From 747d398cc2744a77c32fc69336ef06b2d076e652 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Wed, 23 Sep 2026 22:24:36 -0700
Subject: [PATCH 1/4] myna newsletter: crawlproof tracking, A/B variants, stats
 (port of #90 to main)

#90 was merged into feat/newsletter after #89 had already been squashed
into main, so its commit (fc102a0) never reached main. This is that
commit cherry-picked onto main, with the conflicts against #91 resolved:
sync and the daemon report re-subscribes from myna cloud as well as
unsubscribes from both sources.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md                                     |  45 +-
 apps/cli/src/cli/newsletter.ts                | 268 ++++++++++-
 apps/cli/src/main.ts                          |  17 +-
 packages/core/src/core/daemon.ts              |   9 +-
 packages/core/src/core/newsletter.ts          | 451 ++++++++++++++++--
 packages/core/src/core/smtp.ts                |  53 +-
 packages/core/src/index.ts                    |  27 +-
 packages/core/src/store/newsletters.ts        |  29 ++
 packages/core/src/store/settings.ts           |  44 +-
 .../core/test/newsletter-tracking.test.ts     | 364 ++++++++++++++
 10 files changed, 1228 insertions(+), 79 deletions(-)
 create mode 100644 packages/core/test/newsletter-tracking.test.ts

diff --git a/README.md b/README.md
index c18c14a..97e422d 100644
--- a/README.md
+++ b/README.md
@@ -869,9 +869,9 @@ myna cloud login                                   # mynaposter.com hosts the un
 myna newsletter import subscribers.csv --list moshcode   # email,name,tags (or .json)
 myna newsletter subscribe ada@example.com --list moshcode --name Ada
 myna newsletter create --subject "Moshcode weekly #1" --list moshcode < issue.md
-myna newsletter send moshcode-weekly-1 --test you@example.com   # one [test] copy
+myna newsletter send moshcode-weekly-1 --to you@example.com     # one [test] copy (--test works too)
 myna newsletter send moshcode-weekly-1 --dry-run
-myna newsletter send moshcode-weekly-1
+myna newsletter send moshcode-weekly-1 --yes                    # without --yes: the numbers, nothing sent
 myna newsletter edit moshcode-weekly-2 --at "friday 9am"          # the daemon sends it
 myna newsletter list | show <id> [--body] | rm <id> [--force]
 myna newsletter subscribers --list moshcode
@@ -905,7 +905,46 @@ it. A refusal is `failed` and is retried only with `--retry-failed`; a send
 that died mid-message leaves `pending`, retried only with `--retry-uncertain`,
 because that person may already have it. An issue sent by hand that stopped
 part way (say with `--limit 5`) waits for a hand; only scheduled issues resume
-on their own.
+on their own. Messages go out one a second (`newsletter.paceMs`), and
+`--max-per-day N` raises the cap for one run.
+
+### Tracking and A/B tests
+
+With [crawlproof.com](https://crawlproof.com) tracking set up, every link in an
+issue goes through a signed click URL, the HTML part carries an open pixel,
+and the unsubscribe link is crawlproof's signed one (one-click too) instead of
+myna cloud's, so no `myna cloud login` is needed.
+
+```bash
+myna newsletter track set <trackingId> --secret <hex>   # from the project's Tracking tab; the secret goes in the vault
+myna newsletter track status --check
+myna newsletter create --id moshcode-001 --list moshcode-users --service moshcode \
+  --subject "What shipped in moshcode" --subject-b "Five new things in moshcode" < issue.md
+myna newsletter send moshcode-001 --dry-run         # the variants and how the list splits
+myna newsletter stats moshcode-001                  # per variant: sent, opens, clicks, CTR, unsubscribes
+myna newsletter sync-optouts                        # unsubscribes from myna cloud and crawlproof
+myna newsletter cta list | add "<label>" <url> | rm "<label>"   [--set name]
+```
+
+- **Variants.** An issue's subjects (one, or A and B with `--subject-b`) crossed
+  with the calls to action in its CTA set: two subjects and the four default
+  CTAs (Book a demo, Schedule a call, See our plans, Support us) make eight
+  variants, A to H. Which one a person gets is a hash of the issue id and their
+  address, so a resumed send gives nobody a different one. `{{cta}}` in the
+  body marks where the button goes; without it the CTA goes last, before the
+  footer. `create` uses the `default` set unless `--cta-set <name>` or
+  `--cta-set none`.
+- **The footer.** `--service moshcode` makes it say "You get this because you
+  have an account at moshcode; our Terms say we may email news and updates."
+  instead of "you subscribed to <list>", for a list of your users.
+- **Unsubscribes.** Before every send, myna pulls unsubscribes from every source
+  that is set up and makes them permanent opt-outs. If crawlproof cannot be
+  read, a tracked send refuses to go.
+- **Stats.** Events are joined to variants through each recipient's msgId in
+  `newsletters.json`. Opens and clicks count unique messages, with machine-flagged
+  ones (mail proxies, scanners, Apple's prefetch) left out; all opens are shown
+  beside them. The leader has the best click-through rate, or the best open rate
+  before anyone has clicked. Test copies (`--to`) are never counted.
 
 ## Your settings on every machine
 
diff --git a/apps/cli/src/cli/newsletter.ts b/apps/cli/src/cli/newsletter.ts
index 5b2a155..81b4ecf 100644
--- a/apps/cli/src/cli/newsletter.ts
+++ b/apps/cli/src/cli/newsletter.ts
@@ -2,44 +2,72 @@
  * `myna newsletter`: issues to a contacts list, paced by the daily email cap,
  * with one-click unsubscribe and a postal address on every one.
  *
- *   myna newsletter create --subject "..." --list L [--at "tomorrow 9am"] [--smtp id] [--reply-to r] [--id slug] < issue.md
+ *   myna newsletter create --subject "..." [--subject-b "..."] --list L [--cta-set default|none] [--service moshcode]
+ *        [--at "tomorrow 9am"] [--smtp id] [--reply-to r] [--id slug] < issue.md
  *   myna newsletter list | show <id> [--body] | rm <id> [--force]
- *   myna newsletter edit <id> [--subject] [--list] [--at when | --draft] [--smtp] [--reply-to] [< issue.md]
- *   myna newsletter send <id> [--dry-run] [--test addr] [--limit N] [--retry-failed] [--retry-uncertain]
+ *   myna newsletter edit <id> [--subject] [--subject-b] [--list] [--cta-set] [--service] [--at when | --draft] [--smtp] [--reply-to] [< issue.md]
+ *   myna newsletter send <id> [--dry-run] [--to addr] [--yes] [--limit N] [--max-per-day N] [--pace-ms N] [--retry-failed] [--retry-uncertain]
  *   myna newsletter subscribe <email...> --list L [--name] [--tags a,b]
  *   myna newsletter unsubscribe <email|token> [--list L]
  *   myna newsletter subscribers --list L [--json]
  *   myna newsletter import <file.csv|file.json> --list L [--tags a,b]
- *   myna newsletter sync          pull one-click unsubscribes from myna cloud
+ *   myna newsletter sync | sync-optouts     pull unsubscribes from myna cloud and crawlproof
+ *   myna newsletter track set <trackingId> [--secret <hex>] | track status [--check] | track off
+ *   myna newsletter stats <id> [--json]     opens, clicks, CTR, unsubscribes per variant
+ *   myna newsletter cta list | add "<label>" <url> | rm "<label>"   [--set default]
  *
  * Subscribers are contacts on a list, so `myna contacts` sees them too, and
  * `myna email --list` still mails the same list without any of this.
+ *
+ * An issue with --subject-b and/or a CTA set is an A/B test: the variants are
+ * the subjects crossed with the set's calls to action, one per person, fixed
+ * by a hash of the issue id and the address. With tracking set up, links are
+ * signed crawlproof click URLs, the HTML carries an open pixel, and the
+ * unsubscribe link is crawlproof's signed one.
  */
 import { readFileSync } from "node:fs";
 import {
+  TRACKING_ID,
+  TRACKING_SECRETS,
   createNewsletter,
   deliveriesFor,
   editNewsletter,
+  fetchNewsletterStats,
+  fetchTrackingEvents,
+  getPluginSecrets,
   loadSettings,
+  newsletterTracking,
   parseWhen,
   readNewsletters,
   readSubscriberFile,
   removeNewsletter,
   requireNewsletter,
+  saveSettings,
   sendNewsletter,
+  setPluginSecrets,
   subscribe,
   subscribers,
-  syncUnsubscribes,
+  syncAllUnsubscribes,
   tally,
+  trackingBase,
   unsubscribe,
+  type SendNewsletterReport,
   type SubscribeResult,
 } from "@profullstack/myna-core";
 import { out, table } from "./io.ts";
+import { askSecret } from "./prompt.ts";
 
 type Flags = Record<string, unknown>;
 
 const str = (flags: Flags, key: string): string | undefined => (typeof flags[key] === "string" ? (flags[key] as string) : undefined);
 const list = (value: string | undefined): string[] => (value ? value.split(",").map((s) => s.trim()).filter(Boolean) : []);
+const num = (flags: Flags, key: string): number | undefined => {
+  const value = str(flags, key);
+  if (value === undefined) return undefined;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) throw new Error(`--${key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)} takes a number.`);
+  return parsed;
+};
 
