

src/govoplan_campaign/backend/migrations/dev_versions/d8b3e2c1f4a5_excluded_delivery_skipped.py

@@ -0,0 +1,42 @@
+"""mark untouched excluded jobs as skipped delivery
+
+Revision ID: d8b3e2c1f4a5
+Revises: c7a2f91e4b60
+Create Date: 2026-07-22 11:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "d8b3e2c1f4a5"
+down_revision = "c7a2f91e4b60"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Only normalize rows with no recorded transport effect. Unexpected
+    # historical delivery evidence must remain intact for audit/reconciliation.
+    op.get_bind().execute(
+        sa.text(
+            "UPDATE campaign_jobs "
+            "SET send_status = 'skipped', imap_status = 'skipped' "
+            "WHERE validation_status = 'excluded' "
+            "AND send_status = 'not_queued' "
+            "AND imap_status IN ('not_requested', 'pending', 'skipped')"
+        )
+    )
+
+
+def downgrade() -> None:
+    op.get_bind().execute(
+        sa.text(
+            "UPDATE campaign_jobs "
+            "SET send_status = 'not_queued', imap_status = 'not_requested' "
+            "WHERE validation_status = 'excluded' "
+            "AND send_status = 'skipped' "
+            "AND imap_status = 'skipped'"
+        )
+    )

src/govoplan_campaign/backend/migrations/versions/2c3d4e5f7081_v017_campaign_baseline.py

@@ -0,0 +1,51 @@
+"""v0.1.7 campaign baseline
+
+Revision ID: 2c3d4e5f7081
+Revises: None
+Create Date: 2026-07-11 00:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '2c3d4e5f7081'
+down_revision = None
+branch_labels = None
+depends_on = '4f2a9c8e7b6d'
+
+
+def upgrade() -> None:
+    op.create_table('campaign_recipient_import_mapping_profiles',
+    sa.Column('id', sa.String(length=36), nullable=False),
+    sa.Column('tenant_id', sa.String(length=36), nullable=False),
+    sa.Column('owner_user_id', sa.String(length=36), nullable=False),
+    sa.Column('name', sa.String(length=255), nullable=False),
+    sa.Column('column_count', sa.Integer(), nullable=False),
+    sa.Column('headers', sa.JSON(), nullable=False),
+    sa.Column('normalized_headers', sa.JSON(), nullable=False),
+    sa.Column('ordered_header_fingerprint', sa.String(length=64), nullable=False),
+    sa.Column('unordered_header_fingerprint', sa.String(length=64), nullable=False),
+    sa.Column('delimiter', sa.String(length=8), nullable=False),
+    sa.Column('header_rows', sa.Integer(), nullable=False),
+    sa.Column('quoted', sa.Boolean(), nullable=False),
+    sa.Column('value_separators', sa.String(length=50), nullable=False),
+    sa.Column('mappings', sa.JSON(), nullable=False),
+    sa.Column('created_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), nullable=False),
+    sa.ForeignKeyConstraint(['owner_user_id'], ['access_users.id'], name=op.f('fk_campaign_recipient_import_mapping_profiles_owner_user_id_access_users'), ondelete='CASCADE'),
+    sa.ForeignKeyConstraint(['tenant_id'], ['core_scopes.id'], name=op.f('fk_campaign_recipient_import_mapping_profiles_tenant_id_scopes'), ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_campaign_recipient_import_mapping_profiles'))
+    )
+    op.create_index(op.f('ix_campaign_recipient_import_mapping_profiles_ordered_header_fingerprint'), 'campaign_recipient_import_mapping_profiles', ['ordered_header_fingerprint'], unique=False)
+    op.create_index(op.f('ix_campaign_recipient_import_mapping_profiles_owner_user_id'), 'campaign_recipient_import_mapping_profiles', ['owner_user_id'], unique=False)
+    op.create_index(op.f('ix_campaign_recipient_import_mapping_profiles_tenant_id'), 'campaign_recipient_import_mapping_profiles', ['tenant_id'], unique=False)
+    op.create_index(op.f('ix_campaign_recipient_import_mapping_profiles_unordered_header_fingerprint'), 'campaign_recipient_import_mapping_profiles', ['unordered_header_fingerprint'], unique=False)
+    op.create_index('ix_recipient_import_profiles_ordered_fp', 'campaign_recipient_import_mapping_profiles', ['tenant_id', 'owner_user_id', 'ordered_header_fingerprint'], unique=False)
+    op.create_index('ix_recipient_import_profiles_owner', 'campaign_recipient_import_mapping_profiles', ['tenant_id', 'owner_user_id'], unique=False)
+    op.create_index('ix_recipient_import_profiles_unordered_fp', 'campaign_recipient_import_mapping_profiles', ['tenant_id', 'owner_user_id', 'unordered_header_fingerprint'], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_table('campaign_recipient_import_mapping_profiles')

src/govoplan_campaign/backend/migrations/versions/3c4d5e6f8192_v019_imap_append_claim.py

@@ -0,0 +1,67 @@
+"""add durable IMAP append claim and attempt idempotency
+
+Revision ID: 3c4d5e6f8192
+Revises: 2c3d4e5f7081
+Create Date: 2026-07-21 00:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "3c4d5e6f8192"
+down_revision = "2c3d4e5f7081"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.add_column(sa.Column("imap_claimed_at", sa.DateTime(timezone=True), nullable=True))
+        batch.add_column(sa.Column("imap_claim_token", sa.String(length=36), nullable=True))
+        batch.create_index("ix_campaign_jobs_imap_claim_token", ["imap_claim_token"], unique=False)
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.add_column(sa.Column("claim_token", sa.String(length=36), nullable=True))
+    _renumber_attempts()
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.create_unique_constraint(
+            "uq_imap_append_attempts_job_attempt",
+            ["job_id", "attempt_number"],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("imap_append_attempts") as batch:
+        batch.drop_constraint("uq_imap_append_attempts_job_attempt", type_="unique")
+        batch.drop_column("claim_token")
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.drop_index("ix_campaign_jobs_imap_claim_token")
+        batch.drop_column("imap_claim_token")
+        batch.drop_column("imap_claimed_at")
+
+
+def _renumber_attempts() -> None:
+    """Make historical attempt numbers unique per job before constraining them."""
+
+    bind = op.get_bind()
+    rows = list(
+        bind.execute(
+            sa.text(
+                "SELECT id, job_id FROM imap_append_attempts "
+                "ORDER BY job_id, created_at, id"
+            )
+        ).mappings()
+    )
+    per_job: dict[str, int] = {}
+    for row in rows:
+        job_id = str(row["job_id"])
+        attempt_number = per_job.get(job_id, 0) + 1
+        per_job[job_id] = attempt_number
+        bind.execute(
+            sa.text(
+                "UPDATE imap_append_attempts SET attempt_number = :attempt_number "
+                "WHERE id = :attempt_id"
+            ),
+            {"attempt_number": attempt_number, "attempt_id": row["id"]},
+        )

src/govoplan_campaign/backend/migrations/versions/4d5e6f7a9203_v019_execution_input_seal.py

@@ -0,0 +1,26 @@
+"""seal each campaign delivery job's immutable execution input
+
+Revision ID: 4d5e6f7a9203
+Revises: 3c4d5e6f8192
+Create Date: 2026-07-21 00:00:01.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "4d5e6f7a9203"
+down_revision = "3c4d5e6f8192"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.add_column(sa.Column("execution_input_sha256", sa.String(length=64), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("campaign_jobs") as batch:
+        batch.drop_column("execution_input_sha256")

src/govoplan_campaign/backend/migrations/versions/c7a2f91e4b60_v0110_delivery_mode.py

@@ -0,0 +1,30 @@
+"""persist the selected Campaign delivery mode
+
+Revision ID: c7a2f91e4b60
+Revises: 4d5e6f7a9203
+Create Date: 2026-07-22 09:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "c7a2f91e4b60"
+down_revision = "4d5e6f7a9203"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("campaign_versions") as batch:
+        batch.add_column(sa.Column("delivery_mode", sa.String(length=30), nullable=True))
+        batch.add_column(sa.Column("delivery_mode_selected_at", sa.DateTime(timezone=True), nullable=True))
+        batch.create_index("ix_campaign_versions_delivery_mode", ["delivery_mode"], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("campaign_versions") as batch:
+        batch.drop_index("ix_campaign_versions_delivery_mode")
+        batch.drop_column("delivery_mode_selected_at")
+        batch.drop_column("delivery_mode")

src/govoplan_campaign/backend/migrations/versions/d8b3e2c1f4a5_v0110_excluded_delivery_skipped.py

@@ -0,0 +1,42 @@
+"""mark untouched excluded jobs as skipped delivery
+
+Revision ID: d8b3e2c1f4a5
+Revises: c7a2f91e4b60
+Create Date: 2026-07-22 11:00:00.000000
+"""
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "d8b3e2c1f4a5"
+down_revision = "c7a2f91e4b60"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Only normalize rows with no recorded transport effect. Unexpected
+    # historical delivery evidence must remain intact for audit/reconciliation.
+    op.get_bind().execute(
+        sa.text(
+            "UPDATE campaign_jobs "
+            "SET send_status = 'skipped', imap_status = 'skipped' "
+            "WHERE validation_status = 'excluded' "
+            "AND send_status = 'not_queued' "
+            "AND imap_status IN ('not_requested', 'pending', 'skipped')"
+        )
+    )
+
+
+def downgrade() -> None:
+    op.get_bind().execute(
+        sa.text(
+            "UPDATE campaign_jobs "
+            "SET send_status = 'not_queued', imap_status = 'not_requested' "
+            "WHERE validation_status = 'excluded' "
+            "AND send_status = 'skipped' "
+            "AND imap_status = 'skipped'"
+        )
+    )

src/govoplan_campaign/backend/path_security.py

@@ -0,0 +1,170 @@
+from __future__ import annotations
+
+from pathlib import PureWindowsPath
+from typing import Any, Iterable
+
+
+class CampaignPathSecurityError(ValueError):
+    """Raised when server-provided campaign JSON could read local files."""
+
+
+def _text(value: object) -> str:
+    return value.strip() if isinstance(value, str) else ""
+
+
+def assert_logical_relative_path(value: object, *, field: str) -> None:
+    raw = _text(value)
+    if not raw:
+        return
+    if "\x00" in raw:
+        raise CampaignPathSecurityError(f"{field} contains a NUL byte")
+
+    normalized = raw.replace("\\", "/")
+    windows_path = PureWindowsPath(raw)
+    if (
+        normalized.startswith("/")
+        or normalized.startswith("~")
+        or windows_path.is_absolute()
+        or bool(windows_path.drive)
+    ):
+        raise CampaignPathSecurityError(f"{field} must be a relative managed-file path")
+    if any(part == ".." for part in normalized.split("/")):
+        raise CampaignPathSecurityError(f"{field} must not contain parent-directory traversal")
+
+
+def is_managed_source(value: object) -> bool:
+    raw = _text(value)
+    if not raw.startswith("managed:"):
+        return False
+    parts = raw.split(":", 2)
+    return len(parts) == 3 and parts[1] in {"user", "group"} and bool(parts[2].strip())
+
+
+def _attachment_rules(raw_json: dict[str, Any]) -> Iterable[tuple[str, dict[str, Any]]]:
+    attachments = raw_json.get("attachments")
+    if isinstance(attachments, dict):
+        global_rules = attachments.get("global")
+        if isinstance(global_rules, list):
+            for index, rule in enumerate(global_rules):
+                if isinstance(rule, dict):
+                    yield f"attachments.global[{index}]", rule
+
+    entries = raw_json.get("entries")
+    inline = entries.get("inline") if isinstance(entries, dict) else None
+    if isinstance(inline, list):
+        for entry_index, entry in enumerate(inline):
+            rules = entry.get("attachments") if isinstance(entry, dict) else None
+            if not isinstance(rules, list):
+                continue
+            for rule_index, rule in enumerate(rules):
+                if isinstance(rule, dict):
+                    yield f"entries.inline[{entry_index}].attachments[{rule_index}]", rule
+    defaults = entries.get("defaults") if isinstance(entries, dict) else None
+    default_rules = defaults.get("attachments") if isinstance(defaults, dict) else None
+    if isinstance(default_rules, list):
+        for rule_index, rule in enumerate(default_rules):
+            if isinstance(rule, dict):
+                    yield f"entries.defaults.attachments[{rule_index}]", rule
+
+
+def _assert_inline_server_sources(
+    raw_json: dict[str, Any],
+    *,
+    source_filename: str | None,
+    source_base_path: str | None,
+) -> None:
+    if _text(source_filename):
+        raise CampaignPathSecurityError("source_filename is not accepted for server-managed campaigns")
+    if _text(source_base_path):
+        raise CampaignPathSecurityError("source_base_path is not accepted for server-managed campaigns")
+
+    template = raw_json.get("template")
+    template_source = template.get("source") if isinstance(template, dict) else None
+    path_fields = ("subject_path", "text_path", "html_path")
+    if isinstance(template_source, dict) and any(_text(template_source.get(key)) for key in path_fields):
+        raise CampaignPathSecurityError(
+            "template source paths are not accepted for server-managed campaigns; store template content inline"
+        )
+
+    entries = raw_json.get("entries")
+    entries_source = entries.get("source") if isinstance(entries, dict) else None
+    if isinstance(entries_source, dict) and _text(entries_source.get("path")):
+        raise CampaignPathSecurityError(
+            "entries.source.path is not accepted for server-managed campaigns; import recipients into the campaign snapshot"
+        )
+
+
+def _managed_attachment_base_paths(attachments: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    assert_logical_relative_path(attachments.get("base_path"), field="attachments.base_path")
+    raw_base_paths = attachments.get("base_paths")
+    base_paths = raw_base_paths if isinstance(raw_base_paths, list) else []
+    managed: dict[str, dict[str, Any]] = {}
+    for index, item in enumerate(base_paths):
+        if not isinstance(item, dict):
+            continue
+        assert_logical_relative_path(
+            item.get("path"),
+            field=f"attachments.base_paths[{index}].path",
+        )
+        source_is_managed = is_managed_source(item.get("source"))
+        base_path_id = _text(item.get("id"))
+        if base_path_id and source_is_managed:
+            managed[base_path_id] = item
+        if item.get("unsent_warning") is True and not source_is_managed:
+            raise CampaignPathSecurityError(
+                f"attachments.base_paths[{index}] must use a managed Files source before unsent-file scanning is enabled"
+            )
+    return managed
+
+
+def _assert_managed_attachment_rules(
+    raw_json: dict[str, Any],
+    *,
+    managed_base_paths: dict[str, dict[str, Any]],
+    managed_files_available: bool,
+) -> None:
+    rules = list(_attachment_rules(raw_json))
+    if not rules:
+        return
+    if not managed_files_available:
+        raise CampaignPathSecurityError("campaign attachments require the Files module in server mode")
+
+    for field, rule in rules:
+        base_path_id = _text(rule.get("base_path_id"))
+        if not base_path_id or base_path_id not in managed_base_paths:
+            raise CampaignPathSecurityError(
+                f"{field}.base_path_id must select an attachments.base_paths entry backed by managed Files"
+            )
+        assert_logical_relative_path(rule.get("base_dir"), field=f"{field}.base_dir")
+        assert_logical_relative_path(rule.get("file_filter"), field=f"{field}.file_filter")
+
+
+def assert_server_safe_campaign_paths(
+    raw_json: dict[str, Any],
+    *,
+    source_filename: str | None = None,
+    source_base_path: str | None = None,
+    managed_files_available: bool,
+) -> None:
+    """Reject local-file references at the HTTP/server trust boundary.
+
+    File-oriented campaign loading remains available to trusted operator code
+    through the campaign loader and message builder. Persisted/API campaigns
+    must use inline templates and recipients plus managed Files attachment
+    sources, which are materialized into an isolated snapshot before use.
+    """
+
+    _assert_inline_server_sources(
+        raw_json,
+        source_filename=source_filename,
+        source_base_path=source_base_path,
+    )
+
+    attachments = raw_json.get("attachments")
+    if not isinstance(attachments, dict):
+        return
+    _assert_managed_attachment_rules(
+        raw_json,
+        managed_base_paths=_managed_attachment_base_paths(attachments),
+        managed_files_available=managed_files_available,
+    )

src/govoplan_campaign/backend/persistence/campaigns.py

@@ -1,13 +1,14 @@
 from __future__ import annotations
 
+import copy
 import hashlib
 import json
+import os
+from datetime import UTC, datetime
 from email import policy
 from email.parser import BytesParser
 from pathlib import Path
 from typing import Any
-import copy
-from datetime import UTC, datetime
 from uuid import uuid4
 
 from sqlalchemy import func
@@ -25,13 +26,18 @@ from govoplan_campaign.backend.db.models import (
     JobSendStatus,
     JobValidationStatus,
 )
-from govoplan_campaign.backend.campaign.loader import load_campaign_config, load_campaign_json, validate_against_schema
+from govoplan_campaign.backend.campaign.loader import load_campaign_json, validate_against_schema
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    assert_campaign_uses_mail_profile_reference,
+    campaign_mail_profile_id,
+)
 from govoplan_campaign.backend.campaign.validation import validate_campaign_config
 from govoplan_campaign.backend.messages.builder import build_campaign_messages
 from govoplan_campaign.backend.messages.models import MessageDraft
-from govoplan_campaign.backend.sending.execution import create_execution_snapshot
-from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.sending.execution import create_execution_snapshot, profile_transport_revisions
+from govoplan_campaign.backend.campaign.models import CampaignConfig, SendStatus
 from govoplan_campaign.backend.integrations import files_integration, mail_integration
+from govoplan_campaign.backend.path_security import assert_server_safe_campaign_paths
 
 RUNTIME_DIR = Path(__file__).resolve().parents[3] / "runtime"
 CAMPAIGN_SNAPSHOT_DIR = RUNTIME_DIR / "campaign_snapshots"
@@ -43,8 +49,9 @@ class CampaignPersistenceError(RuntimeError):
 
 
 def _ensure_dirs() -> None:
-    CAMPAIGN_SNAPSHOT_DIR.mkdir(parents=True, exist_ok=True)
-    BUILD_OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
+    for directory in (CAMPAIGN_SNAPSHOT_DIR, BUILD_OUTPUT_DIR):
+        directory.mkdir(parents=True, mode=0o700, exist_ok=True)
+        directory.chmod(0o700)
 
 
 
@@ -58,22 +65,44 @@ def load_campaign_config_from_json(
     owner_user_id: str | None = None,
     owner_group_id: str | None = None,
 ) -> CampaignConfig:
-    materialized = mail_integration().materialize_campaign_mail_profile_config(
-        session,
-        tenant_id=tenant_id,
-        raw_json=raw_json,
-        campaign_id=campaign_id,
-        owner_user_id=owner_user_id,
-        owner_group_id=owner_group_id,
-    )
-    validate_against_schema(materialized)
+    # Validate the persisted Campaign-to-Mail contract before asking Mail for a
+    # non-secret capability summary. Campaign never receives resolved transport
+    # settings, account identities, or credentials.
+    assert_campaign_uses_mail_profile_reference(raw_json)
+    validate_against_schema(raw_json)
+    materialized = copy.deepcopy(raw_json)
+    profile_id = campaign_mail_profile_id(raw_json)
+    if profile_id:
+        summary = mail_integration().campaign_profile_delivery_summary(
+            session,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            profile_id=profile_id,
+            owner_user_id=owner_user_id,
+            owner_group_id=owner_group_id,
+        )
+        materialized.setdefault("server", {})["profile_capabilities"] = {
+            "smtp_available": bool(summary.get("smtp_available")),
+            "imap_available": bool(summary.get("imap_available")),
+        }
     return CampaignConfig.model_validate(materialized)
 
 
 def _write_campaign_snapshot(version: CampaignVersion) -> Path:
     _ensure_dirs()
     path = CAMPAIGN_SNAPSHOT_DIR / f"{version.id}.json"
-    path.write_text(json.dumps(version.raw_json, ensure_ascii=False, indent=2), encoding="utf-8")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(path, flags, 0o600)
+    try:
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+            descriptor = -1
+            json.dump(version.raw_json, stream, ensure_ascii=False, indent=2)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
     return path
 
 
@@ -92,13 +121,14 @@ def _resolve_runtime_path(base_path: Path | None, value: str | None) -> str | No
 
 
 def normalize_campaign_paths(raw_json: dict[str, Any], source_base_path: str | Path | None) -> dict[str, Any]:
-    """Return a DB/runtime-safe campaign JSON snapshot.
+    """Resolve paths for an explicitly trusted, file-oriented import.
 
     The CLI naturally resolves relative paths against the campaign.json file.
     Once the campaign is stored in the database, the JSON snapshot lives in
     app/mailer/runtime/campaign_snapshots. To keep existing file-based
     campaigns working, relative file paths are normalized to absolute paths at
-    import time when a source_base_path is known.
+    import time when a source_base_path is known. HTTP/API callers are rejected
+    by ``assert_server_safe_campaign_paths`` before they can reach this helper.
     """
     base = Path(source_base_path).expanduser().resolve() if source_base_path else None
     data = copy.deepcopy(raw_json)
@@ -127,7 +157,14 @@ def create_campaign_version_from_json(
     raw_json: dict[str, Any],
     source_filename: str | None = None,
     source_base_path: str | None = None,
+    commit: bool = True,
 ) -> tuple[Campaign, CampaignVersion]:
+    assert_server_safe_campaign_paths(
+        raw_json,
+        source_filename=source_filename,
+        source_base_path=source_base_path,
+        managed_files_available=files_integration().available,
+    )
     if source_base_path is None and source_filename:
         source_path = Path(source_filename).expanduser()
         source_base_path = str(source_path.parent if source_path.suffix else source_path)
@@ -175,8 +212,11 @@ def create_campaign_version_from_json(
     session.flush()
     campaign.current_version_id = version.id
     session.add(campaign)
-    _write_campaign_snapshot(version)
-    session.commit()
+    if commit:
+        _write_campaign_snapshot(version)
+        session.commit()
+    else:
+        session.flush()
     return campaign, version
 
 
@@ -235,8 +275,12 @@ def load_version_config(session: Session, version_id: str):
     campaign = session.get(Campaign, version.campaign_id)
     if not campaign:
         raise CampaignPersistenceError(f"Campaign not found for version: {version_id}")
-    path = _write_campaign_snapshot(version)
     raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    assert_server_safe_campaign_paths(
+        raw_json,
+        managed_files_available=files_integration().available,
+    )
+    path = _write_campaign_snapshot(version)
     return version, path, load_campaign_config_from_json(session, tenant_id=campaign.tenant_id, raw_json=raw_json, campaign_id=campaign.id)
 
 
@@ -275,7 +319,7 @@ def validate_campaign_version(
             campaign_id=campaign.id,
             raw_json=version.raw_json if isinstance(version.raw_json, dict) else {},
             include_bytes=False,
-            prefix="multimailer-managed-validate-",
+            prefix="govoplan-managed-validate-",
         ) as prepared:
             managed_raw = load_campaign_json(prepared.path)
             managed_config = load_campaign_config_from_json(session, tenant_id=tenant_id, raw_json=managed_raw, campaign_id=campaign.id)
@@ -362,7 +406,11 @@ def _job_from_message(
         build_status=message.build_status.value if hasattr(message.build_status, "value") else str(message.build_status),
         validation_status=_job_validation_status(message.validation_status.value),
         queue_status=JobQueueStatus.DRAFT.value,
-        send_status=JobSendStatus.NOT_QUEUED.value,
+        send_status=(
+            JobSendStatus.SKIPPED.value
+            if message.send_status == SendStatus.SKIPPED
+            else JobSendStatus.NOT_QUEUED.value
+        ),
         imap_status=message.imap_status.value if hasattr(message.imap_status, "value") else JobImapStatus.NOT_REQUESTED.value,
         resolved_recipients={
             "from": message.from_.model_dump(mode="json") if message.from_ else None,
@@ -407,7 +455,7 @@ def build_campaign_version(
         campaign_id=campaign.id,
         raw_json=version.raw_json if isinstance(version.raw_json, dict) else {},
         include_bytes=True,
-        prefix="multimailer-managed-build-",
+        prefix="govoplan-managed-build-",
     ) as prepared:
         managed_raw = load_campaign_json(prepared.path)
         managed_config = load_campaign_config_from_json(session, tenant_id=tenant_id, raw_json=managed_raw, campaign_id=campaign.id)
@@ -460,13 +508,19 @@ def build_campaign_version(
         [job for job, _message in job_build_pairs],
         stage="built",
     )
-    runtime_smtp = managed_config.server.runtime_smtp_config()
-    if not runtime_smtp:
-        raise CampaignPersistenceError("Campaign has no SMTP configuration; an execution snapshot cannot be created")
+    if not managed_config.server.profile_capabilities.smtp_available:
+        raise CampaignPersistenceError("The selected Mail profile has no SMTP configuration; an execution snapshot cannot be created")
+    profile_id = campaign_mail_profile_id(version.raw_json if isinstance(version.raw_json, dict) else {})
+    if profile_id is None:
+        raise CampaignPersistenceError("Select an authorized Mail profile before building campaign messages")
+    revisions = profile_transport_revisions(session, version)
+    if not revisions["smtp"]:
+        raise CampaignPersistenceError("The selected Mail profile has no SMTP transport revision")
     execution_snapshot, execution_snapshot_hash = create_execution_snapshot(
         version,
-        smtp=runtime_smtp,
-        imap=managed_config.server.runtime_imap_config(),
+        mail_profile_id=profile_id,
+        smtp_transport_revision=revisions["smtp"],
+        imap_transport_revision=revisions["imap"],
         delivery=managed_config.delivery,
         jobs=[job for job, _message in job_build_pairs],
         build_summary=report_json,

src/govoplan_campaign/backend/persistence/versions.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import copy
+from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from typing import Any
 from uuid import uuid4
@@ -18,19 +19,61 @@ from govoplan_campaign.backend.db.models import (
     JobSendStatus,
 )
 from govoplan_campaign.backend.sending.execution import clear_execution_snapshot
-from govoplan_campaign.backend.integrations import mail_integration
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    campaign_editor_state_for_edit,
+    campaign_mail_profile_boundary_violations,
+    campaign_mail_profile_id,
+    assert_campaign_uses_mail_profile_reference,
+    public_campaign_mail_server,
+    validate_campaign_editor_state,
+)
+from govoplan_campaign.backend.integrations import files_integration, mail_integration
 from govoplan_campaign.backend.persistence.campaigns import (
     CampaignPersistenceError,
     _next_version_number,
     _write_campaign_snapshot,
     normalize_campaign_paths,
 )
+from govoplan_campaign.backend.path_security import assert_server_safe_campaign_paths
 
 
 class LockedCampaignVersionError(CampaignPersistenceError):
     """Raised when a caller tries to edit an immutable campaign version."""
 
 
+@dataclass(slots=True)
+class _PartialValidationCollector:
+    section: str | None
+    issues: list[dict[str, Any]] = field(default_factory=list)
+
+    def issue(self, severity: str, section: str, field: str, code: str, message: str) -> None:
+        if self.section is None or self.section == section:
+            self.issues.append({
+                "severity": severity,
+                "section": section,
+                "field": field,
+                "code": code,
+                "message": message,
+            })
+
+    def result(self) -> dict[str, Any]:
+        return {
+            "ok": not any(item["severity"] == "error" for item in self.issues),
+            "section": self.section,
+            "error_count": sum(1 for item in self.issues if item["severity"] == "error"),
+            "warning_count": sum(1 for item in self.issues if item["severity"] == "warning"),
+            "info_count": sum(1 for item in self.issues if item["severity"] == "info"),
+            "issues": self.issues,
+        }
+
+
+def _require_campaign(session: Session, campaign_id: str) -> Campaign:
+    campaign = session.get(Campaign, campaign_id)
+    if campaign is None:
+        raise CampaignPersistenceError(f"Campaign not found: {campaign_id}")
+    return campaign
+
+
 USER_LOCK_TEMPORARY = "temporary"
 USER_LOCK_PERMANENT = "permanent"
 USER_LOCK_STATES = {USER_LOCK_TEMPORARY, USER_LOCK_PERMANENT}
@@ -71,25 +114,7 @@ def minimal_campaign_json(*, external_id: str, name: str, description: str | Non
         },
         "fields": [],
         "global_values": {},
-        "server": {
-            "inherit_smtp_credentials": True,
-            "inherit_imap_credentials": True,
-            "smtp": {
-                "host": "",
-                "port": 587,
-                "security": "starttls",
-            },
-            "imap": {
-                "host": "",
-                "port": 993,
-                "security": "tls",
-                "sent_folder": "auto",
-            },
-            "credentials": {
-                "smtp": {"username": "", "password": ""},
-                "imap": {"username": "", "password": ""},
-            },
-        },
+        "server": {},
         "recipients": {
             "from": [],
             "allow_individual_from": False,
@@ -124,6 +149,7 @@ def minimal_campaign_json(*, external_id: str, name: str, description: str | Non
             ],
             "allow_individual": True,
             "send_without_attachments": False,
+            "send_without_attachments_behavior": "block",
             "global": [],
             "zip": {"enabled": False, "archives": []},
             "missing_behavior": "ask",
@@ -182,6 +208,7 @@ def create_minimal_campaign(
     description: str | None = None,
     current_flow: str = CampaignVersionFlow.CREATE.value,
     current_step: str = "basics",
+    commit: bool = True,
 ) -> tuple[Campaign, CampaignVersion]:
     existing = session.query(Campaign).filter(Campaign.tenant_id == tenant_id, Campaign.external_id == external_id).one_or_none()
     if existing:
@@ -215,8 +242,11 @@ def create_minimal_campaign(
     session.flush()
     campaign.current_version_id = version.id
     session.add(campaign)
-    _write_campaign_snapshot(version)
-    session.commit()
+    if commit:
+        _write_campaign_snapshot(version)
+        session.commit()
+    else:
+        session.flush()
     return campaign, version
 
 
@@ -311,6 +341,8 @@ def fork_campaign_version_for_edit(
     source_filename: str | None = None,
     source_base_path: str | None = None,
     autosave: bool = True,
+    migrate_legacy_mail_settings: bool = False,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Create the next sole working version from immutable campaign history.
 
@@ -320,8 +352,7 @@ def fork_campaign_version_for_edit(
     """
 
     source = get_campaign_version_for_tenant(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version_id)
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
 
     if campaign_has_active_working_version(session, campaign):
         current = session.get(CampaignVersion, campaign.current_version_id)
@@ -336,8 +367,24 @@ def fork_campaign_version_for_edit(
             "Create the next working copy from the campaign's current immutable version."
         )
 
-    base_json = raw_json if raw_json is not None else copy.deepcopy(source.raw_json)
+    source_json = source.raw_json if isinstance(source.raw_json, dict) else {}
+    source_requires_mail_migration = bool(campaign_mail_profile_boundary_violations(source_json))
+    if source_requires_mail_migration and not migrate_legacy_mail_settings:
+        raise CampaignPersistenceError(
+            "This version contains legacy campaign-local SMTP/IMAP settings. Create the editable copy from "
+            "the Mail settings migration action so the audit record is preserved and the copy uses a Mail profile."
+        )
+    base_json = raw_json if raw_json is not None else copy.deepcopy(source_json)
+    if source_requires_mail_migration and raw_json is None:
+        base_json["server"] = public_campaign_mail_server(source_json)
+    assert_server_safe_campaign_paths(
+        base_json,
+        source_filename=source_filename,
+        source_base_path=source_base_path,
+        managed_files_available=files_integration().available,
+    )
     runtime_json = normalize_campaign_paths(base_json, source_base_path) if source_base_path else copy.deepcopy(base_json)
+    assert_campaign_uses_mail_profile_reference(runtime_json)
     mail_integration().assert_campaign_mail_policy_allows_json(session, tenant_id=tenant_id, raw_json=runtime_json, campaign_id=campaign.id)
 
     new_version = CampaignVersion(
@@ -351,7 +398,11 @@ def fork_campaign_version_for_edit(
         current_flow=current_flow if current_flow is not None else (source.current_flow or CampaignVersionFlow.MANUAL.value),
         current_step=current_step if current_step is not None else source.current_step,
         is_complete=False,
-        editor_state=editor_state if editor_state is not None else copy.deepcopy(source.editor_state or {}),
+        editor_state=(
+            validate_campaign_editor_state(editor_state)
+            if editor_state is not None
+            else campaign_editor_state_for_edit(source.editor_state)
+        ),
         autosaved_at=datetime.now(UTC) if autosave else None,
     )
     session.add(new_version)
@@ -361,8 +412,11 @@ def fork_campaign_version_for_edit(
     campaign.current_version_id = new_version.id
     campaign.status = CampaignStatus.DRAFT.value
     session.add(campaign)
-    _write_campaign_snapshot(new_version)
-    session.commit()
+    if commit:
+        _write_campaign_snapshot(new_version)
+        session.commit()
+    else:
+        session.flush()
     return new_version
 
 
@@ -420,6 +474,7 @@ def unlock_validated_campaign_version(
     tenant_id: str,
     campaign_id: str,
     version_id: str,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Unlock a validation snapshot so it can be edited again.
 
@@ -429,8 +484,7 @@ def unlock_validated_campaign_version(
     """
 
     version = get_campaign_version_for_tenant(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version_id)
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="unlock")
 
     if is_temporary_user_locked_version(version):
@@ -470,7 +524,10 @@ def unlock_validated_campaign_version(
     campaign.status = CampaignStatus.DRAFT.value
     session.add(version)
     session.add(campaign)
-    session.commit()
+    if commit:
+        session.commit()
+    else:
+        session.flush()
     return version
 
 def update_campaign_version(
@@ -488,10 +545,18 @@ def update_campaign_version(
     source_filename: str | None = None,
     source_base_path: str | None = None,
     autosave: bool = False,
+    migrate_legacy_mail_settings: bool = False,
+    commit: bool = True,
 ) -> CampaignVersion:
+    if raw_json is not None or source_filename is not None or source_base_path is not None:
+        assert_server_safe_campaign_paths(
+            raw_json if raw_json is not None else {},
+            source_filename=source_filename,
+            source_base_path=source_base_path,
+            managed_files_available=files_integration().available,
+        )
     version = get_campaign_version_for_tenant(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version_id)
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="edit")
 
     if is_version_locked(version):
@@ -501,6 +566,18 @@ def update_campaign_version(
 
     if raw_json is not None:
         runtime_json = normalize_campaign_paths(raw_json, source_base_path) if source_base_path else copy.deepcopy(raw_json)
+        if campaign_mail_profile_boundary_violations(version.raw_json) and not migrate_legacy_mail_settings:
+            raise CampaignPersistenceError(
+                "This version contains legacy campaign-local SMTP/IMAP settings. Select an authorized Mail "
+                "profile on the Mail settings page and explicitly save the migration; the stored legacy version "
+                "will not be changed automatically."
+            )
+        assert_campaign_uses_mail_profile_reference(runtime_json)
+        if campaign_mail_profile_boundary_violations(version.raw_json) and campaign_mail_profile_id(runtime_json) is None:
+            raise CampaignPersistenceError(
+                "Migrating legacy campaign mail settings requires an authorized server.mail_profile_id. "
+                "Select a Mail profile before saving."
+            )
         mail_integration().assert_campaign_mail_policy_allows_json(session, tenant_id=tenant_id, raw_json=runtime_json, campaign_id=campaign.id)
         version.raw_json = runtime_json
         version.schema_version = str(runtime_json.get("version", version.schema_version or "1.0"))
@@ -515,7 +592,7 @@ def update_campaign_version(
     if is_complete is not None:
         version.is_complete = is_complete
     if editor_state is not None:
-        version.editor_state = editor_state
+        version.editor_state = validate_campaign_editor_state(editor_state)
     if source_filename is not None:
         version.source_filename = source_filename
     if source_base_path is not None:
@@ -538,8 +615,11 @@ def update_campaign_version(
     session.add(version)
     session.add(campaign)
     session.flush()
-    _write_campaign_snapshot(version)
-    session.commit()
+    if commit:
+        _write_campaign_snapshot(version)
+        session.commit()
+    else:
+        session.flush()
     return version
 
 
@@ -552,6 +632,7 @@ def update_campaign_review_state(
     inspection_complete: bool,
     reviewed_message_keys: list[str],
     user_id: str | None,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Persist review acknowledgement without mutating the locked campaign data.
 
@@ -566,64 +647,98 @@ def update_campaign_review_state(
         campaign_id=campaign_id,
         version_id=version_id,
     )
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="record review state for")
     if is_version_final_locked(version):
         raise LockedCampaignVersionError("Delivery has started; message review state can no longer be changed.")
+    build_token = _campaign_review_build_token(version)
+    normalized_reviewed = list(dict.fromkeys(str(value) for value in reviewed_message_keys if str(value).strip()))
+    if inspection_complete:
+        normalized_reviewed = _complete_campaign_review_keys(session, version, normalized_reviewed)
+    _write_campaign_review_state(
+        version,
+        build_token=build_token,
+        inspection_complete=inspection_complete,
+        reviewed_message_keys=normalized_reviewed,
+        user_id=user_id,
+    )
+    session.add(version)
+    if commit:
+        session.commit()
+    else:
+        session.flush()
+    return version
+
+
+def _campaign_review_build_token(version: CampaignVersion) -> str:
     build_summary = version.build_summary if isinstance(version.build_summary, dict) else {}
     if not build_summary:
         raise CampaignPersistenceError("Build messages before recording review state.")
     build_token = str(build_summary.get("build_token") or build_summary.get("built_at") or "").strip()
-    if not build_token:
-        # Backwards-compatible upgrade for build summaries created before
-        # review-state tokens were introduced.
-        build_token = uuid4().hex
-        build_summary = copy.deepcopy(build_summary)
-        build_summary["build_token"] = build_token
-        version.build_summary = build_summary
+    if build_token:
+        return build_token
+    build_token = uuid4().hex
+    updated_summary = copy.deepcopy(build_summary)
+    updated_summary["build_token"] = build_token
+    version.build_summary = updated_summary
+    return build_token
 
-    normalized_reviewed = list(dict.fromkeys(str(value) for value in reviewed_message_keys if str(value).strip()))
-    if inspection_complete:
-        jobs = (
-            session.query(CampaignJob)
-            .filter(CampaignJob.campaign_version_id == version.id)
-            .order_by(CampaignJob.entry_index.asc())
-            .all()
+
+def _complete_campaign_review_keys(
+    session: Session,
+    version: CampaignVersion,
+    reviewed_message_keys: list[str],
+) -> list[str]:
+    jobs = (
+        session.query(CampaignJob)
+        .filter(CampaignJob.campaign_version_id == version.id)
+        .order_by(CampaignJob.entry_index.asc())
+        .all()
+    )
+    blocking = [job for job in jobs if job.build_status != "built" or job.validation_status == "blocked"]
+    if blocking:
+        raise CampaignPersistenceError("Blocked or failed messages must be resolved before review can be completed.")
+    missing = sorted(_required_review_keys(jobs) - set(reviewed_message_keys))
+    if missing:
+        raise CampaignPersistenceError(
+            "Messages requiring an explicit decision must be opened before review can be completed: " + ", ".join(missing)
         )
-        blocking = [job for job in jobs if job.build_status != "built" or job.validation_status == "blocked"]
-        if blocking:
-            raise CampaignPersistenceError("Blocked or failed messages must be resolved before review can be completed.")
-        reviewed = set(normalized_reviewed)
-        explicit = {
-            str(job.entry_id or job.entry_index)
-            for job in jobs
-            if job.validation_status == "needs_review"
-        }
-        missing = sorted(explicit - reviewed)
-        if missing:
-            raise CampaignPersistenceError(
-                "Messages requiring an explicit decision must be opened before review can be completed: " + ", ".join(missing)
-            )
-        bulk_acceptable = [
-            str(job.entry_id or job.entry_index)
-            for job in jobs
-            if job.validation_status in {"warning", "excluded"}
-        ]
-        normalized_reviewed = list(dict.fromkeys([*normalized_reviewed, *bulk_acceptable]))
+    return list(dict.fromkeys([*reviewed_message_keys, *_bulk_acceptable_review_keys(jobs)]))
 
+
+def _required_review_keys(jobs: list[CampaignJob]) -> set[str]:
+    return {
+        str(job.entry_id or job.entry_index)
+        for job in jobs
+        if job.validation_status == "needs_review"
+    }
+
+
+def _bulk_acceptable_review_keys(jobs: list[CampaignJob]) -> list[str]:
+    return [
+        str(job.entry_id or job.entry_index)
+        for job in jobs
+        if job.validation_status in {"warning", "excluded"}
+    ]
+
+
+def _write_campaign_review_state(
+    version: CampaignVersion,
+    *,
+    build_token: str,
+    inspection_complete: bool,
+    reviewed_message_keys: list[str],
+    user_id: str | None,
+) -> None:
     editor_state = copy.deepcopy(version.editor_state or {})
     editor_state["review_send"] = {
         "build_token": build_token,
         "inspection_complete": bool(inspection_complete),
-        "reviewed_message_keys": normalized_reviewed,
+        "reviewed_message_keys": reviewed_message_keys,
         "updated_at": datetime.now(UTC).isoformat(),
         "updated_by_user_id": user_id,
     }
     version.editor_state = editor_state
-    session.add(version)
-    session.commit()
-    return version
 
 
 def lock_campaign_version_temporarily(
@@ -633,6 +748,7 @@ def lock_campaign_version_temporarily(
     campaign_id: str,
     version_id: str,
     user_id: str | None,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Apply a reversible user-requested lock without changing workflow state."""
 
@@ -642,8 +758,7 @@ def lock_campaign_version_temporarily(
         campaign_id=campaign_id,
         version_id=version_id,
     )
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="lock")
     if is_version_final_locked(version):
         raise LockedCampaignVersionError("Delivery/final versions are permanently locked and cannot receive a temporary user lock.")
@@ -658,7 +773,10 @@ def lock_campaign_version_temporarily(
     version.user_locked_at = datetime.now(UTC)
     version.user_locked_by_user_id = user_id
     session.add(version)
-    session.commit()
+    if commit:
+        session.commit()
+    else:
+        session.flush()
     return version
 
 
@@ -668,6 +786,7 @@ def unlock_user_locked_campaign_version(
     tenant_id: str,
     campaign_id: str,
     version_id: str,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Remove a reversible user lock without invalidating campaign data."""
 
@@ -677,8 +796,7 @@ def unlock_user_locked_campaign_version(
         campaign_id=campaign_id,
         version_id=version_id,
     )
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="unlock")
     state = campaign_version_user_lock_state(version)
     if state == USER_LOCK_PERMANENT:
@@ -692,7 +810,10 @@ def unlock_user_locked_campaign_version(
     version.user_locked_at = None
     version.user_locked_by_user_id = None
     session.add(version)
-    session.commit()
+    if commit:
+        session.commit()
+    else:
+        session.flush()
     return version
 
 
@@ -703,6 +824,7 @@ def permanently_lock_campaign_version(
     campaign_id: str,
     version_id: str,
     user_id: str | None,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Apply an irreversible user lock.
 
@@ -716,8 +838,7 @@ def permanently_lock_campaign_version(
         campaign_id=campaign_id,
         version_id=version_id,
     )
-    campaign = session.get(Campaign, campaign_id)
-    assert campaign is not None
+    campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="lock permanently")
     if is_version_final_locked(version):
         raise LockedCampaignVersionError("This version is already permanently locked by its delivery/final state.")
@@ -731,7 +852,10 @@ def permanently_lock_campaign_version(
     # Retain published_at as a compatibility marker for existing integrations.
     version.published_at = version.published_at or now
     session.add(version)
-    session.commit()
+    if commit:
+        session.commit()
+    else:
+        session.flush()
     return version
 
 
@@ -742,6 +866,7 @@ def publish_campaign_version(
     campaign_id: str,
     version_id: str,
     user_id: str | None = None,
+    commit: bool = True,
 ) -> CampaignVersion:
     """Backwards-compatible alias for the permanent user lock."""
 
@@ -751,6 +876,7 @@ def publish_campaign_version(
         campaign_id=campaign_id,
         version_id=version_id,
         user_id=user_id,
+        commit=commit,
     )
 
 
@@ -761,79 +887,122 @@ def validate_campaign_partial(raw_json: dict[str, Any], *, section: str | None =
     lets the WebUI autosave and validate one wizard step at a time.
     """
 
-    issues: list[dict[str, Any]] = []
+    collector = _PartialValidationCollector(section=section)
+    _validate_partial_basics(collector, _dict_value(raw_json, "campaign"))
+    recipients = _dict_value(raw_json, "recipients")
+    _validate_partial_sender(collector, recipients)
+    _validate_partial_mail_profile(collector, raw_json)
+    _validate_partial_recipients(collector, _dict_value(raw_json, "entries"))
+    _validate_partial_template(collector, _dict_value(raw_json, "template"))
+    _validate_partial_attachments(collector, _dict_value(raw_json, "attachments"))
+    _validate_partial_delivery(collector, _dict_value(raw_json, "delivery"))
+    return collector.result()
 
-    def issue(severity: str, sec: str, field: str, code: str, message: str) -> None:
-        if section is None or section == sec:
-            issues.append({
-                "severity": severity,
-                "section": sec,
-                "field": field,
-                "code": code,
-                "message": message,
-            })
 
-    campaign = raw_json.get("campaign") if isinstance(raw_json.get("campaign"), dict) else {}
+def _dict_value(value: dict[str, Any], key: str) -> dict[str, Any]:
+    candidate = value.get(key)
+    return candidate if isinstance(candidate, dict) else {}
+
+
+def _validate_partial_basics(collector: _PartialValidationCollector, campaign: dict[str, Any]) -> None:
     if not campaign.get("id"):
-        issue("error", "basics", "campaign.id", "missing_campaign_id", "Campaign id is required.")
+        collector.issue("error", "basics", "campaign.id", "missing_campaign_id", "Campaign id is required.")
     if not campaign.get("name"):
-        issue("error", "basics", "campaign.name", "missing_campaign_name", "Campaign name is required.")
+        collector.issue("error", "basics", "campaign.name", "missing_campaign_name", "Campaign name is required.")
 
-    recipients = raw_json.get("recipients") if isinstance(raw_json.get("recipients"), dict) else {}
+
+def _validate_partial_sender(collector: _PartialValidationCollector, recipients: dict[str, Any]) -> None:
     sender = recipients.get("from") if isinstance(recipients.get("from"), dict) else {}
     if not sender.get("email"):
-        issue("warning", "sender", "recipients.from.email", "missing_sender_email", "Sender email is not configured yet.")
+        collector.issue("warning", "sender", "recipients.from.email", "missing_sender_email", "Sender email is not configured yet.")
 
-    entries = raw_json.get("entries") if isinstance(raw_json.get("entries"), dict) else {}
+
+def _validate_partial_mail_profile(collector: _PartialValidationCollector, raw_json: dict[str, Any]) -> None:
+    violations = campaign_mail_profile_boundary_violations(raw_json)
+    if violations:
+        collector.issue(
+            "error",
+            "sender",
+            "server",
+            "campaign_local_mail_transport_forbidden",
+            "Campaign-local SMTP/IMAP settings are not supported. Select or migrate to an authorized Mail-module profile.",
+        )
+    elif campaign_mail_profile_id(raw_json) is None:
+        collector.issue(
+            "warning",
+            "sender",
+            "server.mail_profile_id",
+            "missing_mail_profile",
+            "Select an authorized Mail-module profile before validating or delivering this campaign.",
+        )
+
+
+def _validate_partial_recipients(collector: _PartialValidationCollector, entries: dict[str, Any]) -> None:
     has_inline = bool(entries.get("inline"))
     has_source = isinstance(entries.get("source"), dict)
     if not has_inline and not has_source:
-        issue("warning", "recipients", "entries", "missing_recipients", "No inline recipients or external recipient source configured yet.")
-    if has_source:
-        mapping = entries.get("mapping") if isinstance(entries.get("mapping"), dict) else {}
-        if not any(key in mapping for key in ("to.0.email", "to.email", "email")):
-            issue("warning", "recipients", "entries.mapping", "missing_email_mapping", "No email field mapping is configured.")
+        collector.issue("warning", "recipients", "entries", "missing_recipients", "No inline recipients or external recipient source configured yet.")
+    if has_source and not _entries_source_has_email_mapping(entries):
+        collector.issue("warning", "recipients", "entries.mapping", "missing_email_mapping", "No email field mapping is configured.")
 
-    template = raw_json.get("template") if isinstance(raw_json.get("template"), dict) else {}
+
+def _entries_source_has_email_mapping(entries: dict[str, Any]) -> bool:
+    mapping = entries.get("mapping") if isinstance(entries.get("mapping"), dict) else {}
+    return any(key in mapping for key in ("to.0.email", "to.email", "email"))
+
+
+def _validate_partial_template(collector: _PartialValidationCollector, template: dict[str, Any]) -> None:
     source_template = template.get("source") if isinstance(template.get("source"), dict) else {}
     if not template.get("subject") and not source_template.get("subject_path"):
-        issue("warning", "template", "template.subject", "missing_subject", "Template subject is empty.")
-    explicit_body_mode = template.get("body_mode") if template.get("body_mode") in {"text", "html", "both"} else None
-    has_text_body = bool(template.get("text")) or bool(source_template.get("text_path"))
-    has_html_body = bool(template.get("html")) or bool(source_template.get("html_path"))
-    if explicit_body_mode == "text" and not has_text_body:
-        issue("warning", "template", "template.text", "missing_template_text_body", "Template body mode is text only, but no text body is configured.")
-    elif explicit_body_mode == "html" and not has_html_body:
-        issue("warning", "template", "template.html", "missing_template_html_body", "Template body mode is HTML only, but no HTML body is configured.")
-    elif explicit_body_mode == "both":
-        if not has_text_body:
-            issue("warning", "template", "template.text", "missing_template_text_body", "Template body mode is both, but no text body is configured.")
-        if not has_html_body:
-            issue("warning", "template", "template.html", "missing_template_html_body", "Template body mode is both, but no HTML body is configured.")
-    elif not has_text_body and not has_html_body and not source_template:
-        issue("warning", "template", "template", "missing_template_body", "No text, HTML or file-based template body configured yet.")
+        collector.issue("warning", "template", "template.subject", "missing_subject", "Template subject is empty.")
+    body_state = _partial_template_body_state(template, source_template)
+    _validate_partial_template_body(collector, body_state)
 
-    attachments = raw_json.get("attachments") if isinstance(raw_json.get("attachments"), dict) else {}
+
+def _partial_template_body_state(template: dict[str, Any], source_template: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "mode": template.get("body_mode") if template.get("body_mode") in {"text", "html", "both"} else None,
+        "has_text": bool(template.get("text")) or bool(source_template.get("text_path")),
+        "has_html": bool(template.get("html")) or bool(source_template.get("html_path")),
+        "has_source": bool(source_template),
+    }
+
+
+def _validate_partial_template_body(collector: _PartialValidationCollector, state: dict[str, Any]) -> None:
+    mode = state["mode"]
+    has_text = bool(state["has_text"])
+    has_html = bool(state["has_html"])
+    if mode == "text" and not has_text:
+        collector.issue("warning", "template", "template.text", "missing_template_text_body", "Template body mode is text only, but no text body is configured.")
+    elif mode == "html" and not has_html:
+        collector.issue("warning", "template", "template.html", "missing_template_html_body", "Template body mode is HTML only, but no HTML body is configured.")
+    elif mode == "both":
+        _validate_partial_dual_body_template(collector, has_text=has_text, has_html=has_html)
+    elif not has_text and not has_html and not state["has_source"]:
+        collector.issue("warning", "template", "template", "missing_template_body", "No text, HTML or file-based template body configured yet.")
+
+
+def _validate_partial_dual_body_template(collector: _PartialValidationCollector, *, has_text: bool, has_html: bool) -> None:
+    if not has_text:
+        collector.issue("warning", "template", "template.text", "missing_template_text_body", "Template body mode is both, but no text body is configured.")
+    if not has_html:
+        collector.issue("warning", "template", "template.html", "missing_template_html_body", "Template body mode is both, but no HTML body is configured.")
+
+
+def _validate_partial_attachments(collector: _PartialValidationCollector, attachments: dict[str, Any]) -> None:
     base_paths = attachments.get("base_paths") if isinstance(attachments.get("base_paths"), list) else []
     has_named_base_path = any(isinstance(item, dict) and item.get("path") for item in base_paths)
     if not has_named_base_path and not attachments.get("base_path"):
-        issue("info", "attachments", "attachments.base_path", "missing_attachment_base_path", "Attachment base path is not configured yet.")
+        collector.issue("info", "attachments", "attachments.base_path", "missing_attachment_base_path", "Attachment base path is not configured yet.")
 
-    delivery = raw_json.get("delivery") if isinstance(raw_json.get("delivery"), dict) else {}
+
+def _validate_partial_delivery(collector: _PartialValidationCollector, delivery: dict[str, Any]) -> None:
     rate_limit = delivery.get("rate_limit") if isinstance(delivery.get("rate_limit"), dict) else {}
     messages_per_minute = rate_limit.get("messages_per_minute")
-    if messages_per_minute is not None:
-        try:
-            if int(messages_per_minute) < 1:
-                issue("error", "send", "delivery.rate_limit.messages_per_minute", "invalid_rate_limit", "Messages per minute must be at least 1.")
-        except (TypeError, ValueError):
-            issue("error", "send", "delivery.rate_limit.messages_per_minute", "invalid_rate_limit", "Messages per minute must be a number.")
-
-    return {
-        "ok": not any(item["severity"] == "error" for item in issues),
-        "section": section,
-        "error_count": sum(1 for item in issues if item["severity"] == "error"),
-        "warning_count": sum(1 for item in issues if item["severity"] == "warning"),
-        "info_count": sum(1 for item in issues if item["severity"] == "info"),
-        "issues": issues,
-    }
+    if messages_per_minute is None:
+        return
+    try:
+        if int(messages_per_minute) < 1:
+            collector.issue("error", "send", "delivery.rate_limit.messages_per_minute", "invalid_rate_limit", "Messages per minute must be at least 1.")
+    except (TypeError, ValueError):
+        collector.issue("error", "send", "delivery.rate_limit.messages_per_minute", "invalid_rate_limit", "Messages per minute must be a number.")

src/govoplan_campaign/backend/report_privacy_policy.py

@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import Any, Mapping
+
+from sqlalchemy.orm import Session
+
+from govoplan_core.tenancy.scope import Tenant
+
+
+DEFAULT_SMALL_CELL_THRESHOLD = 5
+MIN_SMALL_CELL_THRESHOLD = 2
+MAX_SMALL_CELL_THRESHOLD = 100
+SMALL_CELL_THRESHOLD_ENV = "GOVOPLAN_CAMPAIGN_REPORT_SMALL_CELL_THRESHOLD"
+CAMPAIGN_REPORT_POLICY_SETTINGS_KEY = "campaign_report_privacy_policy"
+SMALL_CELL_THRESHOLD_SETTINGS_KEY = "small_cell_threshold"
+
+
+class CampaignReportPrivacyPolicyError(RuntimeError):
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class CampaignReportPrivacyPolicy:
+    small_cell_threshold: int
+    source: str
+    deployment_small_cell_threshold: int
+    tenant_small_cell_threshold: int | None = None
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "small_cell_threshold": self.small_cell_threshold,
+            "source": self.source,
+            "deployment_small_cell_threshold": self.deployment_small_cell_threshold,
+            "tenant_small_cell_threshold": self.tenant_small_cell_threshold,
+            "deployment_setting": SMALL_CELL_THRESHOLD_ENV,
+            "tenant_setting": (
+                f"tenant.settings.{CAMPAIGN_REPORT_POLICY_SETTINGS_KEY}."
+                f"{SMALL_CELL_THRESHOLD_SETTINGS_KEY}"
+            ),
+        }
+
+
+def effective_campaign_report_privacy_policy(
+    session: Session,
+    *,
+    tenant_id: str,
+    environ: Mapping[str, str] | None = None,
+) -> CampaignReportPrivacyPolicy:
+    env = os.environ if environ is None else environ
+    deployment_raw = env.get(SMALL_CELL_THRESHOLD_ENV)
+    deployment_value = _configured_threshold(
+        deployment_raw,
+        source=SMALL_CELL_THRESHOLD_ENV,
+        default=DEFAULT_SMALL_CELL_THRESHOLD,
+    )
+    tenant = session.get(Tenant, tenant_id)
+    tenant_raw = _tenant_threshold_value(tenant.settings if tenant is not None else None)
+    if tenant_raw is None:
+        return CampaignReportPrivacyPolicy(
+            small_cell_threshold=deployment_value,
+            source="deployment" if deployment_raw not in (None, "") else "deployment_default",
+            deployment_small_cell_threshold=deployment_value,
+        )
+
+    tenant_value = _configured_threshold(
+        tenant_raw,
+        source=(
+            f"tenant.settings.{CAMPAIGN_REPORT_POLICY_SETTINGS_KEY}."
+            f"{SMALL_CELL_THRESHOLD_SETTINGS_KEY}"
+        ),
+    )
+    effective_value = max(deployment_value, tenant_value)
+    return CampaignReportPrivacyPolicy(
+        small_cell_threshold=effective_value,
+        source="tenant" if tenant_value >= deployment_value else "deployment_floor",
+        deployment_small_cell_threshold=deployment_value,
+        tenant_small_cell_threshold=tenant_value,
+    )
+
+
+def _tenant_threshold_value(settings: Mapping[str, Any] | None) -> object | None:
+    if not isinstance(settings, Mapping):
+        return None
+    policy = settings.get(CAMPAIGN_REPORT_POLICY_SETTINGS_KEY)
+    if not isinstance(policy, Mapping):
+        return None
+    return policy.get(SMALL_CELL_THRESHOLD_SETTINGS_KEY)
+
+
+def _configured_threshold(value: object, *, source: str, default: int | None = None) -> int:
+    if value is None or (isinstance(value, str) and not value.strip()):
+        if default is not None:
+            return default
+        raise CampaignReportPrivacyPolicyError(f"{source} must be configured as an integer")
+    if isinstance(value, bool):
+        raise CampaignReportPrivacyPolicyError(f"{source} must be an integer, not a boolean")
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError) as exc:
+        raise CampaignReportPrivacyPolicyError(f"{source} must be an integer") from exc
+    if str(parsed) != str(value).strip() and not isinstance(value, int):
+        raise CampaignReportPrivacyPolicyError(f"{source} must be an integer")
+    if parsed < MIN_SMALL_CELL_THRESHOLD or parsed > MAX_SMALL_CELL_THRESHOLD:
+        raise CampaignReportPrivacyPolicyError(
+            f"{source} must be between {MIN_SMALL_CELL_THRESHOLD} and {MAX_SMALL_CELL_THRESHOLD}"
+        )
+    return parsed

