Sending safety controls: pause all sending, failed-send digest, sending-health export #140

Background

Platforms that hand email to many tenants want simple operational safety controls before they trust a provider. Waypoint shipped three small ones between Dec 2025 and Jun 2026, and wrote a changelog post for each (changelog):

• a workspace-level "disable sending" kill switch (Jun 2026)
• hourly failed-message alert digests
• CSV export of message activity

It also publishes its enforcement thresholds and stages: complaints below 0.1%, bounces below 10%, then Warned → Suspended → Deactivated (thresholds, under review).

What SendLit already has (don't duplicate):

• Auto-pause broadcasts and sequences on high bounce or complaint rates #25 (closed): per-sequence auto-pause on bounce or complaint rate, consecutive failures and ESP errors (apps/api/src/automation/sending-health.ts)
• New-account send throttling: spread sends over the day for the first 30-60 days (hosted) #73 and Scope new-account pacing to the risk: don't throttle a customer's own ESP by account age #122 (closed): new-account pacing; Per-ESP send-rate limiting (e.g. SES max send rate) #51 (closed): per-ESP send-rate limiting; Day-one warm-up answer: warm-up guide and self-serve daily send caps for new domains / SES accounts #67 (closed): daily send caps
• Abuse controls: send proper events and logs to PostHog #108 (closed): abuse events and logs to PostHog
• Open: Deliverability report, mailbox-provider breakdown and subscriber growth chart #39 deliverability report, Bounce/complaint handling #6 and Mailgun, SendGrid bounce and complaints support #9 bounce/complaint handling, Signed (HMAC) outbound event webhooks to customers #52 outbound event webhooks
• Terms and Privacy pages on sendlit.app are empty; add Terms, Privacy, Acceptable Use / anti-spam policy and DPA #65 (closed): the Acceptable Use page. The published thresholds live there as website content, tracked on the parent issue.

What's missing: a manual pause-all-sending switch for a team or org, a digest of failed sends to owners, and an export of sending activity.

Source: Waypoint competitor profile (Oct 2026), takeaway #5.

Proposed fix

1. Pause all sending (team and org).
   • Add an owner/admin toggle in team settings, plus an org-level toggle. Expose both through the API and MCP.
   • While paused, broadcasts, sequences and transactional sends are held in a paused state, not dropped. Transactional requests return a clear error (e.g. 423 sending_paused) or queue, configurable per team.
   • Resuming releases held work.
   • Show a banner in the app. Record an audit and PostHog event (Abuse controls: send proper events and logs to PostHog #108).
   • Reuse the sequence auto-pause plumbing from Auto-pause broadcasts and sequences on high bounce or complaint rates #25 where it fits.
2. Failed-send digest.
   • Email team owners an hourly or daily digest (configurable, and can be turned off) of failed, bounced and ESP-error sends: counts by reason, top recipients and domains, and links to the logs.
   • Send nothing when there are zero failures.
   • Reuse notifyOrganizationOwners.
3. Sending-health export.
   • Add a CSV export, filtered by date range, of sends, deliveries, bounces, complaints and failures (message id, recipient, campaign/sequence/transactional, status, reason, timestamps).
   • Fill it from the outbound ledger, and expose it in the UI and the API.
   • Coordinate with the Deliverability report, mailbox-provider breakdown and subscriber growth chart #39 report.

Acceptance criteria

• Pausing a team stops all new ESP handoffs within one worker tick (tested). In-flight queue items are held and resume after unpause, with no duplicates.
• Only org owners and admins can pause or resume. Each action is audited and emitted to PostHog.
• A transactional request to a paused team gets a documented response.
• The digest goes to owners at the chosen interval only when failures exist, has working log links, and can be turned off.
• CSV export works for a date range, streams large ranges, and its columns are documented.
• Docs updated. Cross-links to Auto-pause broadcasts and sequences on high bounce or complaint rates #25, Deliverability report, mailbox-provider breakdown and subscriber growth chart #39 and Signed (HMAC) outbound event webhooks to customers #52 added.