 /** The body from stdin, or undefined when nothing is piped. */
 function pipedBody(): string | undefined {
@@ -50,12 +78,154 @@ function pipedBody(): string | undefined {
 
 const when = (value: string | undefined): string | undefined => (value ? parseWhen(value).at.toISOString() : undefined);
 
+/** --cta-set: a set name, or "none". Absent, `fallback`. */
+function ctaSetFlag(flags: Flags, fallback: string | null | undefined): string | null | undefined {
+  const value = str(flags, "ctaSet");
+  if (value === undefined) return fallback;
+  if (value === "none") return null;
+  if (!loadSettings().newsletter.ctaSets[value]?.length) throw new Error(`No CTA set "${value}", or it is empty. myna newsletter cta list shows them.`);
+  return value;
+}
+
 function reportSubscribe(result: SubscribeResult, listName: string): void {
   out(`${result.added.length} added to ${listName}${result.already.length ? `, ${result.already.length} already on it` : ""}.`);
   if (result.optedOut.length) out(`${result.optedOut.length} opted out before and stay out: ${result.optedOut.slice(0, 10).join(", ")}`);
   if (result.invalid.length) out(`${result.invalid.length} not an email address: ${result.invalid.slice(0, 10).join(", ")}`);
 }
 
+function printVariants(report: SendNewsletterReport): void {
+  if (report.variants.length < 2) return;
+  out(`${report.variants.length} variants, split over the ${Object.values(report.split).reduce((a, b) => a + b, 0)} still due:`);
+  for (const variant of report.variants) {
+    out(`  ${variant.key}  ${String(report.split[variant.key] ?? 0).padStart(6)}  subject ${variant.subjectKey}: ${variant.subject}${variant.cta ? `  |  CTA: ${variant.cta.label}` : ""}`);
+  }
+}
+
+async function runTrack(rest: string[], flags: Flags): Promise<number> {
+  const [sub, id] = rest;
+  const settings = loadSettings();
+  if (sub === "set") {
+    if (!id || !TRACKING_ID.test(id.trim()))
+      throw new Error("Usage: myna newsletter track set <trackingId> [--secret <hex>]   (the id is 24 hex, from the project's Tracking tab on crawlproof.com; pass --secret or pipe the secret in)");
+    const secret = (str(flags, "secret") ?? (process.stdin.isTTY ? await askSecret("Tracking secret") : readFileSync(0, "utf8"))).trim();
+    if (!/^[0-9a-f]{32,}$/i.test(secret)) throw new Error("The tracking secret is hex, from crawlproof.com. Nothing was saved.");
+    settings.newsletter.trackingId = id.trim().toLowerCase();
+    saveSettings(settings);
+    setPluginSecrets(TRACKING_SECRETS, { ...getPluginSecrets(TRACKING_SECRETS), trackingSecret: secret });
+    out(`Tracking through ${trackingBase({ id: settings.newsletter.trackingId, host: settings.newsletter.trackingHost })}. The secret is in the vault.`);
+    out("Every issue's links, open pixel and unsubscribe link now go through it.");
+    return 0;
+  }
+  if (sub === "off") {
+    settings.newsletter.trackingId = "";
+    saveSettings(settings);
+    const secrets = getPluginSecrets(TRACKING_SECRETS);
+    delete secrets.trackingSecret;
+    setPluginSecrets(TRACKING_SECRETS, secrets);
+    out("Tracking is off. Issues use the myna cloud (or newsletter.unsubscribeUrl) unsubscribe link again.");
+    return 0;
+  }
+  if (sub === "status" || sub === undefined) {
+    const n = settings.newsletter;
+    const tracking = newsletterTracking();
+    out(`tracking     ${n.trackingId ? trackingBase({ id: n.trackingId, host: n.trackingHost }) : "off  (myna newsletter track set <trackingId>)"}`);
+    out(`secret       ${getPluginSecrets(TRACKING_SECRETS).trackingSecret ? "in the vault" : "missing"}`);
+    out(`unsubscribe  ${tracking ? "crawlproof's signed link" : n.unsubscribeUrl || "myna cloud (needs myna cloud login)"}`);
+    out(`address      ${n.address || 'not set, nothing is sent  (myna config newsletter.address "Company, street, city, country")'}`);
+    out(`pace         ${n.paceMs} ms between messages`);
+    out(`opt-outs     crawlproof pulled up to ${readNewsletters().trackingSince ?? "never"}`);
+    if (flags.check) {
+      if (!tracking) throw new Error("Nothing to check: tracking is not set.");
+      const events = await fetchTrackingEvents(tracking, { since: new Date(Date.now() - 86_400_000).toISOString() });
+      out(`check        crawlproof answered: ${events.length} event(s) in the last day`);
+    }
+    return 0;
+  }
+  throw new Error(`Unknown: myna newsletter track ${sub}. Try set, status or off.`);
+}
+
+function runCta(rest: string[], flags: Flags): number {
+  const [sub, label, url] = rest;
+  const settings = loadSettings();
+  const setName = str(flags, "set") ?? "default";
+  const sets = settings.newsletter.ctaSets;
+  switch (sub ?? "list") {
+    case "list": {
+      const names = str(flags, "set") ? [setName] : Object.keys(sets);
+      for (const name of names) {
+        out(`${name}:`);
+        const ctas = sets[name] ?? [];
+        if (!ctas.length) out("  (empty)");
+        ctas.forEach((cta, i) => out(`  ${i + 1}. ${cta.label.padEnd(22)} ${cta.url}`));
+      }
+      return 0;
+    }
+    case "add": {
+      if (!label || !url || !/^https?:\/\//.test(url)) throw new Error('Usage: myna newsletter cta add "<label>" <https://url> [--set default]');
+      const ctas = (sets[setName] ?? []).filter((cta) => cta.label.toLowerCase() !== label.toLowerCase());
+      ctas.push({ label, url });
+      sets[setName] = ctas;
+      saveSettings(settings);
+      out(`${setName} now has ${ctas.length} call(s) to action.`);
+      return 0;
+    }
+    case "rm": {
+      if (!label) throw new Error('Usage: myna newsletter cta rm "<label>" [--set default]');
+      const before = sets[setName] ?? [];
+      const after = before.filter((cta, i) => cta.label.toLowerCase() !== label.toLowerCase() && String(i + 1) !== label);
+      if (after.length === before.length) throw new Error(`No "${label}" in ${setName}.`);
+      sets[setName] = after;
+      saveSettings(settings);
+      out(`Removed. ${setName} has ${after.length} left.`);
+      return 0;
+    }
+    default:
+      throw new Error(`Unknown: myna newsletter cta ${sub}. Try list, add or rm.`);
+  }
+}
+
+async function runStats(id: string | undefined, flags: Flags): Promise<number> {
+  if (!id) throw new Error("Usage: myna newsletter stats <id> [--json]");
+  const tracking = newsletterTracking();
+  if (!tracking) throw new Error("Tracking is not set, so there is nothing to count. myna newsletter track set <trackingId>");
+  const stats = await fetchNewsletterStats(id, tracking);
+  if (flags.json) {
+    out(JSON.stringify(stats, null, 2));
+    return 0;
+  }
+  if (!stats.rows.length) {
+    out(`Nothing sent for ${stats.id} yet.`);
+    return 0;
+  }
+  const pct = (value: number): string => `${(value * 100).toFixed(1)}%`;
+  table(
+    stats.rows.map((row) => ({
+      variant: row.variant,
+      subject: row.subjectKey,
+      cta: row.cta,
+      sent: String(row.sent),
+      opens: `${row.opens} (${row.opensTotal})`,
+      clicks: String(row.clicks),
+      ctr: pct(row.ctr),
+      unsub: String(row.unsubscribes),
+    })),
+    [
+      { key: "variant", title: "Variant" },
+      { key: "subject", title: "Subject" },
+      { key: "cta", title: "CTA" },
+      { key: "sent", title: "Sent" },
+      { key: "opens", title: "Opens (all)" },
+      { key: "clicks", title: "Clicks" },
+      { key: "ctr", title: "CTR" },
+      { key: "unsub", title: "Unsubs" },
+    ],
+  );
+  out("");
+  out("Opens and clicks count unique messages, with machine-flagged ones left out; the number in brackets counts every open.");
+  out(stats.leader ? `Leader: ${stats.leader} (by ${stats.basis === "clicks" ? "click-through rate" : "open rate, no clicks yet"}).` : "No leader yet: no opens or clicks.");
+  return 0;
+}
+
 export async function runNewsletter(positional: string[], flags: Flags): Promise<number> {
   const [sub, ...rest] = positional;
   switch (sub ?? "list") {
@@ -99,7 +269,10 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
       const subject = str(flags, "subject");
       const listName = str(flags, "list");
       const body = pipedBody();
-      if (!subject || !listName || !body) throw new Error('Usage: myna newsletter create --subject "..." --list <list> [--at when] [--smtp id] [--reply-to r] < issue.md');
+      if (!subject || !listName || !body)
+        throw new Error(
+          'Usage: myna newsletter create --subject "..." [--subject-b "..."] --list <list> [--cta-set default|none] [--service moshcode] [--at when] [--smtp id] [--reply-to r] [--id slug] < issue.md',
+        );
       const created = createNewsletter({
         subject,
         body,
@@ -109,9 +282,16 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
         smtp: str(flags, "smtp") ?? null,
         replyTo: str(flags, "replyTo") ?? null,
         address: str(flags, "address") ?? null,
+        subjectB: str(flags, "subjectB") ?? null,
+        ctaSet: ctaSetFlag(flags, "default") ?? null,
+        service: str(flags, "service") ?? null,
       });
       out(`Created ${created.id} (${created.status}${created.scheduledFor ? ` for ${created.scheduledFor}` : ""}) to ${created.list}.`);
-      out(`Check it:  myna newsletter send ${created.id} --test you@example.com`);
+      if (created.subjectB || created.ctaSet) {
+        const ctas = created.ctaSet ? (loadSettings().newsletter.ctaSets[created.ctaSet]?.length ?? 1) : 1;
+        out(`A/B test: ${(created.subjectB ? 2 : 1) * ctas} variant(s)${created.ctaSet ? `, calls to action from "${created.ctaSet}"` : ""}.`);
+      }
+      out(`Check it:  myna newsletter send ${created.id} --to you@example.com`);
       if (!loadSettings().newsletter.address && !created.address) out('Before it can go out:  myna config newsletter.address "Company, 1 Main St, City, ST 00000, USA"');
       return 0;
     }
@@ -127,7 +307,10 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
       const t = tally(n.id, file);
       out(`${n.id}  ${n.status}`);
       out(`Subject:   ${n.subject}`);
+      if (n.subjectB) out(`Subject B: ${n.subjectB}`);
       out(`List:      ${n.list} (${subscribers(n.list).filter((s) => s.active).length} can be mailed)`);
+      if (n.ctaSet) out(`CTA set:   ${n.ctaSet}`);
+      if (n.service) out(`Service:   ${n.service} (the footer says they have an account there)`);
       if (n.scheduledFor) out(`Scheduled: ${n.scheduledFor}`);
       if (n.sentAt) out(`Sent:      ${n.sentAt}`);
       out(`Delivered: ${t.sent} sent, ${t.failed} failed, ${t.pending} uncertain`);
@@ -138,7 +321,7 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
     }
 