src/govoplan_campaign/backend/reports/aggregate.py

@@ -0,0 +1,490 @@
+from __future__ import annotations
+
+from collections import Counter
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import case, func, or_
+from sqlalchemy.orm import Session
+
+from govoplan_campaign.backend.db.models import Campaign, CampaignJob, CampaignVersion
+from govoplan_campaign.backend.report_privacy_policy import (
+    CampaignReportPrivacyPolicy,
+    effective_campaign_report_privacy_policy,
+)
+
+
+class AggregateCampaignReportError(RuntimeError):
+    pass
+
+
+class AggregateReportCampaign(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    id: str
+    name: str
+    status: str
+
+
+class AggregateReportCampaignListItem(AggregateReportCampaign):
+    updated_at: datetime
+
+
+class AggregateReportCampaignList(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    campaigns: list[AggregateReportCampaignListItem]
+
+
+class AggregateCount(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    value: int | None
+    suppressed: bool = False
+
+
+class AggregatePopulation(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    denominator: AggregateCount
+    denominator_definition: str
+    inactive_source_entries: AggregateCount
+    excluded_or_blocked_jobs: AggregateCount
+
+
+class AggregateOutcomeCounts(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    smtp_accepted: AggregateCount
+    failed: AggregateCount
+    outcome_unknown: AggregateCount
+    queued_or_active: AggregateCount
+    cancelled: AggregateCount
+    excluded: AggregateCount
+    not_attempted: AggregateCount
+
+
+class AggregateTimeRange(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    first_activity_at: datetime | None
+    last_activity_at: datetime | None
+    suppressed: bool
+
+
+class AggregatePrivacy(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    small_cell_threshold: int
+    suppression_applied: bool
+    rule: str
+
+
+class AggregateCampaignReport(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    generated_at: datetime
+    campaign: AggregateReportCampaign
+    version_number: int | None
+    completion_state: Literal[
+        "not_started",
+        "in_progress",
+        "completed",
+        "partially_completed",
+        "incomplete",
+        "outcome_unknown",
+        "suppressed",
+    ]
+    population: AggregatePopulation
+    outcomes: AggregateOutcomeCounts
+    time_range: AggregateTimeRange
+    privacy: AggregatePrivacy
+
+
+_OUTCOME_KEYS = (
+    "smtp_accepted",
+    "failed",
+    "outcome_unknown",
+    "queued_or_active",
+    "cancelled",
+    "excluded",
+    "not_attempted",
+)
+
+
+def generate_aggregate_campaign_report(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    version_id: str | None = None,
+) -> AggregateCampaignReport:
+    """Build the deliberately small, recipient-free Campaign report projection."""
+
+    campaign = _get_campaign(session, tenant_id=tenant_id, campaign_id=campaign_id)
+    version = _selected_version(session, campaign, version_id)
+    facts = _query_aggregate_facts(
+        session,
+        tenant_id=tenant_id,
+        campaign_id=campaign.id,
+        version=version,
+    )
+    policy = effective_campaign_report_privacy_policy(session, tenant_id=tenant_id)
+    return _build_aggregate_campaign_report(
+        campaign=campaign,
+        version=version,
+        facts=facts,
+        policy=policy,
+    )
+
+
+def _get_campaign(session: Session, *, tenant_id: str, campaign_id: str) -> Campaign:
+    campaign = (
+        session.query(Campaign)
+        .filter(Campaign.tenant_id == tenant_id, Campaign.id == campaign_id)
+        .one_or_none()
+    )
+    if campaign is None:
+        raise AggregateCampaignReportError("Campaign not found")
+    return campaign
+
+
+def _selected_version(
+    session: Session,
+    campaign: Campaign,
+    version_id: str | None,
+) -> CampaignVersion | None:
+    selected_id = version_id or campaign.current_version_id
+    if not selected_id:
+        return None
+    version = session.get(CampaignVersion, selected_id)
+    if version is None or version.campaign_id != campaign.id:
+        raise AggregateCampaignReportError("Campaign version not found")
+    return version
+
+
+def _query_aggregate_facts(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    version: CampaignVersion | None,
+) -> _AggregateFacts:
+    if version is None:
+        return _AggregateFacts.empty()
+
+    accepted = CampaignJob.send_status.in_({"smtp_accepted", "sent"})
+    failed = CampaignJob.send_status.in_({"failed_temporary", "failed_permanent"})
+    unknown = CampaignJob.send_status == "outcome_unknown"
+    active = CampaignJob.send_status.in_({"queued", "claimed", "sending"})
+    cancelled = CampaignJob.send_status == "cancelled"
+    excluded = CampaignJob.send_status == "skipped"
+    excluded_or_blocked = or_(
+        CampaignJob.validation_status.in_({"blocked", "excluded", "inactive"}),
+        CampaignJob.build_status != "built",
+    )
+    row = (
+        session.query(
+            func.count(CampaignJob.id).label("denominator"),
+            func.sum(case((accepted, 1), else_=0)).label("smtp_accepted"),
+            func.sum(case((failed, 1), else_=0)).label("failed"),
+            func.sum(case((unknown, 1), else_=0)).label("outcome_unknown"),
+            func.sum(case((active, 1), else_=0)).label("queued_or_active"),
+            func.sum(case((cancelled, 1), else_=0)).label("cancelled"),
+            func.sum(case((excluded, 1), else_=0)).label("excluded"),
+            func.sum(
+                case((or_(accepted, failed, unknown, active, cancelled, excluded), 0), else_=1)
+            ).label("not_attempted"),
+            func.sum(case((excluded_or_blocked, 1), else_=0)).label("excluded_or_blocked"),
+            func.min(CampaignJob.queued_at).label("queued_min"),
+            func.max(CampaignJob.queued_at).label("queued_max"),
+            func.min(CampaignJob.smtp_started_at).label("smtp_min"),
+            func.max(CampaignJob.smtp_started_at).label("smtp_max"),
+            func.min(CampaignJob.sent_at).label("sent_min"),
+            func.max(CampaignJob.sent_at).label("sent_max"),
+            func.min(CampaignJob.outcome_unknown_at).label("unknown_min"),
+            func.max(CampaignJob.outcome_unknown_at).label("unknown_max"),
+        )
+        .filter(
+            CampaignJob.tenant_id == tenant_id,
+            CampaignJob.campaign_id == campaign_id,
+            CampaignJob.campaign_version_id == version.id,
+        )
+        .one()
+    )
+    values = row._mapping
+    activity = [
+        values[key]
+        for key in (
+            "queued_min",
+            "queued_max",
+            "smtp_min",
+            "smtp_max",
+            "sent_min",
+            "sent_max",
+            "unknown_min",
+            "unknown_max",
+        )
+        if values[key] is not None
+    ]
+    return _AggregateFacts(
+        outcomes={key: int(values[key] or 0) for key in _OUTCOME_KEYS},
+        denominator=int(values["denominator"] or 0),
+        excluded_or_blocked=int(values["excluded_or_blocked"] or 0),
+        first_activity_at=min(activity) if activity else None,
+        last_activity_at=max(activity) if activity else None,
+    )
+
+
+def build_aggregate_campaign_report(
+    *,
+    campaign: Campaign,
+    version: CampaignVersion | None,
+    jobs: list[CampaignJob],
+    policy: CampaignReportPrivacyPolicy,
+    generated_at: datetime | None = None,
+) -> AggregateCampaignReport:
+    return _build_aggregate_campaign_report(
+        campaign=campaign,
+        version=version,
+        facts=_facts_from_jobs(jobs),
+        policy=policy,
+        generated_at=generated_at,
+    )
+
+
+def _build_aggregate_campaign_report(
+    *,
+    campaign: Campaign,
+    version: CampaignVersion | None,
+    facts: _AggregateFacts,
+    policy: CampaignReportPrivacyPolicy,
+    generated_at: datetime | None = None,
+) -> AggregateCampaignReport:
+    outcome_values = facts.outcomes
+    outcomes, denominator = _suppress_partition(
+        outcome_values,
+        threshold=policy.small_cell_threshold,
+    )
+    outcome_suppression_applied = denominator.suppressed or any(
+        item.suppressed for item in outcomes.values()
+    )
+    inactive_entries = _inactive_entry_count(version)
+    standalone_counts = {
+        "inactive_source_entries": _suppress_standalone_count(
+            inactive_entries,
+            threshold=policy.small_cell_threshold,
+        ),
+        # This population count overlaps the outcome partition, so exposing it
+        # can make a suppressed outcome recoverable through subtraction.
+        "excluded_or_blocked_jobs": (
+            AggregateCount(value=None, suppressed=True)
+            if outcome_suppression_applied
+            else _suppress_standalone_count(
+                facts.excluded_or_blocked,
+                threshold=policy.small_cell_threshold,
+            )
+        ),
+    }
+    suppression_applied = denominator.suppressed or any(
+        item.suppressed for item in (*outcomes.values(), *standalone_counts.values())
+    )
+    first_activity = facts.first_activity_at
+    last_activity = facts.last_activity_at
+    suppress_time_range = suppression_applied or (
+        0 < facts.denominator < policy.small_cell_threshold
+    )
+
+    return AggregateCampaignReport(
+        generated_at=generated_at or datetime.now(timezone.utc),
+        campaign=AggregateReportCampaign(
+            id=campaign.id,
+            name=campaign.name,
+            status=campaign.status,
+        ),
+        version_number=version.version_number if version else None,
+        completion_state=(
+            "suppressed"
+            if denominator.suppressed
+            else _completion_state(outcome_values, facts.denominator)
+        ),
+        population=AggregatePopulation(
+            denominator=denominator,
+            denominator_definition=(
+                "All persisted recipient delivery jobs for the selected campaign version, "
+                "including excluded or blocked jobs. Inactive source entries without a job "
+                "record are excluded and reported separately."
+            ),
+            inactive_source_entries=standalone_counts["inactive_source_entries"],
+            excluded_or_blocked_jobs=standalone_counts["excluded_or_blocked_jobs"],
+        ),
+        outcomes=AggregateOutcomeCounts(**outcomes),
+        time_range=AggregateTimeRange(
+            first_activity_at=None if suppress_time_range else first_activity,
+            last_activity_at=None if suppress_time_range else last_activity,
+            suppressed=suppress_time_range and first_activity is not None,
+        ),
+        privacy=AggregatePrivacy(
+            small_cell_threshold=policy.small_cell_threshold,
+            suppression_applied=suppression_applied,
+            rule=(
+                "Positive counts below the threshold are hidden. At least one additional "
+                "count or the denominator is hidden when needed to prevent subtraction. "
+                "Overlapping population counts are hidden whenever outcome suppression applies."
+            ),
+        ),
+    )
+
+
+def aggregate_report_campaign_item(campaign: Campaign) -> AggregateReportCampaignListItem:
+    return AggregateReportCampaignListItem(
+        id=campaign.id,
+        name=campaign.name,
+        status=campaign.status,
+        updated_at=campaign.updated_at,
+    )
+
+
+def _outcome_counts(jobs: list[CampaignJob]) -> dict[str, int]:
+    counts: Counter[str] = Counter()
+    for job in jobs:
+        status = job.send_status
+        if status in {"smtp_accepted", "sent"}:
+            counts["smtp_accepted"] += 1
+        elif status in {"failed_temporary", "failed_permanent"}:
+            counts["failed"] += 1
+        elif status == "outcome_unknown":
+            counts["outcome_unknown"] += 1
+        elif status in {"queued", "claimed", "sending"}:
+            counts["queued_or_active"] += 1
+        elif status == "cancelled":
+            counts["cancelled"] += 1
+        elif status == "skipped":
+            counts["excluded"] += 1
+        else:
+            counts["not_attempted"] += 1
+    return {key: counts[key] for key in _OUTCOME_KEYS}
+
+
+@dataclass(frozen=True, slots=True)
+class _AggregateFacts:
+    outcomes: dict[str, int]
+    denominator: int
+    excluded_or_blocked: int
+    first_activity_at: datetime | None
+    last_activity_at: datetime | None
+
+    @classmethod
+    def empty(cls) -> _AggregateFacts:
+        return cls(
+            outcomes={key: 0 for key in _OUTCOME_KEYS},
+            denominator=0,
+            excluded_or_blocked=0,
+            first_activity_at=None,
+            last_activity_at=None,
+        )
+
+
+def _facts_from_jobs(jobs: list[CampaignJob]) -> _AggregateFacts:
+    first_activity, last_activity = _activity_range(jobs)
+    return _AggregateFacts(
+        outcomes=_outcome_counts(jobs),
+        denominator=len(jobs),
+        excluded_or_blocked=sum(
+            1
+            for job in jobs
+            if job.validation_status in {"blocked", "excluded", "inactive"}
+            or job.build_status != "built"
+        ),
+        first_activity_at=first_activity,
+        last_activity_at=last_activity,
+    )
+
+
+def _suppress_partition(
+    counts: dict[str, int],
+    *,
+    threshold: int,
+) -> tuple[dict[str, AggregateCount], AggregateCount]:
+    total = sum(counts.values())
+    suppressed = {key for key, value in counts.items() if 0 < value < threshold}
+    suppress_denominator = False
+    if suppressed:
+        companions = [
+            (value, key)
+            for key, value in counts.items()
+            if key not in suppressed and value > 0
+        ]
+        if companions:
+            suppressed.add(max(companions)[1])
+        else:
+            suppress_denominator = True
+    denominator = AggregateCount(
+        value=None if suppress_denominator else total,
+        suppressed=suppress_denominator,
+    )
+    return (
+        {
+            key: AggregateCount(
+                value=None if key in suppressed else value,
+                suppressed=key in suppressed,
+            )
+            for key, value in counts.items()
+        },
+        denominator,
+    )
+
+
+def _suppress_standalone_count(value: int, *, threshold: int) -> AggregateCount:
+    if 0 < value < threshold:
+        return AggregateCount(value=None, suppressed=True)
+    return AggregateCount(value=value, suppressed=False)
+
+
+def _completion_state(
+    counts: dict[str, int],
+    total: int,
+) -> Literal[
+    "not_started",
+    "in_progress",
+    "completed",
+    "partially_completed",
+    "incomplete",
+    "outcome_unknown",
+]:
+    if total == 0 or counts["not_attempted"] + counts["excluded"] == total:
+        return "not_started"
+    if counts["outcome_unknown"]:
+        return "outcome_unknown"
+    if counts["queued_or_active"]:
+        return "in_progress"
+    accepted = counts["smtp_accepted"]
+    if accepted == total:
+        return "completed"
+    if accepted:
+        return "partially_completed"
+    return "incomplete"
+
+
+def _activity_range(jobs: list[CampaignJob]) -> tuple[datetime | None, datetime | None]:
+    activity = [
+        value
+        for job in jobs
+        for value in (
+            job.queued_at,
+            job.smtp_started_at,
+            job.sent_at,
+            job.outcome_unknown_at,
+        )
+        if value is not None
+    ]
+    if not activity:
+        return None, None
+    return min(activity), max(activity)
+
+
+def _inactive_entry_count(version: CampaignVersion | None) -> int:
+    build_summary = version.build_summary if version and isinstance(version.build_summary, dict) else {}
+    return int(build_summary.get("inactive_count") or build_summary.get("inactive_entries_count") or 0)

src/govoplan_campaign/backend/reports/campaigns.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import csv
 import io
+import logging
 import math
 from collections import Counter
 from datetime import datetime, timezone
@@ -20,12 +21,20 @@ from govoplan_campaign.backend.db.models import (
     SendAttempt,
 )
 from govoplan_campaign.backend.sending.execution import ExecutionSnapshot
+from govoplan_campaign.backend.response_security import (
+    public_campaign_payload,
+    public_delivery_result_message,
+    public_source_filename,
+)
 
 
 class CampaignReportError(RuntimeError):
     pass
 
 
+logger = logging.getLogger(__name__)
+
+
 def _utcnow_iso() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -55,23 +64,42 @@ def _selected_version(
     return version
 
 
-def _version_info(version: CampaignVersion | None) -> dict[str, Any] | None:
+def _version_info(
+    version: CampaignVersion | None,
+    *,
+    include_diagnostics: bool = False,
+) -> dict[str, Any] | None:
     if not version:
         return None
     return {
         "id": version.id,
         "version_number": version.version_number,
         "schema_version": version.schema_version,
-        "source_filename": version.source_filename,
+        "source_filename": public_source_filename(version.source_filename),
         "created_at": version.created_at.isoformat() if version.created_at else None,
-        "validation_summary": version.validation_summary,
-        "build_summary": version.build_summary,
+        "validation_summary": public_campaign_payload(
+            version.validation_summary,
+            include_diagnostics=include_diagnostics,
+        ),
+        "build_summary": public_campaign_payload(
+            version.build_summary,
+            include_diagnostics=include_diagnostics,
+        ),
         "execution_snapshot_hash": version.execution_snapshot_hash,
         "execution_snapshot_at": version.execution_snapshot_at.isoformat() if version.execution_snapshot_at else None,
+        "delivery_mode": version.delivery_mode,
+        "delivery_mode_selected_at": (
+            version.delivery_mode_selected_at.isoformat() if version.delivery_mode_selected_at else None
+        ),
     }
 
 
-def _load_delivery_info(version: CampaignVersion | None, jobs: list[CampaignJob]) -> dict[str, Any]:
+def _load_delivery_info(
+    version: CampaignVersion | None,
+    jobs: list[CampaignJob],
+    *,
+    include_diagnostics: bool = False,
+) -> dict[str, Any]:
     """Read deterministic delivery settings from the immutable execution snapshot."""
 
     default = {
@@ -81,25 +109,37 @@ def _load_delivery_info(version: CampaignVersion | None, jobs: list[CampaignJob]
         "execution_snapshot_hash": None,
         "execution_snapshot_at": None,
         "snapshot_version": None,
-        "build_token": None,
         "built_at": None,
-        "job_manifest_sha256": None,
         "job_count": 0,
         "queueable_job_count": 0,
-        "effective_policy_sha256": None,
-        "smtp_config_fingerprint": None,
-        "imap_config_fingerprint": None,
         "estimated_remaining_send_seconds": None,
         "estimated_remaining_send_human": None,
-        "background_workers_enabled": bool(core_settings.celery_enabled),
+        "delivery_mode": getattr(version, "delivery_mode", None) if version else None,
+        "delivery_mode_selected_at": (
+            getattr(version, "delivery_mode_selected_at", None).isoformat()
+            if version and getattr(version, "delivery_mode_selected_at", None)
+            else None
+        ),
     }
+    if include_diagnostics:
+        default.update(
+            {
+                "build_token": None,  # nosec B105 - absent report value, not a credential.
+                "job_manifest_sha256": None,
+                "effective_policy_sha256": None,
+                "smtp_transport_revision": None,
+                "imap_transport_revision": None,
+                "background_workers_enabled": bool(core_settings.celery_enabled),
+            }
+        )
     if not version or not isinstance(version.execution_snapshot, dict):
         default["load_error"] = "No execution snapshot exists; rebuild the current locked version before delivery."
         return default
     try:
         snapshot = ExecutionSnapshot.model_validate(version.execution_snapshot)
-    except Exception as exc:  # pragma: no cover - reporting should remain available
-        default["load_error"] = str(exc)
+    except Exception:  # pragma: no cover - reporting should remain available
+        logger.warning("Campaign execution snapshot could not be loaded for a report")
+        default["load_error"] = "Execution snapshot is invalid; rebuild the selected version before delivery."
         return default
 
     messages_per_minute = snapshot.delivery.rate_limit.messages_per_minute
@@ -108,7 +148,7 @@ def _load_delivery_info(version: CampaignVersion | None, jobs: list[CampaignJob]
     if messages_per_minute and pending:
         estimated_seconds = int(math.ceil((len(pending) / messages_per_minute) * 60))
 
-    return {
+    result = {
         "rate_limit": {
             "messages_per_minute": messages_per_minute,
             "concurrency": snapshot.delivery.rate_limit.concurrency,
@@ -124,18 +164,28 @@ def _load_delivery_info(version: CampaignVersion | None, jobs: list[CampaignJob]
         "execution_snapshot_hash": version.execution_snapshot_hash,
         "execution_snapshot_at": version.execution_snapshot_at.isoformat() if version.execution_snapshot_at else None,
         "snapshot_version": snapshot.snapshot_version,
-        "build_token": snapshot.build_token,
         "built_at": snapshot.built_at,
-        "job_manifest_sha256": snapshot.job_manifest_sha256,
         "job_count": snapshot.job_count,
         "queueable_job_count": snapshot.queueable_job_count,
-        "effective_policy_sha256": snapshot.effective_policy_sha256,
-        "smtp_config_fingerprint": snapshot.smtp_config_fingerprint,
-        "imap_config_fingerprint": snapshot.imap_config_fingerprint,
         "estimated_remaining_send_seconds": estimated_seconds,
         "estimated_remaining_send_human": _human_duration(estimated_seconds),
-        "background_workers_enabled": bool(core_settings.celery_enabled),
+        "delivery_mode": version.delivery_mode,
+        "delivery_mode_selected_at": (
+            version.delivery_mode_selected_at.isoformat() if version.delivery_mode_selected_at else None
+        ),
     }
+    if include_diagnostics:
+        result.update(
+            {
+                "build_token": snapshot.build_token,
+                "job_manifest_sha256": snapshot.job_manifest_sha256,
+                "effective_policy_sha256": snapshot.effective_policy_sha256,
+                "smtp_transport_revision": snapshot.smtp_transport_revision,
+                "imap_transport_revision": snapshot.imap_transport_revision,
+                "background_workers_enabled": bool(core_settings.celery_enabled),
+            }
+        )
+    return result
 
 
 def _human_duration(seconds: int | None) -> str | None:
@@ -222,15 +272,19 @@ def _recent_failures(jobs: list[CampaignJob], *, limit: int = 20) -> list[dict[s
             "send_status": job.send_status,
             "imap_status": job.imap_status,
             "attempt_count": job.attempt_count,
-            "last_error": job.last_error,
+            "last_error": public_delivery_result_message(
+                last_error=job.last_error,
+                send_status=job.send_status,
+                imap_status=job.imap_status,
+            ),
             "updated_at": job.updated_at.isoformat() if job.updated_at else None,
         }
         for job in failed[:limit]
     ]
 
 
-def _job_row(job: CampaignJob) -> dict[str, Any]:
-    return {
+def _job_row(job: CampaignJob, *, include_diagnostics: bool = False) -> dict[str, Any]:
+    row = {
         "job_id": job.id,
         "entry_index": job.entry_index,
         "entry_id": job.entry_id,
@@ -243,17 +297,27 @@ def _job_row(job: CampaignJob) -> dict[str, Any]:
         "imap_status": job.imap_status,
         "attempt_count": job.attempt_count,
         "queued_at": job.queued_at.isoformat() if job.queued_at else None,
-        "claimed_at": job.claimed_at.isoformat() if job.claimed_at else None,
-        "smtp_started_at": job.smtp_started_at.isoformat() if job.smtp_started_at else None,
         "outcome_unknown_at": job.outcome_unknown_at.isoformat() if job.outcome_unknown_at else None,
         "sent_at": job.sent_at.isoformat() if job.sent_at else None,
-        "last_error": job.last_error,
+        "last_error": public_delivery_result_message(
+            last_error=job.last_error,
+            send_status=job.send_status,
+            imap_status=job.imap_status,
+        ),
         "eml_size_bytes": job.eml_size_bytes,
         "eml_sha256": job.eml_sha256,
         "issues_count": len(job.issues_snapshot or []),
         "attachment_config_count": len(job.resolved_attachments or []),
         "matched_file_count": sum(len(item.get("matches") or []) for item in (job.resolved_attachments or []) if isinstance(item, dict)),
     }
+    if include_diagnostics:
+        row.update(
+            {
+                "claimed_at": job.claimed_at.isoformat() if job.claimed_at else None,
+                "smtp_started_at": job.smtp_started_at.isoformat() if job.smtp_started_at else None,
+            }
+        )
+    return row
 
 
 def _address_summary(value: Any) -> str:
@@ -316,15 +380,14 @@ def _job_evidence_row(
     *,
     latest_smtp: SendAttempt | None = None,
     latest_imap: ImapAppendAttempt | None = None,
+    include_diagnostics: bool = False,
 ) -> dict[str, Any]:
-    row = _job_row(job)
+    row = _job_row(job, include_diagnostics=include_diagnostics)
     recipients = job.resolved_recipients or {}
     row.update({
         "campaign_id": job.campaign_id,
         "campaign_version_id": job.campaign_version_id,
         "message_id_header": job.message_id_header,
-        "eml_storage_key": job.eml_storage_key,
-        "eml_local_path": job.eml_local_path,
         "from": _address_summary(recipients.get("from")),
         "to": _address_summary(recipients.get("to")),
         "cc": _address_summary(recipients.get("cc")),
@@ -334,15 +397,11 @@ def _job_evidence_row(
         "latest_smtp_attempt_number": latest_smtp.attempt_number if latest_smtp else None,
         "latest_smtp_status": latest_smtp.status if latest_smtp else None,
         "latest_smtp_status_code": latest_smtp.smtp_status_code if latest_smtp else None,
-        "latest_smtp_response": latest_smtp.smtp_response if latest_smtp else None,
-        "latest_smtp_error_type": latest_smtp.error_type if latest_smtp else None,
-        "latest_smtp_error_message": latest_smtp.error_message if latest_smtp else None,
         "latest_smtp_started_at": latest_smtp.started_at.isoformat() if latest_smtp and latest_smtp.started_at else None,
         "latest_smtp_finished_at": latest_smtp.finished_at.isoformat() if latest_smtp and latest_smtp.finished_at else None,
         "latest_imap_attempt_number": latest_imap.attempt_number if latest_imap else None,
         "latest_imap_status": latest_imap.status if latest_imap else None,
         "latest_imap_folder": latest_imap.folder if latest_imap else None,
-        "latest_imap_error_message": latest_imap.error_message if latest_imap else None,
         "latest_imap_created_at": latest_imap.created_at.isoformat() if latest_imap and latest_imap.created_at else None,
         "latest_imap_updated_at": latest_imap.updated_at.isoformat() if latest_imap and latest_imap.updated_at else None,
     })
@@ -356,7 +415,8 @@ def generate_campaign_report(
     campaign_id: str,
     version_id: str | None = None,
     include_jobs: bool = False,
-    include_recent_failures: bool = True,
+    include_recent_failures: bool = False,
+    include_diagnostics: bool = False,
 ) -> dict[str, Any]:
     """Generate a dashboard/report payload for one campaign.
 
@@ -367,39 +427,158 @@ def generate_campaign_report(
 
     campaign = _get_campaign(session, tenant_id=tenant_id, campaign_id=campaign_id)
     version = _selected_version(session, campaign, version_id)
+    jobs = _report_jobs(session, tenant_id=tenant_id, campaign_id=campaign.id, version=version)
+    report = _campaign_report_payload(
+        session,
+        campaign=campaign,
+        version=version,
+        jobs=jobs,
+        tenant_id=tenant_id,
+        include_recent_failures=include_recent_failures,
+        include_diagnostics=include_diagnostics,
+    )
+    if include_jobs:
+        report["jobs"] = [
+            _job_row(job, include_diagnostics=include_diagnostics)
+            for job in jobs
+        ]
+    return report
+
+
+def _report_jobs(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    version: CampaignVersion | None,
+) -> list[CampaignJob]:
     jobs_query = session.query(CampaignJob).filter(
         CampaignJob.tenant_id == tenant_id,
-        CampaignJob.campaign_id == campaign.id,
+        CampaignJob.campaign_id == campaign_id,
     )
     if version:
         jobs_query = jobs_query.filter(CampaignJob.campaign_version_id == version.id)
     else:
         jobs_query = jobs_query.filter(False)
-    jobs = (
-        jobs_query
-        .order_by(CampaignJob.entry_index.asc())
-        .all()
-    )
+    return jobs_query.order_by(CampaignJob.entry_index.asc()).all()
+
+
+def _campaign_report_payload(
+    session: Session,
+    *,
+    campaign: Campaign,
+    version: CampaignVersion | None,
+    jobs: list[CampaignJob],
+    tenant_id: str,
+    include_recent_failures: bool,
+    include_diagnostics: bool,
+) -> dict[str, Any]:
     job_ids = [job.id for job in jobs]
-    send_attempts = session.query(SendAttempt).filter(SendAttempt.job_id.in_(job_ids)).count() if job_ids else 0
-    imap_attempts = session.query(ImapAppendAttempt).filter(ImapAppendAttempt.job_id.in_(job_ids)).count() if job_ids else 0
+    report = {
+        "generated_at": _utcnow_iso(),
+        "campaign": _campaign_report_campaign_payload(campaign),
+        "current_version": _version_info(version, include_diagnostics=include_diagnostics),
+        "selected_version_id": version.id if version else None,
+        "cards": _campaign_report_cards(version, jobs),
+        "status_counts": _campaign_report_status_counts(version, jobs),
+        "issues": {
+            **_issue_summary_from_jobs(jobs),
+            "persisted_campaign_issue_count": _persisted_campaign_issue_count(
+                session,
+                tenant_id=tenant_id,
+                campaign_id=campaign.id,
+                version=version,
+            ),
+        },
+        "attachments": _attachment_summary(jobs),
+        "attempts": _campaign_report_attempt_counts(session, job_ids),
+        "delivery": _load_delivery_info(
+            version,
+            jobs,
+            include_diagnostics=include_diagnostics,
+        ),
+    }
+    if include_recent_failures:
+        report["recent_failures"] = _recent_failures(jobs)
+    return report
+
+
+def _campaign_report_campaign_payload(campaign: Campaign) -> dict[str, Any]:
+    return {
+        "id": campaign.id,
+        "external_id": campaign.external_id,
+        "name": campaign.name,
+        "description": campaign.description,
+        "status": campaign.status,
+        "created_at": campaign.created_at.isoformat() if campaign.created_at else None,
+        "updated_at": campaign.updated_at.isoformat() if campaign.updated_at else None,
+    }
+
+
+def _campaign_report_attempt_counts(session: Session, job_ids: list[str]) -> dict[str, int]:
+    return {
+        "send_attempts": int(session.query(SendAttempt).filter(SendAttempt.job_id.in_(job_ids)).count()) if job_ids else 0,
+        "imap_append_attempts": int(session.query(ImapAppendAttempt).filter(ImapAppendAttempt.job_id.in_(job_ids)).count()) if job_ids else 0,
+    }
+
+
+def _persisted_campaign_issue_count(
+    session: Session,
+    *,
+    tenant_id: str,
+    campaign_id: str,
+    version: CampaignVersion | None,
+) -> int:
     issue_query = session.query(CampaignIssue).filter(
         CampaignIssue.tenant_id == tenant_id,
-        CampaignIssue.campaign_id == campaign.id,
+        CampaignIssue.campaign_id == campaign_id,
     )
     if version:
         issue_query = issue_query.filter(CampaignIssue.campaign_version_id == version.id)
     else:
         issue_query = issue_query.filter(False)
-    persisted_issues = issue_query.count()
+    return int(issue_query.count())
 
+
+def _campaign_report_status_counts(version: CampaignVersion | None, jobs: list[CampaignJob]) -> dict[str, dict[str, int]]:
     validation_counts = _counter([job.validation_status for job in jobs])
-    queue_counts = _counter([job.queue_status for job in jobs])
+    inactive_entries = _inactive_entry_count(version)
+    if inactive_entries:
+        validation_counts["inactive"] = inactive_entries
+    return {
+        "build": _counter([job.build_status for job in jobs]),
+        "validation": validation_counts,
+        "queue": _counter([job.queue_status for job in jobs]),
+        "send": _counter([job.send_status for job in jobs]),
+        "imap": _counter([job.imap_status for job in jobs]),
+    }
+
+
+def _campaign_report_cards(version: CampaignVersion | None, jobs: list[CampaignJob]) -> dict[str, object]:
     send_counts = _counter([job.send_status for job in jobs])
     imap_counts = _counter([job.imap_status for job in jobs])
-    build_counts = _counter([job.build_status for job in jobs])
-
     queueable = sum(1 for job in jobs if job.validation_status in {"ready", "warning"} and job.build_status == "built")
+    queueable_unattempted = sum(
+        1
+        for job in jobs
+        if job.attempt_count == 0
+        and job.send_status in {"not_queued", "cancelled"}
+        and job.validation_status in {"ready", "warning"}
+        and job.build_status == "built"
+    )
+    retry_max_attempts = _retry_max_attempts(version)
+    retryable = sum(
+        1
+        for job in jobs
+        if job.send_status == "failed_temporary"
+        and (retry_max_attempts is None or job.attempt_count < retry_max_attempts)
+    )
+    cancellable = sum(
+        1
+        for job in jobs
+        if job.send_status
+        not in {"skipped", "smtp_accepted", "sent", "outcome_unknown", "claimed", "sending", "cancelled"}
+    )
     needs_attention = sum(
         1
         for job in jobs
@@ -411,65 +590,45 @@ def generate_campaign_report(
     failed = send_counts.get("failed_temporary", 0) + send_counts.get("failed_permanent", 0)
     outcome_unknown = send_counts.get("outcome_unknown", 0)
     not_attempted = send_counts.get("not_queued", 0)
+    skipped = send_counts.get("skipped", 0)
     queued = send_counts.get("queued", 0) + send_counts.get("claimed", 0) + send_counts.get("sending", 0)
     cancelled = send_counts.get("cancelled", 0)
-    build_summary = version.build_summary if version and isinstance(version.build_summary, dict) else {}
-    inactive_entries = int(build_summary.get("inactive_count") or build_summary.get("inactive_entries_count") or 0)
-    if inactive_entries:
-        validation_counts["inactive"] = inactive_entries
-
-    report: dict[str, Any] = {
-        "generated_at": _utcnow_iso(),
-        "campaign": {
-            "id": campaign.id,
-            "external_id": campaign.external_id,
-            "name": campaign.name,
-            "description": campaign.description,
-            "status": campaign.status,
-            "created_at": campaign.created_at.isoformat() if campaign.created_at else None,
-            "updated_at": campaign.updated_at.isoformat() if campaign.updated_at else None,
-        },
-        "current_version": _version_info(version),
-        "selected_version_id": version.id if version else None,
-        "cards": {
-            "jobs_total": len(jobs),
-            "inactive": inactive_entries,
-            "queueable": queueable,
-            "needs_attention": needs_attention,
-            "sent": sent,
-            "smtp_accepted": sent,
-            "failed": failed,
-            "outcome_unknown": outcome_unknown,
-            "not_attempted": not_attempted,
-            "queued_or_active": queued,
-            "cancelled": cancelled,
-            "partially_completed": bool(sent and (failed or outcome_unknown or not_attempted or cancelled)),
-            "imap_appended": imap_counts.get("appended", 0),
-            "imap_failed": imap_counts.get("failed", 0),
-        },
-        "status_counts": {
-            "build": build_counts,
-            "validation": validation_counts,
-            "queue": queue_counts,
-            "send": send_counts,
-            "imap": imap_counts,
-        },
-        "issues": {
-            **_issue_summary_from_jobs(jobs),
-            "persisted_campaign_issue_count": persisted_issues,
-        },
-        "attachments": _attachment_summary(jobs),
-        "attempts": {
-            "send_attempts": int(send_attempts),
-            "imap_append_attempts": int(imap_attempts),
-        },
-        "delivery": _load_delivery_info(version, jobs),
+    inactive_entries = _inactive_entry_count(version)
+    return {
+        "jobs_total": len(jobs),
+        "inactive": inactive_entries,
+        "queueable": queueable,
+        "queueable_unattempted": queueable_unattempted,
+        "retryable": retryable,
+        "cancellable": cancellable,
+        "needs_attention": needs_attention,
+        "sent": sent,
+        "smtp_accepted": sent,
+        "failed": failed,
+        "outcome_unknown": outcome_unknown,
+        "not_attempted": not_attempted,
+        "skipped": skipped,
+        "queued_or_active": queued,
+        "cancelled": cancelled,
+        "partially_completed": bool(sent and (failed or outcome_unknown or not_attempted or cancelled)),
+        "imap_appended": imap_counts.get("appended", 0),
+        "imap_failed": imap_counts.get("failed", 0),
+        "imap_skipped": imap_counts.get("skipped", 0),
     }
-    if include_recent_failures:
-        report["recent_failures"] = _recent_failures(jobs)
-    if include_jobs:
-        report["jobs"] = [_job_row(job) for job in jobs]
-    return report
+
+
+def _retry_max_attempts(version: CampaignVersion | None) -> int | None:
+    if version is None or not isinstance(version.execution_snapshot, dict):
+        return None
+    try:
+        return ExecutionSnapshot.model_validate(version.execution_snapshot).delivery.retry.max_attempts
+    except Exception:
+        return None
+
+
+def _inactive_entry_count(version: CampaignVersion | None) -> int:
+    build_summary = version.build_summary if version and isinstance(version.build_summary, dict) else {}
+    return int(build_summary.get("inactive_count") or build_summary.get("inactive_entries_count") or 0)
 
 
 def generate_jobs_csv(
@@ -478,6 +637,7 @@ def generate_jobs_csv(
     tenant_id: str,
     campaign_id: str,
     version_id: str | None = None,
+    include_diagnostics: bool = False,
 ) -> str:
     campaign = _get_campaign(session, tenant_id=tenant_id, campaign_id=campaign_id)
     version = _selected_version(session, campaign, version_id)
@@ -518,6 +678,7 @@ def generate_jobs_csv(
             job,
             latest_smtp=latest_smtp.get(job.id),
             latest_imap=latest_imap.get(job.id),
+            include_diagnostics=include_diagnostics,
         )
         for job in jobs
     ]
@@ -542,15 +703,11 @@ def generate_jobs_csv(
         "imap_status",
         "attempt_count",
         "queued_at",
-        "claimed_at",
-        "smtp_started_at",
         "outcome_unknown_at",
         "sent_at",
         "last_error",
         "eml_size_bytes",
         "eml_sha256",
-        "eml_storage_key",
-        "eml_local_path",
         "issues_count",
         "attachment_config_count",
         "matched_file_count",
@@ -558,18 +715,17 @@ def generate_jobs_csv(
         "latest_smtp_attempt_number",
         "latest_smtp_status",
         "latest_smtp_status_code",
-        "latest_smtp_response",
-        "latest_smtp_error_type",
-        "latest_smtp_error_message",
         "latest_smtp_started_at",
         "latest_smtp_finished_at",
         "latest_imap_attempt_number",
         "latest_imap_status",
         "latest_imap_folder",
-        "latest_imap_error_message",
         "latest_imap_created_at",
         "latest_imap_updated_at",
     ]
+    if include_diagnostics:
+        sent_at_index = fieldnames.index("outcome_unknown_at")
+        fieldnames[sent_at_index:sent_at_index] = ["claimed_at", "smtp_started_at"]
     buffer = io.StringIO()
     writer = csv.DictWriter(buffer, fieldnames=fieldnames)
     writer.writeheader()

src/govoplan_campaign/backend/reports/emailing.py

@@ -9,11 +9,12 @@ from typing import Any
 from sqlalchemy.orm import Session
 
 from govoplan_campaign.backend.db.models import Campaign, CampaignVersion
-from govoplan_campaign.backend.campaign.loader import load_campaign_config
-from govoplan_campaign.backend.campaign.models import CampaignConfig, SmtpConfig
-from govoplan_campaign.backend.persistence.campaigns import _write_campaign_snapshot
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.campaign.mail_profile_boundary import campaign_mail_profile_id
+from govoplan_campaign.backend.persistence.campaigns import load_version_config
 from govoplan_campaign.backend.reports.campaigns import CampaignReportError, generate_campaign_report, generate_jobs_csv
-from govoplan_campaign.backend.integrations import SmtpConfigurationError, mail_integration
+from govoplan_campaign.backend.integrations import SmtpConfigurationError
+from govoplan_campaign.backend.sending.execution import ExecutionSnapshotError, ensure_execution_snapshot
 
 
 class CampaignReportEmailError(RuntimeError):
@@ -30,8 +31,6 @@ class CampaignReportEmailResult:
     sent: bool
     attached_jobs_csv: bool
     attached_report_json: bool
-    smtp_host: str | None = None
-    smtp_port: int | None = None
     accepted_count: int | None = None
 
     def as_dict(self) -> dict[str, Any]:
@@ -44,8 +43,6 @@ class CampaignReportEmailResult:
             "sent": self.sent,
             "attached_jobs_csv": self.attached_jobs_csv,
             "attached_report_json": self.attached_report_json,
-            "smtp_host": self.smtp_host,
-            "smtp_port": self.smtp_port,
             "accepted_count": self.accepted_count,
         }
 
@@ -62,18 +59,15 @@ def _selected_version(
     return version
 
 
-def _load_config(version: CampaignVersion) -> CampaignConfig:
-    snapshot_path = _write_campaign_snapshot(version)
-    return load_campaign_config(snapshot_path)
+def _load_config(session: Session, version: CampaignVersion) -> CampaignConfig:
+    _campaign, _version, config = load_version_config(session, version.id)
+    return config
 
 
 def _effective_from(config: CampaignConfig) -> tuple[str, str | None]:
     if config.recipients.from_:
         return config.recipients.from_[0].email, config.recipients.from_[0].name
-    smtp_config = config.server.runtime_smtp_config()
-    if smtp_config and smtp_config.username and "@" in smtp_config.username:
-        return smtp_config.username, None
-    raise SmtpConfigurationError("Report email requires a recipients.from address or an SMTP username that is an email address")
+    raise SmtpConfigurationError("Report email requires a Campaign-owned recipients.from address")
 
 
 def _text_summary(report: dict[str, Any]) -> str:
@@ -94,8 +88,10 @@ def _text_summary(report: dict[str, Any]) -> str:
         f"- Needs attention: {cards['needs_attention']}",
         f"- Sent: {cards['sent']}",
         f"- Failed: {cards['failed']}",
+        f"- SMTP skipped (excluded): {cards.get('skipped', status.get('send', {}).get('skipped', 0))}",
         f"- IMAP appended: {cards['imap_appended']}",
         f"- IMAP failed: {cards['imap_failed']}",
+        f"- IMAP skipped: {cards.get('imap_skipped', status.get('imap', {}).get('skipped', 0))}",
         "",
         f"Build status: {status.get('build', {})}",
         f"Validation status: {status.get('validation', {})}",
@@ -105,7 +101,7 @@ def _text_summary(report: dict[str, Any]) -> str:
     ]
     if delivery.get("estimated_remaining_send_human"):
         lines.extend(["", f"Estimated remaining send time: {delivery['estimated_remaining_send_human']}"])
-    lines.extend(["", "This report was generated by MultiMailer."])
+    lines.extend(["", "This report was generated by GovOPlaN."])
     return "\n".join(lines)
 
 
@@ -119,20 +115,20 @@ def build_report_message(
     report_json: dict[str, Any] | None = None,
 ) -> EmailMessage:
     from_email, from_name = _effective_from(config)
-    subject = f"MultiMailer report: {campaign.name}"
+    subject = f"GovOPlaN report: {campaign.name}"
 
     msg = EmailMessage()
     msg["Subject"] = subject
     msg["From"] = formataddr((from_name or from_email, from_email))
     msg["To"] = ", ".join(to)
-    msg["X-MultiMailer-Report"] = "campaign"
+    msg["X-GovOPlaN-Report"] = "campaign"
     msg.set_content(_text_summary(report))
 
     if jobs_csv is not None:
-        filename = f"multimailer-{campaign.external_id}-jobs.csv"
+        filename = f"govoplan-{campaign.external_id}-jobs.csv"
         msg.add_attachment(jobs_csv.encode("utf-8"), maintype="text", subtype="csv", filename=filename)
     if report_json is not None:
-        filename = f"multimailer-{campaign.external_id}-report.json"
+        filename = f"govoplan-{campaign.external_id}-report.json"
         msg.add_attachment(
             json.dumps(report_json, indent=2, ensure_ascii=False, default=str).encode("utf-8"),
             maintype="application",
@@ -150,7 +146,7 @@ def send_campaign_report_email(
     version_id: str | None = None,
     to: list[str],
     include_jobs: bool = False,
-    attach_jobs_csv: bool = True,
+    attach_jobs_csv: bool = False,
     attach_report_json: bool = False,
     dry_run: bool = False,
 ) -> CampaignReportEmailResult:
@@ -161,10 +157,28 @@ def send_campaign_report_email(
         raise CampaignReportEmailError("At least one report recipient is required")
 
     version = _selected_version(session, campaign, version_id)
-    config = _load_config(version)
-    smtp_config: SmtpConfig | None = config.server.runtime_smtp_config()
-    if smtp_config is None:
+    config = _load_config(session, version)
+    if not config.server.profile_capabilities.smtp_available:
         raise SmtpConfigurationError("Campaign has no SMTP configuration")
+    profile_id = campaign_mail_profile_id(version.raw_json if isinstance(version.raw_json, dict) else {})
+    if not profile_id:
+        raise SmtpConfigurationError("Campaign has no Mail profile reference")
+    if not isinstance(version.execution_snapshot, dict):
+        raise CampaignReportEmailError(
+            "Report email requires a validated and built campaign version with stored Mail-profile evidence."
+        )
+    try:
+        snapshot = ensure_execution_snapshot(session, version)
+    except ExecutionSnapshotError as exc:
+        raise CampaignReportEmailError(
+            "Report email requires a validated and built campaign version with current Mail-profile evidence."
+        ) from exc
+    if not snapshot.smtp_transport_revision:
+        raise CampaignReportEmailError("Campaign build evidence has no SMTP transport revision")
+    if not dry_run:
+        raise CampaignReportEmailError(
+            "Report email delivery is disabled until it uses a durable, idempotent Mail-owned outbox with unknown-outcome reconciliation."
+        )
 
     report = generate_campaign_report(
         session,
@@ -172,6 +186,7 @@ def send_campaign_report_email(
         campaign_id=campaign_id,
         version_id=version.id,
         include_jobs=include_jobs,
+        include_recent_failures=include_jobs,
     )
     jobs_csv = (
         generate_jobs_csv(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version.id)
@@ -187,38 +202,13 @@ def send_campaign_report_email(
         jobs_csv=jobs_csv,
         report_json=report_json,
     )
-    envelope_from, _ = _effective_from(config)
-
-    if dry_run:
-        return CampaignReportEmailResult(
-            campaign_id=campaign.id,
-            version_id=version.id,
-            to=to,
-            subject=str(message["Subject"]),
-            dry_run=True,
-            sent=False,
-            attached_jobs_csv=jobs_csv is not None,
-            attached_report_json=report_json is not None,
-            smtp_host=smtp_config.host,
-            smtp_port=smtp_config.port,
-        )
-
-    result = mail_integration().send_email_message(
-        message,
-        smtp_config=smtp_config,
-        envelope_from=envelope_from,
-        envelope_recipients=to,
-    )
     return CampaignReportEmailResult(
         campaign_id=campaign.id,
         version_id=version.id,
         to=to,
         subject=str(message["Subject"]),
-        dry_run=False,
-        sent=True,
+        dry_run=True,
+        sent=False,
         attached_jobs_csv=jobs_csv is not None,
         attached_report_json=report_json is not None,
-        smtp_host=result.host,
-        smtp_port=result.port,
-        accepted_count=result.accepted_count,
     )

src/govoplan_campaign/backend/response_security.py

@@ -0,0 +1,266 @@
+from __future__ import annotations
+
+import copy
+from pathlib import Path, PureWindowsPath
+from typing import Any
+
+from govoplan_campaign.backend.campaign.mail_profile_boundary import public_campaign_mail_server
+
+
+# These fields locate process-local or storage-backend resources, or authorize
+# a worker claim. They are useful for tightly controlled diagnostics but are
+# not part of the campaign business-data contract.
+CAMPAIGN_INTERNAL_RESPONSE_KEYS = frozenset(
+    {
+        "campaign_file",
+        "claim_token",
+        "eml_local_path",
+        "eml_path",
+        "eml_storage_key",
+        "local_path",
+        "source_base_path",
+        "storage_bucket",
+        "storage_key",
+    }
+)
+
+CAMPAIGN_DIAGNOSTIC_RESPONSE_KEYS = frozenset(
+    {
+        "background_workers_enabled",
+        "build_token",
+        "celery_enabled",
+        "claimed_at",
+        "effective_policy_sha256",
+        "execution_input_sha256",
+        "imap_claimed_at",
+        "imap_transport_revision",
+        "job_manifest_sha256",
+        "smtp_started_at",
+        "smtp_transport_revision",
+    }
+)
+
+_SEND_NOW_RESULT_KEYS = (
+    "campaign_id",
+    "version_id",
+    "attempted_count",
+    "sent_count",
+    "failed_count",
+    "outcome_unknown_count",
+    "skipped_count",
+    "preflight_count",
+    "delivery_mode",
+    "dry_run",
+)
+_SEND_NOW_JOB_RESULT_KEYS = (
+    "campaign_id",
+    "version_id",
+    "job_id",
+    "status",
+    "attempt_number",
+    "dry_run",
+    "queued_count",
+    "skipped_count",
+    "blocked_count",
+    "enqueued_count",
+    "delivery_mode",
+    "worker_queue_available",
+)
+_SYNCHRONOUS_POLICY_KEYS = (
+    "max_recipient_jobs",
+    "source",
+    "deployment_max_recipient_jobs",
+    "tenant_max_recipient_jobs",
+)
+_VALIDATION_SUMMARY_KEYS = ("ok", "error_count", "warning_count")
+_BUILD_SUMMARY_KEYS = (
+    "built_count",
+    "build_failed_count",
+    "ready_count",
+    "warning_count",
+    "needs_review_count",
+    "blocked_count",
+    "excluded_count",
+    "inactive_count",
+    "queueable_count",
+)
+
+
+def public_campaign_payload(value: Any, *, include_diagnostics: bool = False) -> Any:
+    """Return a detached payload without infrastructure-only locators."""
+
+    if isinstance(value, dict):
+        blocked_keys = CAMPAIGN_INTERNAL_RESPONSE_KEYS
+        if not include_diagnostics:
+            blocked_keys = blocked_keys | CAMPAIGN_DIAGNOSTIC_RESPONSE_KEYS
+        return {
+            key: public_campaign_payload(item, include_diagnostics=include_diagnostics)
+            for key, item in value.items()
+            if key not in blocked_keys
+        }
+    if isinstance(value, list):
+        return [public_campaign_payload(item, include_diagnostics=include_diagnostics) for item in value]
+    if isinstance(value, tuple):
+        return tuple(public_campaign_payload(item, include_diagnostics=include_diagnostics) for item in value)
+    return copy.deepcopy(value)
+
+
+def public_delivery_result_message(
+    *,
+    last_error: Any,
+    send_status: Any,
+    imap_status: Any,
+) -> str | None:
+    """Map persisted provider text to a stable business-safe explanation."""
+
+    if not last_error:
+        return None
+    clean_send_status = str(send_status or "")
+    clean_imap_status = str(imap_status or "")
+    if clean_send_status == "outcome_unknown":
+        return "SMTP delivery outcome requires operator reconciliation."
+    if clean_send_status in {"failed_temporary", "failed_permanent"}:
+        return "SMTP delivery failed; an operator can inspect restricted diagnostics."
+    if clean_imap_status in {"outcome_unknown", "appending"}:
+        return "Sent-folder append outcome requires operator reconciliation."
+    if clean_imap_status in {"failed", "skipped"}:
+        return "Sent-folder append did not complete; an operator can inspect restricted diagnostics."
+    return "Delivery recorded a warning; an operator can inspect restricted diagnostics."
+
+
+def public_send_campaign_now_result(
+    value: dict[str, Any],
+    *,
+    validation_summary: dict[str, Any],
+    build_summary: dict[str, Any],
+) -> dict[str, Any]:
+    """Project synchronous delivery into its recipient-authorized public contract.
+
+    Per-job provider messages are deliberately omitted. They can contain SMTP
+    diagnostics or refused envelope addresses and belong only in restricted
+    diagnostics backed by persisted job state.
+    """
+
+    result = _selected_payload(value, _SEND_NOW_RESULT_KEYS)
+    policy = value.get("synchronous_send_policy")
+    result["synchronous_send_policy"] = _selected_payload(
+        policy if isinstance(policy, dict) else {},
+        _SYNCHRONOUS_POLICY_KEYS,
+    )
+    rows = value.get("results")
+    if isinstance(rows, list):
+        result["results"] = [
+            _selected_payload(row, _SEND_NOW_JOB_RESULT_KEYS)
+            for row in rows
+            if isinstance(row, dict)
+        ]
+    else:
+        result["results"] = []
+    result["validation"] = _selected_payload(validation_summary, _VALIDATION_SUMMARY_KEYS)
+    result["build"] = _selected_payload(build_summary, _BUILD_SUMMARY_KEYS)
+    return result
+
+
+def send_campaign_now_audit_details(value: dict[str, Any]) -> dict[str, Any]:
+    """Return aggregate-only evidence for a synchronous Campaign send audit."""
+
+    details = _selected_payload(value, _SEND_NOW_RESULT_KEYS)
+    policy = value.get("synchronous_send_policy")
+    details["synchronous_send_policy"] = _selected_payload(
+        policy if isinstance(policy, dict) else {},
+        _SYNCHRONOUS_POLICY_KEYS,
+    )
+    return details
+
+
+def _selected_payload(value: dict[str, Any], keys: tuple[str, ...]) -> dict[str, Any]:
+    return {
+        key: copy.deepcopy(value[key])
+        for key in keys
+        if key in value
+    }
+
+
+def public_campaign_configuration(value: Any) -> Any:
+    """Return campaign JSON without infrastructure locators or mail secrets.
+
+    Password-named business fields are intentionally retained. Only the
+    schema-defined SMTP/IMAP credential paths under ``server`` are secrets.
+    """
+
+    payload = public_campaign_payload(value)
+    if not isinstance(payload, dict):
+        return payload
+    if "server" in payload:
+        payload["server"] = public_campaign_mail_server(payload)
+    _sanitize_configuration_paths(payload)
+    return payload
+
+
+def public_source_filename(value: Any) -> str | None:
+    if value is None:
+        return None
+    text = str(value).strip()
+    if not text:
+        return text
+    windows_path = PureWindowsPath(text)
+    return windows_path.name if windows_path.is_absolute() or "\\" in text else Path(text).name
+
+
+def _sanitize_configuration_paths(payload: dict[str, Any]) -> None:
+    template = payload.get("template")
+    source = template.get("source") if isinstance(template, dict) else None
+    if isinstance(source, dict):
+        for key in ("subject_path", "text_path", "html_path"):
+            if key in source:
+                source[key] = _public_configuration_path(source[key])
+
+    entries = payload.get("entries")
+    entry_source = entries.get("source") if isinstance(entries, dict) else None
+    if isinstance(entry_source, dict) and "path" in entry_source:
+        entry_source["path"] = _public_configuration_path(entry_source["path"])
+
+    attachments = payload.get("attachments")
+    if isinstance(attachments, dict):
+        if "base_path" in attachments:
+            attachments["base_path"] = _public_configuration_path(attachments["base_path"])
+        base_paths = attachments.get("base_paths")
+        if isinstance(base_paths, list):
+            for item in base_paths:
+                if not isinstance(item, dict):
+                    continue
+                for key in ("path", "source"):
+                    if key in item:
+                        item[key] = _public_configuration_path(item[key])
+        _sanitize_attachment_rules(attachments.get("global"))
+
+    if isinstance(entries, dict):
+        inline_entries = entries.get("inline")
+        if isinstance(inline_entries, list):
+            for entry in inline_entries:
+                if isinstance(entry, dict):
+                    _sanitize_attachment_rules(entry.get("attachments"))
+        defaults = entries.get("defaults")
+        if isinstance(defaults, dict):
+            _sanitize_attachment_rules(defaults.get("attachments"))
+
+
+def _sanitize_attachment_rules(value: Any) -> None:
+    if not isinstance(value, list):
+        return
+    for rule in value:
+        if isinstance(rule, dict) and "base_dir" in rule:
+            rule["base_dir"] = _public_configuration_path(rule["base_dir"])
+
+
+def _public_configuration_path(value: Any) -> Any:
+    if not isinstance(value, str) or not value.strip():
+        return value
+    text = value.strip()
+    windows_path = PureWindowsPath(text)
+    path = Path(text)
+    if windows_path.is_absolute():
+        return windows_path.name
+    if path.is_absolute() or text.startswith("~"):
+        return path.name
+    return value

src/govoplan_campaign/backend/retention.py

@@ -127,7 +127,11 @@ def _apply_eml_retention(
         if job.queue_status in {JobQueueStatus.QUEUED.value, JobQueueStatus.SENDING.value} or job.send_status not in FINAL_EML_SEND_STATUSES:
             result["skipped_not_final"] += 1
             continue
-        if job.imap_status == JobImapStatus.PENDING.value:
+        if job.imap_status in {
+            JobImapStatus.PENDING.value,
+            JobImapStatus.APPENDING.value,
+            JobImapStatus.OUTCOME_UNKNOWN.value,
+        }:
             result["skipped_not_final"] += 1
             continue
         result["eligible"] += 1

src/govoplan_campaign/backend/schema/campaign.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://multimailer.local/schema/campaign.schema.json",
-  "title": "MultiMailer Campaign",
+  "$id": "https://govoplan.local/schema/campaign.schema.json",
+  "title": "GovOPlaN Campaign",
   "type": "object",
   "required": [
     "version",
@@ -90,125 +90,9 @@
       "type": "object",
       "properties": {
         "mail_profile_id": {
-          "type": "string"
-        },
-        "inherit_smtp_credentials": {
-          "type": "boolean",
-          "default": true
-        },
-        "inherit_imap_credentials": {
-          "type": "boolean",
-          "default": true
-        },
-        "smtp": {
-          "type": "object",
-          "properties": {
-            "host": {
-              "type": "string"
-            },
-            "port": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 65535
-            },
-            "username": {
-              "type": "string"
-            },
-            "password": {
-              "type": "string"
-            },
-            "security": {
-              "type": "string",
-              "enum": [
-                "plain",
-                "tls",
-                "starttls"
-              ],
-              "default": "starttls"
-            },
-            "timeout_seconds": {
-              "type": "integer",
-              "minimum": 1,
-              "default": 30
-            }
-          },
-          "additionalProperties": false
-        },
-        "imap": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": false
-            },
-            "host": {
-              "type": "string"
-            },
-            "port": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 65535
-            },
-            "username": {
-              "type": "string"
-            },
-            "password": {
-              "type": "string"
-            },
-            "security": {
-              "type": "string",
-              "enum": [
-                "plain",
-                "tls",
-                "starttls"
-              ],
-              "default": "tls"
-            },
-            "sent_folder": {
-              "type": "string",
-              "default": "auto"
-            },
-            "timeout_seconds": {
-              "type": "integer",
-              "minimum": 1,
-              "default": 30
-            }
-          },
-          "additionalProperties": false
-        },
-        "credentials": {
-          "type": "object",
-          "properties": {
-            "smtp": {
-              "type": "object",
-              "properties": {
-                "username": {
-                  "type": "string"
-                },
-                "password": {
-                  "type": "string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "imap": {
-              "type": "object",
-              "properties": {
-                "username": {
-                  "type": "string"
-                },
-                "password": {
-                  "type": "string"
-                }
-              },
-              "additionalProperties": false
-            }
-          },
-          "additionalProperties": false,
-          "default": {
-            "smtp": {},
-            "imap": {}
-          }
+          "type": "string",
+          "minLength": 1,
+          "description": "Stable reference to an authorized profile owned by the Mail module. Campaign JSON never stores SMTP/IMAP settings or credentials."
         }
       },
       "additionalProperties": false
@@ -419,7 +303,19 @@
         "send_without_attachments": {
           "type": "boolean",
           "default": true,
-          "description": "Legacy compatibility flag. Prefer validation_policy and per-config missing_behavior for new campaigns."
+          "description": "Legacy compatibility flag. Use send_without_attachments_behavior for new campaigns."
+        },
+        "send_without_attachments_behavior": {
+          "type": "string",
+          "enum": [
+            "block",
+            "ask",
+            "drop",
+            "continue",
+            "warn"
+          ],
+          "default": "continue",
+          "description": "Campaign-wide behavior when no attachment file is resolved for an active message."
         },
         "zip": {
           "$ref": "#/$defs/zip_collection_config",
@@ -1074,9 +970,32 @@
           "enum": [
             "csv",
             "xlsx",
-            "text"
+            "text",
+            "addresses"
           ]
         },
+        "source_id": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "source_label": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "source_revision": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "source_provenance": {
+          "type": "object",
+          "default": {}
+        },
         "filename": {
           "type": [
             "string",

src/govoplan_campaign/backend/schemas.py

@@ -3,10 +3,18 @@ from __future__ import annotations
 from datetime import datetime
 from typing import Any, Literal
 
-from pydantic import BaseModel, ConfigDict, Field, model_validator
+from pydantic import BaseModel, ConfigDict, Field, ValidationInfo, field_validator, model_validator
 
 from govoplan_core.api.v1.schemas import DeltaDeletedItem
-from govoplan_core.mail.config import ImapConfig, SmtpConfig
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    public_campaign_editor_state,
+    validate_campaign_editor_state,
+)
+from govoplan_campaign.backend.response_security import (
+    public_campaign_configuration,
+    public_campaign_payload,
+    public_source_filename,
+)
 
 
 class CampaignCreateRequest(BaseModel):
@@ -49,6 +57,12 @@ class CampaignVersionUpdateRequest(BaseModel):
     editor_state: dict[str, Any] | None = None
     source_filename: str | None = None
     source_base_path: str | None = None
+    migrate_legacy_mail_settings: bool = False
+
+    @field_validator("editor_state")
+    @classmethod
+    def validate_editor_state(cls, value: dict[str, Any] | None) -> dict[str, Any] | None:
+        return validate_campaign_editor_state(value) if value is not None else None
 
 
 class CampaignVersionSetStepRequest(BaseModel):
@@ -80,7 +94,6 @@ class CampaignVersionResponse(BaseModel):
     version_number: int
     schema_version: str
     source_filename: str | None = None
-    source_base_path: str | None = None
     workflow_state: str = "editing"
     current_flow: str = "manual"
     current_step: str | None = None
@@ -99,10 +112,39 @@ class CampaignVersionResponse(BaseModel):
     build_summary: dict[str, Any] | None = None
     execution_snapshot_hash: str | None = None
     execution_snapshot_at: datetime | None = None
+    delivery_mode: Literal["synchronous", "worker_queue", "database_queue"] | None = None
+    delivery_mode_selected_at: datetime | None = None
+
+    @field_validator("editor_state", mode="before")
+    @classmethod
+    def remove_unsupported_editor_state(cls, value: Any, info: ValidationInfo) -> dict[str, Any]:
+        return public_campaign_editor_state(
+            value,
+            include_diagnostics=bool((info.context or {}).get("include_diagnostics")),
+        )
+
+    @field_validator("source_filename", mode="before")
+    @classmethod
+    def remove_source_directory(cls, value: Any) -> str | None:
+        return public_source_filename(value)
+
+    @field_validator("validation_summary", "build_summary", mode="before")
+    @classmethod
+    def remove_internal_summary_fields(cls, value: Any, info: ValidationInfo) -> Any:
+        return public_campaign_payload(
+            value,
+            include_diagnostics=bool((info.context or {}).get("include_diagnostics")),
+        )
 
 
 class CampaignVersionDetailResponse(CampaignVersionResponse):
     raw_json: dict[str, Any]
+    mail_profile_migration_required: bool = False
+
+    @field_validator("raw_json", mode="before")
+    @classmethod
+    def remove_internal_configuration_fields(cls, value: Any) -> Any:
+        return public_campaign_configuration(value)
 
 
 class CampaignPartialValidationResponse(BaseModel):
@@ -266,6 +308,65 @@ class RecipientImportMappingProfileListResponse(BaseModel):
     profiles: list[RecipientImportMappingProfileResponse] = Field(default_factory=list)
 
 
+class CampaignAddressLookupCandidate(BaseModel):
+    contact_id: str
+    address_book_id: str
+    display_name: str
+    email: str | None = None
+    email_label: str | None = None
+    organization: str | None = None
+    role_title: str | None = None
+    tags: list[str] = Field(default_factory=list)
+    source_kind: str = "local"
+    source_ref: str | None = None
+    source_revision: str | None = None
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class CampaignAddressLookupResponse(BaseModel):
+    available: bool = False
+    candidates: list[CampaignAddressLookupCandidate] = Field(default_factory=list)
+
+
+class CampaignRecipientAddressSource(BaseModel):
+    source_id: str
+    source_label: str
+    source_kind: str
+    source_revision: str
+    recipient_count: int = 0
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class CampaignRecipientAddressSourcesResponse(BaseModel):
+    available: bool = False
+    sources: list[CampaignRecipientAddressSource] = Field(default_factory=list)
+
+
+class CampaignRecipientAddressSourceSnapshotRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    source_id: str = Field(min_length=1)
+
+
+class CampaignRecipientSnapshotItem(BaseModel):
+    contact_id: str
+    display_name: str
+    email: str
+    email_label: str | None = None
+    fields: dict[str, Any] = Field(default_factory=dict)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class CampaignRecipientAddressSourceSnapshotResponse(BaseModel):
+    source_id: str
+    source_label: str
+    source_kind: str
+    source_revision: str
+    generated_at: str
+    recipients: list[CampaignRecipientSnapshotItem] = Field(default_factory=list)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
 class CampaignJobsResponse(BaseModel):
     jobs: list[dict[str, Any]]
     page: int = 1
@@ -292,6 +393,15 @@ class CampaignJobDetailResponse(BaseModel):
     attempts: dict[str, list[dict[str, Any]]] = Field(default_factory=dict)
 
 
+class CampaignJobDiagnosticsResponse(BaseModel):
+    job_id: str
+    campaign_id: str
+    campaign_version_id: str
+    storage: dict[str, Any] = Field(default_factory=dict)
+    worker_claim: dict[str, Any] = Field(default_factory=dict)
+    attempts: dict[str, list[dict[str, Any]]] = Field(default_factory=dict)
+
+
 class CampaignRetryJobsRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
@@ -312,17 +422,39 @@ class CampaignSendUnattemptedRequest(BaseModel):
     dry_run: bool = False
 
 
+class CampaignSendJobRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    include_warnings: bool = True
+    dry_run: bool = False
+    use_rate_limit: bool = True
+    enqueue_imap_task: bool = False
+
+
 class CampaignResolveOutcomeRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
-    decision: Literal["smtp_accepted", "not_sent"]
-    note: str | None = None
+    decision: Literal[
+        "smtp_accepted",
+        "not_sent",
+        "imap_appended",
+        "imap_not_appended",
+    ]
+    note: str | None = Field(default=None, max_length=2000)
+
+    @model_validator(mode="after")
+    def require_reconciliation_evidence(self) -> "CampaignResolveOutcomeRequest":
+        self.note = (self.note or "").strip()
+        if not self.note:
+            raise ValueError("Reconciliation requires an evidence note")
+        return self
 
 
 class ValidateCampaignRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
     check_files: bool = False
+    link_unshared_matches: bool = False
 
 
 class BuildCampaignRequest(BaseModel):
@@ -331,125 +463,6 @@ class BuildCampaignRequest(BaseModel):
     write_eml: bool = True
 
 
-class MailSmtpTestRequest(SmtpConfig):
-    """SMTP settings supplied directly from the WebUI mail settings form."""
-
-
-class MailImapTestRequest(ImapConfig):
-    """IMAP settings supplied directly from the WebUI mail settings form."""
-
-
-
-
-MailProfileScope = Literal["system", "tenant", "user", "group", "campaign"]
-
-
-class MailCredentialPolicyPayload(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    inherit: bool | None = None
-    allow_override: bool | None = None
-
-
-class MailProfilePolicyPayload(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    allowed_profile_ids: list[str] = Field(default_factory=list)
-    allow_user_profiles: bool | None = None
-    allow_group_profiles: bool | None = None
-    allow_campaign_profiles: bool | None = None
-    smtp_credentials: MailCredentialPolicyPayload = Field(default_factory=MailCredentialPolicyPayload)
-    imap_credentials: MailCredentialPolicyPayload = Field(default_factory=MailCredentialPolicyPayload)
-    whitelist: dict[str, list[str]] = Field(default_factory=dict)
-    blacklist: dict[str, list[str]] = Field(default_factory=dict)
-
-
-class MailProfilePolicyUpdateRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    policy: MailProfilePolicyPayload = Field(default_factory=MailProfilePolicyPayload)
-
-
-class MailProfilePolicyResponse(BaseModel):
-    scope_type: MailProfileScope
-    scope_id: str | None = None
-    policy: dict[str, Any]
-    effective_policy: dict[str, Any] | None = None
-
-
-class MailServerProfileCreateRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    name: str = Field(min_length=1, max_length=255)
-    slug: str | None = Field(default=None, max_length=100)
-    description: str | None = None
-    is_active: bool = True
-    scope_type: MailProfileScope = "tenant"
-    scope_id: str | None = None
-    smtp: SmtpConfig
-    imap: ImapConfig | None = None
-
-
-class MailServerProfileUpdateRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    name: str | None = Field(default=None, max_length=255)
-    slug: str | None = Field(default=None, max_length=100)
-    description: str | None = None
-    is_active: bool | None = None
-    smtp: SmtpConfig | None = None
-    imap: ImapConfig | None = None
-    clear_imap: bool = False
-
-
-class MailServerProfileResponse(BaseModel):
-    id: str
-    tenant_id: str | None = None
-    scope_type: MailProfileScope = "tenant"
-    scope_id: str | None = None
-    name: str
-    slug: str
-    description: str | None = None
-    is_active: bool
-    smtp: dict[str, Any]
-    imap: dict[str, Any] | None = None
-    smtp_password_configured: bool = False
-    imap_password_configured: bool = False
-    created_at: datetime
-    updated_at: datetime
-
-
-class MailServerProfileListResponse(BaseModel):
-    profiles: list[MailServerProfileResponse] = Field(default_factory=list)
-
-
-class MailConnectionTestResponse(BaseModel):
-    ok: bool
-    protocol: Literal["smtp", "imap"]
-    host: str | None = None
-    port: int | None = None
-    security: str | None = None
-    message: str
-    details: dict[str, Any] = Field(default_factory=dict)
-
-
-class MailImapFolderResponse(BaseModel):
-    name: str
-    flags: list[str] = Field(default_factory=list)
-
-
-class MailImapFolderListResponse(BaseModel):
-    ok: bool
-    protocol: Literal["imap"] = "imap"
-    host: str | None = None
-    port: int | None = None
-    security: str | None = None
-    message: str
-    folders: list[MailImapFolderResponse] = Field(default_factory=list)
-    detected_sent_folder: str | None = None
-    details: dict[str, Any] = Field(default_factory=dict)
-
-
 class ApiKeyCreateRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
@@ -481,6 +494,8 @@ class QueueCampaignResponse(BaseModel):
     skipped_count: int
     blocked_count: int
     enqueued_count: int
+    delivery_mode: str = "worker_queue"
+    worker_queue_available: bool = False
     dry_run: bool = False
 
