Per-Recipient Cert Tracking (2026-08-05)
Decision (Dustin): cert emails switch from one grouped send to per-recipient tracked copies so the Delivery Ledger can attribute engagement per person. Trigger: 90-day MANA ledger review — every recipient on the shared distribution showed an identical 51% “open rate” because one pixel served five people; July open rate had slid to 31% and nobody could say who stopped looking.
Construction:
- Primary To: copy → shared inbox (config.CERT_PRIMARY_SHARED_INBOXES, currently permits.inspections@jeswork.com). BCC operations.
- Individual copies for everyone else; Reply-To = shared inbox + us; body lists the full distribution (headers only show the copy’s own recipient — Gmail API can’t split envelope from headers).
- Each copy: own pixel + tokened cert link (?r=
on unlikely.report / cert-gen public view) → link_clicks table. Click = “viewed the actual cert”, stronger than a pixel open. - Flag: PER_RECIPIENT_CERT_TRACKING (env, default on). ≤1 recipient falls back to grouped send.
- Ledger UI groups copies by send_group_id; summary counts logical sends (bounced = ALL copies bounced).
Commits: entirely-api 3868129, entirely-portal d9497e0. Tables: email_tracking.db — tracking_tokens.recipient/send_group_id, link_clicks. Schema is ALTER-on-import. Not changed: invoice sends (still grouped); POST /cert/deliver legacy endpoint refactor spun off as its own task (Dustin started it). Caveats: shared-inbox opens still anonymous within the JES team; Outlook SafeLinks prefetch can fake clicks (UA stored for filtering).