     case "edit": {
-      if (!rest[0]) throw new Error('Usage: myna newsletter edit <id> [--subject "..."] [--list L] [--at when | --draft] [< issue.md]');
+      if (!rest[0]) throw new Error('Usage: myna newsletter edit <id> [--subject "..."] [--subject-b "..."] [--list L] [--cta-set name|none] [--service s] [--at when | --draft] [< issue.md]');
       const edited = editNewsletter(rest[0], {
         subject: str(flags, "subject"),
         body: pipedBody(),
@@ -148,6 +331,9 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
         smtp: str(flags, "smtp"),
         replyTo: str(flags, "replyTo"),
         address: str(flags, "address"),
+        subjectB: str(flags, "subjectB"),
+        ctaSet: ctaSetFlag(flags, undefined),
+        service: str(flags, "service"),
       });
       out(`Saved ${edited.id} (${edited.status}${edited.scheduledFor ? ` for ${edited.scheduledFor}` : ""}).`);
       return 0;
@@ -161,34 +347,59 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
     }
 
     case "send": {
-      if (!rest[0]) throw new Error("Usage: myna newsletter send <id> [--dry-run] [--test addr] [--limit N] [--retry-failed] [--retry-uncertain]");
-      const report = await sendNewsletter(rest[0], {
-        dryRun: Boolean(flags.dryRun),
-        test: str(flags, "test"),
-        limit: str(flags, "limit") ? Number(str(flags, "limit")) : undefined,
+      if (!rest[0]) throw new Error("Usage: myna newsletter send <id> [--dry-run] [--to addr] [--yes] [--limit N] [--max-per-day N] [--retry-failed] [--retry-uncertain]");
+      const test = str(flags, "to") ?? str(flags, "test");
+      const dryRun = Boolean(flags.dryRun);
+      const common = {
+        limit: num(flags, "limit"),
+        maxPerDay: num(flags, "maxPerDay"),
+        paceMs: num(flags, "paceMs") ?? loadSettings().newsletter.paceMs,
         retryFailed: Boolean(flags.retryFailed),
         retryUncertain: Boolean(flags.retryUncertain),
-        log: (line) => out(line),
-      });
-      if (str(flags, "test")) {
-        if (flags.dryRun) out(`would send a test copy of ${report.id} to ${str(flags, "test")}`);
+        log: (line: string) => out(line),
+      };
+      // A list send needs --yes. Without it: the numbers, and nothing sent.
+      if (!test && !dryRun && !flags.yes) {
+        const preview = await sendNewsletter(rest[0], { ...common, dryRun: true });
+        out(`${preview.id} to ${preview.list}: ${preview.audience} on the list, ${preview.alreadySent} had it already, ${preview.wouldSend.length} would go now, ${preview.remaining} left for a later run.`);
+        printVariants(preview);
+        out(`Tracking: ${preview.tracked ? "on (crawlproof)" : "off"}.`);
+        out(`Not sent. Send yourself a copy with --to you@example.com, then add --yes to send to the list.`);
+        return 1;
+      }
+      const report = await sendNewsletter(rest[0], { ...common, dryRun, test });
+      if (test) {
+        if (dryRun) out(`would send a test copy of ${report.id} to ${test}`);
         else if (report.sent.length) out(`Test copy of ${report.id} sent to ${report.sent[0]}.`);
         else out(`Test copy failed: ${report.failed[0]?.error}`);
         return report.failed.length ? 1 : 0;
       }
-      if (flags.dryRun) {
-        for (const to of report.wouldSend) out(`would email ${to}: ${report.subject}`);
+      if (dryRun) {
+        for (const to of report.wouldSend.slice(0, 20)) out(`would email ${to}`);
+        if (report.wouldSend.length > 20) out(`... and ${report.wouldSend.length - 20} more`);
+        printVariants(report);
+        out(`Tracking: ${report.tracked ? "on (crawlproof)" : "off"}.`);
       }
       out(
         `${report.id} to ${report.list}: ${report.audience} on the list, ${report.alreadySent} had it already, ` +
-          `${flags.dryRun ? `${report.wouldSend.length} would go now` : `${report.sent.length} sent, ${report.failed.length} failed`}, ${report.remaining} left for a later run.`,
+          `${dryRun ? `${report.wouldSend.length} would go now` : `${report.sent.length} sent, ${report.failed.length} failed`}, ${report.remaining} left for a later run.`,
       );
       if (report.uncertain) out(`${report.uncertain} died mid-send last time and may have it; --retry-uncertain mails them again.`);
       if (report.previouslyFailed) out(`${report.previouslyFailed} were refused before; --retry-failed tries them again.`);
-      if (!flags.dryRun) out(`Status: ${report.status}.`);
+      if (!dryRun) out(`Status: ${report.status}.${report.remaining ? " Run the same command again to carry on." : ""}`);
       return report.failed.length ? 1 : 0;
     }
 
+    case "stats":
+      return await runStats(rest[0] ?? str(flags, "campaign"), flags);
+
+    case "track":
+      return await runTrack(rest, flags);
+
+    case "cta":
+    case "ctas":
+      return runCta(rest, flags);
+
     case "subscribe":
     case "sub": {
       const listName = str(flags, "list");
@@ -243,16 +454,21 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
       return 0;
     }
 