 
@@ -501,6 +516,13 @@ class SendCampaignNowResponse(BaseModel):
     result: dict[str, Any]
 
 
+class CampaignDeliveryOptionsResponse(BaseModel):
+    campaign_id: str
+    version_id: str
+    worker_queue_available: bool
+    synchronous_send: dict[str, Any] = Field(default_factory=dict)
+
+
 class MockCampaignSendRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
@@ -528,124 +550,64 @@ class AppendSentRequest(BaseModel):
 class CampaignActionResponse(BaseModel):
     result: dict[str, Any]
 
+
 class ReportEmailRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
-    to: list[str]
+    to: list[str] = Field(min_length=1, max_length=50)
     version_id: str | None = None
     include_jobs: bool = False
-    attach_jobs_csv: bool = True
+    attach_jobs_csv: bool = False
     attach_report_json: bool = False
     dry_run: bool = False
 
+    @field_validator("to", mode="before")
+    @classmethod
+    def normalize_and_validate_recipients(cls, value: Any) -> Any:
+        if not isinstance(value, list):
+            return value
+        if not 1 <= len(value) <= 50:
+            raise ValueError("report email requires between 1 and 50 recipients")
+        recipients: list[str] = []
+        seen: set[str] = set()
+        for item in value:
+            if not isinstance(item, str):
+                raise ValueError("report recipients must be email-address strings")
+            recipient = item.strip()
+            if len(recipient) > 320:
+                raise ValueError("report recipient addresses must be at most 320 characters")
+            if any(ord(character) < 32 or ord(character) == 127 for character in recipient):
+                raise ValueError("report recipient addresses must not contain control characters")
+            if recipient.count("@") != 1:
+                raise ValueError("report recipients must be email addresses")
+            local, domain = recipient.split("@", 1)
+            if (
+                not local
+                or not domain
+                or any(character.isspace() for character in recipient)
+                or any(character in ',;:<>[]()\\"' for character in recipient)
+                or local.startswith(".")
+                or local.endswith(".")
+                or ".." in local
+                or domain.startswith(".")
+                or domain.endswith(".")
+                or ".." in domain
+                or any(
+                    not label
+                    or label.startswith("-")
+                    or label.endswith("-")
+                    or not all(character.isalnum() or character == "-" for character in label)
+                    for label in domain.split(".")
+                )
+            ):
+                raise ValueError("report recipients must be email addresses")
+            key = recipient.casefold()
+            if key in seen:
+                continue
+            seen.add(key)
+            recipients.append(recipient)
+        return recipients
+
 
 class ReportEmailResponse(BaseModel):
     result: dict[str, Any]
-
-
-class AuditLogItemResponse(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
-
-    id: str
-    tenant_id: str | None = None
-    user_id: str | None = None
-    api_key_id: str | None = None
-    action: str
-    object_type: str | None = None
-    object_id: str | None = None
-    details: dict[str, Any] | None = None
-    created_at: datetime
-
-
-class AuditLogListResponse(BaseModel):
-    items: list[AuditLogItemResponse]
-
-
-
-class LoginRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    email: str
-    password: str
-    # Kept optional for backwards compatibility and future tenant-switch login flows.
-    # The WebUI no longer sends it. If omitted, the backend resolves the user by email.
-    tenant_slug: str | None = None
-
-
-
-
-class SwitchTenantRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    tenant_id: str
-
-
-class TenantInfo(BaseModel):
-    id: str
-    slug: str
-    name: str
-    is_active: bool = True
-    default_locale: str = "en"
-
-
-class TenantMembershipInfo(TenantInfo):
-    roles: list[str] = Field(default_factory=list)
-    is_active: bool = True
-
-
-class UserInfo(BaseModel):
-    id: str
-    account_id: str
-    email: str
-    # Global account identity used by the title bar and account settings.
-    display_name: str | None = None
-    # Optional tenant-local alias used in tenant administration and ownership.
-    tenant_display_name: str | None = None
-    is_tenant_admin: bool = False
-    password_reset_required: bool = False
-
-
-class ProfileUpdateRequest(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    display_name: str | None = Field(default=None, max_length=255)
-    tenant_display_name: str | None = Field(default=None, max_length=255)
-
-
-class RoleInfo(BaseModel):
-    id: str
-    slug: str
-    name: str
-    permissions: list[str] = Field(default_factory=list)
-    level: Literal["tenant", "system"] = "tenant"
-
-
-class GroupInfo(BaseModel):
-    id: str
-    slug: str
-    name: str
-
-
-class LoginResponse(BaseModel):
-    access_token: str
-    token_type: str = "bearer"
-    expires_at: datetime
-    user: UserInfo
-    # Backwards-compatible alias for the active tenant.
-    tenant: TenantInfo
-    active_tenant: TenantInfo
-    tenants: list[TenantMembershipInfo] = Field(default_factory=list)
-    scopes: list[str]
-    roles: list[RoleInfo] = Field(default_factory=list)
-    groups: list[GroupInfo] = Field(default_factory=list)
-
-
-class MeResponse(BaseModel):
-    user: UserInfo
-    # Backwards-compatible alias for the active tenant.
-    tenant: TenantInfo
-    active_tenant: TenantInfo
-    tenants: list[TenantMembershipInfo] = Field(default_factory=list)
-    scopes: list[str]
-    roles: list[RoleInfo] = Field(default_factory=list)
-    groups: list[GroupInfo] = Field(default_factory=list)

src/govoplan_campaign/backend/sending/execution.py

@@ -9,10 +9,16 @@ from pydantic import BaseModel, ConfigDict
 from sqlalchemy.orm import Session
 
 from govoplan_campaign.backend.db.models import Campaign, CampaignJob, CampaignVersion, JobValidationStatus
-from govoplan_campaign.backend.campaign.models import DeliveryConfig, ImapConfig, SmtpConfig
-from govoplan_campaign.backend.integrations import MailProfileError, mail_integration
+from govoplan_campaign.backend.campaign.models import DeliveryConfig
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    CampaignMailProfileBoundaryError,
+    assert_campaign_uses_mail_profile_reference,
+    campaign_mail_profile_id,
+)
+from govoplan_campaign.backend.integrations import MailProfileError, files_integration, mail_integration
+from govoplan_campaign.backend.path_security import CampaignPathSecurityError, assert_server_safe_campaign_paths
 
-SNAPSHOT_VERSION = "3"
+SNAPSHOT_VERSION = "5"
 
 
 class ExecutionSnapshotError(RuntimeError):
@@ -24,9 +30,9 @@ class ExecutionSnapshot(BaseModel):
 
     Rendered messages and attachment evidence remain normalized in
     ``CampaignJob`` and ``CampaignAttachmentUse``.  This record freezes the
-    mutable transport/runtime configuration and cryptographically binds it to
-    the build and the exact set of persisted jobs without duplicating all
-    recipient data into one large JSON value.
+    Mail-profile reference, delivery policy, and opaque transport revisions and
+    cryptographically binds them to the build and exact persisted jobs. Mail
+    owns the resolved transport configuration and credentials.
     """
 
     model_config = ConfigDict(extra="forbid")
@@ -34,6 +40,7 @@ class ExecutionSnapshot(BaseModel):
     snapshot_version: str = SNAPSHOT_VERSION
     campaign_version_id: str
     campaign_json_sha256: str
+    mail_profile_id: str
     created_at: str
     build_token: str | None = None
     built_at: str | None = None
@@ -41,10 +48,8 @@ class ExecutionSnapshot(BaseModel):
     queueable_job_count: int = 0
     job_manifest_sha256: str | None = None
     effective_policy_sha256: str | None = None
-    smtp_config_fingerprint: str | None = None
-    imap_config_fingerprint: str | None = None
-    smtp: SmtpConfig
-    imap: ImapConfig | None = None
+    smtp_transport_revision: str | None = None
+    imap_transport_revision: str | None = None
     delivery: DeliveryConfig
 
 
@@ -60,110 +65,50 @@ def snapshot_hash(payload: dict[str, Any]) -> str:
     return _sha256(payload)
 
 
-def _transport_fingerprint(config: SmtpConfig | ImapConfig | None) -> str | None:
-    if config is None:
-        return None
-    payload = config.model_dump(mode="json")
-    # The fingerprint is safe to expose in reports. It identifies the effective
-    # account/transport settings without incorporating or revealing the secret.
-    if "password" in payload:
-        payload["password"] = "<configured>" if payload.get("password") else None
-    return _sha256(payload)
-
-
-def _redacted_transport_config(config: SmtpConfig | ImapConfig | None) -> SmtpConfig | ImapConfig | None:
-    if config is None:
-        return None
-    payload = config.model_dump(mode="json")
-    payload["password"] = None
-    if isinstance(config, SmtpConfig):
-        return SmtpConfig.model_validate(payload)
-    return ImapConfig.model_validate(payload)
-
-
-def _transport_password_from_campaign_json(raw_json: dict[str, Any] | None, name: str) -> str | None:
-    server = raw_json.get("server") if isinstance(raw_json, dict) else None
-    credentials = server.get("credentials") if isinstance(server, dict) and isinstance(server.get("credentials"), dict) else None
-    config = credentials.get(name) if isinstance(credentials, dict) and isinstance(credentials.get(name), dict) else None
-    password = config.get("password") if isinstance(config, dict) else None
-    if password is None:
-        legacy_config = server.get(name) if isinstance(server, dict) else None
-        password = legacy_config.get("password") if isinstance(legacy_config, dict) else None
-    if password is None:
-        return None
-    return str(password)
-
-
-def _server_from_campaign_json(raw_json: dict[str, Any] | None) -> dict[str, Any]:
-    server = raw_json.get("server") if isinstance(raw_json, dict) else None
-    return server if isinstance(server, dict) else {}
-
-
-def _profile_for_version(session: Session, version: CampaignVersion):
+def profile_delivery_summary(session: Session, version: CampaignVersion) -> dict[str, Any]:
+    raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    _assert_version_mail_profile_boundary(raw_json)
     mail = mail_integration()
-    profile_id = mail.mail_profile_id_from_campaign_json(version.raw_json if isinstance(version.raw_json, dict) else {})
-    if not profile_id:
-        return None
+    profile_id = campaign_mail_profile_id(raw_json)
+    if profile_id is None:  # Kept explicit for static typing; the assertion above requires it.
+        raise ExecutionSnapshotError("Campaign has no Mail profile reference")
     campaign = session.get(Campaign, version.campaign_id)
     if campaign is None:
         raise ExecutionSnapshotError("Campaign not found for mail-server profile resolution")
     try:
-        return mail.ensure_mail_profile_allowed_for_campaign(session, tenant_id=campaign.tenant_id, campaign_id=campaign.id, profile_id=profile_id, require_active=True)
+        return mail.campaign_profile_delivery_summary(
+            session,
+            tenant_id=campaign.tenant_id,
+            campaign_id=campaign.id,
+            profile_id=profile_id,
+        )
     except MailProfileError as exc:
         raise ExecutionSnapshotError(str(exc)) from exc
 
 
-def runtime_smtp_config(session: Session, version: CampaignVersion, snapshot: ExecutionSnapshot) -> SmtpConfig:
-    payload = snapshot.smtp.model_dump(mode="json")
-    if not payload.get("password"):
-        server = _server_from_campaign_json(version.raw_json)
-        profile = _profile_for_version(session, version)
-        if profile is not None:
-            campaign = session.get(Campaign, version.campaign_id)
-            if campaign is None:
-                raise ExecutionSnapshotError("Campaign not found for mail-server profile resolution")
-            mail = mail_integration()
-            profile_payload = mail.smtp_config_from_profile(profile).model_dump(mode="json")
-            if mail.effective_profile_credentials_inherited(session, tenant_id=campaign.tenant_id, campaign_id=campaign.id, server=server, protocol="smtp"):
-                return SmtpConfig.model_validate(profile_payload)
-            return SmtpConfig.model_validate(mail.apply_campaign_credentials(profile_payload, server, "smtp"))
-        payload["password"] = _transport_password_from_campaign_json(version.raw_json, "smtp")
-    return SmtpConfig.model_validate(payload)
+def profile_transport_revisions(session: Session, version: CampaignVersion) -> dict[str, str | None]:
+    summary = profile_delivery_summary(session, version)
+    return {
+        "smtp": summary.get("smtp_transport_revision"),
+        "imap": summary.get("imap_transport_revision"),
+    }
 
 
-def runtime_imap_config(session: Session, version: CampaignVersion, snapshot: ExecutionSnapshot) -> ImapConfig | None:
-    server = _server_from_campaign_json(version.raw_json)
-    if snapshot.imap is None:
-        profile = _profile_for_version(session, version)
-        if profile is None:
-            return None
-        mail = mail_integration()
-        imap = mail.imap_config_from_profile(profile)
-        if imap is None:
-            return None
-        campaign = session.get(Campaign, version.campaign_id)
-        if campaign is None:
-            raise ExecutionSnapshotError("Campaign not found for mail-server profile resolution")
-        imap_payload = imap.model_dump(mode="json")
-        if mail.effective_profile_credentials_inherited(session, tenant_id=campaign.tenant_id, campaign_id=campaign.id, server=server, protocol="imap"):
-            return ImapConfig.model_validate(imap_payload)
-        return ImapConfig.model_validate(mail.apply_campaign_credentials(imap_payload, server, "imap"))
-    payload = snapshot.imap.model_dump(mode="json")
-    if not payload.get("password"):
-        profile = _profile_for_version(session, version)
-        if profile is not None:
-            mail = mail_integration()
-            imap = mail.imap_config_from_profile(profile)
-            if imap is not None:
-                campaign = session.get(Campaign, version.campaign_id)
-                if campaign is None:
-                    raise ExecutionSnapshotError("Campaign not found for mail-server profile resolution")
-                imap_payload = imap.model_dump(mode="json")
-                if mail.effective_profile_credentials_inherited(session, tenant_id=campaign.tenant_id, campaign_id=campaign.id, server=server, protocol="imap"):
-                    return ImapConfig.model_validate(imap_payload)
-                return ImapConfig.model_validate(mail.apply_campaign_credentials(imap_payload, server, "imap"))
-        payload["password"] = _transport_password_from_campaign_json(version.raw_json, "imap")
-    return ImapConfig.model_validate(payload)
+def _assert_snapshot_profile_matches_version(version: CampaignVersion, snapshot: ExecutionSnapshot) -> None:
+    raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    _assert_version_mail_profile_boundary(raw_json)
+    if campaign_mail_profile_id(raw_json) != snapshot.mail_profile_id:
+        raise ExecutionSnapshotError(
+            "The campaign's Mail profile reference differs from the built execution snapshot. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+
+
+def _assert_version_mail_profile_boundary(raw_json: dict[str, Any]) -> None:
+    try:
+        assert_campaign_uses_mail_profile_reference(raw_json, require_profile=True)
+    except CampaignMailProfileBoundaryError as exc:
+        raise ExecutionSnapshotError(str(exc)) from exc
 
 
 def _policy_fingerprint(raw_json: dict[str, Any], delivery: DeliveryConfig) -> str:
@@ -179,68 +124,143 @@ def _policy_fingerprint(raw_json: dict[str, Any], delivery: DeliveryConfig) -> s
     )
 
 
+def _job_execution_input_payload(job: CampaignJob) -> dict[str, Any]:
+    return {
+        "job_id": job.id,
+        "entry_index": job.entry_index,
+        "entry_id": job.entry_id,
+        "recipient_email": job.recipient_email,
+        "subject": job.subject,
+        "message_id_header": job.message_id_header,
+        "eml_size_bytes": job.eml_size_bytes,
+        "eml_sha256": job.eml_sha256,
+        "build_status": job.build_status,
+        "validation_status": job.validation_status,
+        "resolved_recipients_sha256": _sha256(job.resolved_recipients or {}),
+        "resolved_attachments_sha256": _sha256(job.resolved_attachments or []),
+        "issues_sha256": _sha256(job.issues_snapshot or []),
+    }
+
+
+def job_execution_input_hash(job: CampaignJob) -> str:
+    return _sha256(_job_execution_input_payload(job))
+
+
 def job_manifest_hash(jobs: Iterable[CampaignJob]) -> str:
     """Hash the immutable per-message execution records in stable order."""
 
-    payload: list[dict[str, Any]] = []
-    for job in sorted(jobs, key=lambda item: (item.entry_index, item.id)):
-        payload.append(
-            {
-                "job_id": job.id,
-                "entry_index": job.entry_index,
-                "entry_id": job.entry_id,
-                "recipient_email": job.recipient_email,
-                "subject": job.subject,
-                "message_id_header": job.message_id_header,
-                "eml_size_bytes": job.eml_size_bytes,
-                "eml_sha256": job.eml_sha256,
-                "build_status": job.build_status,
-                "validation_status": job.validation_status,
-                "resolved_recipients_sha256": _sha256(job.resolved_recipients or {}),
-                "resolved_attachments_sha256": _sha256(job.resolved_attachments or []),
-                "issues_sha256": _sha256(job.issues_snapshot or []),
-            }
-        )
+    payload = [
+        _job_execution_input_payload(job)
+        for job in sorted(jobs, key=lambda item: (item.entry_index, item.id))
+    ]
     return _sha256(payload)
 
 
 def create_execution_snapshot(
     version: CampaignVersion,
     *,
-    smtp: SmtpConfig,
-    imap: ImapConfig | None,
+    mail_profile_id: str,
+    smtp_transport_revision: str,
+    imap_transport_revision: str | None,
     delivery: DeliveryConfig,
     jobs: Iterable[CampaignJob] = (),
     build_summary: dict[str, Any] | None = None,
 ) -> tuple[dict[str, Any], str]:
     raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
     job_list = list(jobs)
+    for job in job_list:
+        job.execution_input_sha256 = job_execution_input_hash(job)
     summary = build_summary if isinstance(build_summary, dict) else {}
     queueable_statuses = {JobValidationStatus.READY.value, JobValidationStatus.WARNING.value}
-    redacted_smtp = _redacted_transport_config(smtp)
-    redacted_imap = _redacted_transport_config(imap)
-    assert isinstance(redacted_smtp, SmtpConfig)
-    assert redacted_imap is None or isinstance(redacted_imap, ImapConfig)
     payload = ExecutionSnapshot(
         campaign_version_id=version.id,
         campaign_json_sha256=_sha256(raw_json),
+        mail_profile_id=mail_profile_id,
         build_token=str(summary.get("build_token") or "") or None,
         built_at=str(summary.get("built_at") or "") or None,
         job_count=len(job_list),
         queueable_job_count=sum(1 for job in job_list if job.validation_status in queueable_statuses),
         job_manifest_sha256=job_manifest_hash(job_list) if job_list else None,
         effective_policy_sha256=_policy_fingerprint(raw_json, delivery),
-        smtp_config_fingerprint=_transport_fingerprint(smtp),
-        imap_config_fingerprint=_transport_fingerprint(imap),
+        smtp_transport_revision=smtp_transport_revision,
+        imap_transport_revision=imap_transport_revision,
         created_at=datetime.now(timezone.utc).isoformat(),
-        smtp=redacted_smtp,
-        imap=redacted_imap,
         delivery=delivery,
     ).model_dump(mode="json")
     return payload, snapshot_hash(payload)
 
 
-def ensure_execution_snapshot(session: Session, version: CampaignVersion) -> ExecutionSnapshot:
+def _assert_snapshot_matches_persisted_inputs(
+    session: Session,
+    version: CampaignVersion,
+    snapshot: ExecutionSnapshot,
+    *,
+    effect_job: CampaignJob | None = None,
+) -> None:
+    """Fail closed when any build-bound input drifted after snapshot creation."""
+
+    raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    if snapshot.campaign_version_id != version.id:
+        raise ExecutionSnapshotError("Execution snapshot campaign version mismatch")
+    if snapshot.campaign_json_sha256 != _sha256(raw_json):
+        raise ExecutionSnapshotError(
+            "Campaign inputs changed after this execution snapshot was built. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+    if not snapshot.smtp_transport_revision:
+        raise ExecutionSnapshotError("Execution snapshot has no SMTP transport revision")
+    if not snapshot.job_manifest_sha256:
+        raise ExecutionSnapshotError("Execution snapshot has no built-job manifest checksum")
+    if not snapshot.effective_policy_sha256:
+        raise ExecutionSnapshotError("Execution snapshot has no effective-policy checksum")
+    if snapshot.effective_policy_sha256 != _policy_fingerprint(raw_json, snapshot.delivery):
+        raise ExecutionSnapshotError(
+            "Campaign delivery policy changed after the execution snapshot was created. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+
+    if effect_job is not None:
+        if effect_job.campaign_version_id != version.id:
+            raise ExecutionSnapshotError("Campaign job does not belong to the snapshotted version")
+        if not getattr(effect_job, "execution_input_sha256", None):
+            raise ExecutionSnapshotError("Campaign job has no execution-input checksum; rebuild before delivery")
+        if effect_job.execution_input_sha256 != job_execution_input_hash(effect_job):
+            raise ExecutionSnapshotError(
+                "Built campaign job inputs changed after the execution snapshot was created. "
+                "Revalidate and rebuild the campaign before delivery."
+            )
+        return
+
+    jobs = (
+        session.query(CampaignJob)
+        .filter(CampaignJob.campaign_version_id == version.id)
+        .order_by(CampaignJob.entry_index.asc(), CampaignJob.id.asc())
+        .all()
+    )
+    queueable_statuses = {JobValidationStatus.READY.value, JobValidationStatus.WARNING.value}
+    if snapshot.job_count != len(jobs):
+        raise ExecutionSnapshotError(
+            "Built campaign jobs changed after the execution snapshot was created. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+    queueable_count = sum(1 for job in jobs if job.validation_status in queueable_statuses)
+    if (
+        snapshot.queueable_job_count != queueable_count
+        or snapshot.job_manifest_sha256 != job_manifest_hash(jobs)
+        or any(getattr(job, "execution_input_sha256", None) != job_execution_input_hash(job) for job in jobs)
+    ):
+        raise ExecutionSnapshotError(
+            "Built campaign job inputs changed after the execution snapshot was created. "
+            "Revalidate and rebuild the campaign before delivery."
+        )
+
+
+def ensure_execution_snapshot(
+    session: Session,
+    version: CampaignVersion,
+    *,
+    effect_job: CampaignJob | None = None,
+) -> ExecutionSnapshot:
     """Return a validated snapshot, creating one for pre-migration builds.
 
     New builds create the snapshot after persisting their jobs. The fallback is
@@ -248,19 +268,46 @@ def ensure_execution_snapshot(session: Session, version: CampaignVersion) -> Exe
     without a manual data migration.
     """
 
+    raw_json = version.raw_json if isinstance(version.raw_json, dict) else {}
+    try:
+        assert_server_safe_campaign_paths(
+            raw_json,
+            managed_files_available=files_integration().available,
+        )
+    except CampaignPathSecurityError as exc:
+        raise ExecutionSnapshotError(str(exc)) from exc
+    _assert_version_mail_profile_boundary(raw_json)
+
     if isinstance(version.execution_snapshot, dict):
+        if str(version.execution_snapshot.get("snapshot_version") or "") != SNAPSHOT_VERSION:
+            raise ExecutionSnapshotError(
+                "This campaign has a legacy execution snapshot that may contain campaign-owned transport data. "
+                "It is preserved for audit only and cannot be delivered; select a Mail profile, then revalidate "
+                "and rebuild a new campaign version."
+            )
         snapshot = ExecutionSnapshot.model_validate(version.execution_snapshot)
         expected = snapshot_hash(snapshot.model_dump(mode="json"))
-        if version.execution_snapshot_hash and version.execution_snapshot_hash != expected:
+        if not version.execution_snapshot_hash:
+            raise ExecutionSnapshotError("Execution snapshot checksum is missing")
+        if version.execution_snapshot_hash != expected:
             raise ExecutionSnapshotError("Execution snapshot checksum mismatch")
+        _assert_snapshot_profile_matches_version(version, snapshot)
+        _assert_snapshot_matches_persisted_inputs(
+            session,
+            version,
+            snapshot,
+            effect_job=effect_job,
+        )
         return snapshot
 
     from govoplan_campaign.backend.persistence.campaigns import load_version_config
 
     _, _, config = load_version_config(session, version.id)
-    runtime_smtp = config.server.runtime_smtp_config()
-    if not runtime_smtp:
-        raise ExecutionSnapshotError("Campaign has no SMTP configuration")
+    profile_id = campaign_mail_profile_id(raw_json)
+    if not config.server.profile_capabilities.smtp_available:
+        raise ExecutionSnapshotError("The selected Mail profile has no SMTP configuration")
+    if profile_id is None:
+        raise ExecutionSnapshotError("Campaign has no Mail profile reference")
     jobs = (
         session.query(CampaignJob)
         .filter(CampaignJob.campaign_version_id == version.id)
@@ -269,10 +316,14 @@ def ensure_execution_snapshot(session: Session, version: CampaignVersion) -> Exe
     )
     if not jobs:
         raise ExecutionSnapshotError("Campaign version has no built jobs; rebuild it before delivery")
+    revisions = profile_transport_revisions(session, version)
+    if not revisions["smtp"]:
+        raise ExecutionSnapshotError("The selected Mail profile has no SMTP transport revision")
     payload, digest = create_execution_snapshot(
         version,
-        smtp=runtime_smtp,
-        imap=config.server.runtime_imap_config(),
+        mail_profile_id=profile_id,
+        smtp_transport_revision=revisions["smtp"],
+        imap_transport_revision=revisions["imap"],
         delivery=config.delivery,
         jobs=jobs,
         build_summary=version.build_summary if isinstance(version.build_summary, dict) else {},

src/govoplan_campaign/backend/services/zip_service.py

@@ -1,8 +1,14 @@
 from __future__ import annotations
 
+import binascii
+from datetime import datetime
+import secrets
+import stat
+import struct
 import zipfile
 from pathlib import Path
 from typing import Iterable
+import zlib
 
 try:
     import pyzipper
@@ -10,6 +16,8 @@ except ImportError:  # pragma: no cover
     pyzipper = None
 
 ArchiveMember = tuple[Path, str]
+ZIP_METHOD_AES = "aes"
+ZIP_METHOD_STANDARD = "zip_standard"
 
 
 def _normalized_members(files: Iterable[Path | ArchiveMember]) -> list[ArchiveMember]:
@@ -33,24 +41,18 @@ def _normalized_members(files: Iterable[Path | ArchiveMember]) -> list[ArchiveMe
 def create_zip_archive(
     output_path: Path,
     files: Iterable[Path | ArchiveMember],
-    password: str = "",
+    password: str = "",  # nosec B107 - empty means an unencrypted archive.
+    method: str = ZIP_METHOD_AES,
 ) -> Path:
-    """Create a ZIP archive, using AES encryption when a password is supplied."""
+    """Create a ZIP archive, optionally using AES or legacy ZipCrypto encryption."""
 
     output_path.parent.mkdir(parents=True, exist_ok=True)
     members = _normalized_members(files)
     if password:
-        if pyzipper is None:
-            raise RuntimeError("pyzipper is required for writing password-protected ZIP files")
-        with pyzipper.AESZipFile(
-            output_path,
-            "w",
-            compression=pyzipper.ZIP_DEFLATED,
-            encryption=pyzipper.WZ_AES,
-        ) as zip_file:
-            zip_file.setpassword(password.encode("utf-8"))
-            for file_path, archive_name in members:
-                zip_file.write(file_path, arcname=archive_name)
+        if method == ZIP_METHOD_STANDARD:
+            _create_zipcrypto_archive(output_path, members, password)
+            return output_path
+        _create_aes_archive(output_path, members, password)
         return output_path
 
     with zipfile.ZipFile(output_path, "w", compression=zipfile.ZIP_DEFLATED) as zip_file:
@@ -59,7 +61,214 @@ def create_zip_archive(
     return output_path
 
 
-def create_encrypted_zip(output_path: Path, files: list[Path], password: str) -> Path:
+def create_encrypted_zip(output_path: Path, files: list[Path], password: str, method: str = ZIP_METHOD_AES) -> Path:
     """Backward-compatible wrapper for the original per-rule ZIP helper."""
 
-    return create_zip_archive(output_path, files, password)
+    return create_zip_archive(output_path, files, password, method)
+
+
+def _create_aes_archive(output_path: Path, members: list[ArchiveMember], password: str) -> None:
+    if pyzipper is None:
+        raise RuntimeError("pyzipper is required for writing AES password-protected ZIP files")
+    with pyzipper.AESZipFile(
+        output_path,
+        "w",
+        compression=pyzipper.ZIP_DEFLATED,
+        encryption=pyzipper.WZ_AES,
+    ) as zip_file:
+        zip_file.setpassword(password.encode("utf-8"))
+        for file_path, archive_name in members:
+            zip_file.write(file_path, arcname=archive_name)
+
+
+def _create_zipcrypto_archive(output_path: Path, members: list[ArchiveMember], password: str) -> None:
+    entries: list[_CentralDirectoryEntry] = []
+    password_bytes = password.encode("utf-8")
+    with output_path.open("wb") as zip_file:
+        for file_path, archive_name in members:
+            local_header_offset = zip_file.tell()
+            file_data = file_path.read_bytes()
+            crc = binascii.crc32(file_data) & 0xFFFFFFFF
+            compressed_data = _deflate(file_data)
+            encrypted_data = _zipcrypto_encrypt(compressed_data, password_bytes, crc)
+            compressed_size = len(encrypted_data)
+            uncompressed_size = len(file_data)
+            modified_at = datetime.fromtimestamp(file_path.stat().st_mtime)
+            dos_time, dos_date = _dos_timestamp(modified_at)
+            filename_bytes, flags = _filename_bytes(archive_name, encrypted=True)
+
+            zip_file.write(
+                struct.pack(
+                    "<IHHHHHIIIHH",
+                    0x04034B50,
+                    20,
+                    flags,
+                    zipfile.ZIP_DEFLATED,
+                    dos_time,
+                    dos_date,
+                    crc,
+                    compressed_size,
+                    uncompressed_size,
+                    len(filename_bytes),
+                    0,
+                )
+            )
+            zip_file.write(filename_bytes)
+            zip_file.write(encrypted_data)
+            entries.append(
+                _CentralDirectoryEntry(
+                    filename_bytes=filename_bytes,
+                    flags=flags,
+                    dos_time=dos_time,
+                    dos_date=dos_date,
+                    crc=crc,
+                    compressed_size=compressed_size,
+                    uncompressed_size=uncompressed_size,
+                    external_attributes=_external_attributes(file_path),
+                    local_header_offset=local_header_offset,
+                )
+            )
+
+        central_directory_offset = zip_file.tell()
+        for entry in entries:
+            zip_file.write(
+                struct.pack(
+                    "<IHHHHHHIIIHHHHHII",
+                    0x02014B50,
+                    20,
+                    20,
+                    entry.flags,
+                    zipfile.ZIP_DEFLATED,
+                    entry.dos_time,
+                    entry.dos_date,
+                    entry.crc,
+                    entry.compressed_size,
+                    entry.uncompressed_size,
+                    len(entry.filename_bytes),
+                    0,
+                    0,
+                    0,
+                    0,
+                    entry.external_attributes,
+                    entry.local_header_offset,
+                )
+            )
+            zip_file.write(entry.filename_bytes)
+
+        central_directory_size = zip_file.tell() - central_directory_offset
+        zip_file.write(
+            struct.pack(
+                "<IHHHHIIH",
+                0x06054B50,
+                0,
+                0,
+                len(entries),
+                len(entries),
+                central_directory_size,
+                central_directory_offset,
+                0,
+            )
+        )
+
+
+class _CentralDirectoryEntry:
+    def __init__(
+        self,
+        *,
+        filename_bytes: bytes,
+        flags: int,
+        dos_time: int,
+        dos_date: int,
+        crc: int,
+        compressed_size: int,
+        uncompressed_size: int,
+        external_attributes: int,
+        local_header_offset: int,
+    ) -> None:
+        self.filename_bytes = filename_bytes
+        self.flags = flags
+        self.dos_time = dos_time
+        self.dos_date = dos_date
+        self.crc = crc
+        self.compressed_size = compressed_size
+        self.uncompressed_size = uncompressed_size
+        self.external_attributes = external_attributes
+        self.local_header_offset = local_header_offset
+
+
+def _deflate(data: bytes) -> bytes:
+    compressor = zlib.compressobj(zlib.Z_DEFAULT_COMPRESSION, zlib.DEFLATED, -zlib.MAX_WBITS)
+    return compressor.compress(data) + compressor.flush()
+
+
+def _zipcrypto_encrypt(data: bytes, password: bytes, crc: int) -> bytes:
+    cipher = _ZipCrypto(password)
+    header = secrets.token_bytes(11) + bytes([(crc >> 24) & 0xFF])
+    return cipher.encrypt(header + data)
+
+
+class _ZipCrypto:
+    def __init__(self, password: bytes) -> None:
+        self.key0 = 0x12345678
+        self.key1 = 0x23456789
+        self.key2 = 0x34567890
+        for value in password:
+            self._update_keys(value)
+
+    def encrypt(self, data: bytes) -> bytes:
+        encrypted = bytearray()
+        for value in data:
+            encrypted.append(value ^ self._decrypt_byte())
+            self._update_keys(value)
+        return bytes(encrypted)
+
+    def _decrypt_byte(self) -> int:
+        temp = self.key2 | 2
+        return ((temp * (temp ^ 1)) >> 8) & 0xFF
+
+    def _update_keys(self, value: int) -> None:
+        self.key0 = _zipcrypto_crc32_byte(value, self.key0)
+        self.key1 = (self.key1 + (self.key0 & 0xFF)) & 0xFFFFFFFF
+        self.key1 = (self.key1 * 134775813 + 1) & 0xFFFFFFFF
+        self.key2 = _zipcrypto_crc32_byte((self.key1 >> 24) & 0xFF, self.key2)
+
+
+def _build_zipcrypto_crc(value: int) -> int:
+    for _ in range(8):
+        if value & 1:
+            value = 0xEDB88320 ^ (value >> 1)
+        else:
+            value >>= 1
+    return value
+
+
+_ZIPCRYPTO_CRC_TABLE = [_build_zipcrypto_crc(value) for value in range(256)]
+
+
+def _zipcrypto_crc32_byte(value: int, crc: int) -> int:
+    return ((crc >> 8) ^ _ZIPCRYPTO_CRC_TABLE[(crc ^ value) & 0xFF]) & 0xFFFFFFFF
+
+
+def _filename_bytes(filename: str, *, encrypted: bool) -> tuple[bytes, int]:
+    flags = 0x1 if encrypted else 0
+    try:
+        return filename.encode("ascii"), flags
+    except UnicodeEncodeError:
+        return filename.encode("utf-8"), flags | 0x800
+
+
+def _dos_timestamp(value: datetime) -> tuple[int, int]:
+    year = min(max(value.year, 1980), 2107)
+    month = value.month if value.year == year else 1
+    day = value.day if value.year == year else 1
+    dos_time = value.hour << 11 | value.minute << 5 | value.second // 2
+    dos_date = (year - 1980) << 9 | month << 5 | day
+    return dos_time, dos_date
+
+
+def _external_attributes(path: Path) -> int:
+    try:
+        permissions = stat.S_IMODE(path.stat().st_mode)
+    except OSError:
+        return 0
+    return permissions << 16

src/govoplan_campaign/backend/template_rendering.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from typing import Any
+
+
+_DOLLAR_FIELD_PATTERN = re.compile(r"(?<!\\)\$\{(.*?)(?<!\\)\}")
+_BRACE_FIELD_PATTERN = re.compile(r"(?<!\\)\{\{\s*(.*?)\s*\}\}")
+
+
+def normalize_template_key(raw: str) -> str:
+    key = raw.strip()
+    if key.startswith("fields."):
+        key = key.removeprefix("fields.")
+    elif key.startswith("local."):
+        key = "local::" + key.removeprefix("local.")
+    elif key.startswith("global."):
+        key = "global::" + key.removeprefix("global.")
+
+    if key.startswith("local::") or key.startswith("global::"):
+        return key
+    if key.startswith("local:"):
+        return "local::" + key.removeprefix("local:")
+    if key.startswith("global:"):
+        return "global::" + key.removeprefix("global:")
+    return key
+
+
+def render_template(
+    template: str,
+    values: Mapping[str, Any],
+    *,
+    keep_missing: bool = True,
+) -> str:
+    def replace(match: re.Match[str]) -> str:
+        key = normalize_template_key(match.group(1))
+        if key in values:
+            value = values[key]
+            return "" if value is None else str(value)
+        return match.group(0) if keep_missing else ""
+
+    rendered = _DOLLAR_FIELD_PATTERN.sub(replace, template)
+    rendered = _BRACE_FIELD_PATTERN.sub(replace, rendered)
+    return rendered.replace(r"\${", "${").replace(r"\}", "}")
+
+
+def find_unresolved_placeholders(text: str | None) -> set[str]:
+    if not text:
+        return set()
+    return {
+        normalize_template_key(match.group(1))
+        for pattern in (_DOLLAR_FIELD_PATTERN, _BRACE_FIELD_PATTERN)
+        for match in pattern.finditer(text)
+    }

tests/test_access_provider.py

@@ -21,6 +21,7 @@ GROUP_ID = "group-1"
 class CampaignAccessProviderTests(unittest.TestCase):
     def test_campaign_access_provider_explains_owner_share_admin_and_missing_resources(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         owned = Campaign(id="campaign-owned", tenant_id=TENANT_ID, owner_user_id=USER_ID, external_id="owned", name="Owned campaign")
         shared = Campaign(id="campaign-shared", tenant_id=TENANT_ID, owner_user_id=OTHER_USER_ID, external_id="shared", name="Shared campaign")
@@ -46,6 +47,7 @@ class CampaignAccessProviderTests(unittest.TestCase):
 
     def test_campaign_access_provider_requires_write_share_for_write_actions(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         campaign = Campaign(id="campaign-write", tenant_id=TENANT_ID, owner_user_id=OTHER_USER_ID, external_id="write", name="Write campaign")
         session.add_all([
@@ -74,6 +76,12 @@ def _session():
     return sessionmaker(bind=engine, future=True)()
 
 
+def _close_session(session) -> None:
+    engine = session.get_bind()
+    session.close()
+    engine.dispose()
+
+
 def _seed_access_subjects(session) -> None:
     session.add_all([
         Account(id="account-1", email="one@example.test", normalized_email="one@example.test"),

tests/test_aggregate_report.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from types import SimpleNamespace
+
+import pytest
+
+from govoplan_campaign.backend.report_privacy_policy import (
+    CampaignReportPrivacyPolicy,
+    CampaignReportPrivacyPolicyError,
+    DEFAULT_SMALL_CELL_THRESHOLD,
+    effective_campaign_report_privacy_policy,
+)
+from govoplan_campaign.backend.reports.aggregate import build_aggregate_campaign_report
+
+
+class _PolicySession:
+    def __init__(self, settings: dict[str, object] | None = None) -> None:
+        self.tenant = SimpleNamespace(settings=settings or {})
+
+    def get(self, _model, _id):
+        return self.tenant
+
+
+def _policy(threshold: int = 5) -> CampaignReportPrivacyPolicy:
+    return CampaignReportPrivacyPolicy(
+        small_cell_threshold=threshold,
+        source="test",
+        deployment_small_cell_threshold=threshold,
+    )
+
+
+def _campaign() -> SimpleNamespace:
+    now = datetime(2026, 7, 22, 8, 0, tzinfo=UTC)
+    return SimpleNamespace(
+        id="campaign-safe",
+        tenant_id="tenant-safe",
+        external_id="must-not-leak-external-id",
+        name="Semester notification",
+        description="Business-safe description",
+        status="partially_completed",
+        owner_user_id="must-not-leak-owner",
+        current_version_id="must-not-leak-version-id",
+        updated_at=now,
+    )
+
+
+def _version(*, inactive_count: int = 0) -> SimpleNamespace:
+    return SimpleNamespace(
+        id="must-not-leak-version-id",
+        version_number=7,
+        build_summary={"inactive_count": inactive_count, "build_token": "must-not-leak-token"},
+        execution_snapshot={"smtp": {"password": "must-not-leak-secret"}},
+        raw_json={"entries": [{"email": "must-not-leak@example.test"}]},
+    )
+
+
+def _job(index: int, send_status: str, **overrides: object) -> SimpleNamespace:
+    started = datetime(2026, 7, 22, 8, 0, tzinfo=UTC) + timedelta(minutes=index)
+    values: dict[str, object] = {
+        "id": f"job-{index}",
+        "recipient_email": f"private-{index}@example.test",
+        "subject": f"Personal subject {index}",
+        "last_error": "smtp.internal.example provider-secret",
+        "resolved_attachments": [{"storage_key": f"private/{index}"}],
+        "send_status": send_status,
+        "validation_status": "ready",
+        "build_status": "built",
+        "queued_at": started,
+        "smtp_started_at": started,
+        "sent_at": started if send_status in {"smtp_accepted", "sent"} else None,
+        "outcome_unknown_at": started if send_status == "outcome_unknown" else None,
+    }
+    values.update(overrides)
+    return SimpleNamespace(**values)
+
+
+def test_aggregate_projection_has_a_strict_recipient_free_shape() -> None:
+    jobs = [
+        *[_job(index, "smtp_accepted") for index in range(10)],
+        *[_job(index + 10, "failed_permanent") for index in range(5)],
+    ]
+
+    payload = build_aggregate_campaign_report(
+        campaign=_campaign(),  # type: ignore[arg-type]
+        version=_version(inactive_count=5),  # type: ignore[arg-type]
+        jobs=jobs,  # type: ignore[arg-type]
+        policy=_policy(),
+        generated_at=datetime(2026, 7, 22, 12, 0, tzinfo=UTC),
+    ).model_dump(mode="json")
+
+    assert set(payload) == {
+        "generated_at",
+        "campaign",
+        "version_number",
+        "completion_state",
+        "population",
+        "outcomes",
+        "time_range",
+        "privacy",
+    }
+    assert set(payload["campaign"]) == {"id", "name", "status"}
+    assert payload["population"]["denominator"] == {"value": 15, "suppressed": False}
+    assert payload["outcomes"]["smtp_accepted"] == {"value": 10, "suppressed": False}
+    assert payload["outcomes"]["failed"] == {"value": 5, "suppressed": False}
+    assert payload["completion_state"] == "partially_completed"
+    serialized = repr(payload)
+    for forbidden in (
+        "private-0@example.test",
+        "Personal subject",
+        "smtp.internal.example",
+        "provider-secret",
+        "storage_key",
+        "must-not-leak",
+        "Business-safe description",
+        "job-0",
+    ):
+        assert forbidden not in serialized
+
+
+def test_small_cells_use_primary_and_complementary_suppression() -> None:
+    jobs = [
+        *[_job(index, "smtp_accepted") for index in range(8)],
+        _job(8, "failed_permanent"),
+    ]
+
+    report = build_aggregate_campaign_report(
+        campaign=_campaign(),  # type: ignore[arg-type]
+        version=_version(inactive_count=1),  # type: ignore[arg-type]
+        jobs=jobs,  # type: ignore[arg-type]
+        policy=_policy(5),
+    )
+
+    assert report.population.denominator.value == 9
+    assert report.outcomes.failed.suppressed is True
+    assert report.outcomes.failed.value is None
+    assert report.outcomes.smtp_accepted.suppressed is True
+    assert report.outcomes.smtp_accepted.value is None
+    assert report.population.inactive_source_entries.suppressed is True
+    assert report.time_range.suppressed is True
+    assert report.privacy.suppression_applied is True
+
+
+def test_outcome_suppression_also_hides_overlapping_population_count() -> None:
+    jobs = [
+        *[
+            _job(
+                index,
+                "smtp_accepted",
+                validation_status="blocked" if index < 4 else "ready",
+            )
+            for index in range(8)
+        ],
+        _job(8, "skipped", validation_status="excluded"),
+    ]
+
+    report = build_aggregate_campaign_report(
+        campaign=_campaign(),  # type: ignore[arg-type]
+        version=_version(inactive_count=5),  # type: ignore[arg-type]
+        jobs=jobs,  # type: ignore[arg-type]
+        policy=_policy(5),
+    )
+
+    assert report.outcomes.excluded.suppressed is True
+    assert report.population.excluded_or_blocked_jobs.model_dump() == {
+        "value": None,
+        "suppressed": True,
+    }
+    # Source entries without jobs are outside the outcome denominator and do
+    # not overlap the suppressed partition, so their threshold-safe count stays visible.
+    assert report.population.inactive_source_entries.model_dump() == {
+        "value": 5,
+        "suppressed": False,
+    }
+
+
+def test_all_small_cells_also_suppress_the_denominator_and_state() -> None:
+    jobs = [_job(0, "smtp_accepted"), _job(1, "failed_permanent")]
+
+    report = build_aggregate_campaign_report(
+        campaign=_campaign(),  # type: ignore[arg-type]
+        version=_version(),  # type: ignore[arg-type]
+        jobs=jobs,  # type: ignore[arg-type]
+        policy=_policy(5),
+    )
+
+    assert report.population.denominator.model_dump() == {"value": None, "suppressed": True}
+    assert report.completion_state == "suppressed"
+    assert report.outcomes.smtp_accepted.value is None
+    assert report.outcomes.failed.value is None
+
+
+def test_explicitly_skipped_jobs_are_exclusions_not_unattempted_outcomes() -> None:
+    jobs = [_job(index, "skipped") for index in range(5)]
+
+    report = build_aggregate_campaign_report(
+        campaign=_campaign(),  # type: ignore[arg-type]
+        version=_version(),  # type: ignore[arg-type]
+        jobs=jobs,  # type: ignore[arg-type]
+        policy=_policy(5),
+    )
+
+    assert report.outcomes.excluded.value == 5
+    assert report.outcomes.not_attempted.value == 0
+    assert report.completion_state == "not_started"
+
+
+def test_report_privacy_policy_defaults_to_five_and_tenant_can_only_strengthen() -> None:
+    default = effective_campaign_report_privacy_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={},
+    )
+    assert default.small_cell_threshold == DEFAULT_SMALL_CELL_THRESHOLD == 5
+    assert default.source == "deployment_default"
+
+    strengthened = effective_campaign_report_privacy_policy(
+        _PolicySession(
+            {"campaign_report_privacy_policy": {"small_cell_threshold": 10}}
+        ),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_REPORT_SMALL_CELL_THRESHOLD": "5"},
+    )
+    assert strengthened.small_cell_threshold == 10
+    assert strengthened.source == "tenant"
+
+    floor = effective_campaign_report_privacy_policy(
+        _PolicySession(
+            {"campaign_report_privacy_policy": {"small_cell_threshold": 3}}
+        ),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_REPORT_SMALL_CELL_THRESHOLD": "7"},
+    )
+    assert floor.small_cell_threshold == 7
+    assert floor.source == "deployment_floor"
+
+
+@pytest.mark.parametrize("value", [True, 0, 1, 101, "2.5", "disabled"])
+def test_invalid_report_privacy_policy_fails_closed(value: object) -> None:
+    with pytest.raises(CampaignReportPrivacyPolicyError):
+        effective_campaign_report_privacy_policy(
+            _PolicySession(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            environ={"GOVOPLAN_CAMPAIGN_REPORT_SMALL_CELL_THRESHOLD": value},  # type: ignore[dict-item]
+        )

tests/test_aggregate_report_routes.py

@@ -0,0 +1,199 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_access.backend.db.models import Account, Group, User
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.db.models import Campaign, CampaignJob, CampaignVersion
+from govoplan_campaign.backend.reports.aggregate import (
+    AggregateCampaignReportError,
+    generate_aggregate_campaign_report,
+)
+from govoplan_campaign.backend.schemas import ReportEmailRequest
+from govoplan_core.core.change_sequence import ChangeSequenceEntry
+from govoplan_core.db.base import Base
+from govoplan_core.tenancy.scope import Tenant, create_scope_tables
+
+
+class _Principal:
+    def __init__(self, *scopes: str, tenant_id: str = "tenant-1") -> None:
+        self.scopes = set(scopes)
+        self.tenant_id = tenant_id
+        self.user = SimpleNamespace(id="reader-1")
+
+    def has(self, scope: str) -> bool:
+        return scope in self.scopes
+
+
+def test_full_report_and_job_detail_reject_aggregate_only_principal() -> None:
+    principal = _Principal("campaigns:report:read")
+    session = Mock()
+    campaign = SimpleNamespace(id="campaign-1", tenant_id="tenant-1")
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        pytest.raises(HTTPException) as full_report_denied,
+    ):
+        router.campaign_report(
+            "campaign-1",
+            session=session,
+            principal=principal,  # type: ignore[arg-type]
+        )
+    assert full_report_denied.value.status_code == 403
+    assert "campaigns:recipient:read" in full_report_denied.value.detail
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        pytest.raises(HTTPException) as job_detail_denied,
+    ):
+        router.get_job_detail(
+            "campaign-1",
+            "job-1",
+            session=session,
+            principal=principal,  # type: ignore[arg-type]
+        )
+    assert job_detail_denied.value.status_code == 403
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        pytest.raises(HTTPException) as report_email_denied,
+    ):
+        router.email_campaign_report(
+            "campaign-1",
+            ReportEmailRequest(to=["auditor@example.test"]),
+            session=session,
+            principal=_Principal("campaigns:report:send"),  # type: ignore[arg-type]
+        )
+    assert report_email_denied.value.status_code == 403
+    assert "campaigns:recipient:export" in report_email_denied.value.detail
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        pytest.raises(HTTPException) as diagnostics_denied,
+    ):
+        router.get_job_diagnostics(
+            "campaign-1",
+            "job-1",
+            session=session,
+            principal=_Principal("campaigns:diagnostic:read"),  # type: ignore[arg-type]
+        )
+    assert diagnostics_denied.value.status_code == 403
+    assert "campaigns:recipient:read" in diagnostics_denied.value.detail
+
+
+def test_aggregate_route_uses_only_the_safe_projection() -> None:
+    principal = _Principal("campaigns:report:read")
+    session = Mock()
+    safe_projection = Mock()
+
+    with (
+        patch.object(router, "_get_campaign_for_principal") as acl,
+        patch.object(
+            router,
+            "generate_aggregate_campaign_report",
+            return_value=safe_projection,
+        ) as generate,
+    ):
+        result = router.aggregate_campaign_report(
+            "campaign-1",
+            session=session,
+            principal=principal,  # type: ignore[arg-type]
+        )
+
+    assert result is safe_projection
+    acl.assert_called_once_with(session, "campaign-1", principal)
+    generate.assert_called_once_with(
+        session,
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        version_id=None,
+    )
+
+
+@pytest.mark.parametrize("path", ["/campaigns/aggregate-reports", "/campaigns/aggregate-reports/{campaign_id}"])
+def test_aggregate_routes_require_report_read_permission(path: str) -> None:
+    route = next(item for item in router.router.routes if item.path == path)
+    dependency = next(item for item in route.dependant.dependencies if item.name == "principal")
+
+    with pytest.raises(HTTPException) as denied:
+        dependency.call(_Principal())
+    assert denied.value.status_code == 403
+
+    principal = _Principal("campaigns:report:read")
+    assert dependency.call(principal) is principal
+
+
+def test_aggregate_projection_is_tenant_isolated_and_needs_no_optional_module() -> None:
+    engine = create_engine("sqlite+pysqlite:///:memory:")
+    create_scope_tables(engine)
+    Base.metadata.create_all(
+        engine,
+        tables=[
+            Account.__table__,
+            User.__table__,
+            Group.__table__,
+            Campaign.__table__,
+            CampaignVersion.__table__,
+            CampaignJob.__table__,
+            ChangeSequenceEntry.__table__,
+        ],
+    )
+    with Session(engine) as session:
+        session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant 1", settings={}))
+        campaign = Campaign(
+            id="campaign-1",
+            tenant_id="tenant-1",
+            external_id="external-1",
+            name="Safe aggregate",
+            description=None,
+            status="sent",
+        )
+        version = CampaignVersion(
+            id="version-1",
+            campaign_id=campaign.id,
+            version_number=1,
+            raw_json={"mail": {"profile_id": "optional-module-not-loaded"}},
+            schema_version="5",
+            build_summary={},
+        )
+        campaign.current_version_id = version.id
+        session.add_all([campaign, version])
+        for index in range(5):
+            session.add(CampaignJob(
+                id=f"job-{index}",
+                tenant_id="tenant-1",
+                campaign_id=campaign.id,
+                campaign_version_id=version.id,
+                entry_index=index,
+                recipient_email=f"private-{index}@example.test",
+                subject="Private",
+                build_status="built",
+                validation_status="ready",
+                queue_status="queued",
+                send_status="smtp_accepted",
+                imap_status="not_requested",
+            ))
+        session.commit()
+
+        report = generate_aggregate_campaign_report(
+            session,
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+        )
+        assert report.population.denominator.value == 5
+        assert report.outcomes.smtp_accepted.value == 5
+
+        with pytest.raises(AggregateCampaignReportError):
+            generate_aggregate_campaign_report(
+                session,
+                tenant_id="tenant-2",
+                campaign_id="campaign-1",
+            )
+
+    engine.dispose()

tests/test_attachment_building.py

@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+import io
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.campaign.validation import validate_campaign_config
+from govoplan_campaign.backend.messages.builder import build_campaign_messages
+
+
+class CampaignAttachmentBuildTests(unittest.TestCase):
+    def _no_attachment_config(
+        self,
+        behavior: str | None = None,
+        legacy_allow: bool | None = None,
+        *,
+        configure_missing_rule: bool = False,
+    ) -> CampaignConfig:
+        attachments: dict[str, object] = {
+            "base_path": ".",
+            "global": [],
+            "zip": {"enabled": False, "archives": []},
+        }
+        if configure_missing_rule:
+            attachments["global"] = [
+                {
+                    "id": "missing",
+                    "label": "Missing attachment",
+                    "base_dir": ".",
+                    "file_filter": "missing.pdf",
+                    "required": False,
+                    "missing_behavior": "continue",
+                }
+            ]
+        if behavior is not None:
+            attachments["send_without_attachments_behavior"] = behavior
+        if legacy_allow is not None:
+            attachments["send_without_attachments"] = legacy_allow
+        return CampaignConfig.model_validate({
+            "version": "1.0",
+            "campaign": {"id": f"no-attachment-{behavior or legacy_allow}", "name": "No attachment policy", "mode": "test"},
+            "fields": [],
+            "global_values": {},
+            "server": {
+                "mail_profile_id": "profile-1",
+                "profile_capabilities": {"smtp_available": True},
+            },
+            "recipients": {"from": {"email": "sender@example.org", "type": "to"}, "allow_individual_to": True},
+            "template": {"subject": "Subject", "text": "Body"},
+            "attachments": attachments,
+            "entries": {"inline": [{"id": "recipient-1", "to": [{"email": "recipient@example.org", "type": "to"}]}]},
+            "validation_policy": {"missing_email": "block", "template_error": "block"},
+            "delivery": {"imap_append_sent": {"enabled": False}},
+        })
+
+    def test_send_without_attachments_policy_does_not_block_when_no_rules_are_configured(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            campaign_file = root / "campaign.json"
+            campaign_file.write_text("{}", encoding="utf-8")
+            config = self._no_attachment_config(legacy_allow=False)
+
+            validation = validate_campaign_config(config, campaign_file=campaign_file, check_files=True)
+            self.assertTrue(validation.ok)
+            self.assertNotIn("missing_attachment_coverage", {issue.code for issue in validation.issues})
+
+            result = build_campaign_messages(config, campaign_file=campaign_file, output_dir=root / "out", write_eml=True)
+            self.assertEqual(result.report.build_failed_count, 0)
+            self.assertEqual(result.report.queueable_count, 1)
+            message = result.report.messages[0]
+            self.assertEqual(message.attachment_count, 0)
+            self.assertIsNotNone(message.eml_path)
+            self.assertNotIn("missing_attachment_coverage", {issue.code for issue in message.issues})
+            self.assertIsNotNone(result.built_messages[0].mime)
+
+    def test_configured_attachment_rule_blocks_generation_when_no_files_resolve(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            campaign_file = root / "campaign.json"
+            campaign_file.write_text("{}", encoding="utf-8")
+            config = self._no_attachment_config(behavior="block", configure_missing_rule=True)
+
+            validation = validate_campaign_config(config, campaign_file=campaign_file, check_files=True)
+            self.assertFalse(validation.ok)
+            self.assertIn("missing_attachment_coverage", {issue.code for issue in validation.issues})
+
+            result = build_campaign_messages(config, campaign_file=campaign_file, output_dir=root / "out", write_eml=True)
+            self.assertEqual(result.report.build_failed_count, 1)
+            self.assertEqual(result.report.queueable_count, 0)
+            message = result.report.messages[0]
+            self.assertEqual(message.attachment_count, 0)
+            self.assertIsNone(message.eml_path)
+            self.assertIn("missing_attachment_coverage", {issue.code for issue in message.issues})
+            self.assertIsNone(result.built_messages[0].mime)
+
+    def test_send_without_attachments_behavior_modes(self) -> None:
+        cases = {
+            "block": ("build_failed", "blocked", 0, "block", False),
+            "ask": ("built", "needs_review", 0, "ask", True),
+            "drop": ("built", "excluded", 0, "drop", True),
+            "warn": ("built", "warning", 1, "warn", True),
+            "continue": ("built", "ready", 1, None, True),
+        }
+        for behavior, (build_status, validation_status, queueable_count, issue_behavior, has_mime) in cases.items():
+            with self.subTest(behavior=behavior):
+                with tempfile.TemporaryDirectory() as tmp:
+                    root = Path(tmp)
+                    campaign_file = root / "campaign.json"
+                    campaign_file.write_text("{}", encoding="utf-8")
+                    config = self._no_attachment_config(behavior=behavior, configure_missing_rule=True)
+
+                    validation = validate_campaign_config(config, campaign_file=campaign_file, check_files=True)
+                    if behavior == "block":
+                        self.assertFalse(validation.ok)
+                    else:
+                        self.assertTrue(validation.ok)
+
+                    result = build_campaign_messages(config, campaign_file=campaign_file, output_dir=root / "out", write_eml=True)
+                    self.assertEqual(result.report.queueable_count, queueable_count)
+                    message = result.report.messages[0]
+                    self.assertEqual(message.build_status.value, build_status)
+                    self.assertEqual(message.validation_status.value, validation_status)
+                    if validation_status == "excluded":
+                        self.assertEqual(message.send_status.value, "skipped")
+                        self.assertEqual(message.imap_status.value, "skipped")
+                    coverage_issues = [issue for issue in message.issues if issue.code == "missing_attachment_coverage"]
+                    if issue_behavior is None:
+                        self.assertEqual(coverage_issues, [])
+                    else:
+                        self.assertEqual(coverage_issues[0].behavior, issue_behavior)
+                    self.assertEqual(result.built_messages[0].mime is not None, has_mime)
+
+    def test_missing_pattern_does_not_create_zip_member_or_count_as_attachment(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            documents = root / "documents"
+            documents.mkdir()
+            (documents / "matched.xlsx").write_bytes(b"matched workbook")
+            campaign_file = root / "campaign.json"
+            campaign_file.write_text("{}", encoding="utf-8")
+            config = CampaignConfig.model_validate({
+                "version": "1.0",
+                "campaign": {"id": "zip-missing-pattern", "name": "ZIP missing pattern", "mode": "test"},
+                "fields": [],
+                "global_values": {},
+                "server": {
+                    "mail_profile_id": "profile-1",
+                    "profile_capabilities": {"smtp_available": True},
+                },
+                "recipients": {"from": {"email": "sender@example.org", "type": "to"}, "allow_individual_to": True},
+                "template": {"subject": "Subject", "text": "Body"},
+                "attachments": {
+                    "base_path": ".",
+                    "allow_individual": True,
+                    "send_without_attachments": False,
+                    "zip": {
+                        "enabled": True,
+                        "archives": [{"id": "bundle", "name": "recipient-bundle.zip", "standard": True}],
+                    },
+                    "global": [],
+                },
+                "entries": {
+                    "inline": [{
+                        "id": "recipient-1",
+                        "to": [{"email": "recipient@example.org", "type": "to"}],
+                        "attachments": [
+                            {"id": "matched", "base_dir": "documents", "file_filter": "matched.xlsx", "required": True},
+                            {
+                                "id": "missing",
+                                "base_dir": "documents",
+                                "file_filter": "missing.xlsx",
+                                "required": False,
+                                "missing_behavior": "warn",
+                            },
+                        ],
+                    }]
+                },
+                "validation_policy": {
+                    "missing_email": "block",
+                    "template_error": "block",
+                    "missing_optional_attachment": "warn",
+                },
+                "delivery": {"imap_append_sent": {"enabled": False}},
+            })
+
+            validation = validate_campaign_config(config, campaign_file=campaign_file, check_files=True)
+            self.assertTrue(validation.ok)
+            self.assertIn("missing_optional_attachment", {issue.code for issue in validation.issues})
+
+            result = build_campaign_messages(config, campaign_file=campaign_file, output_dir=root / "out", write_eml=False)
+            self.assertEqual(result.report.built_count, 1)
+            self.assertEqual(result.report.queueable_count, 1)
+            message = result.report.messages[0]
+            self.assertEqual(message.attachment_count, 1)
+            summaries = {attachment.attachment_id: attachment for attachment in message.attachments}
+            self.assertEqual(summaries["matched"].zip_filename, "recipient-bundle.zip")
+            self.assertEqual(summaries["matched"].zip_entry_names, ["matched.xlsx"])
+            self.assertIsNone(summaries["missing"].zip_filename)
+            self.assertEqual(summaries["missing"].zip_entry_names, [])
+            self.assertEqual(summaries["missing"].matches, [])
+
+            mime = result.built_messages[0].mime
+            self.assertIsNotNone(mime)
+            attachments = {part.get_filename(): part.get_payload(decode=True) for part in mime.iter_attachments()}
+            self.assertEqual(set(attachments), {"recipient-bundle.zip"})
+            with zipfile.ZipFile(io.BytesIO(attachments["recipient-bundle.zip"])) as archive:
+                self.assertEqual(archive.namelist(), ["matched.xlsx"])
+                self.assertEqual(archive.read("matched.xlsx"), b"matched workbook")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_campaign_audit_atomicity.py