-    case "sync": {
-      const result = await syncUnsubscribes();
+    case "sync":
+    case "sync-optouts": {
+      const result = await syncAllUnsubscribes();
+      const cloud = result.cloud;
       out(
-        `${result.pulled} change${result.pulled === 1 ? "" : "s"} read: ${result.optedOut.length} newly unsubscribed, ${result.resubscribed.length} re-subscribed` +
-          `${result.unknown ? `, ${result.unknown} for tokens this install never sent` : ""}.`,
+        `myna cloud: ${cloud.pulled} change${cloud.pulled === 1 ? "" : "s"} read: ${cloud.optedOut.length} newly unsubscribed, ${cloud.resubscribed.length} re-subscribed` +
+          `${cloud.unknown ? `, ${cloud.unknown} for tokens this install never sent` : ""}.`,
       );
+      if (result.tracking)
+        out(`crawlproof: ${result.tracking.pulled} unsubscribe${result.tracking.pulled === 1 ? "" : "s"} read, ${result.tracking.optedOut.length} newly opted out${result.tracking.optedOut.length ? `: ${result.tracking.optedOut.join(", ")}` : ""}.`);
+      else out("crawlproof: tracking is off.");
       return 0;
     }
 
     default:
-      throw new Error(`Unknown: myna newsletter ${sub}. Try create, list, show, edit, rm, send, subscribe, unsubscribe, subscribers, import or sync.`);
+      throw new Error(`Unknown: myna newsletter ${sub}. Try create, list, show, edit, rm, send, stats, subscribe, unsubscribe, subscribers, import, sync, track or cta.`);
   }
 }
diff --git a/apps/cli/src/main.ts b/apps/cli/src/main.ts
index e118aaa..148b41e 100644
--- a/apps/cli/src/main.ts
+++ b/apps/cli/src/main.ts
@@ -145,14 +145,23 @@ Direct (mail and texts to people, not posts to networks):
 Newsletter (issues to a contacts list; one-click unsubscribe and your postal
 address on every one, paced by outreach.maxEmailsPerDay):
   newsletter create --subject "..." --list <L> [--at when] [--smtp id] [--reply-to r] < issue.md
+       [--subject-b "..."]          A/B: variants are the subjects x the CTA set,
+       [--cta-set default|none]     one per person; {{cta}} marks the button
+       [--service moshcode] [--id slug]   footer: "an account at moshcode" not "subscribed"
   newsletter list | show <id> [--body] | rm <id> [--force]
-  newsletter edit <id> [--subject] [--list] [--at when | --draft] [< issue.md]
-  newsletter send <id> [--dry-run] [--test addr] [--limit N]
-       [--retry-failed] [--retry-uncertain]   Resumes from its ledger; nobody gets it twice
+  newsletter edit <id> [--subject] [--subject-b] [--list] [--cta-set] [--at when | --draft] [< issue.md]
+  newsletter send <id> [--dry-run] [--to addr] [--yes] [--limit N] [--max-per-day N]
+       [--retry-failed] [--retry-uncertain]   --yes sends the list; --to one test copy (variant A)
+                                    Resumes from its ledger; nobody gets it twice
+  newsletter stats <id>             Per variant: sent, opens, clicks, CTR, unsubscribes
   newsletter subscribe <email...> --list <L> [--name] [--tags]
   newsletter unsubscribe <email|token> [--list L]   Without --list: opted out for good
   newsletter subscribers --list <L> | import <file.csv|.json> --list <L>
-  newsletter sync                   Pull one-click unsubscribes from myna cloud
+  newsletter sync | sync-optouts    Pull unsubscribes from myna cloud and crawlproof
+  newsletter track set <id> [--secret hex] | track status [--check] | track off
+                                    crawlproof tracking: signed links, open pixel,
+                                    its unsubscribe link; the secret goes in the vault
+  newsletter cta list | add "<label>" <url> | rm "<label>"   [--set default]
        myna config newsletter.address "..."        required (CAN-SPAM)
        myna config newsletter.unsubscribeUrl https://you/u/{token}   else myna cloud hosts it
 AT Protocol (the network behind Bluesky; a directory of its servers):
diff --git a/packages/core/src/core/daemon.ts b/packages/core/src/core/daemon.ts
index 5eb5dc5..dc2565d 100644
--- a/packages/core/src/core/daemon.ts
+++ b/packages/core/src/core/daemon.ts
@@ -16,7 +16,7 @@ import { pluginContext } from "../plugins/context.ts";
 import { runEvergreen } from "./evergreen.ts";
 import { runRecap } from "./recap.ts";
 import { canSync, syncConfigOnce } from "../store/synconfig.ts";
-import { runDueNewsletters, syncUnsubscribes } from "./newsletter.ts";
+import { runDueNewsletters, syncAllUnsubscribes } from "./newsletter.ts";
 import { readNewsletters } from "../store/newsletters.ts";
 
 export interface DaemonJob {
@@ -69,11 +69,12 @@ export function builtinJobs(log: (line: string) => void, tickMs: number): Daemon
     everyMs: 600_000,
     async run() {
       if (!readNewsletters().newsletters.some((entry) => entry.scheduledFor && entry.status !== "sent")) {
-        const synced = await syncUnsubscribes();
-        if (synced.optedOut.length || synced.resubscribed.length) return `${synced.optedOut.length} unsubscribed, ${synced.resubscribed.length} re-subscribed`;
+        const synced = await syncAllUnsubscribes();
+        const out = synced.cloud.optedOut.length + (synced.tracking?.optedOut.length ?? 0);
+        if (out || synced.cloud.resubscribed.length) return `${out} unsubscribed, ${synced.cloud.resubscribed.length} re-subscribed`;
         return;
       }
-      const reports = await runDueNewsletters(new Date(), { log });
+      const reports = await runDueNewsletters(new Date(), { log, paceMs: loadSettings().newsletter.paceMs });
       const lines = reports
         .filter((report) => report.sent.length || report.failed.length)
         .map((report) => `${report.id}: ${report.sent.length} sent, ${report.failed.length} failed, ${report.remaining} left (${report.status})`);
diff --git a/packages/core/src/core/newsletter.ts b/packages/core/src/core/newsletter.ts
index a0b65b4..4c56e34 100644
--- a/packages/core/src/core/newsletter.ts
+++ b/packages/core/src/core/newsletter.ts
@@ -13,18 +13,28 @@
  * back and turns each into the permanent opt-out in contacts.json, before
  * every send and on the daemon's turn.
  *
+ * With crawlproof tracking set up (`myna newsletter track set`), every link
+ * goes through a signed click URL, the HTML part carries an open pixel, and
+ * the unsubscribe link is crawlproof's signed one instead; its unsubscribes
+ * are pulled the same way. An issue with a second subject or a CTA set is
+ * an A/B test: its variants are the subjects crossed with the calls to
+ * action, and which one a person gets is a hash of the issue id and their
+ * address, so a resumed send gives nobody a different one.
+ *
  * Pacing is the outreach cap: an issue sends what today's
  * `outreach.maxEmailsPerDay` still allows and leaves the rest for the next
  * run, which picks up from the ledger.
  */
 import { readFileSync } from "node:fs";
 import { extname } from "node:path";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { addressOf, sendSmtp, type SmtpMessage, type SmtpOptions, type SmtpServer } from "./smtp.ts";
 import { escapeHtml, renderMarkdown } from "../util/markdown.ts";
 import { getJson, postJson } from "../util/http.ts";
-import { loadSettings } from "../store/settings.ts";
+import { loadSettings, type NewsletterCta } from "../store/settings.ts";
 import { addToList, optIn, optOut, readContacts, recipients, upsertContact, removeFromList, contactId, type Contact } from "../store/contacts.ts";
 import { outreachSentToday, recordSent, smtpServer } from "../store/outreach.ts";
+import { getPluginSecrets } from "../store/accounts.ts";
 import { session, DEFAULT_SERVER } from "../store/cloud.ts";
 import {
   contactForToken,
@@ -33,9 +43,196 @@ import {
   requireNewsletter,
   tokenFor,
   writeNewsletters,
+  type Delivery,
   type Newsletter,
 } from "../store/newsletters.ts";
 