@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+from fastapi import HTTPException
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.schemas import CampaignUpdateRequest, CampaignVersionUpdateRequest
+
+
+def _principal() -> SimpleNamespace:
+    return SimpleNamespace(
+        tenant_id="tenant-1",
+        user=SimpleNamespace(id="user-1"),
+        api_key=None,
+    )
+
+
+def test_version_update_rolls_back_when_its_audit_record_cannot_be_written() -> None:
+    session = MagicMock()
+    principal = _principal()
+    version = SimpleNamespace(
+        id="version-1",
+        raw_json={},
+        current_flow="manual",
+        current_step="recipients",
+    )
+
+    def mutate(*_args, **kwargs):
+        assert kwargs["commit"] is False
+        session.flush()
+        return version
+
+    with (
+        patch.object(router, "_get_campaign_for_principal"),
+        patch.object(router, "_get_version_for_tenant", return_value=version),
+        patch.object(router, "update_campaign_version", side_effect=mutate),
+        patch.object(router, "audit_from_principal", side_effect=RuntimeError("audit unavailable")),
+    ):
+        with pytest.raises(HTTPException, match="audit unavailable") as captured:
+            router._update_campaign_version_detail_response(  # noqa: SLF001 - transaction regression test
+                session,
+                principal,  # type: ignore[arg-type]
+                "campaign-1",
+                "version-1",
+                CampaignVersionUpdateRequest(current_step="recipients"),
+                autosave=True,
+                audit_action="campaign.version_autosaved",
+            )
+
+    assert captured.value.status_code == 422
+    session.commit.assert_not_called()
+    session.rollback.assert_called_once_with()
+
+
+def test_version_fork_rolls_back_when_its_audit_record_cannot_be_written() -> None:
+    session = MagicMock()
+    principal = _principal()
+    campaign = SimpleNamespace(id="campaign-1")
+    source = SimpleNamespace(id="version-1", campaign_id="campaign-1", raw_json={})
+    forked = SimpleNamespace(id="version-2", campaign_id="campaign-1", version_number=2)
+
+    def mutate(*_args, **kwargs):
+        assert kwargs["commit"] is False
+        session.flush()
+        return forked
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        patch.object(router, "_require_permission"),
+        patch.object(router, "_get_version_for_tenant", return_value=source),
+        patch.object(router, "_get_campaign_for_tenant", return_value=campaign),
+        patch.object(router, "fork_campaign_version_for_edit", side_effect=mutate),
+        patch.object(router, "audit_from_principal", side_effect=RuntimeError("audit unavailable")),
+    ):
+        with pytest.raises(RuntimeError, match="audit unavailable"):
+            router.fork_version_for_edit(
+                "campaign-1",
+                "version-1",
+                CampaignVersionUpdateRequest(),
+                session=session,
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    session.commit.assert_not_called()
+    session.rollback.assert_called_once_with()
+
+
+def test_metadata_update_rolls_back_when_its_audit_record_cannot_be_written() -> None:
+    session = MagicMock()
+    principal = _principal()
+    campaign = SimpleNamespace(
+        id="campaign-1",
+        tenant_id="tenant-1",
+        external_id="C-1",
+        name="Old name",
+        description=None,
+        status="draft",
+        current_version_id=None,
+    )
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        patch.object(router, "_sync_campaign_metadata_to_current_version"),
+        patch.object(router, "audit_from_principal", side_effect=RuntimeError("audit unavailable")),
+    ):
+        with pytest.raises(RuntimeError, match="audit unavailable"):
+            router.update_campaign_metadata_endpoint(
+                "campaign-1",
+                CampaignUpdateRequest(name="New name"),
+                session=session,
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    session.flush.assert_called_once_with()
+    session.commit.assert_not_called()
+    session.rollback.assert_called_once_with()

tests/test_campaign_reports.py

@@ -2,8 +2,15 @@ from __future__ import annotations
 
 from datetime import UTC, datetime
 from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
 
-from govoplan_campaign.backend.reports.campaigns import _job_evidence_row, _latest_by_job_id
+from govoplan_campaign.backend.reports.campaigns import (
+    _job_evidence_row,
+    _latest_by_job_id,
+    _load_delivery_info,
+    generate_campaign_report,
+)
 
 
 def _dt() -> datetime:
@@ -86,9 +93,14 @@ def test_job_evidence_row_contains_transport_and_message_evidence() -> None:
     assert "bundle.zip" in row["attachment_names"]
     assert "notice.pdf" in row["attachment_names"]
     assert row["latest_smtp_status_code"] == 250
-    assert row["latest_smtp_response"] == "2.0.0 queued"
+    assert "latest_smtp_response" not in row
+    assert "latest_smtp_error_type" not in row
+    assert "latest_smtp_error_message" not in row
     assert row["latest_imap_status"] == "appended"
     assert row["latest_imap_folder"] == "Sent"
+    assert "latest_imap_error_message" not in row
+    assert "eml_storage_key" not in row
+    assert "eml_local_path" not in row
 
 
 def test_latest_by_job_id_keeps_highest_attempt_number() -> None:
@@ -102,3 +114,60 @@ def test_latest_by_job_id_keeps_highest_attempt_number() -> None:
 
     assert latest["job-1"].attempt_number == 3
     assert latest["job-2"].attempt_number == 2
+
+
+def test_invalid_legacy_snapshot_never_echoes_validation_details() -> None:
+    version = SimpleNamespace(
+        execution_snapshot={
+            "snapshot_version": "legacy",
+            "smtp": {"host": "smtp.internal.example", "password": "provider-secret"},
+        },
+        execution_snapshot_hash=None,
+        execution_snapshot_at=None,
+    )
+
+    delivery = _load_delivery_info(version, [])
+
+    assert delivery["load_error"] == "Execution snapshot is invalid; rebuild the selected version before delivery."
+    assert "provider-secret" not in repr(delivery)
+    assert "smtp.internal.example" not in repr(delivery)
+    assert "background_workers_enabled" not in delivery
+    assert "smtp_transport_revision" not in delivery
+
+    operator_delivery = _load_delivery_info(version, [], include_diagnostics=True)
+    assert "background_workers_enabled" in operator_delivery
+    assert "smtp_transport_revision" in operator_delivery
+
+
+def test_aggregate_report_omits_recipient_level_failures_by_default() -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    version = SimpleNamespace(id="version-1")
+    with (
+        patch("govoplan_campaign.backend.reports.campaigns._get_campaign", return_value=campaign),
+        patch("govoplan_campaign.backend.reports.campaigns._selected_version", return_value=version),
+        patch("govoplan_campaign.backend.reports.campaigns._report_jobs", return_value=[]),
+        patch(
+            "govoplan_campaign.backend.reports.campaigns._campaign_report_payload",
+            return_value={"cards": {}},
+        ) as payload,
+    ):
+        report = generate_campaign_report(
+            object(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+        )
+
+    assert report == {"cards": {}}
+    assert payload.call_args.kwargs["include_recent_failures"] is False
+
+
+class CampaignReportProjectionTests(unittest.TestCase):
+    def test_evidence_projection(self) -> None:
+        test_job_evidence_row_contains_transport_and_message_evidence()
+
+    def test_latest_attempt_projection(self) -> None:
+        test_latest_by_job_id_keeps_highest_attempt_number()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_documentation.py

@@ -0,0 +1,421 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from govoplan_campaign.backend.documentation import CAMPAIGN_USER_DOCUMENTATION, documentation_topics
+from govoplan_core.core.modules import DocumentationContext
+
+
+@dataclass(frozen=True)
+class _Principal:
+    scopes: frozenset[str]
+    tenant_id: str = "tenant-1"
+
+    def has(self, scope: str) -> bool:
+        namespace, resource, _action = scope.split(":", 2)
+        return scope in self.scopes or f"{namespace}:{resource}:*" in self.scopes or f"{namespace}:*" in self.scopes or "*:*" in self.scopes
+
+
+class _Registry:
+    def __init__(self, integrations: set[str], *, interface_only: set[str] | None = None, capability_only: set[str] | None = None) -> None:
+        interfaces = integrations | (interface_only or set())
+        self._capabilities = integrations | (capability_only or set())
+        self._manifests = (
+            SimpleNamespace(
+                provides_interfaces=tuple(SimpleNamespace(name=name) for name in sorted(interfaces)),
+            ),
+        )
+
+    def manifests(self):
+        return self._manifests
+
+    def has_capability(self, name: str) -> bool:
+        return name in self._capabilities
+
+
+def _topics(scopes: set[str], integrations: set[str] | None = None, *, documentation_type: str = "user"):
+    return documentation_topics(
+        DocumentationContext(
+            registry=_Registry(integrations or set()),
+            principal=_Principal(frozenset(scopes)),
+            documentation_type=documentation_type,  # type: ignore[arg-type]
+        )
+    )
+
+
+def test_campaign_runtime_documentation_provider_is_registered() -> None:
+    from govoplan_campaign.backend.manifest import get_manifest
+
+    assert documentation_topics in get_manifest().documentation_providers
+
+
+def test_runtime_documentation_is_user_only_and_requires_a_campaign_task() -> None:
+    assert _topics({"docs:documentation:read"}) == ()
+    assert _topics({"campaigns:campaign:read"}, documentation_type="admin") == ()
+
+
+def test_runtime_documentation_reflects_actor_authority_without_exposing_scopes() -> None:
+    topic = _topics(
+        {
+            "campaigns:campaign:read",
+            "campaigns:campaign:create",
+            "campaigns:campaign:update",
+            "campaigns:campaign:validate",
+            "campaigns:campaign:build",
+            "campaigns:recipient:read",
+            "campaigns:recipient:write",
+            "campaigns:recipient:import",
+        }
+    )[0]
+
+    configuration = topic.metadata["current_configuration"]
+    assert "Role authorization: Create new campaigns." in configuration
+    assert "Role authorization: Build exact recipient messages for review." in configuration
+    assert not any("queue" in item.lower() for item in configuration)
+    assert not any("campaigns:" in item or "files:" in item or "mail:" in item for item in configuration)
+
+
+def test_runtime_documentation_requires_both_interface_and_capability() -> None:
+    integration = "mail.campaign_delivery"
+    scopes = {"campaigns:campaign:read", "campaigns:campaign:update", "mail:profile:use"}
+
+    for registry in (
+        _Registry(set(), interface_only={integration}),
+        _Registry(set(), capability_only={integration}),
+    ):
+        topic = documentation_topics(
+            DocumentationContext(registry=registry, principal=_Principal(frozenset(scopes)), documentation_type="user")
+        )[0]
+        assert not any("profile picker" in item for item in topic.metadata["current_configuration"])
+
+    topic = _topics(scopes, {integration})[0]
+    assert any("Mail's actor-filtered profile picker" in item for item in topic.metadata["current_configuration"])
+
+
+def test_mail_delivery_actions_are_not_presented_without_the_mail_contract() -> None:
+    scopes = {
+        "campaigns:campaign:read",
+        "campaigns:campaign:queue",
+        "campaigns:campaign:send",
+        "campaigns:campaign:retry",
+    }
+
+    without_mail = _topics(scopes)[0]
+    with_mail = _topics(scopes, {"mail.campaign_delivery"})[0]
+
+    assert not any("Queue an eligible" in item for item in without_mail.metadata["current_configuration"])
+    assert any("Queue an eligible" in item for item in with_mail.metadata["current_configuration"])
+
+
+@pytest.mark.parametrize(
+    ("integrations", "scopes", "expected"),
+    [
+        (
+            {"files.campaign_attachments"},
+            {"campaigns:campaign:read", "campaigns:recipient:read", "files:file:read"},
+            "Managed campaign attachments can be previewed",
+        ),
+        (
+            {"addresses.lookup"},
+            {"campaigns:campaign:read", "campaigns:recipient:read"},
+            "Address records can be looked up",
+        ),
+        (
+            {"addresses.recipient_source"},
+            {
+                "campaigns:campaign:read",
+                "campaigns:campaign:update",
+                "campaigns:recipient:read",
+                "campaigns:recipient:write",
+                "campaigns:recipient:import",
+            },
+            "traceable recipient snapshot",
+        ),
+        (
+            {"notifications.dispatch"},
+            {"campaigns:campaign:read"},
+            "status changes",
+        ),
+    ],
+)
+def test_runtime_documentation_reflects_optional_composition_permutations(
+    integrations: set[str],
+    scopes: set[str],
+    expected: str,
+) -> None:
+    topic = _topics(scopes, integrations)[0]
+    assert any(expected in item for item in topic.metadata["current_configuration"])
+
+
+def test_runtime_documentation_full_composition_uses_only_user_facing_names() -> None:
+    integrations = {
+        "mail.campaign_delivery",
+        "files.campaign_attachments",
+        "addresses.lookup",
+        "addresses.recipient_source",
+        "notifications.dispatch",
+    }
+    topic = _topics({"*:*"}, integrations)[0]
+    rendered = "\n".join(
+        (
+            topic.title,
+            topic.summary,
+            topic.body,
+            *topic.metadata["current_configuration"],
+            *topic.metadata["limitations"],
+        )
+    )
+
+    assert "Mail's actor-filtered profile picker" in rendered
+    assert "Managed file versions" in rendered
+    assert "Address records" in rendered
+    assert "In-app notifications" in rendered
+    assert topic.metadata["help_contexts"] == ["campaigns.list", "campaign.overview"]
+    for technical_name in integrations:
+        assert technical_name not in rendered
+    assert "0.1." not in rendered
+    assert "0.2." not in rendered
+    assert "hostname" not in rendered.lower()
+    assert "secret" not in rendered.lower()
+
+
+def test_runtime_documentation_states_the_effective_synchronous_limit() -> None:
+    session = SimpleNamespace(
+        get=lambda _model, _id: SimpleNamespace(
+            settings={
+                "campaign_delivery_policy": {
+                    "synchronous_send_max_recipients": 12,
+                }
+            }
+        )
+    )
+    with patch.dict("os.environ", {"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "25"}):
+        topic = documentation_topics(
+            DocumentationContext(
+                registry=_Registry({"mail.campaign_delivery"}),
+                principal=_Principal(frozenset({"campaigns:campaign:read", "campaigns:campaign:send"})),
+                session=session,
+                documentation_type="user",
+            )
+        )[0]
+
+    assert any(
+        "Send now is limited to 12 eligible recipient job(s)" in item
+        for item in topic.metadata["current_configuration"]
+    )
+
+
+def _visible_static_topics(
+    scopes: set[str],
+    *,
+    modules: set[str] | None = None,
+    capabilities: set[str] | None = None,
+) -> set[str]:
+    installed = modules or {"campaigns"}
+    available_capabilities = capabilities or set()
+    principal = _Principal(frozenset(scopes))
+    visible: set[str] = set()
+    for topic in CAMPAIGN_USER_DOCUMENTATION:
+        condition = topic.conditions[0]
+        if not set(condition.required_modules).issubset(installed):
+            continue
+        if not set(condition.required_capabilities).issubset(available_capabilities):
+            continue
+        if not all(principal.has(scope) for scope in condition.required_scopes):
+            continue
+        visible.add(topic.id)
+    return visible
+
+
+def test_campaign_manager_sees_only_authoring_tasks_from_the_static_handbook() -> None:
+    visible = _visible_static_topics(
+        {
+            "campaigns:campaign:read",
+            "campaigns:campaign:create",
+            "campaigns:campaign:update",
+            "campaigns:campaign:copy",
+            "campaigns:campaign:validate",
+            "campaigns:campaign:build",
+            "campaigns:recipient:read",
+            "campaigns:recipient:write",
+            "campaigns:recipient:import",
+            "campaigns:report:read",
+        }
+    )
+
+    assert {
+        "campaigns.workflow.create-campaign",
+        "campaigns.workflow.create-editable-successor",
+        "campaigns.workflow.import-recipients",
+        "campaigns.workflow.view-delivery-report",
+    }.issubset(visible)
+    assert "campaigns.workflow.queue-delivery" not in visible
+    assert "campaigns.workflow.send-small-controlled-run" not in visible
+    assert "campaigns.workflow.export-delivery-report" not in visible
+    assert "campaigns.workflow.share-campaign" not in visible
+    assert "campaigns.workflow.archive-campaign" not in visible
+    assert "campaigns.workflow.delete-untouched-draft" not in visible
+    assert "campaigns.workflow.create-campaign" not in _visible_static_topics({"campaigns:campaign:create"})
+
+
+def test_sender_sees_queue_and_send_only_with_the_mail_contract_and_profile_authority() -> None:
+    scopes = {
+        "campaigns:campaign:read",
+        "campaigns:campaign:queue",
+        "campaigns:campaign:send",
+        "campaigns:recipient:read",
+        "campaigns:report:read",
+        "mail:profile:use",
+    }
+
+    without_mail = _visible_static_topics(scopes)
+    with_mail = _visible_static_topics(
+        scopes,
+        modules={"campaigns", "mail"},
+        capabilities={"mail.campaign_delivery"},
+    )
+
+    assert "campaigns.workflow.queue-delivery" not in without_mail
+    assert "campaigns.workflow.send-small-controlled-run" not in without_mail
+    assert "campaigns.workflow.queue-delivery" in with_mail
+    assert "campaigns.workflow.send-small-controlled-run" in with_mail
+
+    queue_topic = next(
+        topic for topic in CAMPAIGN_USER_DOCUMENTATION
+        if topic.id == "campaigns.workflow.queue-delivery"
+    )
+    assert any(link.href == "/operator" for link in queue_topic.links)
+
+
+def test_connected_authoring_tasks_require_their_declared_contracts_and_permissions() -> None:
+    attachment_scopes = {
+        "campaigns:campaign:read",
+        "campaigns:campaign:update",
+        "campaigns:campaign:validate",
+        "campaigns:recipient:read",
+        "files:file:read",
+        "files:file:share",
+    }
+    source_scopes = {
+        "campaigns:campaign:read",
+        "campaigns:campaign:update",
+        "campaigns:recipient:read",
+        "campaigns:recipient:write",
+        "campaigns:recipient:import",
+    }
+
+    files_visible = _visible_static_topics(
+        attachment_scopes,
+        modules={"campaigns", "files"},
+        capabilities={"files.campaign_attachments"},
+    )
+    addresses_visible = _visible_static_topics(
+        source_scopes,
+        modules={"campaigns", "addresses"},
+        capabilities={"addresses.recipient_source"},
+    )
+
+    assert "campaigns.workflow.use-managed-attachments" in files_visible
+    assert "campaigns.workflow.import-address-source" in addresses_visible
+    assert "campaigns.workflow.use-managed-attachments" not in _visible_static_topics(attachment_scopes)
+    assert "campaigns.workflow.import-address-source" not in _visible_static_topics(source_scopes)
+
+
+def test_report_export_and_lifecycle_tasks_are_independently_permission_gated() -> None:
+    exporter = _visible_static_topics(
+        {
+            "campaigns:campaign:read",
+            "campaigns:report:read",
+            "campaigns:report:export",
+            "campaigns:recipient:read",
+            "campaigns:recipient:export",
+        }
+    )
+    custodian = _visible_static_topics(
+        {
+            "campaigns:campaign:read",
+            "campaigns:campaign:share",
+            "campaigns:campaign:archive",
+            "campaigns:campaign:delete",
+        }
+    )
+
+    assert "campaigns.workflow.export-delivery-report" in exporter
+    assert "campaigns.workflow.view-delivery-report" in exporter
+    assert "campaigns.workflow.share-campaign" in custodian
+    assert "campaigns.workflow.archive-campaign" in custodian
+    assert "campaigns.workflow.delete-untouched-draft" in custodian
+    assert "campaigns.workflow.export-delivery-report" not in custodian
+
+
+def test_aggregate_report_task_never_implies_recipient_detail_or_export_authority() -> None:
+    visible = _visible_static_topics({"campaigns:report:read"})
+
+    assert visible == {"campaigns.workflow.view-aggregate-delivery-report"}
+    topic = next(
+        item for item in CAMPAIGN_USER_DOCUMENTATION
+        if item.id == "campaigns.workflow.view-aggregate-delivery-report"
+    )
+    assert topic.metadata["route"] == "/reports"
+    assert "export" in topic.metadata["verification"].lower()
+
+
+def test_static_campaign_handbook_has_unique_ids_help_contexts_and_no_planned_resend_claim() -> None:
+    from govoplan_campaign.backend.manifest import get_manifest
+
+    topics = get_manifest().documentation
+    ids = [topic.id for topic in topics]
+    rendered_static = "\n".join(
+        (topic.title + "\n" + topic.summary + "\n" + topic.body).lower()
+        for topic in CAMPAIGN_USER_DOCUMENTATION
+    )
+    known_help_contexts = {
+        "campaigns.list",
+        "campaign.overview",
+        "campaign.settings",
+        "campaign.fields",
+        "campaign.template",
+        "campaign.attachments",
+        "campaign.recipients",
+        "campaign.recipient-data",
+        "campaign.server-settings",
+        "campaign.global-settings",
+        "campaign.review-send",
+        "campaign.report",
+        "campaign.audit",
+        "campaign.json",
+    }
+
+    assert len(ids) == len(set(ids))
+    assert "single resend" not in rendered_static
+    for topic in CAMPAIGN_USER_DOCUMENTATION:
+        assert topic.metadata["kind"] == "workflow"
+        assert topic.metadata["prerequisites"]
+        assert topic.metadata["steps"]
+        assert topic.metadata["outcome"]
+        assert topic.metadata["verification"]
+        assert set(topic.metadata["help_contexts"]).issubset(known_help_contexts)
+
+    existing_user_workflows = {
+        topic.id: topic
+        for topic in topics
+        if topic.id
+        in {
+            "campaigns.mail-profile-user-journey",
+            "campaigns.workflow.prepare-validate-and-build",
+            "campaigns.workflow.complete-review",
+            "campaigns.workflow.retry-and-reconcile",
+        }
+    }
+    assert set(existing_user_workflows) == {
+        "campaigns.mail-profile-user-journey",
+        "campaigns.workflow.prepare-validate-and-build",
+        "campaigns.workflow.complete-review",
+        "campaigns.workflow.retry-and-reconcile",
+    }
+    for topic in existing_user_workflows.values():
+        assert topic.metadata["help_contexts"]

tests/test_editor_state_security.py

@@ -0,0 +1,110 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+import pytest
+from pydantic import ValidationError
+
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    campaign_editor_state_for_edit,
+)
+from govoplan_campaign.backend.schemas import (
+    CampaignVersionResponse,
+    CampaignVersionUpdateRequest,
+)
+
+
+@pytest.mark.parametrize(
+    "editor_state",
+    [
+        {"smtp": {"host": "smtp.example.test", "password": "secret"}},
+        {"transport": {"imap_password": "secret"}},
+        {
+            "review_send": {
+                "build_token": "forged",
+                "inspection_complete": True,
+                "reviewed_message_keys": [],
+                "updated_at": "2026-07-21T00:00:00+00:00",
+                "updated_by_user_id": "user-1",
+            }
+        },
+    ],
+)
+def test_version_updates_reject_arbitrary_or_server_owned_editor_state(
+    editor_state: dict[str, object],
+) -> None:
+    with pytest.raises(ValidationError, match="unsupported or transport-owned"):
+        CampaignVersionUpdateRequest(editor_state=editor_state)
+
+
+def test_version_response_omits_legacy_secret_bearing_editor_state() -> None:
+    response = CampaignVersionResponse.model_validate(
+        {
+            "id": "version-1",
+            "campaign_id": "campaign-1",
+            "version_number": 1,
+            "schema_version": "1.0",
+            "editor_state": {
+                "opt_ins": {"inline_guidance": True},
+                "smtp": {"host": "smtp.internal.example", "password": "provider-secret"},
+            },
+            "created_at": datetime.now(UTC),
+            "updated_at": datetime.now(UTC),
+        }
+    )
+
+    assert response.editor_state == {"opt_ins": {"inline_guidance": True}}
+    assert "provider-secret" not in repr(response)
+    assert "internal.example" not in repr(response)
+
+
+def test_review_build_token_is_visible_only_in_operator_diagnostics() -> None:
+    value = {
+        "id": "version-1",
+        "campaign_id": "campaign-1",
+        "version_number": 1,
+        "schema_version": "1.0",
+        "editor_state": {
+            "review_send": {
+                "build_token": "internal-build-token",
+                "inspection_complete": True,
+                "reviewed_message_keys": ["entry-1"],
+                "updated_at": "2026-07-21T00:00:00+00:00",
+                "updated_by_user_id": "reviewer-1",
+            }
+        },
+        "created_at": datetime.now(UTC),
+        "updated_at": datetime.now(UTC),
+    }
+
+    public = CampaignVersionResponse.model_validate(value)
+    operator = CampaignVersionResponse.model_validate(
+        value,
+        context={"include_diagnostics": True},
+    )
+
+    assert "build_token" not in public.editor_state["review_send"]
+    assert operator.editor_state["review_send"]["build_token"] == "internal-build-token"
+
+
+def test_fork_copy_keeps_only_client_owned_bounded_metadata() -> None:
+    copied = campaign_editor_state_for_edit(
+        {
+            "created_from": "minimal_campaign",
+            "field_overrides": {"department": False},
+            "review_send": {
+                "build_token": "build-1",
+                "inspection_complete": True,
+                "reviewed_message_keys": ["entry-1"],
+                "updated_at": "2026-07-21T00:00:00+00:00",
+                "updated_by_user_id": "reviewer-1",
+            },
+            "credentials": {"password": "legacy-secret"},
+        }
+    )
+
+    assert copied == {
+        "created_from": "minimal_campaign",
+        "field_overrides": {"department": False},
+    }
+    assert "legacy-secret" not in repr(copied)

tests/test_excluded_delivery_status.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+from importlib import import_module
+from unittest.mock import patch
+
+from sqlalchemy import create_engine, text
+
+from govoplan_campaign.backend.campaign.models import BuildStatus, SendStatus
+from govoplan_campaign.backend.messages.models import ImapStatus, MessageDraft, MessageValidationStatus
+from govoplan_campaign.backend.persistence.campaigns import _job_from_message
+
+
+def test_excluded_message_persists_explicit_skipped_transport_states() -> None:
+    message = MessageDraft(
+        entry_index=0,
+        entry_id="excluded-entry",
+        active=True,
+        build_status=BuildStatus.BUILT,
+        validation_status=MessageValidationStatus.EXCLUDED,
+        send_status=SendStatus.SKIPPED,
+        imap_status=ImapStatus.SKIPPED,
+    )
+
+    job = _job_from_message(
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        version_id="version-1",
+        message=message,
+    )
+
+    assert job.send_status == "skipped"
+    assert job.imap_status == "skipped"
+
+
+def test_status_migration_only_normalizes_excluded_rows_without_transport_evidence() -> None:
+    migration = import_module(
+        "govoplan_campaign.backend.migrations.versions."
+        "d8b3e2c1f4a5_v0110_excluded_delivery_skipped"
+    )
+    engine = create_engine("sqlite+pysqlite:///:memory:")
+    with engine.begin() as connection:
+        connection.execute(text(
+            "CREATE TABLE campaign_jobs ("
+            "id TEXT PRIMARY KEY, validation_status TEXT NOT NULL, "
+            "send_status TEXT NOT NULL, imap_status TEXT NOT NULL)"
+        ))
+        connection.execute(
+            text(
+                "INSERT INTO campaign_jobs (id, validation_status, send_status, imap_status) VALUES "
+                "('untouched', 'excluded', 'not_queued', 'pending'), "
+                "('evidence', 'excluded', 'smtp_accepted', 'appended'), "
+                "('queueable', 'ready', 'not_queued', 'pending')"
+            )
+        )
+        with patch.object(migration.op, "get_bind", return_value=connection):
+            migration.upgrade()
+
+        rows = {
+            row.id: (row.send_status, row.imap_status)
+            for row in connection.execute(
+                text("SELECT id, send_status, imap_status FROM campaign_jobs ORDER BY id")
+            )
+        }
+
+    assert rows["untouched"] == ("skipped", "skipped")
+    assert rows["evidence"] == ("smtp_accepted", "appended")
+    assert rows["queueable"] == ("not_queued", "pending")

tests/test_execution_snapshot_integrity.py

@@ -0,0 +1,139 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from govoplan_campaign.backend.campaign.models import DeliveryConfig
+from govoplan_campaign.backend.sending.execution import (
+    ExecutionSnapshotError,
+    create_execution_snapshot,
+    ensure_execution_snapshot,
+)
+
+
+def _raw_campaign() -> dict[str, object]:
+    return {
+        "version": "1.0",
+        "campaign": {"id": "campaign-1", "name": "Campaign", "mode": "send"},
+        "server": {"mail_profile_id": "profile-1"},
+        "recipients": {"from": [{"email": "sender@example.test"}]},
+        "template": {"subject": "Subject", "text": "Body", "body_mode": "text"},
+        "entries": {"inline": []},
+    }
+
+
+def _job() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="job-1",
+        campaign_version_id="version-1",
+        entry_index=0,
+        entry_id="entry-1",
+        recipient_email="recipient@example.test",
+        subject="Subject",
+        message_id_header="<message@example.test>",
+        eml_size_bytes=123,
+        eml_sha256="eml-digest",
+        build_status="built",
+        validation_status="ready",
+        resolved_recipients={"to": ["recipient@example.test"]},
+        resolved_attachments=[],
+        issues_snapshot=[],
+    )
+
+
+class _Query:
+    def __init__(self, jobs: list[SimpleNamespace]):
+        self.jobs = jobs
+
+    def filter(self, *_args):
+        return self
+
+    def order_by(self, *_args):
+        return self
+
+    def all(self):
+        return list(self.jobs)
+
+
+class _Session:
+    def __init__(self, jobs: list[SimpleNamespace]):
+        self.jobs = jobs
+
+    def query(self, _model):
+        return _Query(self.jobs)
+
+
+def _snapshotted_version(job: SimpleNamespace):
+    version = SimpleNamespace(
+        id="version-1",
+        campaign_id="campaign-1",
+        raw_json=_raw_campaign(),
+        build_summary={"build_token": "build-1", "built_at": "2026-07-21T00:00:00+00:00"},
+    )
+    payload, digest = create_execution_snapshot(
+        version,  # type: ignore[arg-type]
+        mail_profile_id="profile-1",
+        smtp_transport_revision="smtp-revision",
+        imap_transport_revision="imap-revision",
+        delivery=DeliveryConfig(),
+        jobs=[job],  # type: ignore[list-item]
+        build_summary=version.build_summary,
+    )
+    version.execution_snapshot = payload
+    version.execution_snapshot_hash = digest
+    return version
+
+
+def _ensure(session: _Session, version) -> None:
+    with patch(
+        "govoplan_campaign.backend.sending.execution.files_integration",
+        return_value=SimpleNamespace(available=False),
+    ):
+        ensure_execution_snapshot(session, version)  # type: ignore[arg-type]
+
+
+def test_v5_snapshot_requires_its_persisted_checksum() -> None:
+    job = _job()
+    version = _snapshotted_version(job)
+    version.execution_snapshot_hash = None
+
+    with pytest.raises(ExecutionSnapshotError, match="checksum is missing"):
+        _ensure(_Session([job]), version)
+
+
+def test_campaign_json_drift_is_rejected_before_delivery() -> None:
+    job = _job()
+    version = _snapshotted_version(job)
+    version.raw_json["template"] = {"subject": "Changed", "text": "Body"}
+
+    with pytest.raises(ExecutionSnapshotError, match="Campaign inputs changed"):
+        _ensure(_Session([job]), version)
+
+
+def test_post_build_recipient_drift_cannot_redirect_delivery() -> None:
+    job = _job()
+    version = _snapshotted_version(job)
+    job.resolved_recipients = {"to": ["attacker@example.test"]}
+
+    with pytest.raises(ExecutionSnapshotError, match="job inputs changed"):
+        _ensure(_Session([job]), version)
+
+
+def test_effect_check_verifies_only_the_claimed_job_in_constant_time() -> None:
+    job = _job()
+    version = _snapshotted_version(job)
+    session = SimpleNamespace(
+        query=lambda *_args: pytest.fail("per-effect validation must not rescan every campaign job")
+    )
+
+    with patch(
+        "govoplan_campaign.backend.sending.execution.files_integration",
+        return_value=SimpleNamespace(available=False),
+    ):
+        ensure_execution_snapshot(
+            session,  # type: ignore[arg-type]
+            version,
+            effect_job=job,  # type: ignore[arg-type]
+        )

tests/test_imap_append_idempotency.py

@@ -0,0 +1,433 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+import importlib
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+from sqlalchemy import create_engine, text
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.db.models import (
+    CampaignJob,
+    ImapAppendAttempt,
+    JobImapStatus,
+    JobSendStatus,
+)
+from govoplan_campaign.backend.retention import _apply_eml_retention
+from govoplan_campaign.backend.schemas import CampaignResolveOutcomeRequest
+from govoplan_campaign.backend.sending.jobs import (
+    AppendSentResult,
+    QueueingError,
+    _claim_job_for_imap_append,
+    _record_imap_append_success,
+    append_sent_for_job,
+    reconcile_job_outcome,
+)
+
+
+@pytest.mark.parametrize(
+    ("imap_status", "expected_status"),
+    [
+        (JobImapStatus.APPENDING.value, "append_in_progress"),
+        (JobImapStatus.OUTCOME_UNKNOWN.value, JobImapStatus.OUTCOME_UNKNOWN.value),
+    ],
+)
+def test_in_progress_and_unknown_jobs_never_reinvoke_mail_provider(
+    imap_status: str,
+    expected_status: str,
+) -> None:
+    job = SimpleNamespace(
+        id="job-1",
+        send_status=JobSendStatus.SMTP_ACCEPTED.value,
+        imap_status=imap_status,
+    )
+    session = SimpleNamespace(get=lambda _model, _id: job)
+
+    with (
+        patch("govoplan_campaign.backend.sending.jobs._imap_attempt_count", return_value=1),
+        patch("govoplan_campaign.backend.sending.jobs.mail_integration") as mail,
+    ):
+        result = append_sent_for_job(
+            session,  # type: ignore[arg-type]
+            job_id="job-1",
+        )
+
+    assert result.status == expected_status
+    mail.assert_not_called()
+
+
+def test_imap_claim_is_a_single_atomic_state_transition() -> None:
+    session = MagicMock()
+    query = session.query.return_value
+    query.filter.return_value.update.return_value = 1
+    job = SimpleNamespace(id="job-1")
+
+    claim_token = _claim_job_for_imap_append(
+        session,
+        job,  # type: ignore[arg-type]
+    )
+
+    assert claim_token
+    changes = query.filter.return_value.update.call_args.args[0]
+    assert changes[CampaignJob.imap_status] == JobImapStatus.APPENDING.value
+    assert changes[CampaignJob.imap_claim_token] == claim_token
+    session.commit.assert_called_once_with()
+    session.expire_all.assert_called_once_with()
+
+
+def test_late_provider_acknowledgement_cannot_overwrite_a_changed_claim() -> None:
+    session = MagicMock()
+    session.query.return_value.filter.return_value.update.return_value = 0
+    job = SimpleNamespace(id="job-1")
+    attempt = SimpleNamespace(id="attempt-1", attempt_number=1)
+    expected = AppendSentResult(
+        job_id="job-1",
+        status=JobImapStatus.OUTCOME_UNKNOWN.value,
+        attempt_number=1,
+    )
+
+    with (
+        patch(
+            "govoplan_campaign.backend.sending.jobs._imap_result_after_lost_claim",
+            return_value=expected,
+        ) as lost_claim,
+        patch("govoplan_campaign.backend.sending.jobs.files_integration") as files,
+    ):
+        result = _record_imap_append_success(
+            session,
+            job=job,  # type: ignore[arg-type]
+            attempt=attempt,  # type: ignore[arg-type]
+            claim_token="claim-1",
+            folder="Sent",
+        )
+
+    assert result is expected
+    lost_claim.assert_called_once_with(
+        session,
+        job_id="job-1",
+        attempt=attempt,
+        provider_succeeded=True,
+    )
+    files.assert_not_called()
+
+
+def test_post_provider_persistence_failure_freezes_imap_retry() -> None:
+    job = SimpleNamespace(
+        id="job-1",
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        campaign_version_id="version-1",
+        send_status=JobSendStatus.SMTP_ACCEPTED.value,
+        imap_status=JobImapStatus.PENDING.value,
+    )
+    version = SimpleNamespace(id="version-1")
+    snapshot = SimpleNamespace(
+        mail_profile_id="profile-1",
+        smtp_transport_revision="smtp-revision",
+        imap_transport_revision="imap-revision",
+        delivery=SimpleNamespace(
+            imap_append_sent=SimpleNamespace(enabled=True, folder="Sent"),
+        ),
+    )
+    attempt = SimpleNamespace(id="attempt-1", attempt_number=1)
+
+    class Session:
+        def get(self, model, _object_id):
+            return version if model.__name__ == "CampaignVersion" else job
+
+    class Mail:
+        def append_campaign_message_to_sent(self, *_args, **_kwargs):
+            return SimpleNamespace(folder="Sent")
+
+    expected = AppendSentResult(
+        job_id="job-1",
+        status=JobImapStatus.OUTCOME_UNKNOWN.value,
+        attempt_number=1,
+    )
+    session = Session()
+    with (
+        patch("govoplan_campaign.backend.sending.jobs.ensure_execution_snapshot", return_value=snapshot),
+        patch("govoplan_campaign.backend.sending.jobs._load_eml_bytes_for_job", return_value=b"message"),
+        patch("govoplan_campaign.backend.sending.jobs._claim_job_for_imap_append", return_value="claim-1"),
+        patch("govoplan_campaign.backend.sending.jobs._record_imap_attempt_start", return_value=attempt),
+        patch("govoplan_campaign.backend.sending.jobs.mail_integration", return_value=Mail()),
+        patch(
+            "govoplan_campaign.backend.sending.jobs._record_imap_append_success",
+            side_effect=OSError("database unavailable"),
+        ),
+        patch(
+            "govoplan_campaign.backend.sending.jobs._mark_imap_append_outcome_unknown_after_effect",
+            return_value=expected,
+        ) as mark_unknown,
+    ):
+        result = append_sent_for_job(
+            session,  # type: ignore[arg-type]
+            job_id="job-1",
+        )
+
+    assert result is expected
+    assert "Automatic retry is stopped" in mark_unknown.call_args.kwargs["reason"]
+
+
+def test_attempt_numbers_are_unique_per_job_in_the_model_contract() -> None:
+    constraints = {
+        constraint.name
+        for constraint in ImapAppendAttempt.__table__.constraints
+    }
+    assert "uq_imap_append_attempts_job_attempt" in constraints
+
+
+def test_imap_claim_migration_preserves_and_renumbers_duplicate_attempts() -> None:
+    migration = importlib.import_module(
+        "govoplan_campaign.backend.migrations.versions.3c4d5e6f8192_v019_imap_append_claim"
+    )
+    engine = create_engine("sqlite+pysqlite:///:memory:")
+    with engine.begin() as connection:
+        connection.execute(
+            text(
+                "CREATE TABLE imap_append_attempts ("
+                "id VARCHAR(36) PRIMARY KEY, job_id VARCHAR(36) NOT NULL, "
+                "attempt_number INTEGER NOT NULL, created_at DATETIME NOT NULL)"
+            )
+        )
+        connection.execute(
+            text(
+                "INSERT INTO imap_append_attempts "
+                "(id, job_id, attempt_number, created_at) VALUES "
+                "('a2', 'job-1', 1, '2026-01-02'), "
+                "('a1', 'job-1', 1, '2026-01-01'), "
+                "('b1', 'job-2', 7, '2026-01-01')"
+            )
+        )
+        with patch.object(migration.op, "get_bind", return_value=connection):
+            migration._renumber_attempts()
+        rows = connection.execute(
+            text(
+                "SELECT id, job_id, attempt_number FROM imap_append_attempts "
+                "ORDER BY job_id, attempt_number"
+            )
+        ).all()
+
+    assert rows == [
+        ("a1", "job-1", 1),
+        ("a2", "job-1", 2),
+        ("b1", "job-2", 1),
+    ]
+
+
+@pytest.mark.parametrize("decision", ["smtp_accepted", "not_sent", "imap_appended", "imap_not_appended"])
+def test_reconciliation_requires_an_evidence_note(decision: str) -> None:
+    with pytest.raises(ValueError, match="evidence note"):
+        CampaignResolveOutcomeRequest(
+            decision=decision,  # type: ignore[arg-type]
+            note="  ",
+        )
+
+
+@pytest.mark.parametrize(
+    ("decision", "expected_status", "attempt_status"),
+    [
+        (
+            "imap_appended",
+            JobImapStatus.APPENDED.value,
+            "reconciled_imap_appended",
+        ),
+        (
+            "imap_not_appended",
+            JobImapStatus.FAILED.value,
+            "reconciled_imap_not_appended",
+        ),
+    ],
+)
+def test_imap_reconciliation_preserves_attempt_and_only_not_appended_is_retryable(
+    decision: str,
+    expected_status: str,
+    attempt_status: str,
+) -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    job = SimpleNamespace(
+        id="job-1",
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        campaign_version_id="version-1",
+        send_status=JobSendStatus.SMTP_ACCEPTED.value,
+        imap_status=JobImapStatus.OUTCOME_UNKNOWN.value,
+        imap_claimed_at=datetime.now(timezone.utc),
+        imap_claim_token="claim-1",
+        last_error="unknown",
+    )
+    attempt = SimpleNamespace(
+        id="attempt-1",
+        status=JobImapStatus.OUTCOME_UNKNOWN.value,
+        error_message="unknown",
+    )
+    session = MagicMock()
+    session.get.return_value = job
+    session.query.return_value.filter.return_value.order_by.return_value.first.return_value = attempt
+
+    with (
+        patch(
+            "govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant",
+            return_value=campaign,
+        ),
+        patch("govoplan_campaign.backend.sending.jobs.files_integration") as files,
+    ):
+        result = reconcile_job_outcome(
+            session,
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+            job_id="job-1",
+            decision=decision,
+            note="Mailbox UID evidence checked by operator 42.",
+            commit=False,
+        )
+
+    assert result["channel"] == "imap"
+    assert job.imap_status == expected_status
+    assert job.imap_claimed_at is None
+    assert job.imap_claim_token is None
+    assert attempt.status == attempt_status
+    assert attempt.error_message == "Mailbox UID evidence checked by operator 42."
+    assert attempt in session.add.call_args_list[0].args
+    session.flush.assert_called_once_with()
+    session.commit.assert_not_called()
+    if decision == "imap_appended":
+        files().mark_job_attachment_uses_sent.assert_called_once_with(session, job)
+    else:
+        files().mark_job_attachment_uses_sent.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "imap_status",
+    [JobImapStatus.APPENDING.value, JobImapStatus.FAILED.value, JobImapStatus.APPENDED.value],
+)
+def test_imap_reconciliation_rejects_live_retryable_or_completed_state(imap_status: str) -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    job = SimpleNamespace(
+        id="job-1",
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        campaign_version_id="version-1",
+        send_status=JobSendStatus.SMTP_ACCEPTED.value,
+        imap_status=imap_status,
+    )
+    session = MagicMock()
+    session.get.return_value = job
+    with patch(
+        "govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant",
+        return_value=campaign,
+    ):
+        with pytest.raises(QueueingError, match="does not require reconciliation"):
+            reconcile_job_outcome(
+                session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                job_id="job-1",
+                decision="imap_not_appended",
+                note="Checked mailbox.",
+            )
+
+
+@pytest.mark.parametrize("send_status", [JobSendStatus.CLAIMED.value, JobSendStatus.SENDING.value])
+def test_smtp_reconciliation_rejects_a_live_worker_state(send_status: str) -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    job = SimpleNamespace(
+        id="job-1",
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        campaign_version_id="version-1",
+        send_status=send_status,
+    )
+    session = MagicMock()
+    session.get.return_value = job
+    with patch(
+        "govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant",
+        return_value=campaign,
+    ):
+        with pytest.raises(QueueingError, match="does not require reconciliation"):
+            reconcile_job_outcome(
+                session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                job_id="job-1",
+                decision="not_sent",
+                note="Checked provider logs.",
+            )
+
+
+@pytest.mark.parametrize(
+    ("decision", "note"),
+    [
+        ("smtp_accepted", "SMTP provider evidence checked."),
+        ("imap_appended", "Mailbox evidence checked."),
+    ],
+)
+def test_reconciliation_rolls_back_state_when_audit_fails(
+    decision: str,
+    note: str | None,
+) -> None:
+    payload = CampaignResolveOutcomeRequest(decision=decision, note=note)  # type: ignore[arg-type]
+    principal = SimpleNamespace(tenant_id="tenant-1")
+    session = MagicMock()
+
+    def mutate_without_commit(*_args, **kwargs):
+        assert kwargs["commit"] is False
+        session.flush()
+        return {"decision": decision, "job_id": "job-1"}
+
+    with (
+        patch("govoplan_campaign.backend.router._get_campaign_for_principal"),
+        patch("govoplan_campaign.backend.router._require_permission"),
+        patch(
+            "govoplan_campaign.backend.router.reconcile_job_outcome",
+            side_effect=mutate_without_commit,
+        ),
+        patch(
+            "govoplan_campaign.backend.router.audit_from_principal",
+            side_effect=RuntimeError("audit unavailable"),
+        ),
+    ):
+        with pytest.raises(RuntimeError, match="audit unavailable"):
+            router.resolve_campaign_job_outcome(
+                "campaign-1",
+                "job-1",
+                payload,
+                session=session,
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    session.commit.assert_not_called()
+    session.rollback.assert_called_once_with()
+
+
+def test_retention_preserves_eml_for_unknown_imap_outcome(tmp_path: Path) -> None:
+    eml_path = tmp_path / "message.eml"
+    eml_path.write_bytes(b"message")
+    job = SimpleNamespace(
+        campaign_id="campaign-1",
+        updated_at=datetime.now(timezone.utc) - timedelta(days=10),
+        queue_status="draft",
+        send_status=JobSendStatus.SMTP_ACCEPTED.value,
+        imap_status=JobImapStatus.OUTCOME_UNKNOWN.value,
+        eml_local_path=str(eml_path),
+        eml_storage_key=None,
+    )
+    query = MagicMock()
+    query.filter.return_value.order_by.return_value.all.return_value = [job]
+    session = MagicMock()
+    session.query.return_value = query
+    policy = SimpleNamespace(generated_eml_retention_days=1)
+
+    result = _apply_eml_retention(
+        session,
+        dry_run=False,
+        now=datetime.now(timezone.utc),
+        policy_for_campaign_id=lambda _campaign_id: policy,
+    )
+
+    assert result["skipped_not_final"] == 1
+    assert eml_path.exists()
+    session.add.assert_not_called()

tests/test_job_list_query.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import unittest
+
+from fastapi import HTTPException
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_access.backend.db.models import Account, Group, User
+from govoplan_campaign.backend.db.models import Campaign, CampaignJob, CampaignVersion
+from govoplan_campaign.backend.router import (
+    _campaign_jobs_grid_filter_expressions,
+    _campaign_jobs_ordering,
+    _campaign_jobs_page_response,
+)
+from govoplan_core.core.change_sequence import ChangeSequenceEntry
+from govoplan_core.db.base import Base
+
+
+class CampaignJobListQueryTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.engine = create_engine("sqlite+pysqlite:///:memory:")
+        Base.metadata.create_all(
+            self.engine,
+            tables=[
+                Account.__table__,
+                User.__table__,
+                Group.__table__,
+                Campaign.__table__,
+                CampaignVersion.__table__,
+                CampaignJob.__table__,
+                ChangeSequenceEntry.__table__,
+            ],
+        )
+        self.session = Session(self.engine)
+        rows = [
+            (0, "ordinary-0@example.test", "General notice", "ready", "draft", "not_queued", "not_requested", 0),
+            (1, "ordinary-1@example.test", "General notice", "ready", "draft", "not_queued", "not_requested", 1),
+            (2, "target-c@example.test", "Target notice C", "warning", "queued", "queued", "pending", 2),
+            (3, "ordinary-3@example.test", "General notice", "blocked", "draft", "failed_permanent", "failed", 3),
+            (4, "target-b@example.test", "Target notice B", "ready", "draft", "failed_temporary", "not_requested", 4),
+            (5, "target-a@example.test", "Target notice A", "ready", "draft", "outcome_unknown", "outcome_unknown", 5),
+            (6, "excluded@example.test", "Excluded notice", "excluded", "draft", "skipped", "skipped", 0),
+        ]
+        for entry_index, recipient, subject, validation, queue, send, imap, attempts in rows:
+            self.session.add(CampaignJob(
+                id=f"job-{entry_index}",
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                campaign_version_id="version-1",
+                entry_index=entry_index,
+                entry_id=f"entry-{entry_index}",
+                recipient_email=recipient,
+                subject=subject,
+                message_id_header=f"<message-{entry_index}@example.test>",
+                eml_sha256=f"sha-{entry_index}",
+                build_status="built",
+                validation_status=validation,
+                queue_status=queue,
+                send_status=send,
+                imap_status=imap,
+                attempt_count=attempts,
+                resolved_attachments=[],
+                issues_snapshot=[],
+            ))
+        self.session.commit()
+
+    def tearDown(self) -> None:
+        self.session.close()
+        self.engine.dispose()
+
+    def test_grid_filters_apply_before_pagination_and_report_filtered_totals(self) -> None:
+        base_filters = [CampaignJob.tenant_id == "tenant-1", CampaignJob.campaign_id == "campaign-1"]
+        grid_filters = {"recipient": "target"}
+        filtered = [*base_filters, *_campaign_jobs_grid_filter_expressions(grid_filters)]
+
+        page = _campaign_jobs_page_response(
+            self.session,
+            campaign_id="campaign-1",
+            version_id="version-1",
+            base_filters=base_filters,
+            filtered=filtered,
+            reviewed_keys=set(),
+            review_metadata={},
+            page=1,
+            page_size=2,
+            grid_filters=grid_filters,
+            sort_by="recipient",
+            sort_direction="asc",
+        )
+
+        self.assertEqual(page.total, 3)
+        self.assertEqual(page.total_unfiltered, 7)
+        self.assertEqual(page.pages, 2)
+        self.assertEqual(
+            [row["recipient_email"] for row in page.jobs],
+            ["target-a@example.test", "target-b@example.test"],
+        )
+        self.assertIsNone(page.next_cursor)
+
+    def test_list_and_integer_filters_share_the_full_backend_query(self) -> None:
+        expressions = _campaign_jobs_grid_filter_expressions({
+            "send": 'list:["failed_temporary","outcome_unknown"]',
+            "attempts": "gte:4",
+        })
+
+        rows = (
+            self.session.query(CampaignJob)
+            .filter(*expressions)
+            .order_by(*_campaign_jobs_ordering("attempts", "desc"))
+            .all()
+        )
+
+        self.assertEqual([row.id for row in rows], ["job-5", "job-4"])
+
+    def test_invalid_list_filters_fail_closed(self) -> None:
+        with self.assertRaises(HTTPException) as raised:
+            _campaign_jobs_grid_filter_expressions({"send": 'list:["not-a-status"]'})
+
+        self.assertEqual(raised.exception.status_code, 422)
+
+    def test_skipped_transport_filters_and_counts_remain_separate(self) -> None:
+        base_filters = [CampaignJob.tenant_id == "tenant-1", CampaignJob.campaign_id == "campaign-1"]
+        grid_filters = {"send": 'list:["skipped"]', "imap": 'list:["skipped"]'}
+        filtered = [*base_filters, *_campaign_jobs_grid_filter_expressions(grid_filters)]
+
+        page = _campaign_jobs_page_response(
+            self.session,
+            campaign_id="campaign-1",
+            version_id="version-1",
+            base_filters=base_filters,
+            filtered=filtered,
+            reviewed_keys=set(),
+            review_metadata={},
+            page=1,
+            page_size=20,
+            grid_filters=grid_filters,
+        )
+
+        self.assertEqual([row["id"] for row in page.jobs], ["job-6"])
+        self.assertEqual(page.counts["send"]["skipped"], 1)
+        self.assertEqual(page.counts["send"]["not_queued"], 2)
+        self.assertEqual(page.counts["imap"]["skipped"], 1)
+        self.assertEqual(page.filtered_counts["send"], {"skipped": 1})
+        self.assertEqual(page.filtered_counts["imap"], {"skipped": 1})
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_mail_profile_boundary.py

@@ -0,0 +1,248 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import call, patch
+
+import pytest
+from fastapi import HTTPException
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.campaign.loader import CampaignSchemaError, validate_against_schema
+from govoplan_campaign.backend.campaign.mail_profile_boundary import (
+    CampaignMailProfileBoundaryError,
+    assert_campaign_uses_mail_profile_reference,
+    campaign_mail_profile_boundary_violations,
+    campaign_mail_profile_id,
+)
+from govoplan_campaign.backend.campaign.models import DeliveryConfig
+from govoplan_campaign.backend.persistence.campaigns import CampaignPersistenceError, load_campaign_config_from_json
+from govoplan_campaign.backend.persistence.versions import update_campaign_version
+from govoplan_campaign.backend.integrations import MailCampaignIntegration
+from govoplan_campaign.backend.sending.execution import ExecutionSnapshotError, create_execution_snapshot, ensure_execution_snapshot
+from govoplan_campaign.backend.schemas import CampaignVersionUpdateRequest
+
+
+def _campaign_json(server: dict[str, object] | None = None) -> dict[str, object]:
+    return {
+        "version": "1.0",
+        "campaign": {"id": "campaign-1", "name": "Campaign", "mode": "send"},
+        "server": server or {},
+        "recipients": {"from": [{"email": "sender@example.test"}]},
+        "template": {"subject": "Subject", "text": "Body", "body_mode": "text"},
+        "entries": {"inline": []},
+    }
+
+
+def test_campaign_mail_contract_accepts_only_a_stable_profile_reference() -> None:
+    raw = _campaign_json({"mail_profile_id": " profile-1 "})
+
+    assert_campaign_uses_mail_profile_reference(raw)
+
+    assert campaign_mail_profile_id(raw) == "profile-1"
+    assert campaign_mail_profile_boundary_violations(raw) == ()
+
+
+def test_mail_profile_documentation_is_classified_for_adaptive_views() -> None:
+    from govoplan_campaign.backend.manifest import get_manifest
+
+    manifest = get_manifest()
+    topics = {topic.id: topic for topic in manifest.documentation}
+
+    workflow = topics["campaigns.mail-profile-user-journey"]
+    assert workflow.metadata["kind"] == "workflow"
+    assert workflow.metadata["route"] == "/campaigns/{campaign_id}/mail-settings"
+    assert workflow.conditions[0].required_scopes == (
+        "campaigns:campaign:update",
+        "mail:profile:use",
+    )
+    assert workflow.metadata["prerequisites"]
+    assert workflow.metadata["steps"]
+    assert workflow.metadata["outcome"]
+    assert workflow.metadata["verification"]
+    assert "campaigns.mail-profile-governance" in workflow.metadata["related_topic_ids"]
+
+    assert topics["campaigns.mail-profile-governance"].metadata["kind"] == "reference"
+    assert topics["campaigns.mail-profile-operations"].metadata["kind"] == "reference"
+    assert topics["campaigns.workflow.prepare-validate-and-build"].metadata["kind"] == "workflow"
+    assert topics["campaigns.workflow.complete-review"].metadata["kind"] == "workflow"
+    assert topics["campaigns.workflow.retry-and-reconcile"].metadata["kind"] == "workflow"
+    assert topics["campaigns.reference.composition-assurance"].metadata["kind"] == "reference"
+
+
+@pytest.mark.parametrize("legacy_key", ["smtp", "imap", "credentials", "inherit_smtp_credentials", "profile_id"])
+def test_campaign_mail_contract_rejects_every_legacy_server_field(legacy_key: str) -> None:
+    raw = _campaign_json({"mail_profile_id": "profile-1", legacy_key: {}})
+
+    with pytest.raises(CampaignMailProfileBoundaryError, match="select an authorized Mail profile"):
+        assert_campaign_uses_mail_profile_reference(raw)
+
+
+def test_persisted_schema_rejects_inline_transport_even_without_a_secret() -> None:
+    with pytest.raises(CampaignSchemaError, match="Additional properties are not allowed"):
+        validate_against_schema(_campaign_json({"smtp": {"host": "smtp.example.test"}}))
+
+
+def test_loader_rejects_inline_transport_before_optional_mail_summary() -> None:
+    integration = SimpleNamespace(campaign_profile_delivery_summary=lambda *_args, **_kwargs: pytest.fail("must not resolve"))
+    with patch("govoplan_campaign.backend.persistence.campaigns.mail_integration", return_value=integration):
+        with pytest.raises(CampaignMailProfileBoundaryError, match="remove campaign-local SMTP/IMAP settings"):
+            load_campaign_config_from_json(
+                object(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                raw_json=_campaign_json({"smtp": {"password": "secret"}}),
+            )
+
+
+def test_loader_uses_only_non_secret_mail_profile_capabilities() -> None:
+    raw = _campaign_json({"mail_profile_id": "profile-1"})
+
+    def summary(_session, **kwargs):
+        assert kwargs["profile_id"] == "profile-1"
+        return {
+            "mail_profile_id": "profile-1",
+            "smtp_available": True,
+            "imap_available": False,
+            "smtp_transport_revision": "opaque-smtp",
+            "imap_transport_revision": None,
+            # Even a broken/malicious provider cannot inject extra material into
+            # Campaign's strict in-memory ServerConfig.
+            "host": "smtp.example.test",
+            "password": "secret",
+        }
+
+    integration = SimpleNamespace(campaign_profile_delivery_summary=summary)
+    with patch("govoplan_campaign.backend.persistence.campaigns.mail_integration", return_value=integration):
+        config = load_campaign_config_from_json(
+            object(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            raw_json=raw,
+        )
+
+    assert raw["server"] == {"mail_profile_id": "profile-1"}
+    assert config.server.mail_profile_id == "profile-1"
+    assert config.server.profile_capabilities.smtp_available is True
+    assert config.server.profile_capabilities.imap_available is False
+    assert "smtp.example.test" not in repr(config.server)
+    assert "secret" not in repr(config.server)
+
+
+def test_new_execution_snapshot_stores_reference_and_evidence_not_transport_material() -> None:
+    raw = _campaign_json({"mail_profile_id": "profile-1"})
+    version = SimpleNamespace(id="version-1", raw_json=raw)
+
+    payload, _digest = create_execution_snapshot(
+        version,  # type: ignore[arg-type]
+        mail_profile_id="profile-1",
+        smtp_transport_revision="opaque-smtp-evidence",
+        imap_transport_revision="opaque-imap-evidence",
+        delivery=DeliveryConfig(),
+    )
+
+    assert payload["snapshot_version"] == "5"
+    assert payload["mail_profile_id"] == "profile-1"
+    assert "smtp" not in payload
+    assert "imap" not in payload
+    assert payload["smtp_transport_revision"] == "opaque-smtp-evidence"
+    assert payload["imap_transport_revision"] == "opaque-imap-evidence"
+
+
+def test_legacy_execution_snapshot_is_preserved_but_fails_closed() -> None:
+    version = SimpleNamespace(
+        raw_json=_campaign_json({"mail_profile_id": "profile-1"}),
+        execution_snapshot={"snapshot_version": "3", "smtp": {"host": "legacy.example.test"}},
+        execution_snapshot_hash=None,
+    )
+    with patch(
+        "govoplan_campaign.backend.sending.execution.files_integration",
+        return_value=SimpleNamespace(available=False),
+    ):
+        with pytest.raises(ExecutionSnapshotError, match="preserved for audit only"):
+            ensure_execution_snapshot(object(), version)  # type: ignore[arg-type]
+
+    assert version.execution_snapshot["smtp"]["host"] == "legacy.example.test"
+
+
+def test_campaign_mail_adapter_does_not_expose_raw_transport_helpers() -> None:
+    integration = MailCampaignIntegration(SimpleNamespace())
+
+    for name in (
+        "smtp_config_from_profile",
+        "imap_config_from_profile",
+        "send_email_bytes",
+        "send_email_message",
+        "materialize_campaign_mail_profile_config",
+    ):
+        assert not hasattr(integration, name)
+
+
+def test_editing_a_legacy_record_requires_an_explicit_profile_migration() -> None:
+    legacy_raw = _campaign_json({"smtp": {"host": "smtp.example.test", "password": "secret"}})
+    version = SimpleNamespace(id="version-1", campaign_id="campaign-1", raw_json=legacy_raw)
+    campaign = SimpleNamespace(id="campaign-1", current_version_id="version-1")
+
+    with (
+        patch("govoplan_campaign.backend.persistence.versions.get_campaign_version_for_tenant", return_value=version),
+        patch("govoplan_campaign.backend.persistence.versions._require_campaign", return_value=campaign),
+        patch("govoplan_campaign.backend.persistence.versions.ensure_current_working_version"),
+        patch("govoplan_campaign.backend.persistence.versions.is_version_locked", return_value=False),
+    ):
+        with pytest.raises(CampaignPersistenceError, match="explicitly save the migration"):
+            update_campaign_version(
+                object(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                version_id="version-1",
+                raw_json=_campaign_json({"mail_profile_id": "profile-1"}),
+            )
+
+    assert version.raw_json is legacy_raw
+    assert legacy_raw["server"]["smtp"]["password"] == "secret"  # type: ignore[index]
+
+
+def test_fork_inherited_profile_requires_mail_profile_use_scope() -> None:
+    principal = SimpleNamespace(
+        tenant_id="tenant-1",
+        user=SimpleNamespace(id="user-1"),
+    )
+    campaign = SimpleNamespace(id="campaign-1")
+    source = SimpleNamespace(
+        id="version-1",
+        campaign_id="campaign-1",
+        raw_json={"server": {"mail_profile_id": "profile-1"}},
+    )
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        patch.object(router, "_require_permission"),
+        patch.object(router, "_get_version_for_tenant", return_value=source),
+        patch.object(router, "has_scope", return_value=False),
+        patch.object(router, "fork_campaign_version_for_edit") as fork,
+    ):
+        with pytest.raises(HTTPException) as captured:
+            router.fork_version_for_edit(
+                "campaign-1",
+                "version-1",
+                CampaignVersionUpdateRequest(),
+                session=object(),  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    assert captured.value.status_code == 403
+    fork.assert_not_called()
+
+
+def test_campaign_wide_effect_authorizes_every_affected_version() -> None:
+    session = object()
+    principal = SimpleNamespace(tenant_id="tenant-1")
+
+    with patch.object(router, "_require_campaign_profile_use_if_needed") as require_profile:
+        router._require_campaign_versions_profile_use(  # noqa: SLF001 - security boundary regression test
+            session,  # type: ignore[arg-type]
+            principal,  # type: ignore[arg-type]
+            "campaign-1",
+            {"version-2", "version-1"},
+        )
+
+    assert require_profile.call_args_list == [
+        call(session, principal, "campaign-1", "version-1"),
+        call(session, principal, "campaign-1", "version-2"),
+    ]

tests/test_mock_campaign_helpers.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+
+from govoplan_campaign.backend.dev.mock_campaign import (
+    _MockSendBatch,
+    _mock_send_steps,
+)
+
+
+class MockCampaignStepTests(unittest.TestCase):
+    def test_preview_marks_delivery_steps_as_skipped(self):
+        validation = SimpleNamespace(ok=True)
+        build = SimpleNamespace(
+            built_count=2,
+            queueable_count=2,
+            needs_review_count=0,
+            blocked_count=0,
+        )
+
+        steps = _mock_send_steps(
+            validation_report=validation,
+            validation_payload={"ok": True},
+            build_report=build,
+            send_batch=_MockSendBatch(results=[]),
+            send=False,
+            append_sent=True,
+        )
+
+        self.assertEqual(
+            [step["status"] for step in steps],
+            ["ok", "ok", "skipped", "skipped"],
+        )
+
+    def test_delivery_failures_require_review(self):
+        validation = SimpleNamespace(ok=False)
+        build = SimpleNamespace(
+            built_count=1,
+            queueable_count=0,
+            needs_review_count=1,
+            blocked_count=0,
+        )
+        batch = _MockSendBatch(
+            results=[],
+            failed_count=1,
+            imap_failed_count=1,
+        )
+
+        steps = _mock_send_steps(
+            validation_report=validation,
+            validation_payload={"ok": False},
+            build_report=build,
+            send_batch=batch,
+            send=True,
+            append_sent=True,
+        )
+
+        self.assertEqual(
+            [step["status"] for step in steps],
+            ["needs_review", "needs_review", "needs_review", "needs_review"],
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_partial_validation.py