+// ---------------------------------------------------------------- crawlproof tracking
+//
+// The contract (crawlproof.com PR #266):
+//   base         https://crawlproof.com/t/<trackingId>          trackingId is 24 hex
+//   open         <base>/o.png?m=<msgId>&c=<campaign>&v=<variant>
+//   click        <base>/c?u=<url>&m=&c=&v=&s=<sig>              sig over u exactly as sent
+//   unsubscribe  <base>/u?m=&c=&e=<email>&s=<sig>               sig over lowercase(e); GET page, POST one-click
+//   events       GET /api/v1/tracking/<trackingId>/events?since=<iso>&type=   Bearer <secret>
+//                -> {events: [{type, m, c, v, url?, email?, machine?, at}], next}
+//                   oldest first; next is null on the last page, else an absolute URL to GET
+// sig = the first 32 hex characters of HMAC-SHA256(secret, value).
+
+export interface Tracking {
+  id: string;
+  secret: string;
+  /** https://crawlproof.com unless a test says otherwise. */
+  host?: string;
+}
+
+export interface TrackingEvent {
+  type: "open" | "click" | "unsubscribe" | string;
+  m?: string | null;
+  c?: string | null;
+  v?: string | null;
+  url?: string | null;
+  email?: string | null;
+  /** Opens and clicks only: a mail proxy, a scanner, Apple's prefetch. */
+  machine?: boolean | null;
+  at: string;
+}
+
+type Fetch = typeof fetch;
+
+export const TRACKING_SECRETS = "newsletter";
+export const TRACKING_ID = /^[0-9a-f]{24}$/i;
+const DEFAULT_TRACKING_HOST = "https://crawlproof.com";
+const CTA_MARK = "{{cta}}";
+
+/** The tracking set up on this machine: the id from settings, the secret from the vault. */
+export function newsletterTracking(): Tracking | undefined {
+  const settings = loadSettings().newsletter;
+  if (!settings.trackingId) return undefined;
+  const secret = getPluginSecrets(TRACKING_SECRETS).trackingSecret ?? "";
+  if (!secret) return undefined;
+  return { id: settings.trackingId, secret, host: settings.trackingHost };
+}
+
+export function trackingBase(tracking: Pick<Tracking, "id" | "host">): string {
+  return `${(tracking.host || DEFAULT_TRACKING_HOST).replace(/\/+$/, "")}/t/${encodeURIComponent(tracking.id)}`;
+}
+
+/** The first 32 hex characters of HMAC-SHA256(secret, value). */
+export function signTracking(secret: string, value: string): string {
+  return createHmac("sha256", secret).update(value, "utf8").digest("hex").slice(0, 32);
+}
+
+const q = encodeURIComponent;
+
+export interface TrackingIds {
+  m: string;
+  c: string;
+  v: string;
+}
+
+export function openPixelUrl(tracking: Tracking, ids: TrackingIds): string {
+  return `${trackingBase(tracking)}/o.png?m=${q(ids.m)}&c=${q(ids.c)}&v=${q(ids.v)}`;
+}
+
+export function clickUrl(tracking: Tracking, url: string, ids: TrackingIds): string {
+  return `${trackingBase(tracking)}/c?u=${q(url)}&m=${q(ids.m)}&c=${q(ids.c)}&v=${q(ids.v)}&s=${signTracking(tracking.secret, url)}`;
+}
+
+export function trackedUnsubscribeUrl(tracking: Tracking, ids: { m: string; c: string; email: string }): string {
+  const email = ids.email.trim().toLowerCase();
+  return `${trackingBase(tracking)}/u?m=${q(ids.m)}&c=${q(ids.c)}&e=${q(email)}&s=${signTracking(tracking.secret, email)}`;
+}
+
+/** A fresh msgId: what crawlproof ties opens, clicks and unsubscribes to. */
+export function newMsgId(): string {
+  return randomBytes(8).toString("hex");
+}
+
+/** Every event since `since`, following `next` (an absolute URL) until it is null. */
+export async function fetchTrackingEvents(tracking: Tracking, options: { since?: string | null; type?: string; fetcher?: Fetch } = {}): Promise<TrackingEvent[]> {
+  const fetcher = options.fetcher ?? fetch;
+  const host = (tracking.host || DEFAULT_TRACKING_HOST).replace(/\/+$/, "");
+  const since = options.since ?? "1970-01-01T00:00:00.000Z";
+  let url: string | null =
+    `${host}/api/v1/tracking/${q(tracking.id)}/events?since=${q(since)}${options.type ? `&type=${q(options.type)}` : ""}`;
+  const events: TrackingEvent[] = [];
+  const seen = new Set<string>();
+  while (url && !seen.has(url) && seen.size < 1000) {
+    seen.add(url);
+    const response: Response = await fetcher(url, { headers: { authorization: `Bearer ${tracking.secret}`, accept: "application/json" } });
+    if (!response.ok) {
+      const body = (await response.text().catch(() => "")).trim();
+      throw new Error(`crawlproof events: ${response.status}${body && !body.startsWith("<") ? ` ${body.slice(0, 200)}` : ""}`);
+    }
+    const payload = (await response.json()) as { events?: TrackingEvent[]; next?: string | null };
+    events.push(...(Array.isArray(payload.events) ? payload.events : []));
+    url = typeof payload.next === "string" && /^https?:\/\//.test(payload.next) ? payload.next : null;
+  }
+  return events;
+}
+
+export interface TrackingSyncResult {
+  pulled: number;
+  optedOut: string[];
+}
+
+/**
+ * Pull unsubscribes from crawlproof and opt each address out for good. One
+ * that is not a contact yet (a test copy's address, say) is added opted
+ * out, so no later list picks it up.
+ */
+export async function syncTrackingUnsubscribes(tracking: Tracking, options: { fetcher?: Fetch } = {}): Promise<TrackingSyncResult> {
+  const file = readNewsletters();
+  const events = await fetchTrackingEvents(tracking, { since: file.trackingSince, type: "unsubscribe", fetcher: options.fetcher });
+  const byMsg = new Map<string, string>();
+  for (const ledger of Object.values(file.deliveries)) for (const entry of Object.values(ledger)) if (entry.msgId) byMsg.set(entry.msgId, entry.to);
+  const result: TrackingSyncResult = { pulled: 0, optedOut: [] };
+  let newest = file.trackingSince;
+  for (const event of events) {
+    if (event.type !== "unsubscribe") continue;
+    result.pulled++;
+    if (!newest || event.at > newest) newest = event.at;
+    const email = (event.email ?? (event.m ? byMsg.get(event.m) : undefined))?.trim().toLowerCase();
+    if (!email) continue;
+    const contacts = readContacts();
+    const id = contactId({ email }) as string;
+    const contact = contacts.contacts.find((entry) => entry.id === id || entry.email?.toLowerCase() === email);
+    if (contact?.optedOut) continue;
+    if (contact) optOut(contact.id, contacts);
+    else {
+      upsertContact({ name: null, email, phone: null, handles: [], openprofile: null, source: "newsletter-unsubscribe", tags: [] }, contacts);
+      optOut(id, readContacts());
+    }
+    result.optedOut.push(email);
+  }
+  if (newest !== file.trackingSince) {
+    const fresh = readNewsletters();
+    fresh.trackingSince = newest;
+    writeNewsletters(fresh);
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------- variants
+
+export interface Variant {
+  /** "A", "B", ...: what crawlproof records as `v`. */
+  key: string;
+  /** "A" or "B": which subject line. */
+  subjectKey: string;
+  subject: string;
+  cta: NewsletterCta | null;
+}
+
+const letter = (index: number): string => (index < 26 ? String.fromCharCode(65 + index) : `V${index + 1}`);
+
+/** Every subject crossed with every call to action: A is the first subject with the first CTA. */
+export function buildVariants(subjects: string[], ctas: (NewsletterCta | null)[]): Variant[] {
+  if (!subjects.length) throw new Error("A newsletter needs a subject.");
+  const list = ctas.length ? ctas : [null];
+  const variants: Variant[] = [];
+  for (const cta of list) subjects.forEach((subject, s) => variants.push({ key: letter(variants.length), subjectKey: letter(s), subject, cta }));
+  return variants;
+}
+
+/** Deterministic per person: sha256(campaign:email) mod the number of variants. */
+export function variantIndex(campaign: string, email: string, count: number): number {
+  const digest = createHash("sha256").update(`${campaign}:${email.trim().toLowerCase()}`).digest();
+  return digest.readUInt32BE(0) % count;
+}
+
+/** An issue's variants: its subjects crossed with its CTA set. */
+export function variantsFor(newsletter: Pick<Newsletter, "subject" | "subjectB" | "ctaSet">): Variant[] {
+  let ctas: (NewsletterCta | null)[] = [null];
+  if (newsletter.ctaSet) {
+    const set = loadSettings().newsletter.ctaSets[newsletter.ctaSet];
+    if (!set?.length) throw new Error(`No CTA set "${newsletter.ctaSet}", or it is empty. myna newsletter cta list shows them.`);
+    ctas = set;
+  }
+  return buildVariants([newsletter.subject, ...(newsletter.subjectB ? [newsletter.subjectB] : [])], ctas);
+}
+
 // ---------------------------------------------------------------- composing
 
 export interface NewsletterComposeOptions {
@@ -46,23 +243,60 @@ export interface NewsletterComposeOptions {
   /** The sender, for the mailto fallback and the List-Id domain. */
   from: string;
   token: string;
+  /** The variant's subject, when it is not the issue's own. */
+  subject?: string;
+  /** The call to action for this variant: where `{{cta}}` is, else last before the footer. */
+  cta?: NewsletterCta | null;
+  /** Set, every link goes through a signed click URL and the HTML carries the open pixel. */
+  tracking?: { tracking: Tracking; ids: TrackingIds };
 }
 