@@ -0,0 +1,174 @@
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.campaign.validation import validate_campaign_config
+from govoplan_campaign.backend.persistence.versions import validate_campaign_partial
+
+
+class CampaignPartialValidationTests(unittest.TestCase):
+    def test_partial_validation_reports_counts_across_sections(self) -> None:
+        result = validate_campaign_partial({
+            "campaign": {},
+            "recipients": {"from": {}},
+            "entries": {"source": {}, "mapping": {}},
+            "template": {"body_mode": "both"},
+            "attachments": {},
+            "delivery": {"rate_limit": {"messages_per_minute": 0}},
+        })
+
+        codes = {item["code"] for item in result["issues"]}
+        self.assertFalse(result["ok"])
+        self.assertEqual(3, result["error_count"])
+        self.assertIn("missing_campaign_id", codes)
+        self.assertIn("missing_email_mapping", codes)
+        self.assertIn("missing_template_text_body", codes)
+        self.assertIn("missing_attachment_base_path", codes)
+        self.assertIn("invalid_rate_limit", codes)
+
+    def test_partial_validation_filters_to_requested_section(self) -> None:
+        result = validate_campaign_partial(
+            {
+                "campaign": {},
+                "template": {"body_mode": "text"},
+                "delivery": {"rate_limit": {"messages_per_minute": "fast"}},
+            },
+            section="template",
+        )
+
+        self.assertTrue(result["ok"])
+        self.assertEqual("template", result["section"])
+        self.assertEqual(0, result["error_count"])
+        self.assertEqual({"missing_subject", "missing_template_text_body"}, {item["code"] for item in result["issues"]})
+
+    def test_address_lookup_returns_unavailable_when_addresses_capability_absent(self) -> None:
+        with patch.object(router, "_get_campaign_for_principal", return_value=None), patch.object(router, "_registry_capability", return_value=None):
+            response = router.lookup_campaign_addresses("campaign-1", query="", session=object(), principal=object())
+
+        self.assertFalse(response.available)
+        self.assertEqual(response.candidates, [])
+
+    def test_address_lookup_accepts_empty_query_for_suggestion_preload(self) -> None:
+        class LookupCapability:
+            def lookup(self, _session, _principal, *, query: str, limit: int):
+                self.query = query
+                self.limit = limit
+                return [{
+                    "contact_id": "contact-1",
+                    "address_book_id": "book-1",
+                    "display_name": "Ada Lovelace",
+                    "email": "ada@example.local",
+                    "email_label": "work",
+                    "tags": [],
+                    "source_kind": "local",
+                    "provenance": {"module": "addresses"},
+                }]
+
+        capability = LookupCapability()
+        with patch.object(router, "_get_campaign_for_principal", return_value=None), patch.object(router, "_registry_capability", return_value=capability):
+            response = router.lookup_campaign_addresses("campaign-1", query="", limit=100, session=object(), principal=object())
+
+        self.assertEqual(capability.query, "")
+        self.assertEqual(capability.limit, 100)
+        self.assertTrue(response.available)
+        self.assertEqual(response.candidates[0].email, "ada@example.local")
+
+
+class CampaignSemanticValidationTests(unittest.TestCase):
+    def test_send_mode_requires_campaign_owned_sender_for_each_inline_entry(self) -> None:
+        config = CampaignConfig.model_validate({
+            "version": "1.0",
+            "campaign": {"id": "campaign-1", "name": "Campaign", "mode": "send"},
+            "server": {
+                "mail_profile_id": "profile-1",
+                "profile_capabilities": {"smtp_available": True},
+            },
+            "recipients": {"allow_individual_from": True},
+            "template": {"subject": "Subject", "text": "Body", "body_mode": "text"},
+            "entries": {
+                "inline": [
+                    {"id": "ready", "from": [{"email": "sender@example.local"}]},
+                    {"id": "missing"},
+                ]
+            },
+        })
+
+        report = validate_campaign_config(config)
+
+        missing_sender = [issue for issue in report.issues if issue.code == "missing_sender"]
+        self.assertEqual(1, len(missing_sender))
+        self.assertEqual("/entries/inline/1/from", missing_sender[0].path)
+
+    def test_semantic_validation_reports_zip_delivery_and_external_mapping_issues(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "recipients.csv").write_text("email\nada@example.local\n", encoding="utf-8")
+            campaign_file = root / "campaign.json"
+            config = CampaignConfig.model_validate({
+                "version": "1.0",
+                "campaign": {"id": "campaign-1", "name": "Campaign", "mode": "send"},
+                "fields": [
+                    {"name": "pin", "type": "string", "can_override": False},
+                    {"name": "secret", "type": "password"},
+                ],
+                "global_values": {"unknown": "value"},
+                "recipients": {
+                    "from": [{"email": "sender@example.local"}],
+                    "to": [{"email": "recipient@example.local"}],
+                },
+                "template": {"subject": "Subject", "text": "Body", "body_mode": "text"},
+                "attachments": {
+                    "base_path": "attachments",
+                    "zip": {
+                        "enabled": True,
+                        "archives": [
+                            {
+                                "id": "main",
+                                "name": "bundle.zip",
+                                "standard": True,
+                                "password_enabled": True,
+                                "password_field": "secret",
+                                "password_scope": "global",
+                            }
+                        ],
+                    },
+                },
+                "entries": {
+                    "source": {"type": "csv", "path": "recipients.csv", "has_header": True},
+                    "mapping": {"fields.pin": "missing_pin", "fields.unknown": "missing_unknown"},
+                    "defaults": {
+                        "attachments": [
+                            {
+                                "base_dir": "",
+                                "file_filter": "*.pdf",
+                                "zip": {"archive_id": "missing-archive"},
+                            }
+                        ]
+                    },
+                },
+                "delivery": {"imap_append_sent": {"enabled": True}},
+            })
+
+            report = validate_campaign_config(config, campaign_file=campaign_file, check_files=True)
+
+        codes = {issue.code for issue in report.issues}
+        self.assertFalse(report.ok)
+        self.assertEqual("external:csv", report.entries_mode)
+        self.assertIsNone(report.entries_count)
+        self.assertIn("unknown_global_value", codes)
+        self.assertIn("zip_global_password_value_missing", codes)
+        self.assertIn("zip_archive_unknown", codes)
+        self.assertIn("missing_mail_profile", codes)
+        self.assertIn("unknown_mapping_target", codes)
+        self.assertIn("mapping_target_not_overridable", codes)
+        self.assertIn("mapping_columns_missing", codes)
+        self.assertIn("attachments_base_path_not_found", codes)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_queue_controls.py

@@ -0,0 +1,216 @@
+from __future__ import annotations
+
+import unittest
+from unittest.mock import patch
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_access.backend.db.models import Account, Group, User
+from govoplan_campaign.backend.db.models import (
+    Campaign,
+    CampaignJob,
+    CampaignStatus,
+    CampaignVersion,
+    JobBuildStatus,
+    JobQueueStatus,
+    JobSendStatus,
+    JobValidationStatus,
+)
+from govoplan_campaign.backend.sending.jobs import (
+    QueueingError,
+    cancel_campaign_jobs,
+    pause_campaign_jobs,
+    resume_campaign_jobs,
+)
+from govoplan_campaign.backend.reports.campaigns import _campaign_report_cards, _version_info
+from govoplan_core.core.change_sequence import ChangeSequenceEntry, ChangeSequenceRetentionFloor
+from govoplan_core.db.base import Base
+
+
+class CampaignQueueControlTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.engine = create_engine("sqlite+pysqlite:///:memory:")
+        Base.metadata.create_all(
+            self.engine,
+            tables=[
+                Account.__table__,
+                User.__table__,
+                Group.__table__,
+                ChangeSequenceEntry.__table__,
+                ChangeSequenceRetentionFloor.__table__,
+                Campaign.__table__,
+                CampaignVersion.__table__,
+                CampaignJob.__table__,
+            ],
+        )
+        self.session = Session(self.engine)
+        self._add_campaign("campaign-1", "tenant-1", "version-1")
+        self._add_campaign("campaign-2", "tenant-2", "version-2")
+        self._add_job("queued", queue="queued", send="queued")
+        self._add_job("paused", queue="paused", send="queued")
+        self._add_job("failed", queue="draft", send="failed_temporary")
+        self._add_job("unknown", queue="draft", send="outcome_unknown")
+        self._add_job("accepted", queue="draft", send="smtp_accepted")
+        self._add_job("claimed", queue="sending", send="claimed")
+        self._add_job(
+            "excluded",
+            queue="draft",
+            send="skipped",
+            validation="excluded",
+            imap="skipped",
+        )
+        self._add_job(
+            "other-tenant",
+            tenant_id="tenant-2",
+            campaign_id="campaign-2",
+            version_id="version-2",
+            queue="queued",
+            send="queued",
+        )
+        self.session.commit()
+
+    def tearDown(self) -> None:
+        self.session.close()
+        self.engine.dispose()
+
+    def test_pause_and_resume_change_only_valid_jobs_in_the_selected_tenant(self) -> None:
+        with patch("govoplan_campaign.backend.sending.jobs._emit_campaign_status_notification"):
+            paused = pause_campaign_jobs(
+                self.session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+            )
+            resumed = resume_campaign_jobs(
+                self.session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                enqueue_celery=False,
+            )
+
+        self.assertEqual(paused["paused_count"], 1)
+        self.assertEqual(resumed, {
+            "campaign_id": "campaign-1",
+            "resumed_count": 2,
+            "enqueued_count": 0,
+        })
+        self.session.expire_all()
+        self.assertEqual(self.session.get(Campaign, "campaign-1").status, CampaignStatus.QUEUED.value)
+        version = self.session.get(CampaignVersion, "version-1")
+        self.assertEqual(version.delivery_mode, "database_queue")
+        self.assertIsNotNone(version.delivery_mode_selected_at)
+        self.assertEqual(self.session.get(CampaignJob, "queued").queue_status, JobQueueStatus.QUEUED.value)
+        self.assertEqual(self.session.get(CampaignJob, "paused").queue_status, JobQueueStatus.QUEUED.value)
+        self.assertEqual(self.session.get(CampaignJob, "other-tenant").queue_status, JobQueueStatus.QUEUED.value)
+
+    def test_cancel_is_auditable_idempotent_state_change_and_protects_started_effects(self) -> None:
+        with patch("govoplan_campaign.backend.sending.jobs._emit_campaign_status_notification"):
+            first = cancel_campaign_jobs(
+                self.session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+            )
+            second = cancel_campaign_jobs(
+                self.session,
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+            )
+
+        self.assertEqual(first["cancelled_count"], 3)
+        self.assertEqual(first["protected_count"], 3)
+        self.assertEqual(first["skipped_count"], 1)
+        self.assertEqual(second["cancelled_count"], 0)
+        self.assertEqual(second["protected_count"], 3)
+        self.assertEqual(second["skipped_count"], 1)
+        self.session.expire_all()
+        for job_id in ("queued", "paused", "failed"):
+            job = self.session.get(CampaignJob, job_id)
+            self.assertEqual(job.queue_status, JobQueueStatus.CANCELLED.value)
+            self.assertEqual(job.send_status, JobSendStatus.CANCELLED.value)
+        self.assertEqual(self.session.get(CampaignJob, "unknown").send_status, JobSendStatus.OUTCOME_UNKNOWN.value)
+        self.assertEqual(self.session.get(CampaignJob, "accepted").send_status, JobSendStatus.SMTP_ACCEPTED.value)
+        self.assertEqual(self.session.get(CampaignJob, "claimed").send_status, JobSendStatus.CLAIMED.value)
+        self.assertEqual(self.session.get(CampaignJob, "excluded").send_status, JobSendStatus.SKIPPED.value)
+        self.assertEqual(self.session.get(CampaignJob, "excluded").queue_status, JobQueueStatus.DRAFT.value)
+        self.assertEqual(self.session.get(CampaignJob, "other-tenant").send_status, JobSendStatus.QUEUED.value)
+
+    def test_controls_fail_closed_for_a_campaign_owned_by_another_tenant(self) -> None:
+        for control in (pause_campaign_jobs, resume_campaign_jobs, cancel_campaign_jobs):
+            with self.subTest(control=control.__name__), self.assertRaises(QueueingError):
+                control(
+                    self.session,
+                    tenant_id="tenant-1",
+                    campaign_id="campaign-2",
+                )
+
+    def test_queue_projection_exposes_exact_action_counts_and_persisted_mode_only(self) -> None:
+        version = self.session.get(CampaignVersion, "version-1")
+        version.delivery_mode = "worker_queue"
+        version.delivery_mode_selected_at = version.updated_at
+        jobs = (
+            self.session.query(CampaignJob)
+            .filter(CampaignJob.tenant_id == "tenant-1")
+            .all()
+        )
+
+        cards = _campaign_report_cards(version, jobs)
+        projected_version = _version_info(version)
+
+        self.assertEqual(cards["retryable"], 1)
+        self.assertEqual(cards["queueable_unattempted"], 0)
+        self.assertEqual(cards["cancellable"], 3)
+        self.assertEqual(cards["skipped"], 1)
+        self.assertEqual(cards["imap_skipped"], 1)
+        self.assertEqual(projected_version["delivery_mode"], "worker_queue")
+        self.assertIn("delivery_mode_selected_at", projected_version)
+        self.assertNotIn("execution_snapshot", projected_version)
+
+    def _add_campaign(self, campaign_id: str, tenant_id: str, version_id: str) -> None:
+        self.session.add(Campaign(
+            id=campaign_id,
+            tenant_id=tenant_id,
+            external_id=f"external-{campaign_id}",
+            name=campaign_id,
+            status=CampaignStatus.QUEUED.value,
+            current_version_id=version_id,
+            settings={},
+            mail_profile_policy={},
+        ))
+        self.session.add(CampaignVersion(
+            id=version_id,
+            campaign_id=campaign_id,
+            version_number=1,
+            raw_json={},
+        ))
+
+    def _add_job(
+        self,
+        job_id: str,
+        *,
+        queue: str,
+        send: str,
+        tenant_id: str = "tenant-1",
+        campaign_id: str = "campaign-1",
+        version_id: str = "version-1",
+        validation: str = JobValidationStatus.READY.value,
+        imap: str = "not_requested",
+    ) -> None:
+        self.session.add(CampaignJob(
+            id=job_id,
+            tenant_id=tenant_id,
+            campaign_id=campaign_id,
+            campaign_version_id=version_id,
+            entry_index=len(self.session.new),
+            entry_id=f"entry-{job_id}",
+            build_status=JobBuildStatus.BUILT.value,
+            validation_status=validation,
+            queue_status=queue,
+            send_status=send,
+            imap_status=imap,
+            resolved_attachments=[],
+            issues_snapshot=[],
+        ))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_report_email_security.py

@@ -0,0 +1,175 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from fastapi import HTTPException
+from pydantic import ValidationError
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.reports.emailing import CampaignReportEmailError, send_campaign_report_email
+from govoplan_campaign.backend.schemas import ReportEmailRequest
+
+
+def test_report_email_recipient_schema_normalizes_and_has_safe_attachment_default() -> None:
+    request = ReportEmailRequest.model_validate({
+        "to": ["  First@Example.test ", "first@example.test", "second@example.test"],
+    })
+
+    assert request.to == ["First@Example.test", "second@example.test"]
+    assert request.attach_jobs_csv is False
+
+
+@pytest.mark.parametrize(
+    "recipients",
+    [
+        [],
+        [f"recipient-{index}@example.test" for index in range(51)],
+        ["a" * 310 + "@example.test"],
+        ["victim@example.test\r\nBcc: attacker@example.test"],
+        ["missing-at.example.test"],
+        ["@example.test"],
+        ["local@"],
+        ["local @example.test"],
+        ["one@two@example.test"],
+        ["victim@example.test,Bcc:attacker"],
+        ["Display<a@example.test>"],
+    ],
+)
+def test_report_email_recipient_schema_rejects_unsafe_addresses(recipients: list[str]) -> None:
+    with pytest.raises(ValidationError):
+        ReportEmailRequest.model_validate({"to": recipients})
+
+
+def test_report_jobs_csv_attachment_requires_recipient_export_permission() -> None:
+    payload = ReportEmailRequest(to=["recipient@example.test"], attach_jobs_csv=True)
+    principal = SimpleNamespace(tenant_id="tenant-1")
+
+    with (
+        patch.object(
+            router,
+            "_get_campaign_for_principal",
+            return_value=SimpleNamespace(id="campaign-1", current_version_id=None),
+        ),
+        patch.object(
+            router,
+            "_require_permission",
+            side_effect=HTTPException(status_code=403, detail="missing export"),
+        ) as require_permission,
+        patch.object(router, "send_campaign_report_email") as send_report,
+    ):
+        with pytest.raises(HTTPException) as captured:
+            router.email_campaign_report(
+                "campaign-1",
+                payload,
+                session=object(),  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    assert captured.value.status_code == 403
+    require_permission.assert_called_once_with(principal, "campaigns:recipient:export")
+    send_report.assert_not_called()
+
+
+def test_report_email_requires_permission_to_use_selected_mail_profile() -> None:
+    payload = ReportEmailRequest(to=["recipient@example.test"])
+    principal = SimpleNamespace(
+        tenant_id="tenant-1",
+        has=lambda scope: scope == "campaigns:recipient:export",
+    )
+    campaign = SimpleNamespace(id="campaign-1", current_version_id="version-1")
+    version = SimpleNamespace(
+        id="version-1",
+        campaign_id="campaign-1",
+        raw_json={"server": {"mail_profile_id": "profile-1"}},
+    )
+    session = SimpleNamespace(get=lambda _model, _id: version)
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        patch.object(
+            router,
+            "_require_mail_profile_use_if_needed",
+            side_effect=HTTPException(status_code=403, detail="missing profile use"),
+        ) as require_profile_use,
+        patch.object(router, "send_campaign_report_email") as send_report,
+    ):
+        with pytest.raises(HTTPException) as captured:
+            router.email_campaign_report(
+                "campaign-1",
+                payload,
+                session=session,  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    assert captured.value.status_code == 403
+    require_profile_use.assert_called_once_with(principal, version.raw_json)
+    send_report.assert_not_called()
+
+
+def test_unexpected_report_failure_does_not_leak_internal_details() -> None:
+    payload = ReportEmailRequest(to=["recipient@example.test"])
+    principal = SimpleNamespace(
+        tenant_id="tenant-1",
+        has=lambda scope: scope == "campaigns:recipient:export",
+    )
+    with (
+        patch.object(
+            router,
+            "_get_campaign_for_principal",
+            return_value=SimpleNamespace(id="campaign-1", current_version_id=None),
+        ),
+        patch.object(
+            router,
+            "send_campaign_report_email",
+            side_effect=RuntimeError("smtp.internal.example provider-secret"),
+        ),
+    ):
+        with pytest.raises(HTTPException) as captured:
+            router.email_campaign_report(
+                "campaign-1",
+                payload,
+                session=object(),  # type: ignore[arg-type]
+                principal=principal,  # type: ignore[arg-type]
+            )
+
+    assert captured.value.status_code == 500
+    assert captured.value.detail == "Campaign report email could not be completed."
+
+
+def test_report_send_fails_closed_until_durable_mail_outbox_exists() -> None:
+    campaign = SimpleNamespace(
+        id="campaign-1",
+        tenant_id="tenant-1",
+        name="Campaign",
+        external_id="campaign-1",
+    )
+    version = SimpleNamespace(
+        id="version-1",
+        campaign_id="campaign-1",
+        raw_json={"server": {"mail_profile_id": "profile-1"}},
+        execution_snapshot={"snapshot_version": "5"},
+    )
+    config = SimpleNamespace(
+        server=SimpleNamespace(profile_capabilities=SimpleNamespace(smtp_available=True)),
+    )
+    snapshot = SimpleNamespace(smtp_transport_revision="frozen-build-revision")
+    class Session:
+        def get(self, _model, _id):
+            return campaign
+
+    with (
+        patch("govoplan_campaign.backend.reports.emailing._selected_version", return_value=version),
+        patch("govoplan_campaign.backend.reports.emailing._load_config", return_value=config),
+        patch("govoplan_campaign.backend.reports.emailing.ensure_execution_snapshot", return_value=snapshot),
+        patch("govoplan_campaign.backend.reports.emailing.generate_campaign_report") as generate_report,
+    ):
+        with pytest.raises(CampaignReportEmailError, match="durable, idempotent Mail-owned outbox"):
+            send_campaign_report_email(
+                Session(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+                to=["recipient@example.test"],
+            )
+
+    generate_report.assert_not_called()

tests/test_response_security.py

@@ -0,0 +1,292 @@
+from __future__ import annotations
+
+import stat
+import unittest
+from datetime import UTC, datetime
+from types import SimpleNamespace
+
+from govoplan_campaign.backend.response_security import public_campaign_payload
+from govoplan_campaign.backend.router import (
+    _job_attempts_payload,
+    _job_detail_payload,
+    _job_diagnostics_payload,
+)
+from govoplan_campaign.backend.schemas import CampaignVersionDetailResponse, CampaignVersionResponse
+
+
+def _now() -> datetime:
+    return datetime(2026, 7, 21, 12, 0, tzinfo=UTC)
+
+
+def _job() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="job-1",
+        tenant_id="tenant-1",
+        campaign_id="campaign-1",
+        campaign_version_id="version-1",
+        entry_index=1,
+        entry_id="recipient-1",
+        recipient_email="person@example.test",
+        subject="Subject",
+        message_id_header="<message@example.test>",
+        build_status="built",
+        validation_status="ready",
+        queue_status="claimed",
+        send_status="sending",
+        imap_status="pending",
+        eml_size_bytes=123,
+        eml_sha256="sha256",
+        eml_local_path="/runtime/campaign/job-1.eml",
+        eml_storage_key="campaign/job-1.eml",
+        claim_token="job-claim-secret",
+        attempt_count=1,
+        last_error="smtp.internal.example /srv/private provider-secret",
+        queued_at=_now(),
+        claimed_at=_now(),
+        smtp_started_at=_now(),
+        outcome_unknown_at=None,
+        sent_at=None,
+        created_at=_now(),
+        updated_at=_now(),
+        issues_snapshot=[],
+        resolved_attachments=[
+            {
+                "filename": "public.pdf",
+                "local_path": "/tmp/materialized/public.pdf",
+                "storage_key": "private/blob-key",
+            }
+        ],
+        resolved_recipients={"to": [{"email": "person@example.test"}]},
+    )
+
+
+def _smtp_attempt() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="smtp-attempt-1",
+        attempt_number=1,
+        status="started",
+        claim_token="attempt-claim-secret",
+        smtp_status_code=None,
+        smtp_response="smtp.internal.example provider-secret",
+        error_type="/srv/private/ProviderError",
+        error_message="credential=provider-secret",
+        started_at=_now(),
+        finished_at=None,
+    )
+
+
+def _imap_attempt() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="imap-attempt-1",
+        attempt_number=1,
+        status="claimed",
+        claim_token="imap-claim-secret",
+        folder="Sent",
+        error_message="imap.internal.example /srv/private provider-secret",
+        created_at=_now(),
+        updated_at=_now(),
+    )
+
+
+def test_public_payload_recursively_removes_infrastructure_locators() -> None:
+    source = {
+        "campaign_file": "/tmp/campaign.json",
+        "messages": [
+            {
+                "subject": "Public",
+                "eml_path": "/tmp/message.eml",
+                "managed": {"storage_bucket": "private", "storage_key": "object"},
+            }
+        ],
+    }
+
+    result = public_campaign_payload(source)
+
+    assert result == {"messages": [{"subject": "Public", "managed": {}}]}
+    assert source["messages"][0]["eml_path"] == "/tmp/message.eml"
+
+
+def test_version_response_omits_source_base_path_and_sanitizes_summaries() -> None:
+    version = SimpleNamespace(
+        id="version-1",
+        campaign_id="campaign-1",
+        version_number=1,
+        schema_version="1",
+        source_filename="/srv/govoplan/imports/campaign.json",
+        source_base_path="/private/import/path",
+        workflow_state="editing",
+        current_flow="manual",
+        current_step=None,
+        is_complete=False,
+        editor_state={},
+        autosaved_at=None,
+        published_at=None,
+        locked_at=None,
+        locked_by_user_id=None,
+        user_lock_state=None,
+        user_locked_at=None,
+        user_locked_by_user_id=None,
+        created_at=_now(),
+        updated_at=_now(),
+        validation_summary={"campaign_file": "/tmp/campaign.json", "ok": True},
+        build_summary={
+            "build_token": "internal-build-token",
+            "smtp_transport_revision": "internal-smtp-revision",
+            "messages": [{"eml_path": "/tmp/message.eml", "subject": "Public"}],
+        },
+        execution_snapshot_hash=None,
+        execution_snapshot_at=None,
+    )
+
+    payload = CampaignVersionResponse.model_validate(version).model_dump()
+
+    assert "source_base_path" not in payload
+    assert payload["source_filename"] == "campaign.json"
+    assert payload["validation_summary"] == {"ok": True}
+    assert payload["build_summary"] == {"messages": [{"subject": "Public"}]}
+
+    operator_payload = CampaignVersionResponse.model_validate(
+        version,
+        context={"include_diagnostics": True},
+    ).model_dump()
+    assert operator_payload["build_summary"]["build_token"] == "internal-build-token"
+    assert operator_payload["build_summary"]["smtp_transport_revision"] == "internal-smtp-revision"
+
+    detail = CampaignVersionDetailResponse.model_validate(
+        SimpleNamespace(
+            **version.__dict__,
+            raw_json={
+                "campaign": {"title": "Public"},
+                "files": [{"storage_key": "private/object", "filename": "public.pdf"}],
+                "server": {
+                    "mail_profile_id": "profile-1",
+                    "smtp": {"host": "smtp.example.invalid", "password": "smtp-secret"},
+                    "imap": {"host": "imap.example.invalid", "password": "imap-secret"},
+                    "credentials": {
+                        "smtp": {"username": "sender", "password": "legacy-smtp-secret"},
+                        "imap": {"username": "archive", "password": "legacy-imap-secret"},
+                    },
+                },
+                "archives": [{"password": "business-zip-password"}],
+                "template": {
+                    "source": {
+                        "subject_path": "/srv/govoplan/templates/subject.txt",
+                        "html_path": "templates/body.html",
+                    }
+                },
+                "entries": {"source": {"type": "csv", "path": "C:\\imports\\recipients.csv"}},
+                "attachments": {
+                    "base_path": "/srv/govoplan/attachments",
+                    "base_paths": [
+                        {"name": "Shared", "path": "/mnt/shared/campaign", "source": "/mnt/shared"}
+                    ],
+                    "global": [{"base_dir": "/srv/govoplan/attachments/global", "file_filter": "*.pdf"}],
+                },
+            },
+        )
+    ).model_dump()
+    assert detail["raw_json"] == {
+        "campaign": {"title": "Public"},
+        "files": [{"filename": "public.pdf"}],
+            "server": {"mail_profile_id": "profile-1"},
+        "archives": [{"password": "business-zip-password"}],
+        "template": {
+            "source": {
+                "subject_path": "subject.txt",
+                "html_path": "templates/body.html",
+            }
+        },
+        "entries": {"source": {"type": "csv", "path": "recipients.csv"}},
+        "attachments": {
+            "base_path": "attachments",
+            "base_paths": [{"name": "Shared", "path": "campaign", "source": "shared"}],
+            "global": [{"base_dir": "global", "file_filter": "*.pdf"}],
+        },
+    }
+
+
+def test_ordinary_job_detail_and_attempts_do_not_expose_diagnostics() -> None:
+    job_payload = _job_detail_payload(_job())  # type: ignore[arg-type]
+    attempts = _job_attempts_payload([_smtp_attempt()], [_imap_attempt()])  # type: ignore[list-item]
+
+    assert "eml_local_path" not in job_payload
+    assert "eml_storage_key" not in job_payload
+    assert "claimed_at" not in job_payload
+    assert "smtp_started_at" not in job_payload
+    assert job_payload["attachments"] == [{"filename": "public.pdf"}]
+    assert "claim_token" not in attempts["smtp"][0]
+    assert "claim_token" not in attempts["imap"][0]
+    assert "smtp_response" not in attempts["smtp"][0]
+    assert "error_type" not in attempts["smtp"][0]
+    assert "error_message" not in attempts["smtp"][0]
+    assert "error_message" not in attempts["imap"][0]
+    ordinary = repr({"job": job_payload, "attempts": attempts})
+    assert "internal.example" not in ordinary
+    assert "/srv/private" not in ordinary
+    assert "provider-secret" not in ordinary
+
+
+def test_operator_diagnostics_include_claim_and_storage_details() -> None:
+    diagnostics = _job_diagnostics_payload(  # type: ignore[arg-type, list-item]
+        _job(),
+        [_smtp_attempt()],
+        [_imap_attempt()],
+    ).model_dump()
+
+    assert diagnostics["storage"]["eml_local_path"] == "/runtime/campaign/job-1.eml"
+    assert diagnostics["storage"]["eml_storage_key"] == "campaign/job-1.eml"
+    assert diagnostics["worker_claim"]["claim_token"] == "job-claim-secret"
+    assert diagnostics["attempts"]["smtp"][0]["claim_token"] == "attempt-claim-secret"
+    assert diagnostics["attempts"]["imap"][0]["claim_token"] == "imap-claim-secret"
+    assert "smtp.internal.example" in diagnostics["attempts"]["smtp"][0]["smtp_response"]
+    assert "imap.internal.example" in diagnostics["attempts"]["imap"][0]["error_message"]
+    assert "provider-secret" in diagnostics["worker_claim"]["last_error"]
+
+
+def test_diagnostics_permission_is_operator_only_by_default() -> None:
+    from govoplan_campaign.backend.manifest import PERMISSIONS, ROLE_TEMPLATES
+
+    permission_scopes = {permission.scope for permission in PERMISSIONS}
+    role_permissions = {role.slug: set(role.permissions) for role in ROLE_TEMPLATES}
+
+    assert "campaigns:diagnostic:read" in permission_scopes
+    assert "campaigns:diagnostic:read" in role_permissions["campaign_sender"]
+    assert "campaigns:diagnostic:read" not in role_permissions["campaign_manager"]
+    assert "campaigns:diagnostic:read" not in role_permissions["campaign_reviewer"]
+
+
+def test_campaign_snapshot_with_inline_credentials_is_owner_only(tmp_path, monkeypatch) -> None:
+    from govoplan_campaign.backend.persistence import campaigns as persistence
+
+    snapshots = tmp_path / "snapshots"
+    output = tmp_path / "generated"
+    monkeypatch.setattr(persistence, "CAMPAIGN_SNAPSHOT_DIR", snapshots)
+    monkeypatch.setattr(persistence, "BUILD_OUTPUT_DIR", output)
+    path = persistence._write_campaign_snapshot(  # type: ignore[arg-type]
+        SimpleNamespace(id="version-secret", raw_json={"server": {"smtp": {"password": "secret"}}})
+    )
+
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert stat.S_IMODE(snapshots.stat().st_mode) == 0o700
+    assert stat.S_IMODE(output.stat().st_mode) == 0o700
+
+
+class ResponseSecurityTests(unittest.TestCase):
+    def test_public_payload(self) -> None:
+        test_public_payload_recursively_removes_infrastructure_locators()
+
+    def test_version_response(self) -> None:
+        test_version_response_omits_source_base_path_and_sanitizes_summaries()
+
+    def test_ordinary_job_response(self) -> None:
+        test_ordinary_job_detail_and_attempts_do_not_expose_diagnostics()
+
+    def test_operator_diagnostics(self) -> None:
+        test_operator_diagnostics_include_claim_and_storage_details()
+
+    def test_operator_permission(self) -> None:
+        test_diagnostics_permission_is_operator_only_by_default()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_send_now_response_security.py

@@ -0,0 +1,133 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.schemas import SendCampaignNowRequest
+from govoplan_campaign.backend.sending.jobs import SendCampaignNowResult
+
+
+def test_send_now_omits_provider_and_recipient_text_from_response_and_audit() -> None:
+    campaign = SimpleNamespace(id="campaign-1", current_version_id="version-1")
+    version = SimpleNamespace(
+        id="version-1",
+        raw_json={},
+        locked_at=datetime(2026, 7, 22, tzinfo=UTC),
+        validation_summary={
+            "ok": True,
+            "error_count": 0,
+            "warning_count": 1,
+            "issues": [{"message": "provider-secret validation detail"}],
+        },
+        build_summary={
+            "built_count": 2,
+            "build_failed_count": 0,
+            "ready_count": 2,
+            "warning_count": 1,
+            "messages": [{"recipient": "refused-recipient@example.test"}],
+            "build_token": "provider-secret-build-token",
+        },
+    )
+    delivery = SendCampaignNowResult(
+        campaign_id="campaign-1",
+        version_id="version-1",
+        attempted_count=2,
+        sent_count=1,
+        failed_count=1,
+        outcome_unknown_count=0,
+        skipped_count=0,
+        preflight_count=2,
+        synchronous_send_policy={
+            "max_recipient_jobs": 25,
+            "source": "deployment_default",
+            "deployment_max_recipient_jobs": 25,
+            "tenant_max_recipient_jobs": None,
+            "provider_diagnostic": "provider-secret-policy",
+        },
+        results=[
+            {
+                "job_id": "job-failed",
+                "status": "failed",
+                "attempt_number": 1,
+                "message": "provider-secret smtp.internal.example",
+                "recipient_email": "private@example.test",
+            },
+            {
+                "job_id": "job-refused",
+                "status": "smtp_accepted",
+                "attempt_number": 1,
+                "message": (
+                    "SMTP accepted 1/2 envelope recipient(s); refused recipients: "
+                    '{"refused-recipient@example.test": [550, "not allowed"]}'
+                ),
+            },
+        ],
+    )
+    principal = SimpleNamespace(tenant_id="tenant-1", user=SimpleNamespace(id="user-1"), api_key=None)
+    audit = Mock()
+
+    with (
+        patch.object(router, "_get_campaign_for_principal", return_value=campaign),
+        patch.object(router, "_require_permission"),
+        patch.object(router, "_get_campaign_for_tenant", return_value=campaign),
+        patch.object(router, "_get_version_for_tenant", return_value=version),
+        patch.object(router, "_require_mail_profile_use_if_needed"),
+        patch.object(router, "is_user_locked_version", return_value=False),
+        patch.object(router, "send_campaign_now", return_value=delivery),
+        patch.object(router, "audit_from_principal", audit),
+    ):
+        response = router.send_campaign_now_endpoint(
+            "campaign-1",
+            SendCampaignNowRequest(),
+            session=Mock(),
+            principal=principal,  # type: ignore[arg-type]
+        )
+
+    payload = response.model_dump(mode="json")["result"]
+    assert payload["results"] == [
+        {"job_id": "job-failed", "status": "failed", "attempt_number": 1},
+        {"job_id": "job-refused", "status": "smtp_accepted", "attempt_number": 1},
+    ]
+    assert payload["validation"] == {"ok": True, "error_count": 0, "warning_count": 1}
+    assert payload["build"] == {
+        "built_count": 2,
+        "build_failed_count": 0,
+        "ready_count": 2,
+        "warning_count": 1,
+    }
+    assert payload["synchronous_send_policy"] == {
+        "max_recipient_jobs": 25,
+        "source": "deployment_default",
+        "deployment_max_recipient_jobs": 25,
+        "tenant_max_recipient_jobs": None,
+    }
+
+    audit_details = audit.call_args.kwargs["details"]
+    assert set(audit_details) == {
+        "campaign_id",
+        "version_id",
+        "attempted_count",
+        "sent_count",
+        "failed_count",
+        "outcome_unknown_count",
+        "skipped_count",
+        "preflight_count",
+        "delivery_mode",
+        "dry_run",
+        "synchronous_send_policy",
+    }
+    assert "results" not in audit_details
+    assert "validation" not in audit_details
+    assert "build" not in audit_details
+
+    serialized = repr({"response": payload, "audit": audit_details})
+    for forbidden in (
+        "provider-secret",
+        "smtp.internal.example",
+        "private@example.test",
+        "refused-recipient@example.test",
+        "not allowed",
+    ):
+        assert forbidden not in serialized

tests/test_sending_jobs.py

@@ -0,0 +1,195 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from govoplan_campaign.backend.db.models import (
+    JobBuildStatus,
+    JobQueueStatus,
+    JobSendStatus,
+    JobValidationStatus,
+)
+from govoplan_campaign.backend.sending.jobs import (
+    SendJobResult,
+    _queue_validation_statuses,
+    _select_campaign_jobs_for_queue,
+    _send_claimed_campaign_job,
+)
+
+
+class FakeSession:
+    def __init__(self) -> None:
+        self.added: list[object] = []
+
+    def add(self, value: object) -> None:
+        self.added.append(value)
+
+
+def _job(entry_id: str, **overrides):
+    values = {
+        "entry_id": entry_id,
+        "entry_index": int(entry_id),
+        "send_status": JobSendStatus.NOT_QUEUED.value,
+        "queue_status": JobQueueStatus.DRAFT.value,
+        "validation_status": JobValidationStatus.READY.value,
+        "build_status": JobBuildStatus.BUILT.value,
+        "eml_local_path": f"{entry_id}.eml",
+        "eml_storage_key": None,
+        "last_error": "old error",
+        "queued_at": None,
+        "claimed_at": "claimed",
+        "claim_token": "token",
+        "smtp_started_at": "started",
+        "outcome_unknown_at": "unknown",
+    }
+    values.update(overrides)
+    return SimpleNamespace(**values)
+
+
+class CampaignQueueSelectionTests(unittest.TestCase):
+    def test_selects_queueable_jobs_without_reclassifying_retry_states(self):
+        skipped_send = _job("1", send_status=JobSendStatus.FAILED_TEMPORARY.value)
+        skipped_queue = _job("2", queue_status=JobQueueStatus.PAUSED.value)
+        blocked_validation = _job(
+            "3",
+            validation_status=JobValidationStatus.WARNING.value,
+        )
+        blocked_missing_eml = _job(
+            "4",
+            eml_local_path=None,
+            eml_storage_key=None,
+        )
+        ready = _job("5")
+        reviewed = _job(
+            "6",
+            validation_status=JobValidationStatus.NEEDS_REVIEW.value,
+        )
+        session = FakeSession()
+
+        queued, skipped_count, blocked_count = _select_campaign_jobs_for_queue(
+            session,
+            jobs=[
+                skipped_send,
+                skipped_queue,
+                blocked_validation,
+                blocked_missing_eml,
+                ready,
+                reviewed,
+            ],
+            allowed_validation=_queue_validation_statuses(include_warnings=False),
+            reviewed_needs_review_keys={"6"},
+            dry_run=False,
+        )
+
+        self.assertEqual(queued, [ready, reviewed])
+        self.assertEqual(skipped_count, 2)
+        self.assertEqual(blocked_count, 2)
+        self.assertIn("generated EML", blocked_missing_eml.last_error)
+        self.assertEqual(session.added, [ready, reviewed])
+        for job in queued:
+            self.assertEqual(job.queue_status, JobQueueStatus.QUEUED.value)
+            self.assertEqual(job.send_status, JobSendStatus.QUEUED.value)
+            self.assertIsNotNone(job.queued_at)
+            self.assertIsNone(job.claimed_at)
+            self.assertIsNone(job.claim_token)
+            self.assertIsNone(job.smtp_started_at)
+            self.assertIsNone(job.outcome_unknown_at)
+            self.assertIsNone(job.last_error)
+
+    def test_dry_run_does_not_mutate_queueable_job(self):
+        warning = _job(
+            "1",
+            validation_status=JobValidationStatus.WARNING.value,
+        )
+        session = FakeSession()
+
+        queued, skipped_count, blocked_count = _select_campaign_jobs_for_queue(
+            session,
+            jobs=[warning],
+            allowed_validation=_queue_validation_statuses(include_warnings=True),
+            reviewed_needs_review_keys=set(),
+            dry_run=True,
+        )
+
+        self.assertEqual(queued, [warning])
+        self.assertEqual((skipped_count, blocked_count), (0, 0))
+        self.assertEqual(warning.queue_status, JobQueueStatus.DRAFT.value)
+        self.assertEqual(warning.send_status, JobSendStatus.NOT_QUEUED.value)
+        self.assertEqual(session.added, [])
+
+    def test_post_smtp_persistence_failure_is_outcome_unknown_not_retryable_failure(self):
+        job = SimpleNamespace(
+            id="job-1",
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+            campaign_version_id="version-1",
+            imap_status="not_requested",
+            resolved_recipients={"from": {"email": "sender@example.test"}},
+        )
+        snapshot = SimpleNamespace(
+            mail_profile_id="profile-1",
+            smtp_transport_revision="frozen",
+            delivery=SimpleNamespace(
+                rate_limit=SimpleNamespace(messages_per_minute=60),
+            ),
+        )
+        context = SimpleNamespace(
+            snapshot=snapshot,
+            message_bytes=b"message",
+            envelope_from="sender@example.test",
+            envelope_recipients=["recipient@example.test"],
+        )
+        current = SimpleNamespace(id="job-1")
+
+        class Session:
+            def __init__(self) -> None:
+                self.rolled_back = False
+
+            def rollback(self) -> None:
+                self.rolled_back = True
+
+            def get(self, _model, _id):
+                return current
+
+        class Mail:
+            def wait_for_rate_limit(self, **_kwargs):
+                return None
+
+            def send_campaign_email_bytes(self, *_args, **_kwargs):
+                return SimpleNamespace(accepted_count=1)
+
+        session = Session()
+        expected = SendJobResult(
+            job_id="job-1",
+            status=JobSendStatus.OUTCOME_UNKNOWN.value,
+            attempt_number=1,
+        )
+        with (
+            patch("govoplan_campaign.backend.sending.jobs.mail_integration", return_value=Mail()),
+            patch("govoplan_campaign.backend.sending.jobs._record_attempt_start", return_value=object()),
+            patch(
+                "govoplan_campaign.backend.sending.jobs._record_smtp_send_success",
+                side_effect=OSError("storage unavailable"),
+            ),
+            patch(
+                "govoplan_campaign.backend.sending.jobs.mark_job_outcome_unknown",
+                return_value=expected,
+            ) as mark_unknown,
+        ):
+            result = _send_claimed_campaign_job(
+                session,  # type: ignore[arg-type]
+                job=job,  # type: ignore[arg-type]
+                claim_token="claim-1",
+                context=context,  # type: ignore[arg-type]
+                use_rate_limit=False,
+                enqueue_imap_task=False,
+            )
+
+        self.assertIs(result, expected)
+        self.assertTrue(session.rolled_back)
+        self.assertIn("Automatic retry is stopped", mark_unknown.call_args.kwargs["reason"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_server_path_security.py

@@ -0,0 +1,279 @@
+from __future__ import annotations
+
+import copy
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from govoplan_campaign.backend.attachments.resolver import (
+    MessageAttachmentStatus,
+    resolve_entry_attachments,
+)
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.path_security import (
+    CampaignPathSecurityError,
+    assert_server_safe_campaign_paths,
+)
+from govoplan_campaign.backend.persistence.campaigns import (
+    create_campaign_version_from_json,
+    load_version_config,
+)
+from govoplan_campaign.backend.sending.execution import ExecutionSnapshotError, ensure_execution_snapshot
+
+
+def _campaign_json() -> dict[str, object]:
+    return {
+        "version": "1.0",
+        "campaign": {"id": "path-security", "name": "Path security", "mode": "test"},
+        "template": {"subject": "Subject", "text": "Body"},
+        "attachments": {"base_path": ".", "base_paths": [], "global": []},
+        "entries": {"inline": []},
+    }
+
+
+class ServerCampaignPathSecurityTests(unittest.TestCase):
+    def test_api_import_rejects_absolute_source_filename_before_persistence(self) -> None:
+        with patch(
+            "govoplan_campaign.backend.persistence.campaigns.files_integration",
+            return_value=SimpleNamespace(available=False),
+        ):
+            with self.assertRaisesRegex(CampaignPathSecurityError, "source_filename"):
+                create_campaign_version_from_json(
+                    None,  # type: ignore[arg-type]
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    raw_json=_campaign_json(),
+                    source_filename="/etc/passwd",
+                )
+
+    def test_template_parent_traversal_is_rejected(self) -> None:
+        raw = _campaign_json()
+        raw["template"] = {"source": {"text_path": "../../etc/passwd"}}
+
+        with self.assertRaisesRegex(CampaignPathSecurityError, "template source paths"):
+            assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+    def test_existing_unsafe_version_cannot_reuse_a_delivery_snapshot(self) -> None:
+        raw = _campaign_json()
+        raw["template"] = {"source": {"text_path": "/etc/passwd"}}
+        version = SimpleNamespace(raw_json=raw, execution_snapshot={})
+
+        with patch(
+            "govoplan_campaign.backend.sending.execution.files_integration",
+            return_value=SimpleNamespace(available=True),
+        ):
+            with self.assertRaisesRegex(ExecutionSnapshotError, "template source paths"):
+                ensure_execution_snapshot(None, version)  # type: ignore[arg-type]
+
+    def test_existing_unsafe_version_is_rejected_before_config_loading(self) -> None:
+        raw = _campaign_json()
+        raw["template"] = {"source": {"text_path": "/etc/passwd"}}
+        version = SimpleNamespace(campaign_id="campaign-1", raw_json=raw)
+        campaign = SimpleNamespace(id="campaign-1", tenant_id="tenant-1")
+        session = SimpleNamespace(get=lambda _model, key: version if key == "version-1" else campaign)
+
+        with (
+            patch(
+                "govoplan_campaign.backend.persistence.campaigns.files_integration",
+                return_value=SimpleNamespace(available=True),
+            ),
+            patch("govoplan_campaign.backend.persistence.campaigns._write_campaign_snapshot") as write_snapshot,
+            patch("govoplan_campaign.backend.persistence.campaigns.load_campaign_config_from_json") as load_config,
+        ):
+            with self.assertRaisesRegex(CampaignPathSecurityError, "template source paths"):
+                load_version_config(session, "version-1")  # type: ignore[arg-type]
+
+        write_snapshot.assert_not_called()
+        load_config.assert_not_called()
+
+    def test_source_base_symlink_escape_is_rejected(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            outside = root / "outside"
+            outside.mkdir()
+            (outside / "secret.txt").write_text("secret", encoding="utf-8")
+            trusted = root / "trusted"
+            trusted.mkdir()
+            (trusted / "escape").symlink_to(outside, target_is_directory=True)
+
+            raw = _campaign_json()
+            raw["template"] = {"source": {"text_path": "escape/secret.txt"}}
+            with self.assertRaisesRegex(CampaignPathSecurityError, "source_base_path"):
+                assert_server_safe_campaign_paths(
+                    raw,
+                    source_base_path=str(trusted),
+                    managed_files_available=True,
+                )
+
+    def test_attachment_absolute_path_and_parent_filter_are_rejected(self) -> None:
+        raw = _managed_attachment_campaign()
+        attachments = raw["attachments"]
+        assert isinstance(attachments, dict)
+        base_paths = attachments["base_paths"]
+        assert isinstance(base_paths, list)
+        assert isinstance(base_paths[0], dict)
+        base_paths[0]["path"] = "/etc"
+        with self.assertRaisesRegex(CampaignPathSecurityError, "relative managed-file path"):
+            assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+        raw = _managed_attachment_campaign()
+        attachments = raw["attachments"]
+        assert isinstance(attachments, dict)
+        rules = attachments["global"]
+        assert isinstance(rules, list)
+        assert isinstance(rules[0], dict)
+        rules[0]["file_filter"] = "../../etc/passwd"
+        with self.assertRaisesRegex(CampaignPathSecurityError, "parent-directory traversal"):
+            assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+    def test_local_attachment_rule_is_rejected_in_server_mode(self) -> None:
+        raw = _managed_attachment_campaign()
+        attachments = raw["attachments"]
+        assert isinstance(attachments, dict)
+        base_paths = attachments["base_paths"]
+        assert isinstance(base_paths, list)
+        assert isinstance(base_paths[0], dict)
+        base_paths[0].pop("source")
+
+        with self.assertRaisesRegex(CampaignPathSecurityError, "backed by managed Files"):
+            assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+    def test_default_attachment_rule_must_use_managed_files(self) -> None:
+        raw = _managed_attachment_campaign()
+        attachments = raw["attachments"]
+        assert isinstance(attachments, dict)
+        attachments["global"] = []
+        entries = raw["entries"]
+        assert isinstance(entries, dict)
+        entries["defaults"] = {
+            "attachments": [{"base_dir": "invoices", "file_filter": "invoice.pdf"}]
+        }
+
+        with self.assertRaisesRegex(CampaignPathSecurityError, "entries.defaults.attachments"):
+            assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+    def test_normal_managed_file_campaign_is_allowed(self) -> None:
+        raw = _managed_attachment_campaign()
+        assert_server_safe_campaign_paths(raw, managed_files_available=True)
+
+        copied = copy.deepcopy(raw)
+        attachments = copied["attachments"]
+        assert isinstance(attachments, dict)
+        rules = attachments["global"]
+        assert isinstance(rules, list)
+        assert isinstance(rules[0], dict)
+        rules[0]["file_filter"] = "**/{{local:invoice_number}}-report.XLSX"
+        assert_server_safe_campaign_paths(copied, managed_files_available=True)
+
+    def test_rendered_managed_filter_cannot_traverse_materialized_source(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            managed_root = root / "managed"
+            managed_root.mkdir()
+            (root / "secret.pdf").write_bytes(b"server secret")
+
+            config = _runtime_managed_attachment_config(
+                managed_root,
+                file_filter="{{local:file_name}}",
+                file_name="../secret.pdf",
+            )
+            resolution = resolve_entry_attachments(
+                config=config,
+                campaign_file=root / "campaign.json",
+                entry=config.entries.inline[0],  # type: ignore[index]
+                entry_index=1,
+            )
+
+        self.assertEqual(resolution.status, MessageAttachmentStatus.BLOCKED)
+        self.assertEqual(resolution.attachments[0].matches, [])
+        self.assertIn(
+            "unsafe_managed_attachment_path",
+            {issue.code for issue in resolution.issues},
+        )
+
+    def test_managed_match_symlink_cannot_escape_materialized_source(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            managed_root = root / "managed"
+            managed_root.mkdir()
+            outside = root / "secret.pdf"
+            outside.write_bytes(b"server secret")
+            (managed_root / "escape.pdf").symlink_to(outside)
+
+            config = _runtime_managed_attachment_config(
+                managed_root,
+                file_filter="escape.pdf",
+                file_name="unused.pdf",
+            )
+            resolution = resolve_entry_attachments(
+                config=config,
+                campaign_file=root / "campaign.json",
+                entry=config.entries.inline[0],  # type: ignore[index]
+                entry_index=1,
+            )
+
+        self.assertEqual(resolution.status, MessageAttachmentStatus.BLOCKED)
+        self.assertEqual(resolution.attachments[0].matches, [])
+        self.assertIn(
+            "managed_attachment_path_escape",
+            {issue.code for issue in resolution.issues},
+        )
+
+
+def _managed_attachment_campaign() -> dict[str, object]:
+    raw = _campaign_json()
+    raw["attachments"] = {
+        "base_path": "invoices",
+        "base_paths": [
+            {
+                "id": "personal-invoices",
+                "name": "My invoices",
+                "source": "managed:user:user-1",
+                "path": "invoices",
+            }
+        ],
+        "global": [
+            {
+                "base_path_id": "personal-invoices",
+                "base_dir": "invoices",
+                "file_filter": "invoice.pdf",
+            }
+        ],
+    }
+    return raw
+
+
+def _runtime_managed_attachment_config(
+    managed_root: Path,
+    *,
+    file_filter: str,
+    file_name: str,
+) -> CampaignConfig:
+    raw = _managed_attachment_campaign()
+    raw["fields"] = [{"name": "file_name", "type": "string", "required": True}]
+    attachments = raw["attachments"]
+    assert isinstance(attachments, dict)
+    base_paths = attachments["base_paths"]
+    assert isinstance(base_paths, list)
+    assert isinstance(base_paths[0], dict)
+    base_paths[0]["path"] = str(managed_root)
+    rules = attachments["global"]
+    assert isinstance(rules, list)
+    assert isinstance(rules[0], dict)
+    rules[0]["file_filter"] = file_filter
+    entries = raw["entries"]
+    assert isinstance(entries, dict)
+    entries["inline"] = [
+        {
+            "id": "recipient-1",
+            "to": [{"email": "recipient@example.test", "type": "to"}],
+            "fields": {"file_name": file_name},
+        }
+    ]
+    return CampaignConfig.model_validate(raw)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_synchronous_delivery_policy.py

@@ -0,0 +1,358 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+import pytest
+from fastapi import HTTPException
+
+from govoplan_campaign.backend import router
+from govoplan_campaign.backend.delivery_policy import (
+    CampaignDeliveryPolicyError,
+    DEFAULT_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS,
+    effective_synchronous_send_policy,
+)
+from govoplan_campaign.backend.db.models import (
+    JobBuildStatus,
+    JobQueueStatus,
+    JobSendStatus,
+    JobValidationStatus,
+)
+from govoplan_campaign.backend.sending.jobs import (
+    QueueCampaignResult,
+    SynchronousSendRejected,
+    _ensure_synchronous_send_count_allowed,
+    _preflight_synchronous_send_batch,
+    queue_campaign_jobs,
+    send_campaign_now,
+    synchronous_send_candidate_jobs,
+    synchronous_send_options,
+)
+
+
+class _PolicySession:
+    def __init__(self, settings: dict[str, object] | None = None) -> None:
+        self.tenant = SimpleNamespace(settings=settings or {})
+
+    def get(self, _model, _id):
+        return self.tenant
+
+
+def _version() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="version-1",
+        locked_at=object(),
+        published_at=None,
+        validation_summary={"ok": True},
+        build_summary={"build_token": "build-1"},
+        editor_state={
+            "review_send": {
+                "build_token": "build-1",
+                "inspection_complete": True,
+                "reviewed_message_keys": ["reviewed"],
+            }
+        },
+    )
+
+
+class _Principal:
+    def __init__(self, *scopes: str) -> None:
+        self.scopes = set(scopes)
+        self.tenant_id = "tenant-1"
+        self.user = SimpleNamespace(id="user-1")
+
+    def has(self, scope: str) -> bool:
+        return scope in self.scopes
+
+
+def _job(job_id: str, **overrides: object) -> SimpleNamespace:
+    values: dict[str, object] = {
+        "id": job_id,
+        "entry_id": job_id,
+        "entry_index": 1,
+        "build_status": JobBuildStatus.BUILT.value,
+        "validation_status": JobValidationStatus.READY.value,
+        "queue_status": JobQueueStatus.DRAFT.value,
+        "send_status": JobSendStatus.NOT_QUEUED.value,
+        "eml_local_path": f"{job_id}.eml",
+        "eml_storage_key": None,
+    }
+    values.update(overrides)
+    return SimpleNamespace(**values)
+
+
+def test_synchronous_policy_defaults_to_25_and_tenant_can_only_narrow() -> None:
+    default = effective_synchronous_send_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={},
+    )
+    assert default.max_recipient_jobs == DEFAULT_SYNCHRONOUS_SEND_MAX_RECIPIENT_JOBS == 25
+    assert default.source == "deployment_default"
+
+    narrowed = effective_synchronous_send_policy(
+        _PolicySession(
+            {"campaign_delivery_policy": {"synchronous_send_max_recipients": 10}}
+        ),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "40"},
+    )
+    assert narrowed.max_recipient_jobs == 10
+    assert narrowed.source == "tenant"
+
+    ceiling = effective_synchronous_send_policy(
+        _PolicySession(
+            {"campaign_delivery_policy": {"synchronous_send_max_recipients": 100}}
+        ),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "40"},
+    )
+    assert ceiling.max_recipient_jobs == 40
+    assert ceiling.source == "deployment_ceiling"
+
+
+@pytest.mark.parametrize("value", [True, -1, 501, "2.5", "unbounded"])
+def test_invalid_synchronous_policy_fails_closed(value: object) -> None:
+    with pytest.raises(CampaignDeliveryPolicyError):
+        effective_synchronous_send_policy(
+            _PolicySession(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": value},  # type: ignore[dict-item]
+        )
+
+
+def test_candidate_count_uses_exact_built_and_reviewed_job_states() -> None:
+    jobs = [
+        _job("ready"),
+        _job("queued", queue_status=JobQueueStatus.QUEUED.value, send_status=JobSendStatus.QUEUED.value),
+        _job("reviewed", validation_status=JobValidationStatus.NEEDS_REVIEW.value),
+        _job("blocked", validation_status=JobValidationStatus.BLOCKED.value),
+        _job("failed", send_status=JobSendStatus.FAILED_TEMPORARY.value),
+        _job("missing-eml", eml_local_path=None),
+    ]
+
+    candidates = synchronous_send_candidate_jobs(_version(), jobs)  # type: ignore[arg-type]
+
+    assert [job.id for job in candidates] == ["ready", "queued", "reviewed"]
+
+
+def test_limit_and_zero_count_reject_before_delivery() -> None:
+    policy = effective_synchronous_send_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "2"},
+    )
+    with pytest.raises(SynchronousSendRejected, match="No eligible") as empty:
+        _ensure_synchronous_send_count_allowed(0, policy=policy)
+    assert empty.value.reason == "no_eligible_recipient_jobs"
+
+    with pytest.raises(SynchronousSendRejected, match="Queue it") as oversized:
+        _ensure_synchronous_send_count_allowed(3, policy=policy)
+    assert oversized.value.audit_details()["eligible_recipient_job_count"] == 3
+    assert oversized.value.audit_details()["synchronous_send_policy"]["max_recipient_jobs"] == 2
+
+
+def test_exact_synchronous_policy_boundary_is_allowed() -> None:
+    policy = effective_synchronous_send_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "2"},
+    )
+
+    _ensure_synchronous_send_count_allowed(2, policy=policy)
+
+
+def test_post_queue_growth_is_rejected_before_batch_or_provider_preflight() -> None:
+    policy = effective_synchronous_send_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={"GOVOPLAN_CAMPAIGN_SYNCHRONOUS_SEND_MAX_RECIPIENTS": "2"},
+    )
+    campaign = SimpleNamespace(id="campaign-1", current_version_id="version-1")
+    initial_jobs = [_job("one"), _job("two")]
+    post_queue_jobs = [
+        _job(
+            job_id,
+            queue_status=JobQueueStatus.QUEUED.value,
+            send_status=JobSendStatus.QUEUED.value,
+        )
+        for job_id in ("one", "two", "concurrent")
+    ]
+    queued = QueueCampaignResult(
+        campaign_id="campaign-1",
+        version_id="version-1",
+        queued_count=2,
+        skipped_count=0,
+        blocked_count=0,
+        enqueued_count=0,
+        delivery_mode="synchronous",
+    )
+
+    with (
+        patch("govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant", return_value=campaign),
+        patch("govoplan_campaign.backend.sending.jobs._get_current_version", return_value=_version()),
+        patch("govoplan_campaign.backend.sending.jobs._ensure_version_validated_and_locked"),
+        patch("govoplan_campaign.backend.sending.jobs._ensure_campaign_execution_snapshot"),
+        patch("govoplan_campaign.backend.sending.jobs.effective_synchronous_send_policy", return_value=policy),
+        patch("govoplan_campaign.backend.sending.jobs._campaign_jobs_for_queue", return_value=initial_jobs),
+        patch("govoplan_campaign.backend.sending.jobs.queue_campaign_jobs", return_value=queued),
+        patch("govoplan_campaign.backend.sending.jobs._campaign_jobs_for_version", return_value=post_queue_jobs),
+        patch("govoplan_campaign.backend.sending.jobs._preflight_synchronous_send_batch") as batch_preflight,
+    ):
+        with pytest.raises(SynchronousSendRejected, match="above the effective") as rejected:
+            send_campaign_now(
+                object(),  # type: ignore[arg-type]
+                tenant_id="tenant-1",
+                campaign_id="campaign-1",
+            )
+
+    assert rejected.value.eligible_count == 3
+    batch_preflight.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("workers_available", "expected_mode", "expected_enqueued"),
+    ((False, "database_queue", 0), (True, "worker_queue", 1)),
+)
+def test_asynchronous_mode_matches_actual_worker_availability(
+    workers_available: bool,
+    expected_mode: str,
+    expected_enqueued: int,
+) -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    version = _version()
+    job = _job("one")
+
+    with (
+        patch("govoplan_campaign.backend.sending.jobs._celery_enabled", return_value=workers_available),
+        patch("govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant", return_value=campaign),
+        patch("govoplan_campaign.backend.sending.jobs._get_current_version", return_value=version),
+        patch("govoplan_campaign.backend.sending.jobs._ensure_version_validated_and_locked"),
+        patch("govoplan_campaign.backend.sending.jobs._ensure_campaign_execution_snapshot"),
+        patch("govoplan_campaign.backend.sending.jobs._campaign_jobs_for_queue", return_value=[job]),
+        patch(
+            "govoplan_campaign.backend.sending.jobs._select_campaign_jobs_for_queue",
+            return_value=([job], 0, 0),
+        ),
+        patch("govoplan_campaign.backend.sending.jobs._persist_campaign_queue") as persist,
+        patch(
+            "govoplan_campaign.backend.sending.jobs._enqueue_campaign_jobs",
+            return_value=expected_enqueued,
+        ) as enqueue,
+    ):
+        result = queue_campaign_jobs(
+            object(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+            enqueue_celery=True,
+        )
+
+    assert result.delivery_mode == expected_mode
+    assert result.worker_queue_available is workers_available
+    assert result.enqueued_count == expected_enqueued
+    assert persist.call_args.kwargs["delivery_mode"] == expected_mode
+    assert enqueue.call_args.kwargs["enabled"] is workers_available
+
+
+def test_invalid_policy_disables_synchronous_mode_without_hiding_queue_availability() -> None:
+    campaign = SimpleNamespace(id="campaign-1")
+    version = _version()
+    with (
+        patch("govoplan_campaign.backend.sending.jobs._get_campaign_for_tenant", return_value=campaign),
+        patch("govoplan_campaign.backend.sending.jobs._get_version_for_campaign", return_value=version),
+        patch("govoplan_campaign.backend.sending.jobs._campaign_jobs_for_version", return_value=[_job("one")]),
+        patch("govoplan_campaign.backend.sending.jobs._celery_enabled", return_value=True),
+        patch(
+            "govoplan_campaign.backend.sending.jobs.effective_synchronous_send_policy",
+            side_effect=CampaignDeliveryPolicyError("invalid deployment value"),
+        ),
+    ):
+        options = synchronous_send_options(
+            object(),  # type: ignore[arg-type]
+            tenant_id="tenant-1",
+            campaign_id="campaign-1",
+        )
+
+    assert options["worker_queue_available"] is True
+    assert options["synchronous_send"]["allowed"] is False
+    assert options["synchronous_send"]["reason"] == "policy_configuration_invalid"
+    assert options["synchronous_send"]["policy"] == {}
+
+
+@pytest.mark.parametrize(
+    ("path", "required_scope"),
+    (
+        ("/campaigns/{campaign_id}/send-now", "campaigns:campaign:send"),
+        ("/campaigns/{campaign_id}/queue", "campaigns:campaign:queue"),
+    ),
+)
+def test_delivery_endpoints_require_their_mode_permission_and_recipient_authority(
+    path: str,
+    required_scope: str,
+) -> None:
+    route = next(item for item in router.router.routes if item.path == path)
+    dependency = next(item for item in route.dependant.dependencies if item.name == "principal")
+
+    with pytest.raises(HTTPException) as missing_mode_permission:
+        dependency.call(_Principal("campaigns:recipient:read"))
+    assert missing_mode_permission.value.status_code == 403
+    allowed = _Principal(required_scope, "campaigns:recipient:read")
+    assert dependency.call(allowed) is allowed
+
+    mode_only = _Principal(required_scope)
+    with (
+        patch.object(router, "_get_campaign_for_principal"),
+        pytest.raises(HTTPException) as missing_recipient_authority,
+    ):
+        if required_scope == "campaigns:campaign:send":
+            router.send_campaign_now_endpoint(
+                "campaign-1",
+                session=Mock(),
+                principal=mode_only,  # type: ignore[arg-type]
+            )
+        else:
+            router.queue_campaign(
+                "campaign-1",
+                session=Mock(),
+                principal=mode_only,  # type: ignore[arg-type]
+            )
+    assert missing_recipient_authority.value.status_code == 403
+    assert "campaigns:recipient:read" in missing_recipient_authority.value.detail
+
+
+def test_batch_preflight_checks_every_message_before_provider_effects() -> None:
+    jobs = [_job("one"), _job("two")]
+    contexts = {
+        "one": SimpleNamespace(snapshot=SimpleNamespace(smtp_transport_revision="revision-1")),
+        "two": SimpleNamespace(snapshot=SimpleNamespace(smtp_transport_revision="revision-1")),
+    }
+    policy = effective_synchronous_send_policy(
+        _PolicySession(),  # type: ignore[arg-type]
+        tenant_id="tenant-1",
+        environ={},
+    )
+    provider = Mock()
+
+    with (
+        patch("govoplan_campaign.backend.sending.jobs._preflight_send_campaign_job", return_value=None) as state_preflight,
+        patch(
+            "govoplan_campaign.backend.sending.jobs._send_job_delivery_context",
+            side_effect=lambda _session, job: contexts[job.id],
+        ) as input_preflight,
+        patch(
+            "govoplan_campaign.backend.sending.jobs.profile_delivery_summary",
+            return_value={"smtp_transport_revision": "revision-1"},
+        ),
+        patch("govoplan_campaign.backend.sending.jobs.mail_integration", return_value=provider),
+    ):
+        result = _preflight_synchronous_send_batch(
+            object(),  # type: ignore[arg-type]
+            version=_version(),  # type: ignore[arg-type]
+            jobs=jobs,  # type: ignore[arg-type]
+            policy=policy,
+        )
+
+    assert list(result) == ["one", "two"]
+    assert state_preflight.call_count == 2
+    assert input_preflight.call_count == 2
+    provider.send_campaign_email_bytes.assert_not_called()