+/** `https://...` in plain text; trailing sentence punctuation is left outside the link. */
+const TEXT_URL = /https?:\/\/[^\s<>()[\]"']+/g;
+
 /** The message for one subscriber: body, footer, and the unsubscribe headers. */
-export function composeNewsletter(newsletter: Pick<Newsletter, "subject" | "body" | "list" | "replyTo">, options: NewsletterComposeOptions): Omit<SmtpMessage, "to"> {
+export function composeNewsletter(
+  newsletter: Pick<Newsletter, "subject" | "body" | "list" | "replyTo"> & Partial<Pick<Newsletter, "service">>,
+  options: NewsletterComposeOptions,
+): Omit<SmtpMessage, "to"> {
   const sender = addressOf(options.from);
   const domain = sender.split("@")[1] ?? "myna.local";
   const listToken = newsletter.list.replace(/[^a-z0-9-]/gi, "-").toLowerCase() || "newsletter";
-  const reason = `You are getting this because you subscribed to ${newsletter.list}.`;
-  const text =
-    `${newsletter.body.trimEnd()}\n\n-- \n${reason}\nUnsubscribe with one click: ${options.link}\n\n${options.address.trim()}\n`;
+  const reason = newsletter.service
+    ? `You get this because you have an account at ${newsletter.service}; our Terms say we may email news and updates.`
+    : `You are getting this because you subscribed to ${newsletter.list}.`;
+
+  const tracked = options.tracking;
+  const base = tracked ? trackingBase(tracked.tracking) : "";
+  const wrap = (url: string): string => (tracked && !url.startsWith(base) ? clickUrl(tracked.tracking, url, tracked.ids) : url);
+
+  // Where the call to action goes; no CTA, and a stray marker is simply dropped.
+  let body = newsletter.body;
+  if (options.cta && !body.includes(CTA_MARK)) body = `${body.trimEnd()}\n\n${CTA_MARK}\n`;
+  const cta = options.cta;
+
+  let textBody = body.split(CTA_MARK).join(cta ? `${cta.label}: ${cta.url}` : "");
+  if (tracked)
+    textBody = textBody.replace(TEXT_URL, (match) => {
+      const trimmed = match.replace(/[.,;:!?]+$/, "");
+      return wrap(trimmed) + match.slice(trimmed.length);
+    });
+  const text = `${textBody.trimEnd()}\n\n-- \n${reason}\nUnsubscribe with one click: ${options.link}\n\n${options.address.trim()}\n`;
+
+  const button = cta
+    ? `<p style="margin:28px 0"><a href="${escapeHtml(cta.url)}" style="display:inline-block;padding:12px 22px;background:#111827;color:#ffffff;text-decoration:none;border-radius:6px;font-weight:600">${escapeHtml(cta.label)}</a></p>`
+    : "";
+  let rendered = renderMarkdown(body);
+  rendered = rendered.split(`<p>${CTA_MARK}</p>`).join(button).split(CTA_MARK).join(button);
+  if (tracked) rendered = rendered.replace(/href="(https?:\/\/[^"]+)"/g, (_, href: string) => `href="${escapeHtml(wrap(href.replace(/&amp;/g, "&")))}"`);
   const small = 'style="font-size:12px;color:#666;line-height:1.5"';
+  const pixel = tracked ? `<img src="${escapeHtml(openPixelUrl(tracked.tracking, tracked.ids))}" width="1" height="1" alt="" style="border:0;width:1px;height:1px">\n` : "";
   const html =
-    `${renderMarkdown(newsletter.body)}\n<hr>\n` +
+    `${rendered}\n<hr>\n` +
     `<p ${small}>${escapeHtml(reason)} <a href="${escapeHtml(options.link)}">Unsubscribe</a>.</p>\n` +
-    `<p ${small}>${escapeHtml(options.address.trim()).replace(/\r?\n/g, "<br>")}</p>\n`;
+    `<p ${small}>${escapeHtml(options.address.trim()).replace(/\r?\n/g, "<br>")}</p>\n${pixel}`;
   return {
-    subject: newsletter.subject,
+    subject: options.subject ?? newsletter.subject,
     text,
     html,
     ...(newsletter.replyTo ? { replyTo: newsletter.replyTo } : {}),
@@ -299,14 +533,19 @@ export function readSubscriberFile(path: string): SubscriberInput[] {
   return parseSubscribers(readFileSync(path, "utf8"), format);
 }
 
+
 // ---------------------------------------------------------------- sending
 
 export interface SendNewsletterOptions {
   dryRun?: boolean;
-  /** Send one copy here and nothing else: no ledger, no status change. */
+  /** Send one copy here and nothing else: no ledger, no status change. Variant A. */
   test?: string;
   /** At most this many this run, under the daily cap. */
   limit?: number;
+  /** This run's daily cap instead of outreach.maxEmailsPerDay. */
+  maxPerDay?: number;
+  /** Milliseconds between two messages. The CLI and the daemon pass newsletter.paceMs. */
+  paceMs?: number;
   /** Mail recipients whose last send died mid-message. They may already have it. */
   retryUncertain?: boolean;
   /** Try again the recipients the server refused last time. */
@@ -317,6 +556,10 @@ export interface SendNewsletterOptions {
   smtp?: SmtpOptions;
   link?: (token: string) => string;
   now?: Date;
+  /** crawlproof tracking; undefined reads it from settings and the vault, null turns it off. */
+  tracking?: Tracking | null;
+  fetcher?: Fetch;
+  sleep?: (ms: number) => Promise<void>;
 }
 
 export interface SendNewsletterReport {
@@ -337,6 +580,10 @@ export interface SendNewsletterReport {
   /** Left for a later run by the daily cap or the limit. */
   remaining: number;
   status: Newsletter["status"];
+  /** The variants, and how many of those still due get each. */
+  variants: Variant[];
+  split: Record<string, number>;
+  tracked: boolean;
 }
 
 /** The postal address for an issue, or an error that says where to set it. */
@@ -349,7 +596,10 @@ export function addressFor(newsletter: Newsletter): string {
 export async function sendNewsletter(id: string, options: SendNewsletterOptions = {}): Promise<SendNewsletterReport> {
   const log = options.log ?? (() => undefined);
   const now = options.now ?? new Date();
+  const sleep = options.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
   const newsletter = requireNewsletter(id);
+  const tracking = options.tracking === undefined ? newsletterTracking() : (options.tracking ?? undefined);
+  const variants = variantsFor(newsletter);
   const report: SendNewsletterReport = {
     id: newsletter.id,
     subject: newsletter.subject,
@@ -363,27 +613,52 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
     wouldSend: [],
     remaining: 0,
     status: newsletter.status,
+    variants,
+    split: {},
+    tracked: Boolean(tracking),
   };
 