tests/test_template_rendering.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.attachments.resolver import resolve_entry_attachments
+from govoplan_campaign.backend.template_rendering import (
+    find_unresolved_placeholders,
+    normalize_template_key,
+    render_template,
+)
+
+
+class CampaignTemplateRenderingTests(unittest.TestCase):
+    def test_template_key_aliases_have_shared_normalization(self) -> None:
+        cases = {
+            " name ": "name",
+            "fields.name": "name",
+            "local.name": "local::name",
+            "local:name": "local::name",
+            "local::name": "local::name",
+            "global.name": "global::name",
+            "global:name": "global::name",
+            "global::name": "global::name",
+        }
+
+        for raw, expected in cases.items():
+            with self.subTest(raw=raw):
+                self.assertEqual(normalize_template_key(raw), expected)
+
+    def test_rendering_preserves_both_syntaxes_none_and_missing_values(self) -> None:
+        values = {
+            "name": "Ada",
+            "local::reference": 42,
+            "global::empty": None,
+        }
+        template = "${fields.name}|{{ local.reference }}|${global:empty}|${missing}|{{ global.absent }}"
+
+        self.assertEqual(
+            render_template(template, values),
+            "Ada|42||${missing}|{{ global.absent }}",
+        )
+        self.assertEqual(render_template(template, values, keep_missing=False), "Ada|42|||")
+
+    def test_rendering_unescapes_literal_dollar_placeholders(self) -> None:
+        self.assertEqual(
+            render_template(r"\${literal\}|${known}", {"known": "resolved"}, keep_missing=False),
+            "${literal}|resolved",
+        )
+
+    def test_unresolved_placeholders_are_normalized_and_deduplicated(self) -> None:
+        unresolved = find_unresolved_placeholders(
+            r"${fields.missing} {{ local:name }} ${global.other} {{local::name}} \${escaped\}"
+        )
+
+        self.assertEqual(unresolved, {"missing", "local::name", "global::other"})
+        self.assertEqual(find_unresolved_placeholders(None), set())
+
+    def test_attachment_resolution_keeps_missing_placeholders(self) -> None:
+        config = CampaignConfig.model_validate(
+            {
+                "version": "1.0",
+                "campaign": {"id": "template-parity", "name": "Template parity", "mode": "test"},
+                "template": {"subject": "Subject", "text": "Body"},
+                "attachments": {
+                    "base_path": ".",
+                    "global": [
+                        {
+                            "base_dir": ".",
+                            "file_filter": "${missing}.pdf",
+                            "required": False,
+                            "missing_behavior": "continue",
+                        }
+                    ],
+                },
+                "entries": {
+                    "inline": [
+                        {
+                            "id": "recipient-1",
+                            "to": [{"email": "recipient@example.test", "type": "to"}],
+                        }
+                    ]
+                },
+            }
+        )
+
+        with tempfile.TemporaryDirectory() as temp_dir:
+            resolution = resolve_entry_attachments(
+                config=config,
+                campaign_file=Path(temp_dir) / "campaign.json",
+                entry=config.entries.inline[0],  # type: ignore[index]
+                entry_index=1,
+            )
+
+        self.assertEqual(resolution.attachments[0].file_filter, "${missing}.pdf")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_zip_service.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from pathlib import Path
+import tempfile
+import unittest
+import zipfile
+
+try:
+    import pyzipper
+except ImportError:  # pragma: no cover
+    pyzipper = None
+
+from govoplan_campaign.backend.services.zip_service import create_zip_archive
+
+
+class ZipServiceTests(unittest.TestCase):
+    def test_standard_password_zip_uses_zipcrypto_readable_by_stdlib(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            source = root / "source.txt"
+            source.write_text("Hello Windows ZIP", encoding="utf-8")
+            output = root / "standard.zip"
+
+            create_zip_archive(output, [(source, "message.txt")], "secret", "zip_standard")
+
+            with zipfile.ZipFile(output) as archive:
+                info = archive.getinfo("message.txt")
+                self.assertEqual(info.compress_type, zipfile.ZIP_DEFLATED)
+                self.assertTrue(info.flag_bits & 0x1)
+                self.assertEqual(archive.read("message.txt", pwd=b"secret"), b"Hello Windows ZIP")
+
+    @unittest.skipIf(pyzipper is None, "pyzipper is not installed")
+    def test_aes_password_zip_keeps_aes_encryption(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            source = root / "source.txt"
+            source.write_text("Hello AES ZIP", encoding="utf-8")
+            output = root / "aes.zip"
+
+            create_zip_archive(output, [(source, "message.txt")], "secret", "aes")
+
+            with zipfile.ZipFile(output) as archive:
+                info = archive.getinfo("message.txt")
+                self.assertEqual(info.compress_type, 99)
+                self.assertTrue(info.flag_bits & 0x1)
+
+            with pyzipper.AESZipFile(output) as archive:
+                archive.setpassword(b"secret")
+                self.assertEqual(archive.read("message.txt"), b"Hello AES ZIP")
+
+    def test_unprotected_zip_ignores_encryption_mode(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            source = root / "source.txt"
+            source.write_text("Plain ZIP", encoding="utf-8")
+            output = root / "plain.zip"
+
+            create_zip_archive(output, [(source, "message.txt")], "", "zip_standard")
+
+            with zipfile.ZipFile(output) as archive:
+                info = archive.getinfo("message.txt")
+                self.assertEqual(info.compress_type, zipfile.ZIP_DEFLATED)
+                self.assertFalse(info.flag_bits & 0x1)
+                self.assertEqual(archive.read("message.txt"), b"Plain ZIP")
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/campaign-webui",
-  "version": "0.1.6",
+  "version": "0.1.10",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -17,7 +17,7 @@
     "read-excel-file": "9.2.0"
   },
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.6",
+    "@govoplan/core-webui": "^0.1.12",
     "lucide-react": "^1.23.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
@@ -26,7 +26,11 @@
   "scripts": {
     "test:policy-ui": "rm -rf .policy-test-build && mkdir -p .policy-test-build && printf '{\"type\":\"commonjs\"}\\n' > .policy-test-build/package.json && tsc -p tsconfig.policy-tests.json && node .policy-test-build/tests/policy-ui.test.js",
     "test:template-preview": "rm -rf .template-preview-test-build && mkdir -p .template-preview-test-build && printf '{\"type\":\"commonjs\"}\\n' > .template-preview-test-build/package.json && tsc -p tsconfig.template-preview-tests.json && node .template-preview-test-build/tests/template-preview-draft.test.js",
-    "test:import-utils": "rm -rf .import-test-build && mkdir -p .import-test-build && printf '{\"type\":\"commonjs\"}\\n' > .import-test-build/package.json && tsc -p tsconfig.import-tests.json && node .import-test-build/tests/import-utils.test.js"
+    "test:import-utils": "rm -rf .import-test-build && mkdir -p .import-test-build && printf '{\"type\":\"commonjs\"}\\n' > .import-test-build/package.json && tsc -p tsconfig.import-tests.json && node .import-test-build/tests/import-utils.test.js",
+    "test:report-grid": "rm -rf .report-grid-test-build && mkdir -p .report-grid-test-build && printf '{\"type\":\"commonjs\"}\\n' > .report-grid-test-build/package.json && tsc -p tsconfig.report-grid-tests.json && node .report-grid-test-build/tests/report-grid-query.test.js",
+    "test:review-preview-ui": "rm -rf .review-preview-test-build && mkdir -p .review-preview-test-build && printf '{\"type\":\"commonjs\"}\\n' > .review-preview-test-build/package.json && tsc -p tsconfig.review-preview-tests.json && node .review-preview-test-build/tests/review-preview-ui.test.js && node tests/delivery-mode-ui-structure.test.mjs",
+    "test:operator-queue": "node --experimental-strip-types --test tests/operator-queue-model.test.ts && node tests/operator-queue-ui-structure.test.mjs",
+    "test:aggregate-report": "tsc -p tsconfig.aggregate-report-tests.json && node tests/aggregate-report-ui-structure.test.mjs"
   },
   "devDependencies": {
     "typescript": "^5.7.2"

webui/src/api/campaigns.ts

@@ -1,5 +1,12 @@
 import type { ApiSettings, CampaignListItem, DeltaDeletedItem } from "../types";
 import { apiDownload, apiFetch } from "./client";
+import { campaignJobsQueryParams, type CampaignJobsQueryParameters } from "../features/campaigns/utils/jobListQuery";
+export { fetchResourceAccessExplanation } from "@govoplan/core-webui";
+export type {
+  AccessDecisionProvenanceItem,
+  ResourceAccessExplanationUser as AccessExplanationUser,
+  ResourceAccessExplanationResponse
+} from "@govoplan/core-webui";
 
 export type CampaignListResponse =
 CampaignListItem[] |
@@ -22,27 +29,6 @@ export type CampaignShare = {
 
 export type CampaignShareTarget = {id: string;name: string;secondary?: string | null;};
 export type CampaignShareTargets = {users: CampaignShareTarget[];groups: CampaignShareTarget[];};
-export type AccessExplanationUser = {
-  id: string;
-  account_id?: string | null;
-  email?: string | null;
-  display_name?: string | null;
-};
-export type AccessDecisionProvenanceItem = {
-  kind: string;
-  id?: string | null;
-  label?: string | null;
-  tenant_id?: string | null;
-  source?: string | null;
-  details?: Record<string, unknown>;
-};
-export type ResourceAccessExplanationResponse = {
-  user: AccessExplanationUser;
-  resource_type: string;
-  resource_id: string;
-  action: string;
-  provenance: AccessDecisionProvenanceItem[];
-};
 
 export type CampaignUpdatePayload = {
   external_id?: string | null;
@@ -91,11 +77,14 @@ export type CampaignVersionListItem = {
   build_summary?: Record<string, unknown> | null;
   execution_snapshot_hash?: string | null;
   execution_snapshot_at?: string | null;
+  delivery_mode?: "synchronous" | "worker_queue" | "database_queue" | null;
+  delivery_mode_selected_at?: string | null;
 };
 
 export type CampaignVersionDetail = CampaignVersionListItem & {
   raw_json: Record<string, unknown>;
   campaign_json?: Record<string, unknown>;
+  mail_profile_migration_required?: boolean;
 };
 
 export type CampaignWorkspaceResponse = {
@@ -162,6 +151,59 @@ export type RecipientImportMappingProfileListResponse = {
   profiles: RecipientImportMappingProfile[];
 };
 
+export type CampaignAddressLookupCandidate = {
+  contact_id: string;
+  address_book_id: string;
+  display_name: string;
+  email?: string | null;
+  email_label?: string | null;
+  organization?: string | null;
+  role_title?: string | null;
+  tags: string[];
+  source_kind: string;
+  source_ref?: string | null;
+  source_revision?: string | null;
+  provenance: Record<string, unknown>;
+};
+
+export type CampaignAddressLookupResponse = {
+  available: boolean;
+  candidates: CampaignAddressLookupCandidate[];
+};
+
+export type CampaignRecipientAddressSource = {
+  source_id: string;
+  source_label: string;
+  source_kind: string;
+  source_revision: string;
+  recipient_count: number;
+  provenance: Record<string, unknown>;
+};
+
+export type CampaignRecipientAddressSourcesResponse = {
+  available: boolean;
+  sources: CampaignRecipientAddressSource[];
+};
+
+export type CampaignRecipientSnapshotItem = {
+  contact_id: string;
+  display_name: string;
+  email: string;
+  email_label?: string | null;
+  fields: Record<string, unknown>;
+  provenance: Record<string, unknown>;
+};
+
+export type CampaignRecipientAddressSourceSnapshot = {
+  source_id: string;
+  source_label: string;
+  source_kind: string;
+  source_revision: string;
+  generated_at: string;
+  recipients: CampaignRecipientSnapshotItem[];
+  provenance: Record<string, unknown>;
+};
+
 export type CampaignVersionUpdatePayload = {
   campaign_json?: Record<string, unknown> | null;
   current_flow?: string | null;
@@ -171,6 +213,7 @@ export type CampaignVersionUpdatePayload = {
   editor_state?: Record<string, unknown> | null;
   source_filename?: string | null;
   source_base_path?: string | null;
+  migrate_legacy_mail_settings?: boolean;
 };
 
 export type CampaignPartialValidationPayload = {
@@ -199,22 +242,29 @@ export type CampaignSummary = {
     created_at?: string | null;
     validation_summary?: Record<string, unknown> | null;
     build_summary?: Record<string, unknown> | null;
+    delivery_mode?: "synchronous" | "worker_queue" | "database_queue" | null;
+    delivery_mode_selected_at?: string | null;
   } | null;
   cards?: {
     jobs_total?: number;
     inactive?: number;
     queueable?: number;
+    queueable_unattempted?: number;
+    retryable?: number;
+    cancellable?: number;
     needs_attention?: number;
     sent?: number;
     smtp_accepted?: number;
     failed?: number;
     outcome_unknown?: number;
     not_attempted?: number;
+    skipped?: number;
     queued_or_active?: number;
     cancelled?: number;
     partially_completed?: boolean;
     imap_appended?: number;
     imap_failed?: number;
+    imap_skipped?: number;
   };
   status_counts?: Record<string, Record<string, number>>;
   issues?: Record<string, unknown>;
@@ -231,6 +281,24 @@ export type CampaignQueuePayload = {
   dry_run?: boolean;
 };
 
+export type CampaignDeliveryOptions = {
+  campaign_id: string;
+  version_id: string;
+  worker_queue_available: boolean;
+  synchronous_send: {
+    allowed?: boolean;
+    reason?: string | null;
+    message?: string | null;
+    eligible_recipient_job_count?: number;
+    policy?: {
+      max_recipient_jobs?: number;
+      source?: string;
+      deployment_max_recipient_jobs?: number;
+      tenant_max_recipient_jobs?: number | null;
+    };
+  };
+};
+
 export type CampaignSendNowPayload = {
   version_id?: string | null;
   include_warnings?: boolean;
@@ -260,6 +328,8 @@ export type CampaignAttachmentPreviewFile = {
   checksum_sha256?: string;
   size_bytes?: number;
   content_type?: string | null;
+  linked_to_campaign?: boolean;
+  share?: Record<string, unknown> | null;
 };
 
 export type CampaignAttachmentPreviewRule = {
@@ -281,6 +351,8 @@ export type CampaignAttachmentPreviewRule = {
   zip_filename?: string | null;
   matches: CampaignAttachmentPreviewFile[];
   match_count: number;
+  linked_match_count?: number;
+  unlinked_match_count?: number;
   issues: Record<string, unknown>[];
 };
 
@@ -288,15 +360,37 @@ export type CampaignAttachmentPreviewResponse = {
   campaign_id: string;
   version_id: string;
   shared_file_count: number;
+  candidate_file_count?: number;
+  matched_file_count?: number;
+  linked_file_count?: number;
+  unlinked_file_count?: number;
   rules: CampaignAttachmentPreviewRule[];
+  linkable_files?: CampaignAttachmentPreviewFile[];
   unused_shared_files: CampaignAttachmentPreviewFile[];
 };
 
 export type CampaignAttachmentPreviewPayload = {
   include_unmatched?: boolean;
+  include_unlinked_candidates?: boolean;
   campaign_json?: Record<string, unknown>;
 };
 
+export type CampaignAttachmentLinkMatchesPayload = {
+  campaign_json?: Record<string, unknown> | null;
+  dry_run?: boolean;
+};
+
+export type CampaignAttachmentLinkMatchesResponse = {
+  campaign_id: string;
+  version_id: string;
+  matched_file_count: number;
+  already_linked_file_count: number;
+  linked_file_count: number;
+  dry_run?: boolean;
+  linked_files: CampaignAttachmentPreviewFile[];
+  linkable_files: CampaignAttachmentPreviewFile[];
+};
+
 export type CampaignMockSendPayload = {
   version_id?: string | null;
   send?: boolean;
@@ -312,18 +406,16 @@ export type CampaignReviewStatePayload = {
   reviewed_message_keys: string[];
 };
 
-
-export type CampaignJobsQuery = {
-  versionId?: string;
-  page?: number;
-  pageSize?: number;
-  cursor?: string | null;
-  sendStatus?: string[];
-  validationStatus?: string[];
-  imapStatus?: string[];
-  query?: string;
+export type CampaignSendJobPayload = {
+  include_warnings?: boolean;
+  dry_run?: boolean;
+  use_rate_limit?: boolean;
+  enqueue_imap_task?: boolean;
 };
 
+
+export type CampaignJobsQuery = Omit<CampaignJobsQueryParameters, "since" | "limit">;
+
 export type CampaignJobsResponse = {
   jobs: Record<string, unknown>[];
   page: number;
@@ -368,6 +460,53 @@ export type CampaignReportEmailPayload = {
   dry_run?: boolean;
 };
 
+export type AggregateReportCount = {
+  value: number | null;
+  suppressed: boolean;
+};
+
+export type AggregateReportCampaign = {
+  id: string;
+  name: string;
+  status: string;
+};
+
+export type AggregateReportCampaignListItem = AggregateReportCampaign & {
+  updated_at: string;
+};
+
+export type AggregateCampaignReport = {
+  generated_at: string;
+  campaign: AggregateReportCampaign;
+  version_number: number | null;
+  completion_state: "not_started" | "in_progress" | "completed" | "partially_completed" | "incomplete" | "outcome_unknown" | "suppressed";
+  population: {
+    denominator: AggregateReportCount;
+    denominator_definition: string;
+    inactive_source_entries: AggregateReportCount;
+    excluded_or_blocked_jobs: AggregateReportCount;
+  };
+  outcomes: {
+    smtp_accepted: AggregateReportCount;
+    failed: AggregateReportCount;
+    outcome_unknown: AggregateReportCount;
+    queued_or_active: AggregateReportCount;
+    cancelled: AggregateReportCount;
+    excluded: AggregateReportCount;
+    not_attempted: AggregateReportCount;
+  };
+  time_range: {
+    first_activity_at: string | null;
+    last_activity_at: string | null;
+    suppressed: boolean;
+  };
+  privacy: {
+    small_cell_threshold: number;
+    suppression_applied: boolean;
+    rule: string;
+  };
+};
+
 export async function listCampaigns(settings: ApiSettings): Promise<CampaignListItem[]> {
   const response = await apiFetch<CampaignListResponse>(settings, "/api/v1/campaigns");
 
@@ -378,6 +517,13 @@ export async function listCampaigns(settings: ApiSettings): Promise<CampaignList
   return response.campaigns ?? response.items ?? response.results ?? [];
 }
 
+export async function listAggregateReportCampaigns(
+settings: ApiSettings)
+: Promise<AggregateReportCampaignListItem[]> {
+  const response = await apiFetch<{campaigns: AggregateReportCampaignListItem[]}>(settings, "/api/v1/campaigns/aggregate-reports");
+  return response.campaigns;
+}
+
 export async function listCampaignsDelta(
 settings: ApiSettings,
 options: {since?: string | null;limit?: number;} = {})
@@ -419,6 +565,34 @@ export async function deleteRecipientImportMappingProfile(settings: ApiSettings,
   await apiFetch<void>(settings, `/api/v1/campaigns/recipient-import/mapping-profiles/${encodeURIComponent(profileId)}`, { method: "DELETE" });
 }
 
+export async function lookupCampaignAddresses(
+settings: ApiSettings,
+campaignId: string,
+query: string,
+limit = 25)
+: Promise<CampaignAddressLookupResponse> {
+  const params = new URLSearchParams({ query, limit: String(limit) });
+  return apiFetch<CampaignAddressLookupResponse>(settings, `/api/v1/campaigns/${campaignId}/address-lookup?${params.toString()}`);
+}
+
+export async function listCampaignRecipientAddressSources(
+settings: ApiSettings,
+campaignId: string)
+: Promise<CampaignRecipientAddressSourcesResponse> {
+  return apiFetch<CampaignRecipientAddressSourcesResponse>(settings, `/api/v1/campaigns/${campaignId}/recipient-address-sources`);
+}
+
+export async function snapshotCampaignRecipientAddressSource(
+settings: ApiSettings,
+campaignId: string,
+sourceId: string)
+: Promise<CampaignRecipientAddressSourceSnapshot> {
+  return apiFetch<CampaignRecipientAddressSourceSnapshot>(settings, `/api/v1/campaigns/${campaignId}/recipient-address-sources/snapshot`, {
+    method: "POST",
+    body: JSON.stringify({ source_id: sourceId })
+  });
+}
+
 export async function getCampaign(settings: ApiSettings, campaignId: string): Promise<CampaignListItem> {
   return apiFetch<CampaignListItem>(settings, `/api/v1/campaigns/${campaignId}`);
 }
@@ -621,11 +795,12 @@ versionId: string)
 export async function validateVersion(
 settings: ApiSettings,
 versionId: string,
-checkFiles = false)
+checkFiles = false,
+linkUnsharedMatches = false)
 : Promise<Record<string, unknown>> {
   return apiFetch<Record<string, unknown>>(settings, `/api/v1/campaigns/versions/${versionId}/validate`, {
     method: "POST",
-    body: JSON.stringify({ check_files: checkFiles })
+    body: JSON.stringify({ check_files: checkFiles, link_unshared_matches: linkUnsharedMatches })
   });
 }
 
@@ -654,6 +829,19 @@ payload: CampaignAttachmentPreviewPayload = {})
   );
 }
 
+export function linkCampaignAttachmentMatches(
+settings: ApiSettings,
+campaignId: string,
+versionId: string,
+payload: CampaignAttachmentLinkMatchesPayload = {})
+: Promise<CampaignAttachmentLinkMatchesResponse> {
+  return apiFetch<CampaignAttachmentLinkMatchesResponse>(
+    settings,
+    `/api/v1/campaigns/${campaignId}/versions/${versionId}/attachments/link-matches`,
+    { method: "POST", body: JSON.stringify(payload) }
+  );
+}
+
 export async function getCampaignSummary(
 settings: ApiSettings,
 campaignId: string,
@@ -668,15 +856,7 @@ settings: ApiSettings,
 campaignId: string,
 options: CampaignJobsQuery = {})
 : Promise<CampaignJobsResponse> {
-  const params = new URLSearchParams();
-  if (options.versionId) params.set("version_id", options.versionId);
-  if (options.page) params.set("page", String(options.page));
-  if (options.pageSize) params.set("page_size", String(options.pageSize));
-  if (options.cursor) params.set("cursor", options.cursor);
-  for (const value of options.sendStatus ?? []) params.append("send_status", value);
-  for (const value of options.validationStatus ?? []) params.append("validation_status", value);
-  for (const value of options.imapStatus ?? []) params.append("imap_status", value);
-  if (options.query?.trim()) params.set("q", options.query.trim());
+  const params = campaignJobsQueryParams(options);
   const suffix = params.size > 0 ? `?${params.toString()}` : "";
   return apiFetch<CampaignJobsResponse>(settings, `/api/v1/campaigns/${campaignId}/jobs${suffix}`);
 }
@@ -686,17 +866,7 @@ settings: ApiSettings,
 campaignId: string,
 options: CampaignJobsQuery & {since?: string | null;limit?: number;} = {})
 : Promise<CampaignJobsDeltaResponse> {
-  const params = new URLSearchParams();
-  if (options.versionId) params.set("version_id", options.versionId);
-  if (options.page) params.set("page", String(options.page));
-  if (options.pageSize) params.set("page_size", String(options.pageSize));
-  if (options.cursor) params.set("cursor", options.cursor);
-  for (const value of options.sendStatus ?? []) params.append("send_status", value);
-  for (const value of options.validationStatus ?? []) params.append("validation_status", value);
-  for (const value of options.imapStatus ?? []) params.append("imap_status", value);
-  if (options.query?.trim()) params.set("q", options.query.trim());
-  if (options.since) params.set("since", options.since);
-  if (options.limit) params.set("limit", String(options.limit));
+  const params = campaignJobsQueryParams(options);
   const suffix = params.size > 0 ? `?${params.toString()}` : "";
   return apiFetch<CampaignJobsDeltaResponse>(settings, `/api/v1/campaigns/${campaignId}/jobs/delta${suffix}`);
 }
@@ -719,6 +889,16 @@ versionId?: string)
   return apiFetch<CampaignSummary>(settings, `/api/v1/campaigns/${campaignId}/report?${params.toString()}`);
 }
 
+export async function getAggregateCampaignReport(
+settings: ApiSettings,
+campaignId: string)
+: Promise<AggregateCampaignReport> {
+  return apiFetch<AggregateCampaignReport>(
+    settings,
+    `/api/v1/campaigns/aggregate-reports/${encodeURIComponent(campaignId)}`
+  );
+}
+
 export async function downloadCampaignJobsCsv(
 settings: ApiSettings,
 campaignId: string,
@@ -765,11 +945,23 @@ payload: Record<string, unknown> = {})
   });
 }
 
+export async function sendCampaignJob(
+settings: ApiSettings,
+campaignId: string,
+jobId: string,
+payload: CampaignSendJobPayload = {})
+: Promise<Record<string, unknown>> {
+  return apiFetch<Record<string, unknown>>(settings, `/api/v1/campaigns/${campaignId}/jobs/${jobId}/send`, {
+    method: "POST",
+    body: JSON.stringify(payload)
+  });
+}
+
 export async function resolveCampaignJobOutcome(
 settings: ApiSettings,
 campaignId: string,
 jobId: string,
-decision: "smtp_accepted" | "not_sent",
+decision: "smtp_accepted" | "not_sent" | "imap_appended" | "imap_not_appended",
 note?: string)
 : Promise<Record<string, unknown>> {
   return apiFetch<Record<string, unknown>>(settings, `/api/v1/campaigns/${campaignId}/jobs/${jobId}/resolve-outcome`, {
@@ -801,6 +993,15 @@ payload: CampaignQueuePayload = {})
   });
 }
 
+export async function getCampaignDeliveryOptions(
+settings: ApiSettings,
+campaignId: string,
+versionId?: string | null)
+: Promise<CampaignDeliveryOptions> {
+  const query = versionId ? `?version_id=${encodeURIComponent(versionId)}` : "";
+  return apiFetch<CampaignDeliveryOptions>(settings, `/api/v1/campaigns/${campaignId}/delivery-options${query}`);
+}
+
 export async function sendCampaignNow(
 settings: ApiSettings,
 campaignId: string,
@@ -855,20 +1056,6 @@ export async function getCampaignShareTargets(settings: ApiSettings, campaignId:
   return apiFetch<CampaignShareTargets>(settings, `/api/v1/campaigns/${campaignId}/share-targets`);
 }
 
-export function fetchResourceAccessExplanation(
-settings: ApiSettings,
-options: {userId: string;resourceType: string;resourceId: string;action: string;tenantId?: string | null;})
-: Promise<ResourceAccessExplanationResponse> {
-  const params = new URLSearchParams({
-    user_id: options.userId,
-    resource_type: options.resourceType,
-    resource_id: options.resourceId,
-    action: options.action
-  });
-  if (options.tenantId) params.set("tenant_id", options.tenantId);
-  return apiFetch<ResourceAccessExplanationResponse>(settings, `/api/v1/admin/access/resource-explanation?${params.toString()}`);
-}
-
 export async function getCampaignShares(settings: ApiSettings, campaignId: string): Promise<CampaignShare[]> {
   const response = await apiFetch<{shares: CampaignShare[];}>(settings, `/api/v1/campaigns/${campaignId}/shares`);
   return response.shares;

webui/src/api/client.ts

@@ -1 +1 @@
-export { apiFetch, apiUrl, authHeaders, csrfToken, apiDownload } from "@govoplan/core-webui";
+export { apiDownload, apiFetch, apiGetList, apiPath, apiPost, apiPostJson, apiQuery, apiUrl, authHeaders, csrfToken } from "@govoplan/core-webui";

webui/src/api/mail.ts

@@ -1,222 +1,50 @@
-import type { ApiSettings } from "../types";
-import { apiFetch } from "./client";
+import type {
+  ApiSettings,
+  MailConnectionTestResponse,
+  MailImapFolderListResponse,
+  MailServerProfile,
+  MockMailboxMessageResponse
+} from "@govoplan/core-webui";
+import { apiFetch, apiGetList, apiPost } from "./client";
 
-export type MailSecurity = "plain" | "tls" | "starttls";
-export type MailProfileScope = "system" | "tenant" | "user" | "group" | "campaign";
+const profileActionEndpoints = {
+  smtp: "test-smtp",
+  imap: "test-imap",
+  folders: "list-imap-folders"
+} as const;
 
-export type MailSmtpTestPayload = {
-  host?: string | null;
-  port?: number | null;
-  username?: string | null;
-  password?: string | null;
-  security?: MailSecurity;
-  timeout_seconds?: number;
-};
-
-export type MailImapTestPayload = MailSmtpTestPayload & {
-  sent_folder?: string | null;
-};
-
-export type MailTransportCredentialsPayload = {
-  username?: string | null;
-  password?: string | null;
-};
-
-export type MailServerProfileCredentialsPayload = {
-  smtp?: MailTransportCredentialsPayload;
-  imap?: MailTransportCredentialsPayload;
-};
-
-export type MailConnectionTestResponse = {
-  ok: boolean;
-  protocol: "smtp" | "imap";
-  host?: string | null;
-  port?: number | null;
-  security?: MailSecurity | string | null;
-  message: string;
-  details?: Record<string, unknown>;
-};
-
-export type MailImapFolderResponse = {
-  name: string;
-  flags?: string[];
-};
-
-export type MailImapFolderListResponse = {
-  ok: boolean;
-  protocol: "imap";
-  host?: string | null;
-  port?: number | null;
-  security?: MailSecurity | string | null;
-  message: string;
-  folders: MailImapFolderResponse[];
-  detected_sent_folder?: string | null;
-  details?: Record<string, unknown>;
-};
-
-export type MailServerProfile = {
-  id: string;
-  tenant_id?: string | null;
-  scope_type: MailProfileScope;
-  scope_id?: string | null;
-  name: string;
-  slug: string;
-  description?: string | null;
-  is_active: boolean;
-  smtp: MailSmtpTestPayload;
-  imap?: MailImapTestPayload | null;
-  credentials?: MailServerProfileCredentialsPayload | null;
-  smtp_password_configured: boolean;
-  imap_password_configured: boolean;
-  created_at: string;
-  updated_at: string;
-};
-
-export type MailServerProfileListResponse = { profiles: MailServerProfile[] };
-
-export const mailProfilePatternKeys = [
-  "smtp_hosts",
-  "imap_hosts",
-  "envelope_senders",
-  "from_headers",
-  "recipient_domains"
-] as const;
-
-export type MailProfilePatternKey = typeof mailProfilePatternKeys[number];
-export type MailProfilePatternRules = Partial<Record<MailProfilePatternKey, string[]>>;
-
-export type MailCredentialPolicy = {
-  inherit?: boolean | null;
-  allow_override?: boolean | null;
-};
-
-export type MailProfilePolicy = {
-  allowed_profile_ids?: string[] | null;
-  allow_user_profiles?: boolean | null;
-  allow_group_profiles?: boolean | null;
-  allow_campaign_profiles?: boolean | null;
-  smtp_credentials?: MailCredentialPolicy | null;
-  imap_credentials?: MailCredentialPolicy | null;
-  whitelist?: MailProfilePatternRules | null;
-  blacklist?: MailProfilePatternRules | null;
-};
-
-export type PolicySourceStep = {
-  scope_type: string;
-  scope_id?: string | null;
-  label: string;
-  applied_fields?: string[];
-};
-
-export type MailProfilePolicyResponse = {
-  scope_type: MailProfileScope;
-  scope_id?: string | null;
-  policy: MailProfilePolicy;
-  effective_policy?: MailProfilePolicy | null;
-  parent_policy?: MailProfilePolicy | null;
-  effective_policy_sources?: PolicySourceStep[];
-  parent_policy_sources?: PolicySourceStep[];
-};
-
-export type MailServerProfilePayload = {
-  name: string;
-  slug?: string | null;
-  description?: string | null;
-  is_active?: boolean;
-  scope_type?: MailProfileScope;
-  scope_id?: string | null;
-  smtp: MailSmtpTestPayload;
-  imap?: MailImapTestPayload | null;
-  credentials?: MailServerProfileCredentialsPayload | null;
-};
+function runProfileAction<TResponse>(
+  settings: ApiSettings,
+  profileId: string,
+  action: keyof typeof profileActionEndpoints
+): Promise<TResponse> {
+  return apiPost<TResponse>(
+    settings,
+    `/api/v1/mail/profiles/${encodeURIComponent(profileId)}/${profileActionEndpoints[action]}`
+  );
+}
 
 export async function listMailServerProfiles(settings: ApiSettings, includeInactive = false, campaignId?: string): Promise<MailServerProfile[]> {
-  const params = new URLSearchParams();
-  if (includeInactive) params.set("include_inactive", "true");
-  if (campaignId) params.set("campaign_id", campaignId);
-  const suffix = params.toString() ? `?${params.toString()}` : "";
-  const response = await apiFetch<MailServerProfileListResponse>(settings, `/api/v1/mail/profiles${suffix}`);
-  return response.profiles ?? [];
-}
-
-export async function createMailServerProfile(settings: ApiSettings, payload: MailServerProfilePayload): Promise<MailServerProfile> {
-  return apiFetch<MailServerProfile>(settings, "/api/v1/mail/profiles", {
-    method: "POST",
-    body: JSON.stringify(payload)
+  return apiGetList<MailServerProfile, "profiles">(settings, "/api/v1/mail/profiles", "profiles", {
+    include_inactive: includeInactive ? true : undefined,
+    campaign_id: campaignId
   });
 }
 
-export async function getMailProfilePolicy(
-  settings: ApiSettings,
-  scopeType: MailProfileScope,
-  scopeId?: string | null,
-  campaignId?: string | null
-): Promise<MailProfilePolicyResponse> {
-  const params = new URLSearchParams();
-  if (scopeId) params.set("scope_id", scopeId);
-  if (campaignId) params.set("campaign_id", campaignId);
-  const suffix = params.toString() ? `?${params.toString()}` : "";
-  return apiFetch<MailProfilePolicyResponse>(settings, `/api/v1/mail/policies/${encodeURIComponent(scopeType)}${suffix}`);
-}
-
 export async function testMailProfileSmtp(settings: ApiSettings, profileId: string): Promise<MailConnectionTestResponse> {
-  return apiFetch<MailConnectionTestResponse>(settings, `/api/v1/mail/profiles/${encodeURIComponent(profileId)}/test-smtp`, { method: "POST" });
+  return runProfileAction<MailConnectionTestResponse>(settings, profileId, "smtp");
 }
 
 export async function testMailProfileImap(settings: ApiSettings, profileId: string): Promise<MailConnectionTestResponse> {
-  return apiFetch<MailConnectionTestResponse>(settings, `/api/v1/mail/profiles/${encodeURIComponent(profileId)}/test-imap`, { method: "POST" });
+  return runProfileAction<MailConnectionTestResponse>(settings, profileId, "imap");
 }
 
 export async function listMailProfileImapFolders(settings: ApiSettings, profileId: string): Promise<MailImapFolderListResponse> {
-  return apiFetch<MailImapFolderListResponse>(settings, `/api/v1/mail/profiles/${encodeURIComponent(profileId)}/list-imap-folders`, { method: "POST" });
+  return runProfileAction<MailImapFolderListResponse>(settings, profileId, "folders");
 }
 
-export async function testSmtpSettings(settings: ApiSettings, payload: MailSmtpTestPayload): Promise<MailConnectionTestResponse> {
-  return apiFetch<MailConnectionTestResponse>(settings, "/api/v1/mail/test-smtp", {
-    method: "POST",
-    body: JSON.stringify(payload)
-  });
-}
-
-export async function testImapSettings(settings: ApiSettings, payload: MailImapTestPayload): Promise<MailConnectionTestResponse> {
-  return apiFetch<MailConnectionTestResponse>(settings, "/api/v1/mail/test-imap", {
-    method: "POST",
-    body: JSON.stringify(payload)
-  });
-}
-
-export async function listImapFolders(settings: ApiSettings, payload: MailImapTestPayload): Promise<MailImapFolderListResponse> {
-  return apiFetch<MailImapFolderListResponse>(settings, "/api/v1/mail/list-imap-folders", {
-    method: "POST",
-    body: JSON.stringify(payload)
-  });
-}
-
-export type MockMailboxMessage = {
-  id: string;
-  kind: "smtp" | "imap_append" | string;
-  created_at: string;
-  envelope_from?: string | null;
-  envelope_recipients?: string[];
-  subject?: string | null;
-  from_header?: string | null;
-  to_header?: string | null;
-  cc_header?: string | null;
-  bcc_header?: string | null;
-  message_id?: string | null;
-  size_bytes?: number;
-  body_preview?: string | null;
-  attachment_count?: number;
-  folder?: string | null;
-  raw_eml?: string | null;
-  headers?: Record<string, string>;
-  attachments?: Array<{ filename?: string | null; content_type?: string | null; size_bytes?: number }>;
-};
-
-export type MockMailboxMessageResponse = {
-  message: MockMailboxMessage;
-};
-
 export async function getMockMailboxMessage(settings: ApiSettings, id: string): Promise<MockMailboxMessageResponse> {
   return apiFetch<MockMailboxMessageResponse>(settings, `/api/v1/dev/mailbox/messages/${encodeURIComponent(id)}`);
 }
+
+export type { MailConnectionTestResponse, MailImapFolderListResponse, MailImapFolderResponse, MailServerProfile, MailServerProfileListResponse, MockMailboxMessage, MockMailboxMessageResponse } from "@govoplan/core-webui";

webui/src/components/table/DataGrid.tsx

@@ -1,4 +0,0 @@
-import { DataGrid, DataGridEmptyAction, DataGridRowActions } from "@govoplan/core-webui";
-export type { DataGridColumn, DataGridListOption, DataGridPagination, DataGridQueryState, DataGridSortDirection } from "@govoplan/core-webui";
-export { DataGridEmptyAction, DataGridRowActions };
-export default DataGrid;

webui/src/features/addressbook/AddressBookPage.tsx

@@ -1,97 +0,0 @@
-import { Button } from "@govoplan/core-webui";
-import { Card } from "@govoplan/core-webui";
-import { PageTitle } from "@govoplan/core-webui";
-import { StatusBadge } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn } from "../../components/table/DataGrid";
-
-const personalContacts = [
-{ name: "i18n:govoplan-campaign.ada_lovelace.a69a9f8a", email: "ada@example.local", source: "Personal", tags: "i18n:govoplan-campaign.used_recently.af75cea7" },
-{ name: "i18n:govoplan-campaign.grace_hopper.d97e6939", email: "grace@example.local", source: "Personal", tags: "i18n:govoplan-campaign.favorite.6b90b6a1" }];
-
-
-const groupContacts = [
-{ name: "i18n:govoplan-campaign.project_office.c35aa9ca", email: "project-office@example.local", source: "Group", tags: "i18n:govoplan-campaign.shared.50d0d8dd" },
-{ name: "i18n:govoplan-campaign.finance_team.ff353e5c", email: "finance@example.local", source: "Group", tags: "i18n:govoplan-campaign.shared_list.b3c94b39" }];
-
-
-const tenantContacts = [
-{ name: "i18n:govoplan-campaign.helpdesk.191815bf", email: "helpdesk@example.local", source: "Tenant", tags: "i18n:govoplan-campaign.directory.4b892fe0" },
-{ name: "i18n:govoplan-campaign.data_protection.06e87cd3", email: "privacy@example.local", source: "Tenant", tags: "i18n:govoplan-campaign.directory.4b892fe0" }];
-
-
-function contactColumns(): DataGridColumn<{name: string;email: string;source: string;tags: string;}>[] {
-  return [
-  { id: "name", header: "i18n:govoplan-campaign.name.709a2322", width: "minmax(180px, 1fr)", sortable: true, filterable: true, sticky: "start", render: (contact) => <strong>{contact.name}</strong>, value: (contact) => contact.name },
-  { id: "email", header: "i18n:govoplan-campaign.email.84add5b2", width: 240, sortable: true, filterable: true, value: (contact) => contact.email },
-  { id: "scope", header: "i18n:govoplan-campaign.scope.4651a34e", width: 140, sortable: true, filterable: true, columnType: "from-list", list: { options: [{ value: "Personal", label: "i18n:govoplan-campaign.personal.40f07323" }, { value: "Group", label: "i18n:govoplan-campaign.group.171a0606" }, { value: "Tenant", label: "i18n:govoplan-campaign.tenant.3ca93c78" }] }, value: (contact) => contact.source },
-  { id: "tags", header: "i18n:govoplan-campaign.tags.848eed0f", width: 180, sortable: true, filterable: true, value: (contact) => contact.tags },
-  { id: "status", header: "i18n:govoplan-campaign.status.bae7d5be", width: 130, sortable: true, filterable: true, columnType: "from-list", list: { options: [{ value: "mock", label: "i18n:govoplan-campaign.mock.3bba2a47" }], display: "pill" }, render: () => <StatusBadge status="mock" />, value: () => "mock" }];
-
-}
-
-export default function AddressBookPage() {
-  const allContacts = [...personalContacts, ...groupContacts, ...tenantContacts];
-
-  return (
-    <div className="content-pad workspace-data-page module-entry-page address-book-page">
-      <div className="page-heading split workspace-heading">
-        <div>
-          <PageTitle>i18n:govoplan-campaign.address_book.f6327f59</PageTitle>
-          <p>i18n:govoplan-campaign.mock_workspace_for_personal_group_and_tenant_add.ce99f4d4</p>
-        </div>
-        <div className="button-row compact-actions">
-          <Button disabled>i18n:govoplan-campaign.import.d6fbc9d2</Button>
-          <Button variant="primary" disabled>i18n:govoplan-campaign.add_contact.6da0b4b8</Button>
-        </div>
-      </div>
-
-      <div className="metric-grid">
-        <Card title="i18n:govoplan-campaign.personal.40f07323"><strong className="module-big-number">{personalContacts.length}</strong><p className="muted">i18n:govoplan-campaign.private_contacts_and_remembered_addresses.2bd71556</p></Card>
-        <Card title="i18n:govoplan-campaign.group.171a0606"><strong className="module-big-number">{groupContacts.length}</strong><p className="muted">i18n:govoplan-campaign.shared_group_address_books_and_lists.12bac69d</p></Card>
-        <Card title="i18n:govoplan-campaign.tenant.3ca93c78"><strong className="module-big-number">{tenantContacts.length}</strong><p className="muted">i18n:govoplan-campaign.tenant_directory_and_approved_shared_contacts.fa671f1b</p></Card>
-        <Card title="i18n:govoplan-campaign.sync.905f6309"><strong className="module-big-number">i18n:govoplan-campaign.mock.3bba2a47</strong><p className="muted">i18n:govoplan-campaign.carddav_ldap_import_connectors_can_be_added_late.0471f513</p></Card>
-      </div>
-
-      <div className="dashboard-grid settings-dashboard-grid">
-        <Card title="i18n:govoplan-campaign.address_book_scopes.b0d0efde">
-          <div className="address-book-scope-list">
-            <AddressBookScope title="i18n:govoplan-campaign.personal_address_book.e240066d" description="i18n:govoplan-campaign.private_contacts_remembered_recipients_and_perso.685cca95" status="Local" />
-            <AddressBookScope title="i18n:govoplan-campaign.group_address_books.aed5a7c0" description="i18n:govoplan-campaign.shared_contact_sets_for_teams_departments_or_cam.4408edd7" status="Shared" />
-            <AddressBookScope title="i18n:govoplan-campaign.tenant_directory.11b0e09c" description="i18n:govoplan-campaign.tenant_wide_contacts_functional_mailboxes_and_ap.c437a8b9" status="Directory" />
-          </div>
-        </Card>
-        <Card title="i18n:govoplan-campaign.planned_address_actions.1d4a056a">
-          <div className="placeholder-stack">
-            <span>i18n:govoplan-campaign.choose_addresses_from_personal_group_or_tenant_s.3d6dc0e4</span>
-            <span>i18n:govoplan-campaign.remember_addresses_used_in_campaigns_after_opt_i.6f8b2529</span>
-            <span>i18n:govoplan-campaign.share_selected_contacts_with_a_group.604d1464</span>
-            <span>i18n:govoplan-campaign.use_contacts_in_to_cc_bcc_sender_and_reply_to_fi.79f3ea6a</span>
-          </div>
-        </Card>
-      </div>
-
-      <Card title="i18n:govoplan-campaign.contacts.b0dd615c" actions={<Button disabled>i18n:govoplan-campaign.manage_sources.ec758de0</Button>}>
-        <DataGrid
-          id="address-book-contacts"
-          rows={allContacts}
-          columns={contactColumns()}
-          getRowKey={(contact) => contact.source + "-" + contact.email}
-          emptyText="i18n:govoplan-campaign.no_contacts_found.ad977b09"
-          className="compact-table-wrap module-table" />
-        
-      </Card>
-    </div>);
-
-}
-
-function AddressBookScope({ title, description, status }: {title: string;description: string;status: string;}) {
-  return (
-    <div className="address-book-scope-card">
-      <div>
-        <strong>{title}</strong>
-        <p>{description}</p>
-      </div>
-      <StatusBadge status={status} />
-    </div>);
-
-}

webui/src/features/campaigns/AttachmentsDataPage.tsx

@@ -6,12 +6,13 @@ import { Button } from "@govoplan/core-webui";
 import { Card } from "@govoplan/core-webui";
 import { PageTitle } from "@govoplan/core-webui";
 import { LoadingFrame } from "@govoplan/core-webui";
+import { MetricCard } from "@govoplan/core-webui";
 import LockedVersionNotice from "./components/LockedVersionNotice";
 import VersionLine from "./components/VersionLine";
 import { ToggleSwitch } from "@govoplan/core-webui";
 import { DismissibleAlert } from "@govoplan/core-webui";
 import { ConfirmDialog } from "@govoplan/core-webui";
-import DataGrid, { DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "../../components/table/DataGrid";
+import { DataGrid, DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "@govoplan/core-webui";
 import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
 import { useCampaignDraftEditor } from "./hooks/useCampaignDraftEditor";
 import { asArray, asRecord, isAuditLockedVersion } from "./utils/campaignView";
@@ -40,7 +41,7 @@ export default function AttachmentsDataPage({ settings, campaignId }: {settings:
   const [zipNameEditorIndex, setZipNameEditorIndex] = useState<number | null>(null);
   const version = data.currentVersion;
   const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, setDraft, displayDraft, dirty, saveState, localError, patch, markDirty, saveDraft } = useCampaignDraftEditor({
+  const { draft, setDraft, displayDraft, dirty, saveState, localError, patch, markDirty, discardDraft, saveDraft } = useCampaignDraftEditor({
     settings,
     campaignId,
     version,
@@ -238,7 +239,7 @@ export default function AttachmentsDataPage({ settings, campaignId }: {settings:
         </div>
         <div className="button-row compact-actions">
           {filesModuleInstalled && <Button onClick={() => navigate("/files")}>i18n:govoplan-campaign.manage_files.90a419f7</Button>}
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void discardDraft()} disabled={loading}>Discard</Button>
           <Button variant="primary" onClick={() => saveDraft("manual")} disabled={!canSave}>i18n:govoplan-campaign.save.efc007a3</Button>
         </div>
       </div>
@@ -249,6 +250,13 @@ export default function AttachmentsDataPage({ settings, campaignId }: {settings:
 
       <LoadingFrame loading={loading || !draft} label="i18n:govoplan-campaign.loading_campaign_draft.1cf47e50">
         <>
+          <div className="metric-grid attachment-statistics-grid">
+            <MetricCard label="i18n:govoplan-campaign.base_paths.edf35a97" value={basePaths.length} tone="neutral" />
+            <MetricCard label="i18n:govoplan-campaign.global_attachments.438263a1" value={`${globalSummary.direct} / ${globalSummary.rules}`} tone="info" detail="direct / rules" />
+            <MetricCard label="i18n:govoplan-campaign.per_recipient_patterns.53da30da" value={individualRulesCount} tone="neutral" />
+            <MetricCard label="i18n:govoplan-campaign.upload_support.1c54931c" value={managedFilesAvailable ? "Files" : "Manual"} tone={managedFilesAvailable ? "good" : filesModuleInstalled ? "warning" : "neutral"} />
+          </div>
+
           <Card title="i18n:govoplan-campaign.attachment_sources.8ef0a6ce">
             <div className="admin-table-surface attachment-sources-table-surface">
               <DataGrid
@@ -300,7 +308,6 @@ export default function AttachmentsDataPage({ settings, campaignId }: {settings:
             {zipArchiveNameValidation.message &&
             <DismissibleAlert tone="danger" compact resetKey={zipArchiveNameValidation.message} className="attachment-zip-name-error">{zipArchiveNameValidation.message}</DismissibleAlert>
             }
-            <p className="muted small-note">i18n:govoplan-campaign.archive_names_support_recipient_and_campaign_fie.d5b1b2d1</p>
           </Card>
 
           <Card title="i18n:govoplan-campaign.global_attachments.492bd841" collapsible>
@@ -319,20 +326,6 @@ export default function AttachmentsDataPage({ settings, campaignId }: {settings:
             
           </Card>
 
-          <Card title="i18n:govoplan-campaign.statistics.2086b21f" collapsible>
-            <dl className="detail-list">
-              <div><dt>i18n:govoplan-campaign.base_paths.edf35a97</dt><dd>{basePaths.length}</dd></div>
-              <div><dt>i18n:govoplan-campaign.global_attachments.438263a1</dt><dd>direct: {globalSummary.direct} i18n:govoplan-campaign.rules.e5d36074 {globalSummary.rules}</dd></div>
-              <div><dt>i18n:govoplan-campaign.per_recipient_patterns.53da30da</dt><dd>{individualRulesCount}</dd></div>
-              <div><dt>i18n:govoplan-campaign.upload_support.1c54931c</dt><dd>{managedFilesAvailable ? "i18n:govoplan-campaign.connected_through_files.95007112" : "i18n:govoplan-campaign.manual_paths.8e20627a"}</dd></div>
-            </dl>
-            <p className="muted small-note">{managedFilesAvailable ?
-              "i18n:govoplan-campaign.files_are_managed_in_the_top_level_files_module_.4b370222" :
-              filesModuleInstalled ?
-              "i18n:govoplan-campaign.managed_file_browsing_is_unavailable_use_manual_.782867fe" :
-              "i18n:govoplan-campaign.the_files_module_is_not_installed_use_manual_pat.49abc725"}</p>
-          </Card>
-
         </>
       </LoadingFrame>
 
@@ -450,6 +443,19 @@ function zipArchiveColumns({ disabled, archives, invalidNameIndexes, onEditName,
     render: (archive, index) => <ToggleSwitch label="i18n:govoplan-campaign.protected.28531336" checked={archive.password_enabled} disabled={disabled} onChange={(checked) => patchArchive(index, { password_enabled: checked })} />,
     value: (archive) => archive.password_enabled ? "protected" : "none"
   },
+  {
+    id: "method", header: "ZIP mode", width: 280, sortable: true, filterable: true,
+    columnType: "from-list", list: { options: [{ value: "aes", label: "AES" }, { value: "zip_standard", label: "Win-compatible" }] },
+    render: (archive, index) =>
+    <ToggleSwitch
+      label="Win-compatible"
+      checked={archive.method === "zip_standard"}
+      disabled={disabled}
+      help="Win-compatible ZIP uses the legacy ZipCrypto format so password-protected archives can be opened with Windows Explorer. Use AES when recipients can use 7-Zip, NanaZip, WinRAR, or another AES-capable ZIP tool."
+      onChange={(checked) => patchArchive(index, { method: checked ? "zip_standard" : "aes" })} />,
+
+    value: (archive) => archive.method
+  },
   {
     id: "password_field", header: "i18n:govoplan-campaign.password_field.a1fc8a1c", width: 230, sortable: true, filterable: true,
     columnType: "from-list", list: { options: [{ value: "", label: "i18n:govoplan-campaign.no_field.1fe00ed4" }, ...passwordFields.map((field) => ({ value: field.name, label: field.label || field.name }))] },

webui/src/features/campaigns/CampaignAuditPage.tsx

@@ -19,7 +19,7 @@ export default function CampaignAuditPage({ settings, campaignId }: {settings: A
           <VersionLine version={version} versions={data.versions} loadedAt={version?.updated_at} />
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void reload({ force: true })} disabled={loading}>Discard</Button>
         </div>
       </div>
 
@@ -32,4 +32,4 @@ export default function CampaignAuditPage({ settings, campaignId }: {settings: A
       </LoadingFrame>
     </div>);
 
-}
+}

webui/src/features/campaigns/CampaignFieldsPage.tsx

@@ -13,7 +13,7 @@ import { asRecord, isAuditLockedVersion, isRecord } from "./utils/campaignView";
 import { getBool, getText, updateNested } from "./utils/draftEditor";
 import FieldValueInput from "./components/FieldValueInput";
 import { DismissibleAlert } from "@govoplan/core-webui";
-import DataGrid, { DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "../../components/table/DataGrid";
+import { DataGrid, DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "@govoplan/core-webui";
 import { fieldTypeOptions, humanizeFieldName, normalizeFieldType, type CampaignFieldDefinition } from "./utils/fieldDefinitions";
 import { insertAfter, moveArrayItem, i18nMessage } from "@govoplan/core-webui";
 export default function CampaignFieldsPage({ settings, campaignId }: {settings: ApiSettings;campaignId: string;}) {
@@ -22,7 +22,7 @@ export default function CampaignFieldsPage({ settings, campaignId }: {settings:
 
   const version = data.currentVersion;
   const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, setDraft, displayDraft, dirty, saveState, setSaveState, localError, setLocalError, markDirty, saveDraft } = useCampaignDraftEditor({
+  const { draft, setDraft, displayDraft, dirty, saveState, setSaveState, localError, setLocalError, markDirty, discardDraft, saveDraft } = useCampaignDraftEditor({
     settings,
     campaignId,
     version,
@@ -157,7 +157,7 @@ export default function CampaignFieldsPage({ settings, campaignId }: {settings:
           <VersionLine version={version} versions={data.versions} status={saveState} />
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void discardDraft()} disabled={loading}>Discard</Button>
           <Button variant="primary" onClick={saveFields} disabled={!canSave}>i18n:govoplan-campaign.save.efc007a3</Button>
         </div>
       </div>

webui/src/features/campaigns/CampaignJsonView.tsx

@@ -24,7 +24,7 @@ export default function CampaignJsonView({ settings, campaignId }: {settings: Ap
           <VersionLine version={version} versions={data.versions} loadedAt={version?.updated_at} />
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void reload({ force: true })} disabled={loading}>Discard</Button>
           <Button onClick={() => downloadJson(filename, campaignJson)} disabled={!version}>i18n:govoplan-campaign.download_json.d296a30a</Button>
         </div>
       </div>
@@ -36,4 +36,4 @@ export default function CampaignJsonView({ settings, campaignId }: {settings: Ap
       </LoadingFrame>
     </div>);
 
-}
+}

webui/src/features/campaigns/CampaignListPage.tsx

@@ -8,8 +8,8 @@ import { Button } from "@govoplan/core-webui";
 import { StatusBadge } from "@govoplan/core-webui";
 import { PageTitle } from "@govoplan/core-webui";
 import { LoadingFrame } from "@govoplan/core-webui";
-import { DismissibleAlert, i18nMessage, useGuardedNavigate } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn } from "../../components/table/DataGrid";
+import { DismissibleAlert, TableActionGroup, i18nMessage, useGuardedNavigate } from "@govoplan/core-webui";
+import { DataGrid, type DataGridColumn } from "@govoplan/core-webui";
 import { createNewCampaign, listCampaignsDelta, type CampaignDeltaResponse } from "../../api/campaigns";
 import type { CampaignListItem } from "../../types";
 
@@ -126,15 +126,13 @@ export default function CampaignListPage({ settings }: {settings: ApiSettings;})
     width: 70,
     sticky: "end",
     align: "right",
-    render: (campaign) =>
-    <Link
-      to={`/campaigns/${campaign.id}`}
-      className="btn btn-primary admin-icon-button"
-      aria-label={i18nMessage("i18n:govoplan-campaign.open_value.a34416a9", { value0: campaign.name || campaign.external_id || campaign.id })}
-      title={i18nMessage("i18n:govoplan-campaign.open_value.a34416a9", { value0: campaign.name || campaign.external_id || campaign.id })}>
-      
-          <ExternalLink aria-hidden="true" />
-        </Link>
+    render: (campaign) => <TableActionGroup actions={[{
+      id: "open",
+      label: i18nMessage("i18n:govoplan-campaign.open_value.a34416a9", { value0: campaign.name || campaign.external_id || campaign.id }),
+      icon: <ExternalLink aria-hidden="true" />,
+      variant: "primary",
+      onClick: () => navigate(`/campaigns/${campaign.id}`)
+    }]} />
 
   }];
 
@@ -149,7 +147,7 @@ export default function CampaignListPage({ settings }: {settings: ApiSettings;})
           <p className="mono-small">{lastLoadedAt ? i18nMessage("i18n:govoplan-campaign.last_loaded_value.35ef046a", { value0: lastLoadedAt }) : "i18n:govoplan-campaign.not_loaded_yet.9968c191"}</p>
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={load} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void load(null)} disabled={loading}>Discard</Button>
           <Button variant="primary" onClick={create} disabled={creating}>
             {creating ? "i18n:govoplan-campaign.creating.94d7d8ee" : "i18n:govoplan-campaign.new_campaign.aaf9a8a4"}
           </Button>

webui/src/features/campaigns/CampaignOverviewPage.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState } from "react";
-import { ExternalLink, LockKeyhole } from "lucide-react";
+import { ExternalLink, LockKeyhole, LockOpen } from "lucide-react";
 import { Link } from "react-router-dom";
 import type { ApiSettings } from "../../types";
 import { Button } from "@govoplan/core-webui";
@@ -10,8 +10,8 @@ import { LoadingFrame } from "@govoplan/core-webui";
 import { MetricCard } from "@govoplan/core-webui";
 import { PageTitle } from "@govoplan/core-webui";
 import { StatusBadge } from "@govoplan/core-webui";
-import { DismissibleAlert, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn } from "../../components/table/DataGrid";
+import { DismissibleAlert, TableActionGroup, i18nMessage, useGuardedNavigate, useUnsavedDraftGuard } from "@govoplan/core-webui";
+import { DataGrid, type DataGridColumn } from "@govoplan/core-webui";
 import {
   lockCampaignVersionPermanently,
   lockCampaignVersionTemporarily,
@@ -40,6 +40,7 @@ type LockAction = "temporary" | "unlock" | "permanent";
 type PendingLockAction = {version: CampaignVersionListItem;action: LockAction;} | null;
 
 export default function CampaignOverviewPage({ settings, campaignId }: {settings: ApiSettings;campaignId: string;}) {
+  const navigate = useGuardedNavigate();
   const { data, loading, error, reload, setError } = useCampaignWorkspaceData(settings, campaignId, { includeSummary: true });
   const campaign = data.campaign;
   const versions = useMemo(() => data.versions.slice().sort((a, b) => (b.version_number ?? 0) - (a.version_number ?? 0)), [data.versions]);
@@ -131,6 +132,19 @@ export default function CampaignOverviewPage({ settings, campaignId }: {settings
     }
   }
 
+  async function discardOverview() {
+    if (campaign) {
+      setIdentity({
+        external_id: campaign.external_id ?? "",
+        name: campaign.name ?? "",
+        status: campaign.status ?? "",
+        description: campaign.description ?? ""
+      });
+      setIdentityDirty(false);
+    }
+    await reload({ force: true });
+  }
+
   return (
     <div className="content-pad workspace-data-page">
       <div className="page-heading split workspace-heading">
@@ -139,8 +153,7 @@ export default function CampaignOverviewPage({ settings, campaignId }: {settings
           <p className="mono-small">i18n:govoplan-campaign.campaign_overview_version_independent_identity_a.ebaf1113</p>
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading || savingIdentity || lockBusy}>i18n:govoplan-campaign.reload.cce71553</Button>
-          <Link to="wizard/create"><Button>i18n:govoplan-campaign.edit_with_wizard.672a7d1a</Button></Link>
+          <Button onClick={() => void discardOverview()} disabled={loading || savingIdentity || lockBusy}>Discard</Button>
           <Button variant="primary" onClick={() => void saveIdentity()} disabled={!campaign || !identityDirty || savingIdentity}>{savingIdentity ? "i18n:govoplan-campaign.saving.56a2285c" : "i18n:govoplan-campaign.save.efc007a3"}</Button>
         </div>
       </div>
@@ -149,13 +162,6 @@ export default function CampaignOverviewPage({ settings, campaignId }: {settings
       {message && <DismissibleAlert tone="success" resetKey={message} floating>{message}</DismissibleAlert>}
 
       <LoadingFrame loading={loading} label="i18n:govoplan-campaign.loading_campaign_overview.ffa1adf0">
-        <div className="metric-grid campaign-overview-metrics current-version-metrics">
-          <MetricCard label="i18n:govoplan-campaign.version.2da600bf" value={data.currentVersion?.version_number ? `#${data.currentVersion.version_number}` : "—"} tone="neutral" />
-          <MetricCard label="i18n:govoplan-campaign.fields.e8b68527" value={versionMetrics.fieldCount} tone="info" />
-          <MetricCard label="i18n:govoplan-campaign.recipients.78cbf8eb" value={versionMetrics.recipientCount} tone="neutral" detail="i18n:govoplan-campaign.active_inline_recipients.8ba58f6e" />
-          <MetricCard label="i18n:govoplan-campaign.template_health.22e14b59" value={versionMetrics.templateHealthValue} tone={versionMetrics.templateHealthTone} detail={versionMetrics.templateHealthDetail} />
-        </div>
-
         <div className="metric-grid campaign-overview-metrics">
           <MetricCard label="i18n:govoplan-campaign.queueable.ea776f8d" value={data.summary?.cards?.queueable ?? "—"} tone="good" detail="i18n:govoplan-campaign.ready_or_warning.4dcce676" />
           <MetricCard label="i18n:govoplan-campaign.needs_attention.a126722e" value={data.summary?.cards?.needs_attention ?? "—"} tone="warning" detail="i18n:govoplan-campaign.review_first.741ac781" />
@@ -163,23 +169,10 @@ export default function CampaignOverviewPage({ settings, campaignId }: {settings
           <MetricCard label="i18n:govoplan-campaign.failed.09fef5d8" value={data.summary?.cards?.failed ?? "—"} tone="danger" detail="i18n:govoplan-campaign.smtp_failures.00b33b85" />
         </div>
 