-  // A test copy: one address, a fake token, nothing written but the outreach ledger.
+  /** One person's message: their variant, their msgId, their unsubscribe link. */
+  const messageFor = (to: string, variant: Variant, token: string, link: (token: string) => string, server: SmtpServer, subjectPrefix = "") => {
+    const msgId = newMsgId();
+    const ids = { m: msgId, c: newsletter.id, v: variant.key };
+    const unsubscribeLink = tracking ? trackedUnsubscribeUrl(tracking, { m: msgId, c: newsletter.id, email: to }) : link(token);
+    const message = composeNewsletter(newsletter, {
+      link: unsubscribeLink,
+      address: addressFor(newsletter),
+      from: server.from,
+      token,
+      subject: `${subjectPrefix}${variant.subject}`,
+      cta: variant.cta,
+      ...(tracking ? { tracking: { tracking, ids } } : {}),
+    });
+    return { message, msgId };
+  };
+  // Tracking makes crawlproof the unsubscribe host, so myna cloud is only asked when it is not.
+  const hostedLink = async (): Promise<(token: string) => string> => options.link ?? (tracking ? () => "" : await linkMaker());
+
+  // A test copy: one address, variant A, nothing written but the outreach ledger.
   if (options.test) {
-    const address = addressFor(newsletter);
+    const variant = variants[0] as Variant;
+    log(`Test copy to ${options.test} as variant ${variant.key} (subject ${variant.subjectKey}${variant.cta ? `, CTA "${variant.cta.label}"` : ""}).`);
+    const known = readContacts().contacts.find((c) => c.id === options.test!.trim().toLowerCase());
+    if (known?.optedOut) throw new Error(`${options.test} has opted out. It is never written to again.`);
     const server = options.server ?? smtpServer(newsletter.smtp ?? undefined);
-    let link: string;
+    let link: (token: string) => string;
     try {
-      link = (options.link ?? (await linkMaker()))("test-copy-not-a-subscriber");
+      link = await hostedLink();
     } catch (error) {
-      link = "https://example.invalid/unsubscribe";
+      link = () => "https://example.invalid/unsubscribe";
       log(`warning: ${(error as Error).message} The test copy carries a placeholder link.`);
     }
-    const message = composeNewsletter({ ...newsletter, subject: `[test] ${newsletter.subject}` }, { link, address, from: server.from, token: "test" });
+    const { message, msgId } = messageFor(options.test, variant, "test", link, server, "[test] ");
     if (options.dryRun) {
       report.wouldSend.push(options.test);
       return report;
     }
     try {
-      const result = await sendSmtp(server, { ...message, to: [options.test] }, options.smtp);
-      recordSent([{ at: now.toISOString(), kind: "email", to: options.test, via: server.id, subject: message.subject, ok: true, id: result.messageId }]);
+      await sendSmtp(server, { ...message, to: [options.test] }, options.smtp);
+      recordSent([{ at: now.toISOString(), kind: "email", to: options.test, via: server.id, subject: message.subject, ok: true, id: msgId }]);
       report.sent.push(options.test);
     } catch (error) {
       recordSent([{ at: now.toISOString(), kind: "email", to: options.test, via: server.id, subject: message.subject, ok: false, error: (error as Error).message }]);
@@ -399,6 +674,15 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
     } catch (error) {
       log(`warning: could not read unsubscribes from myna cloud (${(error as Error).message}); sending to the list as it stands.`);
     }
+    if (tracking) {
+      // The tracked link is the one people press, so a send never goes without its unsubscribes.
+      try {
+        const synced = await syncTrackingUnsubscribes(tracking, { fetcher: options.fetcher });
+        if (synced.optedOut.length) log(`${synced.optedOut.length} unsubscribed through crawlproof: ${synced.optedOut.join(", ")}`);
+      } catch (error) {
+        throw new Error(`Could not read unsubscribes from crawlproof (${(error as Error).message}); not sending until they are applied.`);
+      }
+    }
   }
 
   const ledger = readNewsletters().deliveries[newsletter.id] ?? {};
@@ -413,16 +697,22 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
     else if (entry?.state === "failed" && !options.retryFailed) report.previouslyFailed++;
     else due.push(contact);
   }
+  const variantOf = (contact: Contact): Variant => variants[variantIndex(newsletter.id, contact.email as string, variants.length)] as Variant;
+  for (const contact of due) {
+    const key = variantOf(contact).key;
+    report.split[key] = (report.split[key] ?? 0) + 1;
+  }
 
   const settings = loadSettings();
-  const capLeft = Math.max(0, settings.outreach.maxEmailsPerDay - outreachSentToday("email", now.getTime()));
+  const cap = options.maxPerDay ?? settings.outreach.maxEmailsPerDay;
+  const capLeft = Math.max(0, cap - outreachSentToday("email", now.getTime()));
   const room = Math.min(capLeft, options.limit ?? Number.POSITIVE_INFINITY);
   const batch = due.slice(0, room);
   report.remaining = due.length - batch.length;
 
   if (options.dryRun) {
     report.wouldSend = batch.map((contact) => contact.email as string);
-    if (report.remaining) log(`${report.remaining} more wait for a later run (daily cap ${settings.outreach.maxEmailsPerDay}, ${capLeft} left today).`);
+    if (report.remaining) log(`${report.remaining} more wait for a later run (daily cap ${cap}, ${capLeft} left today).`);
     try {
       addressFor(newsletter);
     } catch (error) {
@@ -431,30 +721,38 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
     return report;
   }
 
-  const address = addressFor(newsletter);
+  addressFor(newsletter);
   if (batch.length) {
     const server = options.server ?? smtpServer(newsletter.smtp ?? undefined);
-    const link = options.link ?? (await linkMaker());
-    for (const contact of batch) {
+    const link = await hostedLink();
+    for (const [index, contact] of batch.entries()) {
       const to = contact.email as string;
       const token = tokenFor(contact.id);
-      const message = composeNewsletter(newsletter, { link: link(token), address, from: server.from, token });
-      recordDelivery(newsletter.id, contact.id, { state: "pending", at: new Date().toISOString(), to });
+      const variant = variantOf(contact);
+      const { message, msgId } = messageFor(to, variant, token, link, server);
+      const tag: Pick<Delivery, "msgId" | "variant" | "subjectKey" | "cta"> = {
+        msgId,
+        variant: variant.key,
+        subjectKey: variant.subjectKey,
+        ...(variant.cta ? { cta: variant.cta.label } : {}),
+      };
+      recordDelivery(newsletter.id, contact.id, { state: "pending", at: new Date().toISOString(), to, ...tag });
       try {
         const result = await sendSmtp(server, { ...message, to: [to] }, options.smtp);
         const at = new Date().toISOString();
-        recordDelivery(newsletter.id, contact.id, { state: "sent", at, to, messageId: result.messageId });
-        recordSent([{ at, kind: "email", to, via: server.id, subject: newsletter.subject, ok: true, id: result.messageId }]);
+        recordDelivery(newsletter.id, contact.id, { state: "sent", at, to, messageId: result.messageId, ...tag });
+        recordSent([{ at, kind: "email", to, via: server.id, subject: message.subject, ok: true, id: result.messageId }]);
         report.sent.push(to);
-        log(`sent to ${contact.name ? `${contact.name} ` : ""}<${to}>`);
+        log(`sent ${variants.length > 1 ? `${variant.key} ` : ""}to ${contact.name ? `${contact.name} ` : ""}<${to}>`);
       } catch (error) {
         const at = new Date().toISOString();
-        const message = (error as Error).message;
-        recordDelivery(newsletter.id, contact.id, { state: "failed", at, to, error: message });
-        recordSent([{ at, kind: "email", to, via: server.id, subject: newsletter.subject, ok: false, error: message }]);
-        report.failed.push({ to, error: message });
-        log(`could not send to <${to}>: ${message}`);
+        const reason = (error as Error).message;
+        recordDelivery(newsletter.id, contact.id, { state: "failed", at, to, error: reason, ...tag });
+        recordSent([{ at, kind: "email", to, via: server.id, subject: message.subject, ok: false, error: reason }]);
+        report.failed.push({ to, error: reason });
+        log(`could not send to <${to}>: ${reason}`);
       }
+      if (options.paceMs && index < batch.length - 1) await sleep(options.paceMs);
     }
   }
 
@@ -474,6 +772,95 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
   return report;
 }
 