-        <Card title="i18n:govoplan-campaign.current_version_state.f581778f" actions={<Link
-          to={`send?version=${campaign?.current_version_id}`}
-          className={`btn btn-primary`}
-          aria-label={i18nMessage("i18n:govoplan-campaign.open_curent_version.cc1cd678", {})}
-          title={i18nMessage("i18n:govoplan-campaign.open_curent_version.cc1cd678", {})}>
-          
-              i18n:govoplan-campaign.open.cf9b7706
-            </Link>}>
-          <div className="summary-grid overview-summary-grid">
-            <SummaryTile label="i18n:govoplan-campaign.validation_errors.e54ca4fe" value={summaryValue(data.currentVersion?.validation_summary, ["error_count", "errors", "blocked"])} />
-            <SummaryTile label="i18n:govoplan-campaign.warnings.1430f976" value={summaryValue(data.currentVersion?.validation_summary, ["warning_count", "warnings"])} />
-            <SummaryTile label="i18n:govoplan-campaign.built_messages.1fb804f2" value={summaryValue(data.currentVersion?.build_summary, ["built_count", "built", "messages_built"])} />
-            <SummaryTile label="i18n:govoplan-campaign.jobs_total.98da65bc" value={data.summary?.cards?.jobs_total ?? "—"} />
-          </div>
-        </Card>
-
-        <Card title="i18n:govoplan-campaign.campaign_identity.a00ca574" collapsible>
+        <Card
+          title="i18n:govoplan-campaign.campaign_identity.a00ca574"
+          collapsible
+          actions={<Link className="btn btn-secondary" to="wizard/create">i18n:govoplan-campaign.edit_with_wizard.672a7d1a</Link>}>
           <div className="form-grid campaign-identity-grid">
             <FormField label="i18n:govoplan-campaign.campaign_id.4c4ed79e">
               <input value={identity.external_id} onChange={(event) => patchIdentity("external_id", event.target.value)} />
@@ -198,12 +191,31 @@ export default function CampaignOverviewPage({ settings, campaignId }: {settings
           </div>
         </Card>
 
-        <Card title="i18n:govoplan-campaign.version_history.91f86581" collapsible>
-          <div className="admin-table-surface">
+        <Card title="Versions" collapsible actions={<Link
+          to={`send?version=${campaign?.current_version_id}`}
+          className={`btn btn-primary`}
+          aria-label={i18nMessage("i18n:govoplan-campaign.open_curent_version.cc1cd678", {})}
+          title={i18nMessage("i18n:govoplan-campaign.open_curent_version.cc1cd678", {})}>
+
+              i18n:govoplan-campaign.open.cf9b7706
+            </Link>}>
+          <div className="metric-grid inside campaign-versions-metrics">
+            <MetricCard label="i18n:govoplan-campaign.version.2da600bf" value={data.currentVersion?.version_number ? `#${data.currentVersion.version_number}` : "—"} tone="neutral" />
+            <MetricCard label="i18n:govoplan-campaign.fields.e8b68527" value={versionMetrics.fieldCount} tone="info" />
+            <MetricCard label="i18n:govoplan-campaign.recipients.78cbf8eb" value={versionMetrics.recipientCount} tone="neutral" detail="i18n:govoplan-campaign.active_inline_recipients.8ba58f6e" />
+            <MetricCard label="i18n:govoplan-campaign.template_health.22e14b59" value={versionMetrics.templateHealthValue} tone={versionMetrics.templateHealthTone} detail={versionMetrics.templateHealthDetail} />
+          </div>
+          <div className="metric-grid inside">
+            <MetricCard label="i18n:govoplan-campaign.validation_errors.e54ca4fe" value={summaryValue(data.currentVersion?.validation_summary, ["error_count", "errors", "blocked"])} />
+            <MetricCard label="i18n:govoplan-campaign.warnings.1430f976" value={summaryValue(data.currentVersion?.validation_summary, ["warning_count", "warnings"])} />
+            <MetricCard label="i18n:govoplan-campaign.built_messages.1fb804f2" value={summaryValue(data.currentVersion?.build_summary, ["built_count", "built", "messages_built"])} />
+            <MetricCard label="i18n:govoplan-campaign.jobs_total.98da65bc" value={data.summary?.cards?.jobs_total ?? "—"} />
+          </div>
+          <div className="admin-table-surface version-history-table-surface">
             <DataGrid
               id={`campaign-${campaignId}-versions`}
               rows={versions}
-              columns={versionColumns(setPendingLockAction, campaign?.current_version_id)}
+              columns={versionColumns(setPendingLockAction, navigate, campaign?.current_version_id)}
               getRowKey={(version) => version.id}
               initialSort={{ columnId: "version", direction: "desc" }}
               emptyText="i18n:govoplan-campaign.no_versions_found.a8284e9e"
@@ -285,7 +297,7 @@ function textValue(value: unknown, fallback = ""): string {
   return typeof value === "string" ? value : fallback;
 }
 
-function versionColumns(setPendingLockAction: (action: PendingLockAction) => void, currentVersionId?: string | null): DataGridColumn<CampaignVersionListItem>[] {
+function versionColumns(setPendingLockAction: (action: PendingLockAction) => void, navigate: (to: string) => void, currentVersionId?: string | null): DataGridColumn<CampaignVersionListItem>[] {
   return [
   { id: "version", header: "i18n:govoplan-campaign.version.2da600bf", width: 110, sortable: true, filterable: true, filterType: "integer", sticky: "start", render: (version) => `#${version.version_number}`, value: (version) => version.version_number ?? 0 },
   { id: "state", header: "i18n:govoplan-campaign.state.a7250206", width: 140, sortable: true, filterable: true, columnType: "from-list", list: { options: ["editing", "validated", "built", "approved", "queued", "sending", "sent", "completed", "partially_completed", "outcome_unknown", "failed", "partially_sent", "failed_partial", "cancelled", "archived"].map((value) => ({ value, label: value.replace(/_/g, " ") })), display: "pill" }, render: (version) => <StatusBadge status={version.workflow_state ?? "editing"} />, value: (version) => version.workflow_state ?? "editing" },
@@ -296,36 +308,18 @@ function versionColumns(setPendingLockAction: (action: PendingLockAction) => voi
   {
     id: "actions",
     header: "i18n:govoplan-campaign.actions.c3cd636a",
-    width: 260,
+    width: 150,
     sticky: "end",
     render: (version) => {
       const isCurrent = version.id === currentVersionId;
-      return (
-        <div className="button-row compact-actions">
-            <Link
-            to={`send?version=${version.id}`}
-            className={`btn ${isCurrent ? "btn-primary" : "btn-secondary"} admin-icon-button`}
-            aria-label={i18nMessage("i18n:govoplan-campaign.open_version_value.7ef53546", { value0: version.version_number })}
-            title={i18nMessage("i18n:govoplan-campaign.open_version_value.7ef53546", { value0: version.version_number })}>
-            
-              <ExternalLink aria-hidden="true" />
-            </Link>
-            {isCurrent && (isTemporaryUserLockedVersion(version) ?
-          <>
-                <Button onClick={() => setPendingLockAction({ version, action: "unlock" })}>i18n:govoplan-campaign.unlock.1526a17e</Button>
-                <Button variant="danger" onClick={() => setPendingLockAction({ version, action: "permanent" })}>i18n:govoplan-campaign.lock_permanently.cc0ce9e7</Button>
-              </> :
-          !isPermanentUserLockedVersion(version) && !isFinalLockedVersion(version) && !canUnlockValidationVersion(version) && !version.locked_at ?
-          <Button
-            className="admin-icon-button"
-            onClick={() => setPendingLockAction({ version, action: "temporary" })}
-            aria-label={i18nMessage("i18n:govoplan-campaign.temporarily_lock_version_value.8019e581", { value0: version.version_number })}
-            title="i18n:govoplan-campaign.temporarily_lock_version.82b31149">
-            
-                <LockKeyhole aria-hidden="true" />
-              </Button> :
-          null)}
-          </div>);
+      const temporarilyLocked = isCurrent && isTemporaryUserLockedVersion(version);
+      const canTemporarilyLock = isCurrent && !temporarilyLocked && !isPermanentUserLockedVersion(version) && !isFinalLockedVersion(version) && !canUnlockValidationVersion(version) && !version.locked_at;
+      return <TableActionGroup actions={[
+        { id: "open", label: i18nMessage("i18n:govoplan-campaign.open_version_value.7ef53546", { value0: version.version_number }), icon: <ExternalLink aria-hidden="true" />, variant: isCurrent ? "primary" : "secondary", onClick: () => navigate(`send?version=${version.id}`) },
+        { id: "unlock", label: "i18n:govoplan-campaign.unlock.1526a17e", icon: <LockOpen aria-hidden="true" />, applicable: temporarilyLocked, onClick: () => setPendingLockAction({ version, action: "unlock" }) },
+        { id: "permanent-lock", label: "i18n:govoplan-campaign.lock_permanently.cc0ce9e7", icon: <LockKeyhole aria-hidden="true" />, variant: "danger", applicable: temporarilyLocked, onClick: () => setPendingLockAction({ version, action: "permanent" }) },
+        { id: "temporary-lock", label: i18nMessage("i18n:govoplan-campaign.temporarily_lock_version_value.8019e581", { value0: version.version_number }), icon: <LockKeyhole aria-hidden="true" />, applicable: canTemporarilyLock, onClick: () => setPendingLockAction({ version, action: "temporary" }) }
+      ]} />;
 
     }
   }];
@@ -381,12 +375,3 @@ function lockDialogLabel(pending: PendingLockAction): string {
   if (pending?.action === "permanent") return "i18n:govoplan-campaign.lock_permanently.cc0ce9e7";
   return "i18n:govoplan-campaign.confirm.04a21221";
 }
-
-function SummaryTile({ label, value }: {label: string;value: string | number;}) {
-  return (
-    <div className="summary-tile">
-      <span>{label}</span>
-      <strong>{value}</strong>
-    </div>);
-
-}

webui/src/features/campaigns/CampaignReportPage.tsx

@@ -1,12 +1,14 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Check, RotateCcw, Search, X } from "lucide-react";
 import type { ApiSettings } from "../../types";
 import {
   downloadCampaignJobsCsv,
   emailCampaignReport,
   getCampaignJobDetail,
-  getCampaignJobsDelta,
+  getCampaignJobs,
   resolveCampaignJobOutcome,
   retryCampaignJobs,
+  sendCampaignJob,
   sendUnattemptedCampaignJobs,
   type CampaignJobDetailResponse,
   type CampaignJobsResponse } from
@@ -14,19 +16,29 @@ import {
 import { Card } from "@govoplan/core-webui";
 import { Button } from "@govoplan/core-webui";
 import { ConfirmDialog } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn, type DataGridListOption } from "../../components/table/DataGrid";
+import { DataGrid, type DataGridColumn, type DataGridListOption, type DataGridQueryState } from "@govoplan/core-webui";
 import { Dialog } from "@govoplan/core-webui";
 import { DismissibleAlert } from "@govoplan/core-webui";
+import { FormField } from "@govoplan/core-webui";
 import { PageTitle } from "@govoplan/core-webui";
 import { StatusBadge } from "@govoplan/core-webui";
 import VersionLine from "./components/VersionLine";
-import { LoadingFrame, i18nMessage, useDeltaWatermarks } from "@govoplan/core-webui";
+import { LoadingFrame, TableActionGroup, ToggleSwitch, i18nMessage } from "@govoplan/core-webui";
 import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
 import { asRecord, formatDateTime, humanize } from "./utils/campaignView";
-import { emptyCampaignJobsResponse, mergeCampaignJobsDelta } from "./utils/jobDeltas";
+import { emptyCampaignJobsResponse } from "./utils/jobDeltas";
+import type { CampaignJobSortColumn } from "./utils/jobListQuery";
+import {
+  DEFAULT_REPORT_GRID_SORT,
+  activeReportGridShortcut,
+  reportGridQueriesEqual,
+  toggleReportGridShortcut,
+  type ReportGridShortcutId
+} from "./utils/reportGridShortcuts";
 
 const SEND_STATUS_OPTIONS: DataGridListOption[] = [
 "not_queued",
+"skipped",
 "queued",
 "claimed",
 "sending",
@@ -36,21 +48,41 @@ const SEND_STATUS_OPTIONS: DataGridListOption[] = [
 "failed_temporary",
 "failed_permanent",
 "cancelled"].
-map((value) => ({ value, label: humanize(value) }));
+map((value) => ({ value, label: deliveryStatusLabel(value) ?? humanize(value) }));
 
 const IMAP_STATUS_OPTIONS: DataGridListOption[] = [
 "not_requested",
 "pending",
+"appending",
 "appended",
+"outcome_unknown",
 "failed",
 "skipped"].
+map((value) => ({ value, label: deliveryStatusLabel(value) ?? humanize(value) }));
+
+const VALIDATION_STATUS_OPTIONS: DataGridListOption[] = [
+"ready",
+"warning",
+"needs_review",
+"blocked",
+"excluded",
+"inactive"].
 map((value) => ({ value, label: humanize(value) }));
 
+const QUEUE_STATUS_OPTIONS: DataGridListOption[] = [
+"draft",
+"queued",
+"sending",
+"paused",
+"cancelled"].
+map((value) => ({ value, label: humanize(value) }));
+
+const JOB_GRID_QUERY_DELAY_MS = 300;
+
 type ReconcileRequest = {jobId: string;decision: "smtp_accepted" | "not_sent";} | null;
 
 export default function CampaignReportPage({ settings, campaignId }: {settings: ApiSettings;campaignId: string;}) {
   const { data, loading, error, reload } = useCampaignWorkspaceData(settings, campaignId, { includeSummary: true });
-  const { getDeltaWatermark, setDeltaWatermark, resetDeltaWatermark } = useDeltaWatermarks();
   const version = data.currentVersion;
   const cards = data.summary?.cards;
   const delivery = asRecord(data.summary?.delivery);
@@ -58,14 +90,19 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
   const imapPolicy = asRecord(delivery.imap_append_sent);
 
   const [jobs, setJobs] = useState<CampaignJobsResponse>(() => emptyCampaignJobsResponse());
-  const jobsRef = useRef<CampaignJobsResponse>(emptyCampaignJobsResponse());
-  const jobPageCursorsRef = useRef<Record<number, string | null>>({ 1: null });
+  const jobsRequestRef = useRef(0);
   const [jobsLoading, setJobsLoading] = useState(false);
   const [page, setPage] = useState(1);
-  const [sendStatus, setSendStatus] = useState("");
-  const [imapStatus, setImapStatus] = useState("");
-  const [query, setQuery] = useState("");
-  const [appliedQuery, setAppliedQuery] = useState("");
+  const [pageSize, setPageSize] = useState(50);
+  const [initialGridFilters] = useState<Record<string, string | string[]>>(() => initialReportGridFilters());
+  const initialGridQuery = useMemo<DataGridQueryState>(() => ({
+    sort: DEFAULT_REPORT_GRID_SORT,
+    filters: serializeInitialGridFilters(initialGridFilters)
+  }), [initialGridFilters]);
+  const [jobGridQuery, setJobGridQuery] = useState<DataGridQueryState>(initialGridQuery);
+  const [appliedJobGridQuery, setAppliedJobGridQuery] = useState<DataGridQueryState>(initialGridQuery);
+  const [query, setQuery] = useState(() => initialReportQuery());
+  const [appliedQuery, setAppliedQuery] = useState(query.trim());
   const [actionMessage, setActionMessage] = useState("");
   const [actionError, setActionError] = useState("");
   const [busyAction, setBusyAction] = useState("");
@@ -79,83 +116,76 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
   useEffect(() => {
     const handle = window.setTimeout(() => {
       setAppliedQuery(query.trim());
+      setAppliedJobGridQuery((current) => reportGridQueriesEqual(current, jobGridQuery) ? current : jobGridQuery);
       setPage(1);
-    }, 350);
+    }, JOB_GRID_QUERY_DELAY_MS);
     return () => window.clearTimeout(handle);
-  }, [query]);
+  }, [query, jobGridQuery]);
 
-  const jobsQueryKey = useMemo(
-    () => JSON.stringify({
-      campaignId,
-      versionId: version?.id ?? null,
-      page,
-      pageSize: 50,
-      sendStatus,
-      imapStatus,
-      appliedQuery,
-      apiBaseUrl: settings.apiBaseUrl,
-      apiKey: settings.apiKey,
-      accessToken: settings.accessToken
-    }),
-    [campaignId, version?.id, page, sendStatus, imapStatus, appliedQuery, settings.apiBaseUrl, settings.apiKey, settings.accessToken]
+  const handleJobGridQuery = useCallback((next: DataGridQueryState) => {
+    setJobGridQuery((current) => reportGridQueriesEqual(current, next) ? current : next);
+  }, []);
+
+  const activeJobGridShortcut = useMemo(
+    () => query.trim() ? null : activeReportGridShortcut(jobGridQuery),
+    [jobGridQuery, query]
   );
 
-  useEffect(() => {
-    jobPageCursorsRef.current = { 1: null };
-  }, [campaignId, version?.id, sendStatus, imapStatus, appliedQuery, settings.apiBaseUrl, settings.apiKey, settings.accessToken]);
+  const applyJobGridShortcut = useCallback((shortcutId: ReportGridShortcutId) => {
+    const next = toggleReportGridShortcut(jobGridQuery, shortcutId);
+    setQuery("");
+    setAppliedQuery("");
+    setJobGridQuery(next);
+    setAppliedJobGridQuery(next);
+    setPage(1);
+  }, [jobGridQuery]);
+
+  const deliveryOutcomeShortcuts: { label: string; value: string | number; shortcutId: ReportGridShortcutId }[] = [
+    { label: "i18n:govoplan-campaign.jobs_total.98da65bc", value: cards?.jobs_total ?? "—", shortcutId: "all" },
+    { label: "i18n:govoplan-campaign.smtp_accepted.e3aa7603", value: cards?.smtp_accepted ?? cards?.sent ?? 0, shortcutId: "smtp_accepted" },
+    { label: "i18n:govoplan-campaign.failed.09fef5d8", value: cards?.failed ?? 0, shortcutId: "failed" },
+    { label: "i18n:govoplan-campaign.outcome_unknown.6e929fca", value: cards?.outcome_unknown ?? 0, shortcutId: "outcome_unknown" },
+    { label: "i18n:govoplan-campaign.not_attempted.e1be3c69", value: cards?.not_attempted ?? 0, shortcutId: "not_attempted" },
+    { label: "i18n:govoplan-campaign.smtp_skipped_excluded_.df6eca19", value: cards?.skipped ?? jobs.counts.send?.skipped ?? 0, shortcutId: "smtp_skipped" },
+    { label: "i18n:govoplan-campaign.cancelled.a1bf92ef", value: cards?.cancelled ?? 0, shortcutId: "cancelled" }
+  ];
+  const imapOutcomeShortcuts: { label: string; value: string | number; shortcutId: ReportGridShortcutId }[] = [
+    { label: "i18n:govoplan-campaign.imap_appended.56017ea3", value: cards?.imap_appended ?? 0, shortcutId: "imap_appended" },
+    { label: "i18n:govoplan-campaign.imap_failed.50dbca55", value: cards?.imap_failed ?? 0, shortcutId: "imap_failed" },
+    { label: "i18n:govoplan-campaign.imap_skipped.5a97b542", value: cards?.imap_skipped ?? jobs.counts.imap?.skipped ?? 0, shortcutId: "imap_skipped" }
+  ];
 
   const loadJobs = useCallback(async () => {
     if (!campaignId) return;
+    const requestId = ++jobsRequestRef.current;
     setJobsLoading(true);
     setActionError("");
     try {
-      let nextWatermark = getDeltaWatermark(jobsQueryKey);
-      let merged = jobsRef.current;
-      let hasMore = false;
-      const pageCursor = page === 1 ? null : jobPageCursorsRef.current[page];
-      do {
-        const response = await getCampaignJobsDelta(settings, campaignId, {
-          versionId: version?.id,
-          page,
-          pageSize: 50,
-          cursor: pageCursor,
-          sendStatus: sendStatus ? [sendStatus] : undefined,
-          imapStatus: imapStatus ? [imapStatus] : undefined,
-          query: appliedQuery || undefined,
-          since: nextWatermark
-        });
-        merged = mergeCampaignJobsDelta(merged, response);
-        if (response.cursor !== undefined) jobPageCursorsRef.current[page] = response.cursor ?? null;
-        if (response.next_cursor !== undefined) {
-          if (response.next_cursor) jobPageCursorsRef.current[page + 1] = response.next_cursor;
-          else delete jobPageCursorsRef.current[page + 1];
-        }
-        nextWatermark = response.watermark ?? null;
-        hasMore = response.has_more;
-      } while (hasMore);
-      setDeltaWatermark(jobsQueryKey, nextWatermark);
-      jobsRef.current = merged;
-      setJobs(merged);
-      if (merged.pages > 0 && page > merged.pages) setPage(merged.pages);
+      const response = await getCampaignJobs(settings, campaignId, {
+        versionId: version?.id,
+        page,
+        pageSize,
+        query: appliedQuery || undefined,
+        sortBy: campaignJobSortColumn(appliedJobGridQuery.sort?.columnId),
+        sortDirection: appliedJobGridQuery.sort?.direction ?? "asc",
+        filters: appliedJobGridQuery.filters
+      });
+      if (requestId !== jobsRequestRef.current) return;
+      setJobs(response);
+      if (response.pages > 0 && page > response.pages) setPage(response.pages);
     } catch (err) {
-      setActionError(err instanceof Error ? err.message : String(err));
+      if (requestId === jobsRequestRef.current) setActionError(err instanceof Error ? err.message : String(err));
     } finally {
-      setJobsLoading(false);
+      if (requestId === jobsRequestRef.current) setJobsLoading(false);
     }
-  }, [settings, campaignId, version?.id, page, sendStatus, imapStatus, appliedQuery, jobsQueryKey, getDeltaWatermark, setDeltaWatermark]);
-
-  useEffect(() => {
-    resetDeltaWatermark(jobsQueryKey);
-    jobsRef.current = emptyCampaignJobsResponse();
-    setJobs(emptyCampaignJobsResponse());
-  }, [jobsQueryKey, resetDeltaWatermark]);
+  }, [settings, campaignId, version?.id, page, pageSize, appliedQuery, appliedJobGridQuery]);
 
   useEffect(() => {
     void loadJobs();
   }, [loadJobs]);
 
   async function reloadAll() {
-    await Promise.all([reload(), loadJobs()]);
+    await Promise.all([reload({ force: true }), loadJobs()]);
   }
 
   async function runExplicitAction(action: "retry" | "unattempted") {
@@ -177,6 +207,67 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
     }
   }
 
+  const failedRowsOnPage = useMemo(
+    () => jobs.jobs.filter((row) => retryableFailedStatus(String(row.send_status ?? "")) && String(row.id ?? "")),
+    [jobs.jobs]
+  );
+
+  async function retryFailedSynchronously(rows: Record<string, unknown>[]) {
+    if (!version || busyAction || rows.length === 0) return;
+    setBusyAction(rows.length === 1 ? `retry-sync:${String(rows[0].id ?? "")}` : "retry-sync-page");
+    setActionError("");
+    setActionMessage("");
+    let attempted = 0;
+    let accepted = 0;
+    let skipped = 0;
+    const failures: string[] = [];
+    try {
+      for (const row of rows) {
+        const jobId = String(row.id ?? "");
+        if (!jobId) {
+          skipped += 1;
+          continue;
+        }
+        const sendStatus = String(row.send_status ?? "");
+        const queueResponse = await retryCampaignJobs(settings, campaignId, {
+          version_id: version.id,
+          job_ids: [jobId],
+          include_permanent: sendStatus === "failed_permanent",
+          enqueue_celery: false
+        });
+        const queueResult = asRecord(queueResponse.result ?? queueResponse);
+        if (Number(queueResult.selected_count ?? 0) < 1) {
+          skipped += 1;
+          const skippedRows = Array.isArray(queueResult.skipped) ? queueResult.skipped.map(asRecord) : [];
+          const reason = String(skippedRows[0]?.reason ?? "not selected for retry");
+          failures.push(`${shortJobId(jobId)}: ${reason}`);
+          continue;
+        }
+        attempted += 1;
+        try {
+          const sendResponse = await sendCampaignJob(settings, campaignId, jobId, {
+            include_warnings: true,
+            dry_run: false,
+            use_rate_limit: true,
+            enqueue_imap_task: false
+          });
+          const sendResult = asRecord(asRecord(sendResponse.result ?? sendResponse).result);
+          const status = String(sendResult.status ?? "submitted");
+          if (status === "smtp_accepted" || status === "already_accepted") accepted += 1;
+          else failures.push(`${shortJobId(jobId)}: ${humanize(status)}`);
+        } catch (err) {
+          failures.push(`${shortJobId(jobId)}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      const failed = failures.length;
+      setActionMessage(`Synchronous retry finished: ${attempted} attempted, ${accepted} accepted, ${failed} failed, ${skipped} skipped.`);
+      if (failures.length > 0) setActionError(failures.slice(0, 5).join("\n"));
+      await reloadAll();
+    } finally {
+      setBusyAction("");
+    }
+  }
+
   async function reconcileOutcome() {
     if (!reconcile || busyAction) return;
     setBusyAction("reconcile");
@@ -260,10 +351,10 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
     value: (row) => String(row.recipient_email ?? "—")
   },
   { id: "subject", header: "i18n:govoplan-campaign.subject.8d183dbd", width: "minmax(260px, 1fr)", resizable: true, sortable: true, filterable: true, value: (row) => String(row.subject ?? "—") },
-  { id: "validation", header: "i18n:govoplan-campaign.validation.dd74d182", width: 145, sortable: true, filterable: true, render: (row) => <StatusBadge status={String(row.validation_status ?? "unknown")} />, value: (row) => String(row.validation_status ?? "unknown") },
-  { id: "queue", header: "i18n:govoplan-campaign.queue.d325fcd9", width: 130, sortable: true, filterable: true, render: (row) => <StatusBadge status={String(row.queue_status ?? "unknown")} />, value: (row) => String(row.queue_status ?? "unknown") },
-  { id: "send", header: "i18n:govoplan-campaign.smtp.efff9cca", width: 160, sortable: true, filterable: true, columnType: "from-list", list: { options: SEND_STATUS_OPTIONS, display: "pill" }, render: (row) => <StatusBadge status={String(row.send_status ?? "unknown")} />, value: (row) => String(row.send_status ?? "unknown") },
-  { id: "imap", header: "i18n:govoplan-campaign.imap.271f9ef2", width: 130, sortable: true, filterable: true, render: (row) => <StatusBadge status={String(row.imap_status ?? "unknown")} />, value: (row) => String(row.imap_status ?? "unknown") },
+  { id: "validation", header: "i18n:govoplan-campaign.validation.dd74d182", width: 145, sortable: true, filterable: true, columnType: "from-list", list: { options: VALIDATION_STATUS_OPTIONS, display: "pill" }, render: (row) => <StatusBadge status={String(row.validation_status ?? "unknown")} />, value: (row) => String(row.validation_status ?? "unknown") },
+  { id: "queue", header: "i18n:govoplan-campaign.queue.d325fcd9", width: 130, sortable: true, filterable: true, columnType: "from-list", list: { options: QUEUE_STATUS_OPTIONS, display: "pill" }, render: (row) => <StatusBadge status={String(row.queue_status ?? "unknown")} />, value: (row) => String(row.queue_status ?? "unknown") },
+  { id: "send", header: "i18n:govoplan-campaign.smtp.efff9cca", width: 160, sortable: true, filterable: true, columnType: "from-list", list: { options: SEND_STATUS_OPTIONS, display: "pill" }, render: (row) => <StatusBadge status={String(row.send_status ?? "unknown")} label={deliveryStatusLabel(String(row.send_status ?? "unknown"))} />, value: (row) => String(row.send_status ?? "unknown") },
+  { id: "imap", header: "i18n:govoplan-campaign.imap.271f9ef2", width: 130, sortable: true, filterable: true, columnType: "from-list", list: { options: IMAP_STATUS_OPTIONS, display: "pill" }, render: (row) => <StatusBadge status={String(row.imap_status ?? "unknown")} label={deliveryStatusLabel(String(row.imap_status ?? "unknown"))} />, value: (row) => String(row.imap_status ?? "unknown") },
   { id: "attempts", header: "i18n:govoplan-campaign.attempts.5a29585e", width: 105, align: "right", sortable: true, filterType: "integer", value: (row) => Number(row.attempt_count ?? 0) },
   {
     id: "evidence",
@@ -284,7 +375,6 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
     header: "i18n:govoplan-campaign.last_result.110b888b",
     width: "minmax(220px, 1fr)",
     resizable: true,
-    filterable: true,
     render: (row) => <span className={row.last_error ? "recipient-outcome-error" : "muted"} title={String(row.last_error ?? "")}>{String(row.last_error ?? "—")}</span>,
     value: (row) => String(row.last_error ?? "—")
   },
@@ -292,21 +382,21 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
   {
     id: "actions",
     header: "i18n:govoplan-campaign.actions.c3cd636a",
-    width: 250,
+    width: 190,
     sticky: "end",
     render: (row) => {
       const id = String(row.id ?? "");
       const status = String(row.send_status ?? "");
-      return (
-        <div className="button-row compact-actions">
-            <Button onClick={() => void openJob(id)} disabled={!id || busyAction === "detail"}>i18n:govoplan-campaign.details.dc3decbb</Button>
-            {status === "outcome_unknown" && <Button onClick={() => setReconcile({ jobId: id, decision: "smtp_accepted" })}>i18n:govoplan-campaign.accepted.61a0572c</Button>}
-            {status === "outcome_unknown" && <Button onClick={() => setReconcile({ jobId: id, decision: "not_sent" })}>i18n:govoplan-campaign.not_sent.587c501e</Button>}
-          </div>);
+      return <TableActionGroup actions={[
+        { id: "details", label: "i18n:govoplan-campaign.details.dc3decbb", icon: <Search aria-hidden="true" />, disabled: !id || busyAction === "detail", onClick: () => void openJob(id) },
+        { id: "retry", label: busyAction === `retry-sync:${id}` ? "Sending..." : "Retry now", icon: <RotateCcw aria-hidden="true" />, applicable: retryableFailedStatus(status), disabled: !id || Boolean(busyAction), onClick: () => void retryFailedSynchronously([row]) },
+        { id: "accepted", label: "i18n:govoplan-campaign.accepted.61a0572c", icon: <Check aria-hidden="true" />, applicable: status === "outcome_unknown", onClick: () => setReconcile({ jobId: id, decision: "smtp_accepted" }) },
+        { id: "not-sent", label: "i18n:govoplan-campaign.not_sent.587c501e", icon: <X aria-hidden="true" />, variant: "danger", applicable: status === "outcome_unknown", onClick: () => setReconcile({ jobId: id, decision: "not_sent" }) }
+      ]} />;
 
     }
   }],
-  [busyAction]);
+  [busyAction, retryFailedSynchronously]);
 
   return (
     <div className="content-pad workspace-data-page">
@@ -318,7 +408,7 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
         <div className="button-row compact-actions">
           <Button onClick={() => void exportCsv()} disabled={busyAction === "csv"}>i18n:govoplan-campaign.download_csv.eaa216ad</Button>
           <Button onClick={() => setEmailOpen(true)}>i18n:govoplan-campaign.email_report.ee3e7091</Button>
-          <Button onClick={() => void reloadAll()} disabled={loading || jobsLoading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void reloadAll()} disabled={loading || jobsLoading}>Discard</Button>
         </div>
       </div>
       {(error || actionError) && <DismissibleAlert tone="danger" resetKey={`${error}${actionError}`} floating>{error || actionError}</DismissibleAlert>}
@@ -328,18 +418,36 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
           <Card title="i18n:govoplan-campaign.delivery_outcome.f9d7c085">
             <dl className="detail-list">
               <div><dt>i18n:govoplan-campaign.generated.8eefdd52</dt><dd>{formatDateTime(data.summary?.generated_at)}</dd></div>
-              <div><dt>i18n:govoplan-campaign.jobs_total.98da65bc</dt><dd>{cards?.jobs_total ?? "—"}</dd></div>
-              <div><dt>i18n:govoplan-campaign.smtp_accepted.e3aa7603</dt><dd>{cards?.smtp_accepted ?? cards?.sent ?? 0}</dd></div>
-              <div><dt>i18n:govoplan-campaign.failed.09fef5d8</dt><dd>{cards?.failed ?? 0}</dd></div>
-              <div><dt>i18n:govoplan-campaign.outcome_unknown.6e929fca</dt><dd>{cards?.outcome_unknown ?? 0}</dd></div>
-              <div><dt>i18n:govoplan-campaign.not_attempted.e1be3c69</dt><dd>{cards?.not_attempted ?? 0}</dd></div>
-              <div><dt>i18n:govoplan-campaign.cancelled.a1bf92ef</dt><dd>{cards?.cancelled ?? 0}</dd></div>
+              {deliveryOutcomeShortcuts.map(({ label, value, shortcutId }) => {
+                const active = activeJobGridShortcut === shortcutId;
+                return (
+                  <div key={shortcutId}>
+                    <dt>{label}</dt>
+                    <dd>
+                      <Button type="button" variant={active ? "primary" : "ghost"} aria-pressed={active} onClick={() => applyJobGridShortcut(shortcutId)}>
+                        {value}
+                      </Button>
+                    </dd>
+                  </div>
+                );
+              })}
             </dl>
           </Card>
           <Card title="i18n:govoplan-campaign.imap_and_execution_plan.4c80c058">
             <dl className="detail-list">
-              <div><dt>i18n:govoplan-campaign.imap_appended.56017ea3</dt><dd>{cards?.imap_appended ?? 0}</dd></div>
-              <div><dt>i18n:govoplan-campaign.imap_failed.50dbca55</dt><dd>{cards?.imap_failed ?? 0}</dd></div>
+              {imapOutcomeShortcuts.map(({ label, value, shortcutId }) => {
+                const active = activeJobGridShortcut === shortcutId;
+                return (
+                  <div key={shortcutId}>
+                    <dt>{label}</dt>
+                    <dd>
+                      <Button type="button" variant={active ? "primary" : "ghost"} aria-pressed={active} onClick={() => applyJobGridShortcut(shortcutId)}>
+                        {value}
+                      </Button>
+                    </dd>
+                  </div>
+                );
+              })}
               <div><dt>i18n:govoplan-campaign.append_policy.f195cb05</dt><dd>{imapPolicy.enabled === true ? i18nMessage("i18n:govoplan-campaign.enabled_value.e395e48f", { value0: String(imapPolicy.folder ?? "i18n:govoplan-campaign.auto.0d612c12") }) : "i18n:govoplan-campaign.disabled.f4f4473d"}</dd></div>
               <div><dt>i18n:govoplan-campaign.rate_limit.d08e55f5</dt><dd>{rateLimit.messages_per_minute ? i18nMessage("i18n:govoplan-campaign.value_minute.aeb1a9ea", { value0: String(rateLimit.messages_per_minute) }) : "—"}</dd></div>
               <div><dt>i18n:govoplan-campaign.minimum_remaining_duration.639b792c</dt><dd>{String(delivery.estimated_remaining_send_human ?? "—")}</dd></div>
@@ -350,40 +458,52 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
             <p className="muted">i18n:govoplan-campaign.these_actions_never_include_smtp_accepted_or_unr.449d0a80</p>
             <div className="button-row compact-actions">
               <Button onClick={() => void runExplicitAction("retry")} disabled={!version || Boolean(busyAction)}>i18n:govoplan-campaign.retry_temporary_failures.e65cfd13</Button>
+              <Button onClick={() => void retryFailedSynchronously(failedRowsOnPage)} disabled={!version || Boolean(busyAction) || failedRowsOnPage.length === 0}>
+                {busyAction === "retry-sync-page" ? "Sending failed jobs..." : `Retry failed on this page now (${failedRowsOnPage.length})`}
+              </Button>
               <Button onClick={() => void runExplicitAction("unattempted")} disabled={!version || Boolean(busyAction)}>i18n:govoplan-campaign.send_unattempted_jobs.db7acc9f</Button>
             </div>
           </Card>
         </div>
 
         <Card title="i18n:govoplan-campaign.recipient_delivery_jobs.52492608">
+          <p className="muted small-note">
+            i18n:govoplan-campaign.excluded_rows_are_intentionally_omitted_from_del.421a1f00
+          </p>
           <div className="page-heading split">
             <div className="button-row compact-actions">
-              <input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="i18n:govoplan-campaign.search_recipient_subject_or_entry_id.6d6544f5" />
-              <select value={sendStatus} onChange={(event) => {setSendStatus(event.target.value);setPage(1);}}>
-                <option value="">i18n:govoplan-campaign.all_smtp_states.739597b1</option>
-                {SEND_STATUS_OPTIONS.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}
-              </select>
-              <select value={imapStatus} onChange={(event) => {setImapStatus(event.target.value);setPage(1);}}>
-                <option value="">i18n:govoplan-campaign.all_imap_states.8546b84c</option>
-                {IMAP_STATUS_OPTIONS.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}
-              </select>
+              <FormField label="i18n:govoplan-campaign.search_recipient_subject_or_entry_id.6d6544f5">
+                <input value={query} onChange={(event) => setQuery(event.target.value)} />
+              </FormField>
             </div>
             <span className="muted">{jobs.total} i18n:govoplan-campaign.matching_of.66a3778e {jobs.total_unfiltered} i18n:govoplan-campaign.total_job_s.c94b7d20</span>
           </div>
           <LoadingFrame loading={jobsLoading} label="i18n:govoplan-campaign.loading_delivery_jobs.20ecc37e">
             <DataGrid<Record<string, unknown>>
-              id={`campaign-report-jobs-${campaignId}`}
+              id={`campaign-report-jobs-v2-${campaignId}`}
               rows={jobs.jobs}
               columns={columns}
               getRowKey={(row: Record<string, unknown>) => String(row.id ?? "")}
-              emptyText="i18n:govoplan-campaign.no_jobs_match_the_current_filters.b1501ff5" />
+              emptyText="i18n:govoplan-campaign.no_jobs_match_the_current_filters.b1501ff5"
+              initialFilters={initialGridFilters}
+              initialSort={DEFAULT_REPORT_GRID_SORT}
+              query={jobGridQuery}
+              pagination={{
+                mode: "server",
+                page,
+                pageSize,
+                totalRows: jobs.total,
+                pageSizeOptions: [25, 50, 100, 200],
+                disabled: jobsLoading,
+                onPageChange: setPage,
+                onPageSizeChange: (nextPageSize) => {
+                  setPageSize(nextPageSize);
+                  setPage(1);
+                }
+              }}
+              onQueryChange={handleJobGridQuery} />
             
           </LoadingFrame>
-          <div className="button-row compact-actions">
-            <Button onClick={() => setPage((value) => Math.max(1, value - 1))} disabled={page <= 1 || jobsLoading}>i18n:govoplan-campaign.previous.50f94286</Button>
-            <span>i18n:govoplan-campaign.page.fb06270f {jobs.pages === 0 ? 0 : jobs.page} of {jobs.pages}</span>
-            <Button onClick={() => setPage((value) => Math.min(jobs.pages || 1, value + 1))} disabled={page >= jobs.pages || jobsLoading}>i18n:govoplan-campaign.next.bc981983</Button>
-          </div>
         </Card>
       </LoadingFrame>
 
@@ -403,8 +523,8 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
           <span>i18n:govoplan-campaign.recipients.78cbf8eb</span>
           <textarea value={emailRecipients} onChange={(event) => setEmailRecipients(event.target.value)} placeholder="audit@example.org; owner@example.org" rows={3} />
         </label>
-        <label><input type="checkbox" checked={attachCsv} onChange={(event) => setAttachCsv(event.target.checked)} /> i18n:govoplan-campaign.attach_job_csv.adb76197</label>
-        <label><input type="checkbox" checked={attachJson} onChange={(event) => setAttachJson(event.target.checked)} /> i18n:govoplan-campaign.attach_json_report.d70883b5</label>
+        <ToggleSwitch label="i18n:govoplan-campaign.attach_job_csv.adb76197" checked={attachCsv} onChange={setAttachCsv} />
+        <ToggleSwitch label="i18n:govoplan-campaign.attach_json_report.d70883b5" checked={attachJson} onChange={setAttachJson} />
       </Dialog>
 
       <Dialog
@@ -419,8 +539,8 @@ export default function CampaignReportPage({ settings, campaignId }: {settings:
               <div><dt>i18n:govoplan-campaign.recipient.90343260</dt><dd>{String(detail.job.recipient_email ?? "—")}</dd></div>
               <div><dt>i18n:govoplan-campaign.subject.8d183dbd</dt><dd>{String(detail.job.subject ?? "—")}</dd></div>
               <div><dt>i18n:govoplan-campaign.message_id.465056ba</dt><dd>{String(detail.job.message_id_header ?? "—")}</dd></div>
-              <div><dt>i18n:govoplan-campaign.smtp_state.ff372566</dt><dd><StatusBadge status={String(detail.job.send_status ?? "unknown")} /></dd></div>
-              <div><dt>i18n:govoplan-campaign.imap_state.03b83be0</dt><dd><StatusBadge status={String(detail.job.imap_status ?? "unknown")} /></dd></div>
+              <div><dt>i18n:govoplan-campaign.smtp_state.ff372566</dt><dd><StatusBadge status={String(detail.job.send_status ?? "unknown")} label={deliveryStatusLabel(String(detail.job.send_status ?? "unknown"))} /></dd></div>
+              <div><dt>i18n:govoplan-campaign.imap_state.03b83be0</dt><dd><StatusBadge status={String(detail.job.imap_status ?? "unknown")} label={deliveryStatusLabel(String(detail.job.imap_status ?? "unknown"))} /></dd></div>
               <div><dt>i18n:govoplan-campaign.attachments.6771ade6</dt><dd>{String(detail.job.matched_file_count ?? detail.job.attachment_count ?? 0)}</dd></div>
             </dl>
             <AttemptHistoryTable kind="smtp" rows={detail.attempts.smtp ?? []} />
@@ -456,39 +576,75 @@ function AttemptHistoryTable({ kind, rows }: {kind: "smtp" | "imap";rows: Record
 
   }
 
+  const columns: DataGridColumn<Record<string, unknown>>[] = [
+    { id: "attempt", header: "#", width: 72, sortable: true, value: (row, index) => Number(row.attempt_number ?? index + 1), render: (row, index) => String(row.attempt_number ?? index + 1) },
+    { id: "status", header: "i18n:govoplan-campaign.status.bae7d5be", width: 150, sortable: true, filterable: true, value: (row) => String(row.status ?? "unknown"), render: (row) => <StatusBadge status={String(row.status ?? "unknown")} /> },
+    kind === "imap" ?
+      { id: "folder", header: "i18n:govoplan-campaign.folder.30baa249", width: 180, sortable: true, filterable: true, value: (row) => String(row.folder ?? "—"), render: (row) => String(row.folder ?? "—") } :
+      { id: "code", header: "i18n:govoplan-campaign.code.adac6937", width: 110, sortable: true, value: (row) => String(row.smtp_status_code ?? "—"), render: (row) => String(row.smtp_status_code ?? "—") },
+    { id: "started", header: "i18n:govoplan-campaign.started.faa9e7e7", width: 180, sortable: true, value: (row) => String(row.started_at ?? row.created_at ?? ""), render: (row) => formatDateTime(String(row.started_at ?? row.created_at ?? "")) },
+    { id: "finished", header: "i18n:govoplan-campaign.finished.355bcc57", width: 180, sortable: true, value: (row) => String(row.finished_at ?? row.updated_at ?? ""), render: (row) => formatDateTime(String(row.finished_at ?? row.updated_at ?? "")) },
+    { id: "result", header: "i18n:govoplan-campaign.result.5faa59d4", width: "minmax(240px, 1fr)", minWidth: 200, resizable: true, filterable: true, value: (row) => String(row.smtp_response ?? row.error_message ?? "—"), render: (row) => <span title={String(row.smtp_response ?? row.error_message ?? "")}>{String(row.smtp_response ?? row.error_message ?? "—")}</span> }
+  ];
+
   return (
     <section className="attempt-history-section">
       <h3>{title}</h3>
-      <div className="attempt-history-wrap">
-        <table className="attempt-history-table">
-          <thead>
-            <tr>
-              <th>#</th>
-              <th>i18n:govoplan-campaign.status.bae7d5be</th>
-              {kind === "imap" && <th>i18n:govoplan-campaign.folder.30baa249</th>}
-              {kind === "smtp" && <th>i18n:govoplan-campaign.code.adac6937</th>}
-              <th>i18n:govoplan-campaign.started.faa9e7e7</th>
-              <th>i18n:govoplan-campaign.finished.355bcc57</th>
-              <th>i18n:govoplan-campaign.result.5faa59d4</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rows.map((row, index) =>
-            <tr key={String(row.id ?? `${kind}-${index}`)}>
-                <td>{String(row.attempt_number ?? index + 1)}</td>
-                <td><StatusBadge status={String(row.status ?? "unknown")} /></td>
-                {kind === "imap" && <td>{String(row.folder ?? "—")}</td>}
-                {kind === "smtp" && <td>{String(row.smtp_status_code ?? "—")}</td>}
-                <td>{formatDateTime(String(row.started_at ?? row.created_at ?? ""))}</td>
-                <td>{formatDateTime(String(row.finished_at ?? row.updated_at ?? ""))}</td>
-                <td title={String(row.smtp_response ?? row.error_message ?? "")}>
-                  {String(row.smtp_response ?? row.error_message ?? "—")}
-                </td>
-              </tr>
-            )}
-          </tbody>
-        </table>
-      </div>
+      <DataGrid id={`campaign-${kind}-attempt-history`} rows={rows} columns={columns} getRowKey={(row, index) => String(row.id ?? `${kind}-${index}`)} />
     </section>);
 
 }
+
+function initialReportGridFilters(): Record<string, string | string[]> {
+  if (typeof window === "undefined") return {};
+  const params = new URLSearchParams(window.location.search);
+  const result: Record<string, string | string[]> = {};
+  const send = statusParameters(params, "send_status", SEND_STATUS_OPTIONS);
+  const imap = statusParameters(params, "imap_status", IMAP_STATUS_OPTIONS);
+  const validation = statusParameters(params, "validation_status", VALIDATION_STATUS_OPTIONS);
+  if (send.length > 0) result.send = send;
+  if (imap.length > 0) result.imap = imap;
+  if (validation.length > 0) result.validation = validation;
+  return result;
+}
+
+function deliveryStatusLabel(status: string): string | undefined {
+  return status === "skipped" ? "i18n:govoplan-campaign.skipped.5a000ad7" : undefined;
+}
+
+function initialReportQuery(): string {
+  if (typeof window === "undefined") return "";
+  return new URLSearchParams(window.location.search).get("q")?.trim() ?? "";
+}
+
+function statusParameters(params: URLSearchParams, name: string, options: DataGridListOption[]): string[] {
+  const allowed = new Set(options.map((option) => option.value));
+  return [...new Set(
+    params.getAll(name).
+    flatMap((value) => value.split(",")).
+    map((value) => value.trim()).
+    filter((value) => allowed.has(value))
+  )];
+}
+
+function serializeInitialGridFilters(filters: Record<string, string | string[]>): Record<string, string> {
+  return Object.fromEntries(Object.entries(filters).map(([columnId, value]) => [
+    columnId,
+    Array.isArray(value) ? `list:${JSON.stringify([...new Set(value)])}` : value
+  ]));
+}
+
+function campaignJobSortColumn(value?: string): CampaignJobSortColumn {
+  if (value === "recipient" || value === "subject" || value === "validation" || value === "queue" || value === "send" || value === "imap" || value === "attempts" || value === "updated") {
+    return value;
+  }
+  return "number";
+}
+
+function retryableFailedStatus(status: string): boolean {
+  return status === "failed_temporary" || status === "failed_permanent";
+}
+
+function shortJobId(jobId: string): string {
+  return jobId.length > 12 ? `${jobId.slice(0, 12)}...` : jobId;
+}

webui/src/features/campaigns/CampaignWorkspace.tsx

@@ -7,7 +7,6 @@ import CampaignOverviewPage from "./CampaignOverviewPage";
 import CampaignFieldsPage from "./CampaignFieldsPage";
 import GlobalSettingsPage from "./GlobalSettingsPage";
 import RecipientDataPage from "./RecipientDataPage";
-import RecipientDetailsPage from "./RecipientDetailsPage";
 import TemplateDataPage from "./TemplateDataPage";
 import AttachmentsDataPage from "./AttachmentsDataPage";
 import MailSettingsPage from "./MailSettingsPage";
@@ -26,7 +25,7 @@ const sectionPaths: Record<CampaignWorkspaceSection, string> = {
   policies: "policies",
   fields: "fields",
   recipients: "recipients",
-  "recipient-data": "recipient-data",
+  "recipient-data": "recipients",
   template: "template",
   files: "files",
   "mail-settings": "mail-settings",
@@ -85,7 +84,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
           <Route path="data" element={<Navigate to="../recipients" replace />} />
           <Route path="fields" element={<CampaignFieldsPage settings={settings} campaignId={campaignId || ""} />} />
           <Route path="recipients" element={<RecipientDataPage settings={settings} campaignId={campaignId || ""} />} />
-          <Route path="recipient-data" element={<RecipientDetailsPage settings={settings} campaignId={campaignId || ""} />} />
+          <Route path="recipient-data" element={<Navigate to="../recipients" replace />} />
           <Route path="template" element={<TemplateDataPage settings={settings} campaignId={campaignId || ""} />} />
           <Route path="files" element={<AttachmentsDataPage settings={settings} campaignId={campaignId || ""} />} />
           <Route path="attachments" element={<Navigate to="../files" replace />} />
@@ -96,7 +95,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
           <Route path="global-settings" element={<GlobalSettingsPage settings={settings} auth={auth} campaignId={campaignId || ""} view="settings" />} />
           <Route path="policies" element={<GlobalSettingsPage settings={settings} auth={auth} campaignId={campaignId || ""} view="policy" />} />
           <Route path="policy" element={<Navigate to="../policies" replace />} />
-          <Route path="review" element={<ReviewSendPage settings={settings} campaignId={campaignId || ""} />} />
+          <Route path="review" element={<ReviewSendPage settings={settings} auth={auth} campaignId={campaignId || ""} />} />
           <Route path="send" element={<Navigate to="../review" replace />} />
           <Route path="report" element={<CampaignReportPage settings={settings} campaignId={campaignId || ""} />} />
           <Route path="reports" element={<Navigate to="../report" replace />} />
@@ -127,7 +126,7 @@ function sectionFromPath(pathname: string): CampaignWorkspaceSection {
   if (section === "policies" || section === "policy") return "policies";
   if (section === "fields") return "fields";
   if (section === "recipients") return "recipients";
-  if (section === "recipient-data" || section === "recipient-details") return "recipient-data";
+  if (section === "recipient-data" || section === "recipient-details") return "recipients";
   if (section === "template") return "template";
   if (section === "files" || section === "attachments") return "files";
   if (section === "mail-settings" || section === "server-settings" || section === "mail") return "mail-settings";

webui/src/features/campaigns/GlobalSettingsPage.tsx

@@ -13,7 +13,7 @@ import CampaignAccessCard from "./components/CampaignAccessCard";
 import VersionLine from "./components/VersionLine";
 import { ToggleSwitch } from "@govoplan/core-webui";
 import { hasScope } from "@govoplan/core-webui";
-import { RetentionPolicyEditor } from "../privacy/RetentionPolicyManagement";
+import { RetentionPolicyEditor } from "@govoplan/core-webui";
 import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
 import { useCampaignDraftEditor } from "./hooks/useCampaignDraftEditor";
 import { asRecord, isAuditLockedVersion } from "./utils/campaignView";
@@ -38,7 +38,7 @@ export default function GlobalSettingsPage({ settings, auth, campaignId, view =
 
   const version = data.currentVersion;
   const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, displayDraft, dirty, saveState, localError, patch, markDirty, saveDraft } = useCampaignDraftEditor({
+  const { draft, displayDraft, dirty, saveState, localError, patch, markDirty, discardDraft, saveDraft } = useCampaignDraftEditor({
     settings,
     campaignId,
     version,
@@ -71,6 +71,11 @@ export default function GlobalSettingsPage({ settings, auth, campaignId, view =
     markDirty();
   }
 
+  function patchSendWithoutAttachmentsBehavior(value: string) {
+    patch(["attachments", "send_without_attachments_behavior"], value);
+    patch(["attachments", "send_without_attachments"], value !== "block");
+  }
+
   return (
     <div className="content-pad workspace-data-page">
       <div className="page-heading split workspace-heading">
@@ -79,7 +84,7 @@ export default function GlobalSettingsPage({ settings, auth, campaignId, view =
           <VersionLine version={version} versions={data.versions} status={saveState} />
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void discardDraft()} disabled={loading}>Discard</Button>
           <Button variant="primary" onClick={() => saveDraft("manual")} disabled={!dirty || locked || !draft}>{dirty ? "i18n:govoplan-campaign.save_now.3989b7c0" : "i18n:govoplan-campaign.saved.c0ae8f6e"}</Button>
         </div>
       </div>
@@ -208,8 +213,8 @@ export default function GlobalSettingsPage({ settings, auth, campaignId, view =
                   effectiveClassName="campaign-policy-effective-note"
                   label="i18n:govoplan-campaign.send_without_attachments.ead6d030"
                   note="i18n:govoplan-campaign.campaign_wide_fallback_when_no_attachment_is_ava.84ffa0bc"
-                  control={<ToggleSwitch label="i18n:govoplan-campaign.allowed.77c7b490" checked={getBool(attachments, "send_without_attachments", true)} disabled={locked} onChange={(checked) => patch(["attachments", "send_without_attachments"], checked)} />}
-                  effective={getBool(attachments, "send_without_attachments", true) ? "i18n:govoplan-campaign.messages_may_be_sent_when_attachment_rules_allow.e6bf1aed" : "i18n:govoplan-campaign.missing_attachment_coverage_blocks_sending.05ff02a1"} />
+                  control={<PolicySelectControl value={sendWithoutAttachmentsBehavior(attachments)} disabled={locked} onChange={patchSendWithoutAttachmentsBehavior} />}
+                  effective={behaviorSummary(sendWithoutAttachmentsBehavior(attachments))} />
                 
                 </PolicyTable>
               </Card>
@@ -261,3 +266,9 @@ function behaviorSummary(value: string): string {
   if (value === "warn") return "i18n:govoplan-campaign.keeps_sending_possible_with_a_warning.66c84a54";
   return "i18n:govoplan-campaign.uses_the_configured_behavior.ea6e82a3";
 }
+
+function sendWithoutAttachmentsBehavior(attachments: Record<string, unknown>): string {
+  const configured = getText(attachments, "send_without_attachments_behavior");
+  if (behaviorOptions.includes(configured)) return configured;
+  return getBool(attachments, "send_without_attachments", true) ? "continue" : "block";
+}

webui/src/features/campaigns/MailSettingsPage.tsx

@@ -1,35 +1,35 @@
-import { useEffect, useMemo, useState } from "react";
-import { MailServerSettingsPanel, addressesFromValue, hasMailImapSettings, mailImapSettingsPayload, mailNumberOrDefault, mailNumberOrNull, mailServerSecurityOptions, mailSmtpSettingsPayload, mailTransportCredentialsPayloadFromRecords, usePlatformModuleInstalled, usePlatformUiCapability, type MailProfilesUiCapability, type MailServerConnectionTestResult, type MailServerCredentialSettings, type MailServerFolderLookupResult, type MailServerImapSettings, type MailServerSmtpSettings } from "@govoplan/core-webui";
-import type { ApiSettings } from "../../types";
-import { Button } from "@govoplan/core-webui";
-import { Card } from "@govoplan/core-webui";
-import { FormField } from "@govoplan/core-webui";
-import { PageTitle } from "@govoplan/core-webui";
-import { LoadingFrame } from "@govoplan/core-webui";
-import LockedVersionNotice from "./components/LockedVersionNotice";
-import VersionLine from "./components/VersionLine";
-import { DismissibleAlert, i18nMessage } from "@govoplan/core-webui";
+import { useEffect, useState } from "react";
+import {
+  Button,
+  Card,
+  DismissibleAlert,
+  FormField,
+  LoadingFrame,
+  MailServerFolderLookupResultView,
+  MetricCard,
+  PageTitle,
+  ToggleSwitch,
+  usePlatformModuleInstalled,
+  usePlatformUiCapability,
+  type MailProfilesUiCapability,
+  type MailServerConnectionTestResult,
+  type MailServerFolderLookupResult
+} from "@govoplan/core-webui";
+import type { ApiSettings } from "../../types";
 import {
-  createMailServerProfile,
-  getMailProfilePolicy,
-  listImapFolders,
   listMailProfileImapFolders,
   listMailServerProfiles,
-  testImapSettings,
   testMailProfileImap,
   testMailProfileSmtp,
-  testSmtpSettings,
-  type MailProfilePolicy,
-  type MailSecurity,
-  type MailServerProfile } from
-"../../api/mail";
+  type MailServerProfile
+} from "../../api/mail";
 import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
 import { useCampaignDraftEditor } from "./hooks/useCampaignDraftEditor";
-import { asArray, asRecord, isAuditLockedVersion } from "./utils/campaignView";
-import { cloneJson, getBool, getNumber, getText } from "./utils/draftEditor";
-import { campaignMailSettingsPolicyState } from "./policyUi";
-
-const securityOptions = mailServerSecurityOptions as readonly MailSecurity[];
+import LockedVersionNotice from "./components/LockedVersionNotice";
+import VersionLine from "./components/VersionLine";
+import { asRecord, isAuditLockedVersion } from "./utils/campaignView";
+import { getBool, getText } from "./utils/draftEditor";
+import { campaignMailProfileReferenceOnly } from "./utils/mailProfileReference";
 
 type MailSettingsView = "settings" | "policy";
 
@@ -41,25 +41,23 @@ type MailSettingsPageProps = {
 
 export default function MailSettingsPage({ settings, campaignId, view = "settings" }: MailSettingsPageProps) {
   const mailModuleInstalled = usePlatformModuleInstalled("mail");
-  const isPolicyView = view === "policy";
   const mailProfilesUi = usePlatformUiCapability<MailProfilesUiCapability>("mail.profiles");
   const MailProfilePolicyEditor = mailProfilesUi?.MailProfilePolicyEditor ?? null;
+  const isPolicyView = view === "policy";
   const { data, loading, error, reload, setError } = useCampaignWorkspaceData(settings, campaignId);
+  const [mailProfiles, setMailProfiles] = useState<MailServerProfile[]>([]);
+  const [policyProfiles, setPolicyProfiles] = useState<MailServerProfile[]>([]);
+  const [profilesLoading, setProfilesLoading] = useState(false);
+  const [profileError, setProfileError] = useState("");
+  const [mailActionState, setMailActionState] = useState<"smtp" | "imap" | "folders" | null>(null);
   const [smtpTestResult, setSmtpTestResult] = useState<MailServerConnectionTestResult | null>(null);
   const [imapTestResult, setImapTestResult] = useState<MailServerConnectionTestResult | null>(null);
   const [folderResult, setFolderResult] = useState<MailServerFolderLookupResult | null>(null);
-  const [mailActionState, setMailActionState] = useState<"smtp" | "imap" | "folders" | null>(null);
-  const [mailProfiles, setMailProfiles] = useState<MailServerProfile[]>([]);
-  const [policyProfiles, setPolicyProfiles] = useState<MailServerProfile[]>([]);
-  const [effectiveMailPolicy, setEffectiveMailPolicy] = useState<MailProfilePolicy | null>(null);
-  const [profilesLoading, setProfilesLoading] = useState(false);
-  const [profileName, setProfileName] = useState("");
-  const [profileMessage, setProfileMessage] = useState("");
-  const [profileError, setProfileError] = useState("");
 
   const version = data.currentVersion;
   const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, displayDraft, dirty, saveState, localError, setLocalError, patch, saveDraft } = useCampaignDraftEditor({
+  const migrationRequired = version?.mail_profile_migration_required === true;
+  const { draft, displayDraft, dirty, saveState, localError, setLocalError, patch, discardDraft, saveDraft } = useCampaignDraftEditor({
     settings,
     campaignId,
     version,
@@ -68,75 +66,29 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
     setError,
     currentStep: isPolicyView ? "mail-policy" : "mail-settings",
     unsavedTitle: isPolicyView ? "i18n:govoplan-campaign.unsaved_mail_policy_changes.c9327491" : "i18n:govoplan-campaign.unsaved_mail_settings.38e1536b",
-    unsavedMessage: isPolicyView ?
-    "i18n:govoplan-campaign.mail_policy_changes_have_unsaved_draft_changes_s.5aee7d4e" :
-    "i18n:govoplan-campaign.mail_settings_have_unsaved_changes_save_them_bef.52644559",
-    transformDraftBeforeSave: normalizeMailSettingsBeforeSave
+    unsavedMessage: isPolicyView
+      ? "i18n:govoplan-campaign.mail_policy_changes_have_unsaved_draft_changes_s.5aee7d4e"
+      : "i18n:govoplan-campaign.mail_settings_have_unsaved_changes_save_them_bef.52644559",
+    transformDraftBeforeSave: campaignMailProfileReferenceOnly,
+    extraPayload: () => ({
+      migrate_legacy_mail_settings: migrationRequired && Boolean(selectedProfileId)
+    })
   });
+
   const server = asRecord(displayDraft.server);
-  const smtp = asRecord(server.smtp);
-  const imap = asRecord(server.imap);
-  const credentials = asRecord(server.credentials);
-  const smtpCredentials = asRecord(credentials.smtp);
-  const imapCredentials = asRecord(credentials.imap);
+  const selectedProfileId = getText(server, "mail_profile_id");
+  const selectedProfile = mailProfiles.find((profile) => profile.id === selectedProfileId) ?? null;
   const delivery = asRecord(displayDraft.delivery);
   const imapAppend = asRecord(delivery.imap_append_sent);
-  const selectedProfileId = mailModuleInstalled ? getText(server, "mail_profile_id") : "";
-  const selectedProfile = mailModuleInstalled ? mailProfiles.find((profile) => profile.id === selectedProfileId) ?? null : null;
-  const usingMailProfile = mailModuleInstalled && Boolean(selectedProfileId);
-  const selectedProfileHasImap = Boolean(selectedProfile?.imap);
-  const imapUnavailable = usingMailProfile && !selectedProfileHasImap;
-  const smtpCredentialsInherited = usingMailProfile ? effectiveMailPolicy?.smtp_credentials?.inherit !== false : false;
-  const imapCredentialsInherited = usingMailProfile ? effectiveMailPolicy?.imap_credentials?.inherit !== false : false;
-  const effectiveMailPolicyForState: MailProfilePolicy | null = mailModuleInstalled ? effectiveMailPolicy : { allow_campaign_profiles: true };
-  const mailPolicyState = campaignMailSettingsPolicyState({ effectivePolicy: effectiveMailPolicyForState, selectedProfileId, locked });
-  const campaignProfilesAllowed = mailPolicyState.campaignProfilesAllowed;
-  const inlineMailSettingsBlocked = mailPolicyState.inlineMailSettingsBlocked;
-  const smtpDisabled = locked || usingMailProfile || inlineMailSettingsBlocked;
-  const smtpCredentialDisabled = locked || inlineMailSettingsBlocked || usingMailProfile && smtpCredentialsInherited;
-  const imapServerDisabled = locked || inlineMailSettingsBlocked || usingMailProfile;
-  const imapCredentialDisabled = locked || inlineMailSettingsBlocked || imapUnavailable || usingMailProfile && imapCredentialsInherited;
-  const imapDisabled = locked || inlineMailSettingsBlocked || imapUnavailable;
   const imapAppendEnabled = getBool(imapAppend, "enabled");
-  const appendTargetFolderDisabled = imapDisabled || !imapAppendEnabled;
-  const inlinePolicyMessages = useMemo(() => {
-    const validateMailPolicy = mailProfilesUi?.validateMailPolicy;
-    if (!mailModuleInstalled || usingMailProfile || !validateMailPolicy || !effectiveMailPolicy) return [];
-    const recipients = asRecord(displayDraft.recipients);
-    const fromEmail = firstAddressEmail(recipients.from);
-    return validateMailPolicy(effectiveMailPolicy, {
-      smtpHost: getText(smtp, "host"),
-      imapHost: getText(imap, "host"),
-      envelopeSender: fromEmail || getText(smtpCredentials, "username", getText(smtp, "username")),
-      fromHeader: fromEmail,
-      recipientDomains: collectRecipientDomains(displayDraft)
-    });
-  }, [displayDraft, effectiveMailPolicy, imap, mailModuleInstalled, mailProfilesUi, smtp, smtpCredentials, usingMailProfile]);
-  const displayedSmtp = {
-    host: usingMailProfile && selectedProfile ? stringOrEmpty(selectedProfile.smtp.host) : getText(smtp, "host"),
-    port: usingMailProfile && selectedProfile ? selectedProfile.smtp.port ?? 587 : getNumber(smtp, "port", 587),
-    username: usingMailProfile && smtpCredentialsInherited ? profileUsername(selectedProfile, "smtp") : getText(smtpCredentials, "username", getText(smtp, "username")),
-    password: usingMailProfile && smtpCredentialsInherited ? "" : getText(smtpCredentials, "password", getText(smtp, "password")),
-    security: usingMailProfile && selectedProfile ? selectedProfile.smtp.security ?? "starttls" : getText(smtp, "security", "starttls"),
-    timeout_seconds: usingMailProfile && selectedProfile ? selectedProfile.smtp.timeout_seconds ?? 30 : getNumber(smtp, "timeout_seconds", 30)
-  };
-  const displayedImap = {
-    host: usingMailProfile && selectedProfile?.imap ? stringOrEmpty(selectedProfile.imap.host) : getText(imap, "host"),
-    port: usingMailProfile && selectedProfile?.imap ? selectedProfile.imap.port ?? 993 : getNumber(imap, "port", 993),
-    username: usingMailProfile && imapCredentialsInherited ? profileUsername(selectedProfile, "imap") : getText(imapCredentials, "username", getText(imap, "username")),
-    password: usingMailProfile && imapCredentialsInherited ? "" : getText(imapCredentials, "password", getText(imap, "password")),
-    security: usingMailProfile && selectedProfile?.imap ? selectedProfile.imap.security ?? "tls" : getText(imap, "security", "tls"),
-    sent_folder: usingMailProfile && selectedProfile?.imap ? selectedProfile.imap.sent_folder ?? "auto" : getText(imap, "sent_folder", "auto"),
-    timeout_seconds: usingMailProfile && selectedProfile?.imap ? selectedProfile.imap.timeout_seconds ?? 30 : getNumber(imap, "timeout_seconds", 30)
-  };
-  const selectedProfileNeedsLocalCredentials = usingMailProfile && (!smtpCredentialsInherited || selectedProfileHasImap && !imapCredentialsInherited);
+  const selectedProfileHasImap = Boolean(selectedProfile?.imap);
+  const selectedProfileUnavailable = Boolean(selectedProfileId && !profilesLoading && !selectedProfile);
+  const canSave = dirty && !locked && Boolean(draft) && (!migrationRequired || Boolean(selectedProfileId));
 
   useEffect(() => {
     if (!mailModuleInstalled) {
       setMailProfiles([]);
       setPolicyProfiles([]);
-      setEffectiveMailPolicy({ allow_campaign_profiles: true });
-      setProfileError("");
       setProfilesLoading(false);
       return;
     }
@@ -148,230 +100,55 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
     setProfilesLoading(true);
     setProfileError("");
     try {
-      const [allowedProfiles, visibleProfiles, policyResponse] = await Promise.all([
-      listMailServerProfiles(settings, false, campaignId),
-      listMailServerProfiles(settings, true),
-      getMailProfilePolicy(settings, "campaign", campaignId, campaignId)]
-      );
+      const [allowedProfiles, visibleProfiles] = await Promise.all([
+        listMailServerProfiles(settings, false, campaignId),
+        listMailServerProfiles(settings, true)
+      ]);
       setMailProfiles(allowedProfiles);
       setPolicyProfiles(visibleProfiles);
-      setEffectiveMailPolicy(policyResponse.effective_policy ?? null);
     } catch (err) {
       setMailProfiles([]);
       setPolicyProfiles([]);
-      setEffectiveMailPolicy(null);
       setProfileError(err instanceof Error ? err.message : String(err));
     } finally {
       setProfilesLoading(false);
     }
   }
 
-  function normalizeMailSettingsBeforeSave(value: Record<string, unknown>): Record<string, unknown> {
-    if (mailModuleInstalled === false) return value;
-    const next = cloneJson(value);
-    const nextServer = { ...asRecord(next.server) };
-    const profileId = getText(nextServer, "mail_profile_id");
-    if (profileId.length === 0) return next;
-
-    const nextCredentials = { ...asRecord(nextServer.credentials) };
-    normalizeProfileCredentialProtocol(nextServer, nextCredentials, "smtp", effectiveMailPolicy?.smtp_credentials?.inherit === false ? false : true);
-    normalizeProfileCredentialProtocol(nextServer, nextCredentials, "imap", effectiveMailPolicy?.imap_credentials?.inherit === false ? false : true);
-    nextServer.credentials = nextCredentials;
-    next.server = nextServer;
-    return next;
-  }
-
-  function normalizeProfileCredentialProtocol(
-  serverValue: Record<string, unknown>,
-  credentialsValue: Record<string, unknown>,
-  protocol: "smtp" | "imap",
-  inherit: boolean)
-  {
-    serverValue["inherit_" + protocol + "_credentials"] = inherit;
-    if (inherit === false) return;
-
-    const transport = { ...asRecord(serverValue[protocol]) };
-    delete transport.username;
-    delete transport.password;
-    serverValue[protocol] = transport;
-    credentialsValue[protocol] = {};
-  }
-
   function selectMailProfile(profileId: string) {
     if (!mailModuleInstalled || locked) return;
-    if (!profileId && !campaignProfilesAllowed) {
-      setProfileError(mailPolicyState.inlineBlockedMessage);
-      return;
-    }
-    patch(["server", "mail_profile_id"], profileId);
-    setProfileMessage("");
+    patch(["server"], profileId ? { mail_profile_id: profileId } : {});
+    setSmtpTestResult(null);
+    setImapTestResult(null);
+    setFolderResult(null);
     setProfileError("");
-    if (profileId) {
-      patch(["server", "smtp"], {});
-      patch(["server", "imap"], {});
-      patch(["server", "credentials"], {});
-      setSmtpTestResult(null);
-      setImapTestResult(null);
-      setFolderResult(null);
-    }
   }
 
-  async function saveCurrentSettingsAsProfile() {
-    if (!mailModuleInstalled || locked || usingMailProfile || !campaignProfilesAllowed) return;
-    setProfilesLoading(true);
-    setProfileMessage("");
-    setProfileError("");
-    try {
-      const created = await createMailServerProfile(settings, {
-        name: profileName.trim() || `${data.campaign?.name || "Campaign"} mail profile`,
-        scope_type: "campaign",
-        scope_id: campaignId,
-        smtp: smtpServerPayload(),
-        imap: hasInlineImapSettings() ? imapServerPayload() : null,
-        credentials: mailProfileCredentialsPayload(false),
-        is_active: true
-      });
-      setMailProfiles((current) => [...current.filter((profile) => profile.id !== created.id), created].sort((a, b) => a.name.localeCompare(b.name)));
-      patch(["server", "mail_profile_id"], created.id);
-      patch(["server", "smtp"], {});
-      patch(["server", "imap"], {});
-      patch(["server", "credentials"], {});
-      setProfileName("");
-      setProfileMessage(`Saved profile ${created.name}.`);
-    } catch (err) {
-      setProfileError(err instanceof Error ? err.message : String(err));
-    } finally {
-      setProfilesLoading(false);
-    }
-  }
-
-
-  function patchSmtpSettings(patchValue: Partial<MailServerSmtpSettings>) {
-    if (patchValue.host !== undefined) patch(["server", "smtp", "host"], String(patchValue.host ?? ""));
-    if (patchValue.port !== undefined) patch(["server", "smtp", "port"], mailNumberOrNull(patchValue.port));
-    if (patchValue.security !== undefined) patch(["server", "smtp", "security"], String(patchValue.security || "starttls"));
-    if (patchValue.timeout_seconds !== undefined) patch(["server", "smtp", "timeout_seconds"], mailNumberOrDefault(patchValue.timeout_seconds, 30));
-  }
-
-  function patchImapSettings(patchValue: Partial<MailServerImapSettings>) {
-    if (patchValue.host !== undefined) patch(["server", "imap", "host"], String(patchValue.host ?? ""));
-    if (patchValue.port !== undefined) patch(["server", "imap", "port"], mailNumberOrNull(patchValue.port));
-    if (patchValue.security !== undefined) patch(["server", "imap", "security"], String(patchValue.security || "tls"));
-    if (patchValue.sent_folder !== undefined) patch(["server", "imap", "sent_folder"], String(patchValue.sent_folder ?? ""));
-    if (patchValue.timeout_seconds !== undefined) patch(["server", "imap", "timeout_seconds"], mailNumberOrDefault(patchValue.timeout_seconds, 30));
-  }
-
-  function patchSmtpCredentials(patchValue: Partial<MailServerCredentialSettings>) {
-    if (patchValue.username !== undefined) patch(["server", "credentials", "smtp", "username"], String(patchValue.username ?? ""));
-    if (patchValue.password !== undefined) patch(["server", "credentials", "smtp", "password"], String(patchValue.password ?? ""));
-  }
-
-  function patchImapCredentials(patchValue: Partial<MailServerCredentialSettings>) {
-    if (patchValue.username !== undefined) patch(["server", "credentials", "imap", "username"], String(patchValue.username ?? ""));
-    if (patchValue.password !== undefined) patch(["server", "credentials", "imap", "password"], String(patchValue.password ?? ""));
-  }
-
-  function profileScopeLabel(profile: MailServerProfile): string {
-    if (profile.scope_type === "system") return "system";
-    if (profile.scope_type === "tenant") return "tenant";
-    if (profile.scope_type === "user") return "user";
-    if (profile.scope_type === "group") return "group";
-    return "campaign";
-  }
-
-
-  function smtpServerPayload() {
-    return mailSmtpSettingsPayload<MailSecurity>(
-      { host: getText(smtp, "host"), port: getNumber(smtp, "port", 587), security: getText(smtp, "security", "starttls"), timeout_seconds: getNumber(smtp, "timeout_seconds", 30) },
-      { fallbackSecurity: "starttls", allowedSecurity: securityOptions }
-    );
-  }
-
-  function imapServerPayload() {
-    return mailImapSettingsPayload<MailSecurity>(
-      { host: getText(imap, "host"), port: getNumber(imap, "port", 993), security: getText(imap, "security", "tls"), sent_folder: getText(imap, "sent_folder", "auto"), timeout_seconds: getNumber(imap, "timeout_seconds", 30) },
-      { fallbackSecurity: "tls", allowedSecurity: securityOptions }
-    );
-  }
-
-  function mailProfileCredentialsPayload(preserveBlankPassword: boolean) {
-    return {
-      smtp: mailTransportCredentialsPayloadFromRecords(smtpCredentials, smtp, preserveBlankPassword),
-      imap: mailTransportCredentialsPayloadFromRecords(imapCredentials, imap, preserveBlankPassword)
-    };
-  }
-
-  function rawSmtpPayload() {
-    const serverPayload = selectedProfile && !smtpCredentialsInherited ? selectedProfile.smtp : smtpServerPayload();
-    return { ...serverPayload, ...mailTransportCredentialsPayloadFromRecords(smtpCredentials, smtp, false) };
-  }
-
-  function rawImapPayload() {
-    const serverPayload = selectedProfile?.imap && !imapCredentialsInherited ? selectedProfile.imap : imapServerPayload();
-    return { ...serverPayload, ...mailTransportCredentialsPayloadFromRecords(imapCredentials, imap, false) };
-  }
-
-  function hasInlineImapSettings(): boolean {
-    return hasMailImapSettings([getText(imap, "host"), getText(imapCredentials, "username", getText(imap, "username")), getText(imapCredentials, "password", getText(imap, "password"))]);
-  }
-
-  function profileUsername(profile: MailServerProfile | null, protocol: "smtp" | "imap"): string {
-    if (!profile) return "";
-    if (protocol === "smtp") return stringOrEmpty(profile.credentials?.smtp?.username ?? profile.smtp.username);
-    return stringOrEmpty(profile.credentials?.imap?.username ?? profile.imap?.username);
-  }
-
-
-  async function runSmtpTest() {
-    if (!mailModuleInstalled) {
-      setSmtpTestResult({ ok: false, protocol: "smtp", message: "i18n:govoplan-campaign.install_and_enable_the_mail_module_to_test_smtp_.a7ce04e1", details: {} });
-      return;
-    }
-    if (locked || inlineMailSettingsBlocked) return;
-    setMailActionState("smtp");
+  async function runProfileTest(protocol: "smtp" | "imap") {
+    if (!selectedProfileId || locked) return;
+    setMailActionState(protocol);
     setLocalError("");
     try {
-      setSmtpTestResult(selectedProfileId && smtpCredentialsInherited ?
-      await testMailProfileSmtp(settings, selectedProfileId) :
-      await testSmtpSettings(settings, rawSmtpPayload()));
+      if (protocol === "smtp") {
+        setSmtpTestResult(await testMailProfileSmtp(settings, selectedProfileId));
+      } else {
+        setImapTestResult(await testMailProfileImap(settings, selectedProfileId));
+      }
     } catch (err) {
-      setSmtpTestResult({ ok: false, protocol: "smtp", message: err instanceof Error ? err.message : String(err), details: {} });
-    } finally {
-      setMailActionState(null);
-    }
-  }
-
-  async function runImapTest() {
-    if (!mailModuleInstalled) {
-      setImapTestResult({ ok: false, protocol: "imap", message: "i18n:govoplan-campaign.install_and_enable_the_mail_module_to_test_imap_.d6537dfd", details: {} });
-      return;
-    }
-    if (imapDisabled) return;
-    setMailActionState("imap");
-    setLocalError("");
-    try {
-      setImapTestResult(selectedProfileId && imapCredentialsInherited ?
-      await testMailProfileImap(settings, selectedProfileId) :
-      await testImapSettings(settings, rawImapPayload()));
-    } catch (err) {
-      setImapTestResult({ ok: false, protocol: "imap", message: err instanceof Error ? err.message : String(err), details: {} });
+      const result = { ok: false, protocol, message: err instanceof Error ? err.message : String(err), details: {} };
+      if (protocol === "smtp") setSmtpTestResult(result);
+      else setImapTestResult(result);
     } finally {
       setMailActionState(null);
     }
   }
 
   async function runFolderLookup() {
-    if (!mailModuleInstalled) {
-      setFolderResult({ ok: false, protocol: "imap", message: "i18n:govoplan-campaign.install_and_enable_the_mail_module_to_inspect_im.52535774", folders: [], details: {} });
-      return;
-    }
-    if (appendTargetFolderDisabled) return;
+    if (!selectedProfileId || locked || !selectedProfileHasImap) return;
     setMailActionState("folders");
     setLocalError("");
     try {
-      setFolderResult(selectedProfileId && imapCredentialsInherited ?
-      await listMailProfileImapFolders(settings, selectedProfileId) :
-      await listImapFolders(settings, rawImapPayload()));
+      setFolderResult(await listMailProfileImapFolders(settings, selectedProfileId));
     } catch (err) {
       setFolderResult({ ok: false, protocol: "imap", message: err instanceof Error ? err.message : String(err), folders: [], details: {} });
     } finally {
@@ -381,8 +158,7 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
 
   function useDetectedSentFolder() {
     const folder = folderResult?.detected_sent_folder;
-    if (!folder || appendTargetFolderDisabled) return;
-    patch(["delivery", "imap_append_sent", "folder"], folder);
+    if (folder && !locked) patch(["delivery", "imap_append_sent", "folder"], folder);
   }
 
   return (
@@ -393,8 +169,8 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
           <VersionLine version={version} versions={data.versions} status={saveState} />
         </div>
         <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
-          {!isPolicyView && <Button variant="primary" onClick={() => saveDraft("manual")} disabled={!dirty || locked || !draft || inlineMailSettingsBlocked}>{dirty ? "i18n:govoplan-campaign.save_now.3989b7c0" : "i18n:govoplan-campaign.saved.c0ae8f6e"}</Button>}
+          {!isPolicyView && <Button variant="primary" onClick={() => void saveDraft("manual")} disabled={!canSave}>{dirty ? "i18n:govoplan-campaign.save_now.3989b7c0" : "i18n:govoplan-campaign.saved.c0ae8f6e"}</Button>}
+          <Button onClick={() => void discardDraft()} disabled={loading}>i18n:govoplan-campaign.discard.36fff63c</Button>
         </div>
       </div>
 
@@ -404,14 +180,13 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
 
       <LoadingFrame loading={loading || !draft} label="i18n:govoplan-campaign.loading_campaign_draft.1cf47e50">
         <>
-          {!mailModuleInstalled &&
-          <DismissibleAlert tone="info" dismissible={false}>
-              i18n:govoplan-campaign.the_mail_module_is_not_installed_inline_smtp_and.8e0f802e
-            </DismissibleAlert>
-          }
+          {!mailModuleInstalled && <DismissibleAlert tone="warning" dismissible={false}>i18n:govoplan-campaign.install_and_enable_the_mail_module_to_select_a_d.01c75fc4</DismissibleAlert>}
 
-          {isPolicyView && mailModuleInstalled && MailProfilePolicyEditor &&
-          <MailProfilePolicyEditor
+          {migrationRequired && <DismissibleAlert tone="warning" dismissible={false}>
+            i18n:govoplan-campaign.this_version_contains_legacy_campaign_local_mail.44c7a6fd
+          </DismissibleAlert>}
+
+          {isPolicyView && mailModuleInstalled && MailProfilePolicyEditor && <MailProfilePolicyEditor
             settings={settings}
             scopeType="campaign"
             scopeId={campaignId}
@@ -422,129 +197,72 @@ export default function MailSettingsPage({ settings, campaignId, view = "setting
             canWrite={!locked}
             locked={locked}
             title="i18n:govoplan-campaign.campaign_local_mail_policy.94f59da0"
-            description="i18n:govoplan-campaign.campaign_local_mail_limits_applied_after_system_.e7f9bb31"
-            onSaved={refreshMailProfiles} />
+            description="i18n:govoplan-campaign.mail_policy_limits_which_mail_owned_profiles_thi.824b1b2e"
+            onSaved={refreshMailProfiles} />}
 
-          }
+          {isPolicyView && mailModuleInstalled && !MailProfilePolicyEditor && <DismissibleAlert tone="warning" dismissible={false}>i18n:govoplan-campaign.the_mail_module_did_not_expose_profile_managemen.2cdb57e1</DismissibleAlert>}
 
-          {isPolicyView && mailModuleInstalled && !MailProfilePolicyEditor &&
-          <DismissibleAlert tone="warning" dismissible={false}>i18n:govoplan-campaign.the_mail_module_did_not_expose_profile_managemen.2cdb57e1</DismissibleAlert>
-          }
-
-          {!isPolicyView && mailModuleInstalled &&
-          <Card
+          {!isPolicyView && mailModuleInstalled && <Card
             title="i18n:govoplan-campaign.reusable_mail_profile.f9c9aab1"
-            actions={
-            <div className="button-row compact-actions">
-                <Button onClick={() => void refreshMailProfiles()} disabled={profilesLoading}>{profilesLoading ? "i18n:govoplan-campaign.loading.33ce4174" : "i18n:govoplan-campaign.reload_profiles.0fe100d1"}</Button>
-                <Button variant="primary" onClick={() => void saveCurrentSettingsAsProfile()} disabled={locked || usingMailProfile || profilesLoading || !campaignProfilesAllowed}>{profilesLoading ? "i18n:govoplan-campaign.saving.56a2285c" : "i18n:govoplan-campaign.save_current_settings_as_profile.7578a50b"}</Button>
-              </div>
-            }>
-            
+            actions={<Button onClick={() => void refreshMailProfiles()} disabled={profilesLoading}>{profilesLoading ? "i18n:govoplan-campaign.loading.33ce4174" : "i18n:govoplan-campaign.reload_profiles.0fe100d1"}</Button>}>
+            <p className="muted small-note">i18n:govoplan-campaign.campaign_stores_only_this_stable_profile_referen.de554809</p>
             <div className="form-grid compact responsive-form-grid">
               <FormField label="i18n:govoplan-campaign.profile.ff4fc027">
                 <select value={selectedProfileId} disabled={locked || profilesLoading} onChange={(event) => selectMailProfile(event.target.value)}>
-                  <option value="" disabled={mailPolicyState.inlineOptionDisabled}>i18n:govoplan-campaign.inline_smtp_imap_settings.cf16c421</option>
+                  <option value="">i18n:govoplan-campaign.select_a_mail_profile.76480af0</option>
                   {mailProfiles.map((profile) => <option key={profile.id} value={profile.id}>{profile.name} ({profileScopeLabel(profile)})</option>)}
                 </select>
               </FormField>
-              <FormField label="i18n:govoplan-campaign.new_profile_name.393313b6">
-                <input value={profileName} disabled={locked || usingMailProfile || profilesLoading || !campaignProfilesAllowed} onChange={(event) => setProfileName(event.target.value)} placeholder={data.campaign?.name ? i18nMessage("i18n:govoplan-campaign.value_campaign_local_profile.70cd9d43", { value0: data.campaign.name }) : "i18n:govoplan-campaign.campaign_local_profile.c24cf2d1"} />
-              </FormField>
             </div>
-            {!campaignProfilesAllowed && <p className="muted small-note">i18n:govoplan-campaign.campaign_local_mail_settings_are_blocked_by_the_.0b2510aa</p>}
-            {selectedProfile &&
-            <p className="muted small-note">i18n:govoplan-campaign.using.c25de2e8 {selectedProfile.name} ({profileScopeLabel(selectedProfile)}i18n:govoplan-campaign.smtp_credentials.10f75c8a {smtpCredentialsInherited ? "i18n:govoplan-campaign.inherited_from_profile.1947c2f3" : "i18n:govoplan-campaign.local_credentials_required.fdc9af1c"}i18n:govoplan-campaign.imap_credentials.7442b238 {selectedProfile.imap ? imapCredentialsInherited ? "i18n:govoplan-campaign.inherited_from_profile.1947c2f3" : "i18n:govoplan-campaign.local_credentials_required.fdc9af1c" : "i18n:govoplan-campaign.not_configured.67f2141f"}.</p>
-            }
-            {selectedProfileNeedsLocalCredentials &&
-            <p className="muted small-note">i18n:govoplan-campaign.the_selected_profile_supplies_the_server_setting.bdc830db</p>
-            }
-            {profileMessage && <DismissibleAlert tone="success" resetKey={profileMessage} floating>{profileMessage}</DismissibleAlert>}
-            {profileError && <DismissibleAlert tone="warning" resetKey={profileError} dismissStorageKey={`campaign:${campaignId}:mail-settings:profile-error`} floating>{profileError}</DismissibleAlert>}
-          </Card>
-          }
-
-          {!isPolicyView &&
-          <Card title="i18n:govoplan-campaign.mail_server_settings.6db620b0" collapsible>
-            {inlinePolicyMessages.length > 0 &&
-            <DismissibleAlert tone="warning" resetKey={inlinePolicyMessages.map((item) => `${item.key}:${item.value}`).join("|")} dismissible={false}>
-                <strong>i18n:govoplan-campaign.effective_mail_policy_blocks_the_current_inline_.99c34c6b</strong>
-                <ul>{inlinePolicyMessages.map((item) => <li key={`${item.key}:${item.value}`}>{item.message}</li>)}</ul>
-              </DismissibleAlert>
-            }
-            <MailServerSettingsPanel
-              smtp={displayedSmtp}
-              imap={displayedImap}
-              onSmtpChange={patchSmtpSettings}
-              onImapChange={patchImapSettings}
-              smtpCredentials={{ username: displayedSmtp.username, password: displayedSmtp.password }}
-              imapCredentials={{ username: displayedImap.username, password: displayedImap.password }}
-              onSmtpCredentialsChange={patchSmtpCredentials}
-              onImapCredentialsChange={patchImapCredentials}
-              smtpDisabled={smtpDisabled}
-              smtpCredentialDisabled={smtpCredentialDisabled}
-              smtpPasswordSaved={Boolean(usingMailProfile && smtpCredentialsInherited && selectedProfile?.smtp_password_configured)}
-              smtpActionDisabled={locked || inlineMailSettingsBlocked || !mailModuleInstalled}
-              imapServerDisabled={imapServerDisabled}
-              imapCredentialDisabled={imapCredentialDisabled}
-              imapPasswordSaved={Boolean(usingMailProfile && imapCredentialsInherited && selectedProfile?.imap_password_configured)}
-              imapActionDisabled={imapDisabled || !mailModuleInstalled}
-              append={{
-                enabled: imapAppendEnabled,
-                folder: getText(imapAppend, "folder", getText(imap, "sent_folder", "auto")),
-                disabled: imapDisabled,
-                folderDisabled: appendTargetFolderDisabled,
-                onEnabledChange: (checked) => patch(["delivery", "imap_append_sent", "enabled"], checked),
-                onFolderChange: (folder) => patch(["delivery", "imap_append_sent", "folder"], folder)
-              }}
-              smtpTestLabel={usingMailProfile ? "i18n:govoplan-campaign.test_profile_smtp.884a0e66" : "i18n:govoplan-campaign.test_smtp_login.a1359755"}
-              imapTestLabel={usingMailProfile ? "i18n:govoplan-campaign.test_profile_imap.e1cec0e0" : "i18n:govoplan-campaign.test_imap_login.c32e316e"}
-              busyAction={mailActionState}
-              onTestSmtp={runSmtpTest}
-              onTestImap={runImapTest}
-              onLookupFolders={runFolderLookup}
-              smtpTestResult={smtpTestResult}
-              imapTestResult={imapTestResult}
-              folderLookupResult={folderResult}
-              onUseDetectedFolder={useDetectedSentFolder}
-              useDetectedFolderDisabled={appendTargetFolderDisabled}
-              floatingResults />
-            
-          </Card>
-          }
+            {selectedProfileUnavailable && <DismissibleAlert tone="warning" dismissible={false}>i18n:govoplan-campaign.the_referenced_mail_profile_is_inactive_unavaila.abeebe26</DismissibleAlert>}
+            {selectedProfile && <div className="metric-grid inside">
+              <MetricCard label="i18n:govoplan-campaign.profile.ff4fc027" value={selectedProfile.name} />
+              <MetricCard label="i18n:govoplan-campaign.scope.4651a34e" value={profileScopeLabel(selectedProfile)} />
+              <MetricCard label="i18n:govoplan-campaign.smtp.efff9cca" value="i18n:govoplan-campaign.configured.668c5fff" tone="good" />
+              <MetricCard label="i18n:govoplan-campaign.imap.271f9ef2" value={selectedProfile.imap ? "i18n:govoplan-campaign.configured.668c5fff" : "i18n:govoplan-campaign.not_configured.811931bb"} tone={selectedProfile.imap ? "good" : "neutral"} />
+            </div>}
+            <div className="button-row compact-actions">
+              <Button onClick={() => void runProfileTest("smtp")} disabled={!selectedProfile || locked || Boolean(mailActionState)}>{mailActionState === "smtp" ? "i18n:govoplan-campaign.testing_smtp.8e9f8247" : "i18n:govoplan-campaign.test_profile_smtp.884a0e66"}</Button>
+              <Button onClick={() => void runProfileTest("imap")} disabled={!selectedProfileHasImap || locked || Boolean(mailActionState)}>{mailActionState === "imap" ? "i18n:govoplan-campaign.testing_imap.13d255cf" : "i18n:govoplan-campaign.test_profile_imap.e1cec0e0"}</Button>
+            </div>
+            {smtpTestResult && <DismissibleAlert tone={smtpTestResult.ok ? "success" : "danger"} resetKey={`${smtpTestResult.protocol}:${smtpTestResult.message}`} floating>{smtpTestResult.message}</DismissibleAlert>}
+            {imapTestResult && <DismissibleAlert tone={imapTestResult.ok ? "success" : "danger"} resetKey={`${imapTestResult.protocol}:${imapTestResult.message}`} floating>{imapTestResult.message}</DismissibleAlert>}
+            {profileError && <DismissibleAlert tone="warning" resetKey={profileError} floating>{profileError}</DismissibleAlert>}
+          </Card>}
 
+          {!isPolicyView && <Card title="i18n:govoplan-campaign.imap_append.8c0d9e96" collapsible>
+            <div className="form-grid compact responsive-form-grid mail-server-form-grid">
+              <div className="mail-server-field-span mail-server-toggle-row mail-server-plain-toggle-row">
+                <ToggleSwitch
+                  label="i18n:govoplan-campaign.append_successful_messages_to_sent_via_imap.dbd1b1d8"
+                  checked={imapAppendEnabled}
+                  disabled={locked || !selectedProfileHasImap}
+                  onChange={(checked) => patch(["delivery", "imap_append_sent", "enabled"], checked)} />
+              </div>
+              <FormField label="i18n:govoplan-core.append_target_folder.0aaacc0c" help="i18n:govoplan-core.folder_for_sent_message_copies_leave_as_auto_unl.a62586e9">
+                <div className="field-with-action mail-server-folder-field">
+                  <input
+                    value={getText(imapAppend, "folder", "auto")}
+                    disabled={locked || !imapAppendEnabled || !selectedProfileHasImap}
+                    onChange={(event) => patch(["delivery", "imap_append_sent", "folder"], event.target.value)} />
+                  <Button type="button" variant="primary" onClick={() => void runFolderLookup()} disabled={locked || !imapAppendEnabled || !selectedProfileHasImap || Boolean(mailActionState)}>
+                    {mailActionState === "folders" ? "i18n:govoplan-core.looking_up.5fc6d2a2" : "i18n:govoplan-core.folders.c603ab65"}
+                  </Button>
+                </div>
+              </FormField>
+              <MailServerFolderLookupResultView result={folderResult} disabled={locked || !imapAppendEnabled} onUseDetected={useDetectedSentFolder} floatingFailures />
+            </div>
+          </Card>}
         </>
       </LoadingFrame>
-    </div>);
-
+    </div>
+  );
 }
 
-
-function stringOrEmpty(value: unknown): string {
-  return value === null || value === undefined ? "" : String(value);
-}
-
-function firstAddressEmail(value: unknown): string {
-  return addressesFromValue(value)[0]?.email ?? "";
-}
-
-function collectRecipientDomains(draft: Record<string, unknown>): string[] {
-  const domains = new Set<string>();
-  const recipients = asRecord(draft.recipients);
-  for (const key of ["to", "cc", "bcc"]) addAddressDomains(domains, recipients[key]);
-
-  const entries = asArray(asRecord(draft.entries).inline).map(asRecord);
-  for (const entry of entries) {
-    for (const key of ["to", "cc", "bcc"]) addAddressDomains(domains, entry[key]);
-    addAddressDomains(domains, entry.recipient);
-    addAddressDomains(domains, entry);
-  }
-  return [...domains].sort();
-}
-
-function addAddressDomains(domains: Set<string>, value: unknown) {
-  for (const address of addressesFromValue(value)) {
-    const domain = address.email.split("@").pop()?.trim().toLowerCase();
-    if (domain) domains.add(domain);
-  }
+function profileScopeLabel(profile: MailServerProfile): string {
+  if (profile.scope_type === "system") return "i18n:govoplan-campaign.system.bc0792d8";
+  if (profile.scope_type === "tenant") return "i18n:govoplan-campaign.tenant.3ca93c78";
+  if (profile.scope_type === "user") return "i18n:govoplan-campaign.user.9f8a2389";
+  if (profile.scope_type === "group") return "i18n:govoplan-campaign.group.171a0606";
+  return "i18n:govoplan-campaign.campaign_scoped_mail_profile.9cbf3505";
 }

webui/src/features/campaigns/RecipientDetailsPage.tsx

@@ -1,269 +0,0 @@
-import { useMemo, useState } from "react";
-import { Link } from "react-router-dom";
-import { usePlatformModuleInstalled } from "@govoplan/core-webui";
-import type { ApiSettings } from "../../types";
-import { Button } from "@govoplan/core-webui";
-import { Card } from "@govoplan/core-webui";
-import { PageTitle } from "@govoplan/core-webui";
-import { LoadingFrame } from "@govoplan/core-webui";
-import LockedVersionNotice from "./components/LockedVersionNotice";
-import VersionLine from "./components/VersionLine";
-import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
-import { useCampaignDraftEditor } from "./hooks/useCampaignDraftEditor";
-import { asArray, asRecord, isAuditLockedVersion } from "./utils/campaignView";
-import FieldValueInput from "./components/FieldValueInput";
-import AttachmentRulesOverlay from "./components/AttachmentRulesOverlay";
-import { getDraftFields } from "./utils/fieldDefinitions";
-import { getIndividualAttachmentBasePaths, normalizeAttachmentBasePaths, normalizeAttachmentRules, normalizeAttachmentZipCollection, type AttachmentBasePath, type AttachmentRule, type AttachmentZipCollection } from "./utils/attachments";
-import { importedRowsNeedAttachmentSource, materializeRecipientImport, type RecipientImportMode, type RecipientImportPreview } from "./utils/bulkImport";
-import { buildTemplatePreviewContext } from "./utils/templatePlaceholders";
-import { RecipientImportDialog } from "./RecipientDataPage";
-import { addressesFromValue } from "@govoplan/core-webui";
-import { DismissibleAlert, i18nMessage } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn } from "../../components/table/DataGrid";
-
-
-export default function RecipientDetailsPage({ settings, campaignId }: {settings: ApiSettings;campaignId: string;}) {
-  const filesModuleInstalled = usePlatformModuleInstalled("files");
-  const { data, loading, error, reload, setError } = useCampaignWorkspaceData(settings, campaignId);
-  const [importOpen, setImportOpen] = useState(false);
-  const [recipientDataPage, setRecipientDataPage] = useState(1);
-  const [recipientDataPageSize, setRecipientDataPageSize] = useState(10);
-
-  const version = data.currentVersion;
-  const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, setDraft, displayDraft, dirty, saveState, localError, patch, markDirty, saveDraft } = useCampaignDraftEditor({
-    settings,
-    campaignId,
-    version,
-    locked,
-    reload,
-    setError,
-    currentStep: "recipient-data",
-    unsavedTitle: "i18n:govoplan-campaign.unsaved_recipient_data_changes.c810507e",
-    unsavedMessage: "i18n:govoplan-campaign.recipient_field_values_or_attachments_have_unsav.49ab1870"
-  });
-  const entries = asRecord(displayDraft.entries);
-  const inlineEntries = asArray(entries.inline).map(asRecord);
-  const source = asRecord(entries.source);
-  const fieldDefinitions = useMemo(() => getDraftFields(displayDraft), [displayDraft]);
-  const attachmentSection = asRecord(displayDraft.attachments);
-  const attachmentBasePaths = useMemo(() => normalizeAttachmentBasePaths(attachmentSection.base_paths, attachmentSection), [attachmentSection]);
-  const individualAttachmentBasePaths = useMemo(() => getIndividualAttachmentBasePaths(attachmentBasePaths), [attachmentBasePaths]);
-  const importBasePaths = useMemo(() => normalizeAttachmentBasePaths(attachmentSection.base_paths, attachmentSection, true), [attachmentSection]);
-  const defaultImportBasePath = useMemo(() => importBasePaths.find((basePath) => basePath.allow_individual) ?? importBasePaths[0] ?? null, [importBasePaths]);
-  const zipConfig = useMemo(() => normalizeAttachmentZipCollection(attachmentSection.zip), [attachmentSection.zip]);
-
-
-  function replaceInlineEntries(nextEntries: Record<string, unknown>[]) {
-    patch(["entries", "inline"], nextEntries);
-  }
-
-  function updateEntry(index: number, updater: (entry: Record<string, unknown>) => Record<string, unknown>) {
-    const nextEntries = inlineEntries.map((entry, currentIndex) => currentIndex === index ? updater(entry) : entry);
-    replaceInlineEntries(nextEntries);
-  }
-
-  function updateEntryField(index: number, field: string, value: unknown) {
-    updateEntry(index, (entry) => ({
-      ...entry,
-      fields: {
-        ...asRecord(entry.fields),
-        [field]: value
-      }
-    }));
-  }
-
-  function updateEntryAttachments(index: number, attachments: AttachmentRule[]) {
-    updateEntry(index, (entry) => ({ ...entry, attachments }));
-  }
-
-  function applyRecipientImport(preview: RecipientImportPreview, mode: RecipientImportMode) {
-    if (locked || !draft) return;
-    const needsAttachmentSource = importedRowsNeedAttachmentSource(preview);
-    const currentAttachments = asRecord(draft.attachments);
-    let nextBasePaths = normalizeAttachmentBasePaths(currentAttachments.base_paths, currentAttachments, true);
-    let attachmentBasePath: AttachmentBasePath | null = null;
-
-    if (needsAttachmentSource) {
-      if (nextBasePaths.length === 0) {
-        nextBasePaths = [{ id: "base-path-campaign", name: "Campaign files", path: ".", allow_individual: true, unsent_warning: false }];
-      }
-      const selectedIndex = Math.max(0, nextBasePaths.findIndex((basePath) => basePath.allow_individual));
-      nextBasePaths = nextBasePaths.map((basePath, index) => index === selectedIndex ? { ...basePath, allow_individual: true } : basePath);
-      attachmentBasePath = nextBasePaths[selectedIndex] ?? null;
-    }
-
-    const importedDraft = materializeRecipientImport(draft, preview, { mode, attachmentBasePath });
-    const nextDraft = needsAttachmentSource ?
-    {
-      ...importedDraft,
-      attachments: {
-        ...asRecord(importedDraft.attachments),
-        base_paths: nextBasePaths,
-        base_path: nextBasePaths[0]?.path || "."
-      }
-    } :
-    importedDraft;
-    setDraft(nextDraft);
-    markDirty();
-    setImportOpen(false);
-  }
-
-
-  return (
-    <div className="content-pad workspace-data-page">
-      <div className="page-heading split workspace-heading">
-        <div>
-          <PageTitle loading={loading}>i18n:govoplan-campaign.recipient_data.c2baaf10</PageTitle>
-          <VersionLine version={version} versions={data.versions} status={saveState} />
-        </div>
-        <div className="button-row compact-actions">
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
-          <Button variant="primary" onClick={() => saveDraft("manual")} disabled={!dirty || locked || !draft}>i18n:govoplan-campaign.save.efc007a3</Button>
-        </div>
-      </div>
-
-      {error && <DismissibleAlert tone="danger" resetKey={error} floating>{error}</DismissibleAlert>}
-      {localError && <DismissibleAlert tone="danger" resetKey={localError} floating>{localError}</DismissibleAlert>}
-      {locked && <LockedVersionNotice settings={settings} campaignId={campaignId} version={version} currentVersionId={data.campaign?.current_version_id} reload={reload} message="i18n:govoplan-campaign.this_page_is_read_only_for_the_selected_version.dacf5743" />}
-
-      <LoadingFrame loading={loading || !draft} label="i18n:govoplan-campaign.loading_campaign_draft.1cf47e50">
-        <>
-          <Card title="i18n:govoplan-campaign.recipient_field_values_and_attachments.96e670ca" actions={<Button disabled={locked} onClick={() => setImportOpen(true)}>i18n:govoplan-campaign.import.d6fbc9d2</Button>}>
-            {inlineEntries.length === 0 && !source.type && <p className="muted">i18n:govoplan-campaign.no_recipient_profiles_are_stored_in_the_current_.e9f9a224</p>}
-            {inlineEntries.length === 0 && Boolean(source.type) &&
-            <DismissibleAlert tone="info">i18n:govoplan-campaign.this_campaign_references_an_external_recipient_s.0d1ae252</DismissibleAlert>
-            }
-            {inlineEntries.length > 0 &&
-            <div className="admin-table-surface recipient-data-table-surface">
-                <DataGrid
-                id={`campaign-${campaignId}-recipient-data`}
-                rows={inlineEntries}
-                columns={recipientDataColumns({ settings, campaignId, draft: displayDraft, locked, filesModuleInstalled, fieldDefinitions, individualAttachmentBasePaths, zipConfig, updateEntryAttachments, updateEntryField })}
-                getRowKey={(entry, index) => String(entry.id || index)}
-                emptyText="i18n:govoplan-campaign.no_recipient_data_found.a12be7d0"
-                className="recipient-table-wrap recipient-data-table-wrap recipient-data-table"
-                pagination={{
-                  page: recipientDataPage,
-                  pageSize: recipientDataPageSize,
-                  pageSizeOptions: [10, 25, 50, 100, 250],
-                  onPageChange: setRecipientDataPage,
-                  onPageSizeChange: (pageSize) => {
-                    setRecipientDataPageSize(pageSize);
-                    setRecipientDataPage(1);
-                  }
-                }} />
-              
-              </div>
-            }
-          </Card>
-        </>
-      </LoadingFrame>
-
-      {importOpen &&
-      <RecipientImportDialog
-        settings={settings}
-        campaignId={campaignId}
-        existingEntries={inlineEntries}
-        existingFields={fieldDefinitions}
-        defaultAttachmentBasePath={defaultImportBasePath}
-        onCancel={() => setImportOpen(false)}
-        onImport={applyRecipientImport} />
-
-      }
-    </div>);
-
-}
-
-type RecipientDataColumnContext = {
-  settings: ApiSettings;
-  campaignId: string;
-  draft: Record<string, unknown>;
-  locked: boolean;
-  filesModuleInstalled: boolean;
-  fieldDefinitions: ReturnType<typeof getDraftFields>;
-  individualAttachmentBasePaths: ReturnType<typeof getIndividualAttachmentBasePaths>;
-  zipConfig: AttachmentZipCollection;
-  updateEntryAttachments: (index: number, attachments: AttachmentRule[]) => void;
-  updateEntryField: (index: number, field: string, value: unknown) => void;
-};
-
-function recipientDataColumns({ settings, campaignId, draft, locked, filesModuleInstalled, fieldDefinitions, individualAttachmentBasePaths, zipConfig, updateEntryAttachments, updateEntryField }: RecipientDataColumnContext): DataGridColumn<Record<string, unknown>>[] {
-  return [
-  { id: "number", header: "#", width: 70, sortable: true, filterType: "integer", sticky: "start", render: (_entry, index) => <span className="mono-small recipient-index-cell">{index + 1}</span>, value: (_entry, index) => index + 1 },
-  {
-    id: "recipient",
-    header: "i18n:govoplan-campaign.recipient.90343260",
-    width: 260,
-    resizable: true,
-    sortable: true,
-    filterable: true,
-    sticky: "start",
-    render: (entry) =>
-    <Link className="recipient-data-identity" to="../recipients" title="i18n:govoplan-campaign.open_recipient_address_profile.f7daa676">
-          <span className="recipient-data-address">{firstRecipientEmail(entry) || "i18n:govoplan-campaign.no_to_address.683350f9"}</span>
-          {extraRecipientCount(entry) > 0 && <span className="recipient-extra-bubble">+{extraRecipientCount(entry)}</span>}
-        </Link>,
-
-    value: firstRecipientEmail
-  },
-  {
-    id: "attachments",
-    header: "i18n:govoplan-campaign.attachments.6771ade6",
-    width: 180,
-    filterable: true,
-    render: (entry, index) => {
-      const attachments = normalizeAttachmentRules(entry.attachments);
-      return (
-        <AttachmentRulesOverlay
-          title={i18nMessage("i18n:govoplan-campaign.attachments_for_recipient_value.9a8df82d", { value0: index + 1 })}
-          rules={attachments}
-          settings={settings}
-          campaignId={campaignId}
-          disabled={locked}
-          buttonLabel={`entries: ${attachments.length}`}
-          basePaths={individualAttachmentBasePaths}
-          zipConfig={zipConfig}
-          filesModuleInstalled={filesModuleInstalled}
-          previewContext={buildTemplatePreviewContext(draft, entry)}
-          onChange={(rules) => updateEntryAttachments(index, rules)} />);
-
-
-    },
-    value: (entry) => normalizeAttachmentRules(entry.attachments).map((rule) => `${rule.label ?? ""} ${rule.file_filter ?? ""}`).join(", ")
-  },
-  ...fieldDefinitions.map((field): DataGridColumn<Record<string, unknown>> => ({
-    id: `field-${field.name}`,
-    header: field.label || field.name,
-    width: 190,
-    resizable: true,
-    sortable: true,
-    filterable: true,
-    filterType: field.type === "integer" ? "integer" : field.type === "double" ? "number" : field.type === "date" ? "date" : "text",
-    render: (entry, index) => {
-      const fields = asRecord(entry.fields);
-      return (
-        <FieldValueInput
-          className="recipient-field-input"
-          fieldType={field.type}
-          value={fields[field.name]}
-          disabled={locked || field.can_override === false}
-          placeholder={field.can_override === false ? "i18n:govoplan-campaign.uses_global_value.98eae5e0" : undefined}
-          onChange={(value) => updateEntryField(index, field.name, value)} />);
-
-
-    },
-    value: (entry) => String(asRecord(entry.fields)[field.name] ?? "")
-  }))];
-
-}
-
-function firstRecipientEmail(entry: Record<string, unknown>): string {
-  return (addressesFromValue(entry.to)[0] ?? addressesFromValue(entry.recipient)[0] ?? addressesFromValue(entry)[0])?.email ?? "";
-}
-
-function extraRecipientCount(entry: Record<string, unknown>): number {
-  const count = addressesFromValue(entry.to).length;
-  return Math.max(0, count - 1);
-}

webui/src/features/campaigns/TemplateDataPage.tsx

@@ -39,7 +39,7 @@ export default function TemplateDataPage({ settings, campaignId }: {settings: Ap
 
   const version = data.currentVersion;
   const locked = isAuditLockedVersion(version, data.campaign?.current_version_id);
-  const { draft, setDraft, displayDraft, dirty, saveState, localError, patch, markDirty, saveDraft } = useCampaignDraftEditor({
+  const { draft, setDraft, displayDraft, dirty, saveState, localError, patch, markDirty, discardDraft, saveDraft } = useCampaignDraftEditor({
     settings,
     campaignId,
     version,
@@ -121,6 +121,7 @@ export default function TemplateDataPage({ settings, campaignId }: {settings: Ap
     const handle = window.setTimeout(() => {
       void previewCampaignAttachments(settings, campaignId, version.id, {
         include_unmatched: false,
+        include_unlinked_candidates: true,
         campaign_json: campaignJsonForAttachmentPreview(displayDraft)
       }).
       then((response) => {
@@ -233,7 +234,7 @@ export default function TemplateDataPage({ settings, campaignId }: {settings: Ap
         </div>
         <div className="button-row compact-actions">
           <Button disabled>i18n:govoplan-campaign.manage_templates.23688071</Button>
-          <Button onClick={reload} disabled={loading}>i18n:govoplan-campaign.reload.cce71553</Button>
+          <Button onClick={() => void discardDraft()} disabled={loading}>Discard</Button>
           <Button variant="primary" onClick={() => saveDraft("manual")} disabled={!dirty || locked || !draft}>i18n:govoplan-campaign.save.efc007a3</Button>
         </div>
       </div>
@@ -399,45 +400,46 @@ draft: Record<string, unknown>)
 : CampaignMessagePreviewAttachment[] {
   if (loading) {
     return [{
-      filename: i18nMessage("i18n:govoplan-campaign.resolving_attachment_patterns.87d7d21b"),
-      detail: i18nMessage("i18n:govoplan-campaign.managed_files_are_being_checked_for_this_recipie.489ecefd")
+      filename: "Resolving attachment patterns",
+      detail: "Managed files are being checked for this recipient preview."
     }];
   }
   if (error) {
-    return [{ filename: i18nMessage("i18n:govoplan-campaign.attachment_preview_unavailable.62211756"), detail: error }];
+    return [{ filename: "Attachment preview unavailable", detail: error }];
   }
   return rules.flatMap((rule) => {
     const zipProtection = zipProtectionForRule(rule, draft);
     const detailParts = [
-    rule.source === "global" ? i18nMessage("i18n:govoplan-campaign.global.5f1184f7") : i18nMessage("i18n:govoplan-campaign.recipient.90343260"),
+    rule.source === "global" ? "Global" : "Recipient",
     rule.label,
-    rule.required ? i18nMessage("i18n:govoplan-campaign.required.eed6bfb4") : i18nMessage("i18n:govoplan-campaign.optional.0c6c4102"),
+    rule.required ? "Required" : "Optional",
     rule.pattern].
     filter(Boolean);
     const detail = detailParts.join(" · ");
-    const fallbackArchiveLabel = i18nMessage("i18n:govoplan-campaign.recipient_attachments_zip.79d436c7");
+    const fallbackArchiveLabel = "Recipient attachments ZIP";
     if (rule.matches.length > 0) {
       return rule.matches.map((match) => ({
         filename: match.filename || match.display_path,
         label: rule.label,
-        detail: i18nMessage("i18n:govoplan-campaign.value_value.a8618e4a", { value0: detail, value1: match.display_path ? ` · ${match.display_path}` : "" }),
+        detail: `${match.linked_to_campaign === false ? "Unlinked candidate" : "Linked"} · ${match.display_path ? `${detail} · ${match.display_path}` : detail}`,
         contentType: match.content_type,
         sizeBytes: match.size_bytes,
+        linkedToCampaign: match.linked_to_campaign !== false,
         archiveGroup: rule.zip_included ? rule.zip_filename || "recipient-attachments.zip" : null,
         archiveLabel: rule.zip_included ? rule.zip_filename || fallbackArchiveLabel : null,
         protected: zipProtection.protected,
         protectionNote: zipProtection.note
       }));
     }
-    const pattern = rule.pattern || i18nMessage("i18n:govoplan-campaign.attachment_pattern.3540c952");
+    const pattern = rule.pattern || "attachment pattern";
     return [{
-      filename: i18nMessage("i18n:govoplan-campaign.no_file_matched_value", { value0: pattern }),
+      filename: `No file matched ${pattern}`,
       label: rule.label,
-      detail: i18nMessage("i18n:govoplan-campaign.value_value.a8618e4a", { value0: detail, value1: rule.status !== "ok" ? ` · ${rule.status}` : "" }),
-      archiveGroup: rule.zip_included ? rule.zip_filename || "recipient-attachments.zip" : null,
-      archiveLabel: rule.zip_included ? rule.zip_filename || fallbackArchiveLabel : null,
-      protected: zipProtection.protected,
-      protectionNote: zipProtection.note
+      detail: rule.status !== "ok" ? `${detail} · ${rule.status}` : detail,
+      archiveGroup: null,
+      archiveLabel: null,
+      protected: false,
+      protectionNote: null
     }];
   });
 }

webui/src/features/campaigns/components/AttachmentRulesOverlay.tsx

@@ -4,7 +4,7 @@ import type { ApiSettings } from "../../../types";
 import { Button } from "@govoplan/core-webui";
 import { Dialog } from "@govoplan/core-webui";
 import { usePlatformUiCapability, type FilesFileExplorerUiCapability, type FilesManagedAttachmentSelection } from "@govoplan/core-webui";
-import DataGrid, { DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "../../../components/table/DataGrid";
+import { DataGrid, DataGridEmptyAction, DataGridRowActions, type DataGridColumn } from "@govoplan/core-webui";
 import { ToggleSwitch } from "@govoplan/core-webui";
 import { getBool, getText } from "../utils/draftEditor";
 import { attachmentRuleZipSelection, createAttachmentRule, nextAttachmentLabel, summarizeAttachmentRules, type AttachmentBasePath, type AttachmentRule, type AttachmentZipCollection } from "../utils/attachments";

webui/src/features/campaigns/components/CampaignAccessCard.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useMemo, useState } from "react";
 import type { ApiSettings, AuthInfo, CampaignListItem } from "../../../types";
-import { KeyRound } from "lucide-react";
+import { KeyRound, Trash2 } from "lucide-react";
 import {
   fetchResourceAccessExplanation,
   getCampaignShares,
@@ -12,13 +12,13 @@ import {
   type CampaignShareTargets,
   type ResourceAccessExplanationResponse } from
 "../../../api/campaigns";
-import { Button } from "@govoplan/core-webui";
+import { Button, ResourceAccessExplanation } from "@govoplan/core-webui";
 import { Card } from "@govoplan/core-webui";
 import { ConfirmDialog } from "@govoplan/core-webui";
-import DataGrid, { type DataGridColumn } from "../../../components/table/DataGrid";
+import { DataGrid, type DataGridColumn } from "@govoplan/core-webui";
 import { Dialog } from "@govoplan/core-webui";
 import { FormField } from "@govoplan/core-webui";
-import { StatusBadge, hasScope, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
+import { StatusBadge, TableActionGroup, hasScope, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
 type TargetType = "user" | "group";
 
 export default function CampaignAccessCard({
@@ -196,7 +196,7 @@ export default function CampaignAccessCard({
     }
   },
   { id: "permission", header: "i18n:govoplan-campaign.access.2f81a22d", width: 120, resizable: false, sortable: true, filterable: true, value: (row) => row.permission, render: (row) => <StatusBadge status={row.permission === "write" ? "active" : "built"} label={row.permission === "write" ? "i18n:govoplan-campaign.can_edit.cb0ab3da" : "i18n:govoplan-campaign.can_view.1b3e4006"} /> },
-  { id: "actions", header: "i18n:govoplan-campaign.actions.c3cd636a", width: 110, resizable: false, sticky: "end", align: "right", render: (row) => <Button variant="danger" onClick={() => setRevokeTarget(row)}>i18n:govoplan-campaign.remove.e963907d</Button> }],
+  { id: "actions", header: "i18n:govoplan-campaign.actions.c3cd636a", width: 72, resizable: false, sticky: "end", align: "right", render: (row) => <TableActionGroup actions={[{ id: "remove", label: "i18n:govoplan-campaign.remove.e963907d", icon: <Trash2 aria-hidden="true" />, variant: "danger", onClick: () => setRevokeTarget(row) }]} /> }],
   [targetMap]);
 
   if (available === false) return null;
@@ -221,76 +221,11 @@ export default function CampaignAccessCard({
         <FormField label="i18n:govoplan-campaign.access.2f81a22d"><select value={sharePermission} onChange={(event) => setSharePermission(event.target.value as "read" | "write")}><option value="read">i18n:govoplan-campaign.can_view.1b3e4006</option><option value="write">i18n:govoplan-campaign.can_edit_and_operate.77acb15e</option></select></FormField>
       </Dialog>
 
-      <Dialog open={accessExplanationOpen} className="campaign-access-dialog" title="i18n:govoplan-campaign.access_explanation.75ee7f62" onClose={() => { if (!accessExplanationLoading) { setAccessExplanationOpen(false); setAccessExplanation(null); } }} footer={<Button onClick={() => { setAccessExplanationOpen(false); setAccessExplanation(null); }} disabled={accessExplanationLoading}>i18n:govoplan-campaign.close.bbfa773e</Button>}>
-        <ResourceAccessExplanationContent loading={accessExplanationLoading} explanation={accessExplanation} fallbackResourceLabel={campaign.name || campaign.external_id || campaign.id} />
+      <Dialog open={accessExplanationOpen} className="campaign-access-dialog" title="i18n:govoplan-core.access_explanation.75ee7f62" onClose={() => { if (!accessExplanationLoading) { setAccessExplanationOpen(false); setAccessExplanation(null); } }} footer={<Button onClick={() => { setAccessExplanationOpen(false); setAccessExplanation(null); }} disabled={accessExplanationLoading}>i18n:govoplan-campaign.close.bbfa773e</Button>}>
+        <ResourceAccessExplanation loading={accessExplanationLoading} explanation={accessExplanation} fallbackResourceLabel={campaign.name || campaign.external_id || campaign.id} />
       </Dialog>
 
       <ConfirmDialog open={Boolean(revokeTarget)} title="i18n:govoplan-campaign.remove_campaign_share.2c2d42eb" message="i18n:govoplan-campaign.remove_this_user_s_or_group_s_explicit_access_to.5ff07672" confirmLabel="i18n:govoplan-campaign.remove_share.69c932e1" tone="danger" busy={busy} onCancel={() => setRevokeTarget(null)} onConfirm={() => void revoke()} />
     </>);
 
 }
-
-function ResourceAccessExplanationContent({
-  loading,
-  explanation,
-  fallbackResourceLabel
-}: {loading: boolean;explanation: ResourceAccessExplanationResponse | null;fallbackResourceLabel: string;}) {
-  if (loading) return <p className="muted small-note">i18n:govoplan-campaign.loading_access_explanation.04a7c934</p>;
-  if (!explanation) return null;
-  const userLabel = explanation.user.display_name || explanation.user.email || explanation.user.id;
-  const resourceLabel = explanation.provenance.find((item) => item.kind === "resource")?.label || fallbackResourceLabel || explanation.resource_id;
-  return (
-    <>
-      <div className="form-grid compact responsive-form-grid">
-        <div><span className="form-label">i18n:govoplan-campaign.user.9f8a2389</span><p>{userLabel}</p></div>
-        <div><span className="form-label">i18n:govoplan-campaign.resource.d1c626a9</span><p>{resourceLabel}</p></div>
-        <div><span className="form-label">i18n:govoplan-campaign.action.97c89a4d</span><p><code>{explanation.action}</code></p></div>
-        <div><span className="form-label">i18n:govoplan-campaign.evidence.8487d192</span><p>{explanation.provenance.length}</p></div>
-      </div>
-      {explanation.provenance.length === 0 ?
-      <p className="muted small-note">i18n:govoplan-campaign.no_access_evidence_was_returned.84a21e4e</p> :
-      <div className="admin-assignment-grid">
-          {explanation.provenance.map((item, index) =>
-        <div key={`${item.kind}:${item.id ?? index}`}>
-              <strong>{provenanceKindLabel(item.kind)}</strong>
-              <div className="muted small-note">
-                {item.source || "i18n:govoplan-campaign.no_source.6dcf9723"}
-                {item.id && <> · <code>{item.id}</code></>}
-              </div>
-              {item.label && <p>{item.label}</p>}
-              {Object.keys(item.details ?? {}).length > 0 && <p className="muted small-note">{formatProvenanceDetails(item.details ?? {})}</p>}
-            </div>
-        )}
-        </div>
-      }
-    </>);
-}
-
-function provenanceKindLabel(kind: string): string {
-  switch (kind) {
-    case "resource":
-      return "i18n:govoplan-campaign.resource.d1c626a9";
-    case "owner":
-      return "i18n:govoplan-campaign.owner.89ff3122";
-    case "share":
-      return "i18n:govoplan-campaign.share.09ca55ca";
-    case "policy":
-      return "i18n:govoplan-campaign.policy.0b779a05";
-    case "role":
-      return "i18n:govoplan-campaign.role.b5b4a5a2";
-    case "right":
-      return "i18n:govoplan-campaign.permission.2f81a22d";
-    default:
-      return kind;
-  }
-}
-
-function formatProvenanceDetails(details: Record<string, unknown>): string {
-  return Object.entries(details).map(([key, value]) => `${key}: ${formatProvenanceValue(value)}`).join("; ");
-}
-
-function formatProvenanceValue(value: unknown): string {
-  if (value === null || value === undefined) return "i18n:govoplan-campaign.none.6eef6648";
-  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
-  return JSON.stringify(value);
-}

webui/src/features/campaigns/components/CampaignDraftPageScaffold.tsx

@@ -0,0 +1,67 @@
+import type { ReactNode } from "react";
+import { Button, DismissibleAlert, LoadingFrame, PageTitle } from "@govoplan/core-webui";
+import type { ApiSettings } from "../../../types";
+import type { CampaignVersionDetail, CampaignVersionListItem } from "../../../api/campaigns";
+import LockedVersionNotice from "./LockedVersionNotice";
+import VersionLine from "./VersionLine";
+
+type CampaignDraftPageScaffoldProps = {
+  settings: ApiSettings;
+  campaignId: string;
+  title: string;
+  loading: boolean;
+  version: CampaignVersionDetail | null;
+  versions: CampaignVersionListItem[];
+  saveState: string;
+  onReload: () => Promise<void>;
+  onSave: () => void;
+  dirty: boolean;
+  locked: boolean;
+  draft: Record<string, unknown> | null;
+  error?: string | null;
+  localError?: string | null;
+  currentVersionId?: string | null;
+  children: ReactNode;
+};
+
+export default function CampaignDraftPageScaffold({
+  settings,
+  campaignId,
+  title,
+  loading,
+  version,
+  versions,
+  saveState,
+  onReload,
+  onSave,
+  dirty,
+  locked,
+  draft,
+  error,
+  localError,
+  currentVersionId,
+  children
+}: CampaignDraftPageScaffoldProps) {
+  return (
+    <div className="content-pad workspace-data-page">
+      <div className="page-heading split workspace-heading">
+        <div>
+          <PageTitle loading={loading}>{title}</PageTitle>
+          <VersionLine version={version} versions={versions} status={saveState} />
+        </div>
+        <div className="button-row compact-actions">
+          <Button onClick={onReload} disabled={loading}>Discard</Button>
+          <Button variant="primary" onClick={onSave} disabled={!dirty || locked || !draft}>i18n:govoplan-campaign.save.efc007a3</Button>
+        </div>
+      </div>
+
+      {error && <DismissibleAlert tone="danger" resetKey={error} floating>{error}</DismissibleAlert>}
+      {localError && <DismissibleAlert tone="danger" resetKey={localError} floating>{localError}</DismissibleAlert>}
+      {locked && <LockedVersionNotice settings={settings} campaignId={campaignId} version={version} currentVersionId={currentVersionId} reload={onReload} message="i18n:govoplan-campaign.this_page_is_read_only_for_the_selected_version.dacf5743" />}
+
+      <LoadingFrame loading={loading || !draft} label="i18n:govoplan-campaign.loading_campaign_draft.1cf47e50">
+        <>{children}</>
+      </LoadingFrame>
+    </div>);
+
+}

webui/src/features/campaigns/components/LockedVersionNotice.tsx

@@ -43,6 +43,9 @@ export default function LockedVersionNotice({ settings, campaignId, version, cur
   const permanentUserLock = isPermanentUserLockedVersion(version);
   const finalLock = isFinalLockedVersion(version);
   const canCreateEditableCopy = !historicalVersion && (permanentUserLock || finalLock);
+  const mailProfileMigrationRequired = Boolean(
+    version && "mail_profile_migration_required" in version && version.mail_profile_migration_required
+  );
   const presentation = lockPresentation(version, {
     historicalVersion,
     validationLock,
@@ -83,7 +86,8 @@ export default function LockedVersionNotice({ settings, campaignId, version, cur
     try {
       const result = await forkCampaignVersion(settings, campaignId, version.id, {
         current_flow: "manual",
-        current_step: version.current_step ?? null
+        current_step: version.current_step ?? null,
+        migrate_legacy_mail_settings: mailProfileMigrationRequired
       });
       setLocalMessage(`Created editable version #${result.version.version_number}.`);
       await reload();
@@ -100,6 +104,7 @@ export default function LockedVersionNotice({ settings, campaignId, version, cur
         <strong>{presentation.title}</strong>{" "}
         <span>{presentation.description}</span>
         {message && <span className="locked-version-context"> {message}</span>}
+        {mailProfileMigrationRequired && <span className="locked-version-context"> i18n:govoplan-campaign.the_editable_copy_will_preserve_this_audit_recor.aac956f1</span>}
         {presentation.info && <span className="locked-version-reason"> {presentation.info}</span>}
         {localMessage && <span className="locked-version-feedback"> {localMessage}</span>}
         {localError && <span className="locked-version-error"> {localError}</span>}
@@ -232,4 +237,4 @@ function confirmDialogLabel(action: ConfirmAction): string {
   if (action === "unlock-user") return "i18n:govoplan-campaign.unlock.1526a17e";
   if (action === "permanent") return "i18n:govoplan-campaign.lock_permanently.cc0ce9e7";
   return "i18n:govoplan-campaign.confirm.04a21221";
-}
+}