+// ---------------------------------------------------------------- stats
+
+export interface VariantStats {
+  variant: string;
+  subjectKey: string;
+  cta: string;
+  sent: number;
+  /** Unique messages opened by a person (machine-flagged opens left out). */
+  opens: number;
+  /** Unique messages with any open, machines included. */
+  opensTotal: number;
+  /** Unique messages clicked by a person (machine-flagged clicks left out, so a link scanner cannot pick the leader). */
+  clicks: number;
+  ctr: number;
+  unsubscribes: number;
+}
+
+export interface NewsletterStats {
+  id: string;
+  rows: VariantStats[];
+  leader: string | null;
+  /** What the leader leads on. */
+  basis: "clicks" | "opens" | null;
+}
+
+/** Join crawlproof's events to the ledger by msgId, and count per variant. Test copies are not in the ledger. */
+export function newsletterStats(id: string, events: TrackingEvent[], deliveries: Record<string, Delivery> = readNewsletters().deliveries[id] ?? {}): NewsletterStats {
+  const rows = new Map<string, VariantStats>();
+  const variantOf = new Map<string, string>();
+  for (const entry of Object.values(deliveries)) {
+    if (entry.state !== "sent") continue;
+    const variant = entry.variant ?? "A";
+    if (entry.msgId) variantOf.set(entry.msgId, variant);
+    const row = rows.get(variant) ?? { variant, subjectKey: entry.subjectKey ?? "A", cta: entry.cta ?? "", sent: 0, opens: 0, opensTotal: 0, clicks: 0, ctr: 0, unsubscribes: 0 };
+    row.sent++;
+    rows.set(variant, row);
+  }
+  const sets = new Map<string, { open: Set<string>; all: Set<string>; click: Set<string>; unsub: Set<string> }>();
+  for (const event of events) {
+    const variant = event.m ? variantOf.get(event.m) : undefined;
+    if (!variant || !event.m) continue;
+    const bucket = sets.get(variant) ?? { open: new Set(), all: new Set(), click: new Set(), unsub: new Set() };
+    sets.set(variant, bucket);
+    if (event.type === "open") {
+      bucket.all.add(event.m);
+      if (!event.machine) bucket.open.add(event.m);
+    } else if (event.type === "click") {
+      if (!event.machine) bucket.click.add(event.m);
+    } else if (event.type === "unsubscribe") bucket.unsub.add(event.m);
+  }
+  for (const [variant, row] of rows) {
+    const bucket = sets.get(variant);
+    row.opens = bucket?.open.size ?? 0;
+    row.opensTotal = bucket?.all.size ?? 0;
+    row.clicks = bucket?.click.size ?? 0;
+    row.unsubscribes = bucket?.unsub.size ?? 0;
+    row.ctr = row.sent ? row.clicks / row.sent : 0;
+  }
+  const list = [...rows.values()].sort((a, b) => a.variant.localeCompare(b.variant, undefined, { numeric: true }));
+  const openRate = (row: VariantStats): number => (row.sent ? row.opens / row.sent : 0);
+  let leader: string | null = null;
+  let basis: NewsletterStats["basis"] = null;
+  if (list.some((row) => row.clicks > 0)) {
+    leader = [...list].sort((a, b) => b.ctr - a.ctr || openRate(b) - openRate(a))[0]?.variant ?? null;
+    basis = "clicks";
+  } else if (list.some((row) => row.opens > 0)) {
+    leader = [...list].sort((a, b) => openRate(b) - openRate(a))[0]?.variant ?? null;
+    basis = "opens";
+  }
+  return { id, rows: list, leader, basis };
+}
+
+/** Pull the issue's events from crawlproof, from its first send on, and count them. */
+export async function fetchNewsletterStats(id: string, tracking: Tracking, options: { fetcher?: Fetch } = {}): Promise<NewsletterStats> {
+  const newsletter = requireNewsletter(id);
+  const deliveries = readNewsletters().deliveries[newsletter.id] ?? {};
+  const since = Object.values(deliveries).map((entry) => entry.at).sort()[0];
+  const events = since ? await fetchTrackingEvents(tracking, { since: new Date(Date.parse(since) - 60_000).toISOString(), fetcher: options.fetcher }) : [];
+  return newsletterStats(newsletter.id, events.filter((event) => !event.c || event.c === newsletter.id), deliveries);
+}
+
+/** Every unsubscribe source that is set up: myna cloud's hosted link, and crawlproof tracking. */
+export async function syncAllUnsubscribes(options: { tracking?: Tracking | null; fetcher?: Fetch } = {}): Promise<{ cloud: SyncResult; tracking: TrackingSyncResult | null }> {
+  const tracking = options.tracking === undefined ? newsletterTracking() : (options.tracking ?? undefined);
+  const cloud = await syncUnsubscribes();
+  const tracked = tracking ? await syncTrackingUnsubscribes(tracking, { fetcher: options.fetcher }) : null;
+  return { cloud, tracking: tracked };
+}
+
 /**
  * The daemon's turn: send every scheduled issue that is due, and carry on
  * with any scheduled one the cap cut short. An issue sent by hand that
diff --git a/packages/core/src/core/smtp.ts b/packages/core/src/core/smtp.ts
index bdbc0a5..edae267 100644
--- a/packages/core/src/core/smtp.ts
+++ b/packages/core/src/core/smtp.ts
@@ -129,27 +129,68 @@ export function buildMime(server: SmtpServer, message: SmtpMessage, messageId: s
     ...Object.entries(message.headers ?? {}).map(([key, value]) => `${key}: ${value}`),
   ];
   if (!message.html) {
-    headers.push("Content-Type: text/plain; charset=utf-8", "Content-Transfer-Encoding: 8bit");
-    return `${headers.join(CRLF)}${CRLF}${CRLF}${dotStuff(message.text)}`;
+    const body = encodeBody(message.text);
+    headers.push("Content-Type: text/plain; charset=utf-8", `Content-Transfer-Encoding: ${body.encoding}`);
+    return `${headers.join(CRLF)}${CRLF}${CRLF}${dotStuff(body.content)}`;
   }
   const boundary = `=_myna_${randomBytes(9).toString("hex")}`;
   headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+  const text = encodeBody(message.text);
+  const html = encodeBody(message.html);
   const parts = [
     `--${boundary}`,
     "Content-Type: text/plain; charset=utf-8",
-    "Content-Transfer-Encoding: 8bit",
+    `Content-Transfer-Encoding: ${text.encoding}`,
     "",
-    dotStuff(message.text),
+    dotStuff(text.content),
     `--${boundary}`,
     "Content-Type: text/html; charset=utf-8",
-    "Content-Transfer-Encoding: 8bit",
+    `Content-Transfer-Encoding: ${html.encoding}`,
     "",
-    dotStuff(message.html),
+    dotStuff(html.content),
     `--${boundary}--`,
   ];
   return `${headers.join(CRLF)}${CRLF}${CRLF}${parts.join(CRLF)}`;
 }
 
+/**
+ * 8bit while every line fits SMTP's 998 octets, quoted-printable when one
+ * does not. A newsletter paragraph with a few signed links in it is one long
+ * HTML line, and a server may refuse or cut a line past the limit.
+ */
+function encodeBody(body: string): { encoding: "8bit" | "quoted-printable"; content: string } {
+  const long = body
+    .replace(/\r\n?/g, "\n")
+    .split("\n")
+    .some((line) => Buffer.byteLength(line, "utf8") > 998);
+  return long ? { encoding: "quoted-printable", content: quotedPrintable(body) } : { encoding: "8bit", content: body };
+}
+
+/** RFC 2045 quoted-printable: lines of at most 76 characters, newlines kept as hard breaks. */
+export function quotedPrintable(body: string): string {
+  return body
+    .replace(/\r\n?/g, "\n")
+    .split("\n")
+    .map((line) => {
+      const bytes = Buffer.from(line, "utf8");
+      const lines: string[] = [];
+      let current = "";
+      bytes.forEach((byte, index) => {
+        const last = index === bytes.length - 1;
+        const plain = (byte >= 33 && byte <= 126 && byte !== 61) || ((byte === 32 || byte === 9) && !last);
+        const token = plain ? String.fromCharCode(byte) : `=${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+        if (current.length + token.length > 75) {
+          lines.push(`${current}=`);
+          current = "";
+        }
+        current += token;
+      });
+      lines.push(current);
+      return lines.join("\n");
+    })
+    .join("\n");
+}
+
 /** RFC 2047 for a subject with anything outside ASCII. */
 function encodeHeader(value: string): string {
   return /^[\x20-\x7e]*$/.test(value) ? value : `=?utf-8?B?${Buffer.from(value, "utf8").toString("base64")}?=`;
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 92d6154..fb740cc 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -417,7 +417,8 @@ export { sendSms, e164, TELNYX_MESSAGES_URL, type SmsConfig, type SmsResult } fr
 export { readContacts, writeContacts, upsertContact, removeContact, optOut, optIn, addToList, removeFromList, recipients, contactId, type Contact, type ContactsFile } from "./store/contacts.ts";
 export { readOutreach, writeOutreach, saveSmtpServer, removeSmtpServer, smtpServer, saveSms, smsConfig, recordSent, outreachSentToday, type SmsSetup, type SentRecord, type OutreachFile } from "./store/outreach.ts";
 export { importFromAgenticjobs, type ImportOptions, type ImportResult } from "./core/contacts-import.ts";
-export { DEFAULT_OUTREACH, type OutreachSettings, DEFAULT_NEWSLETTER, type NewsletterSettings } from "./store/settings.ts";
+export { DEFAULT_OUTREACH, type OutreachSettings, DEFAULT_NEWSLETTER, DEFAULT_CTAS, type NewsletterSettings, type NewsletterCta } from "./store/settings.ts";
+export { quotedPrintable } from "./core/smtp.ts";
 // Newsletters: issues to a contacts list, a per-recipient ledger, one-click unsubscribe.
 export {
   readNewsletters,
@@ -458,4 +459,28 @@ export {
   type SubscriberInput,
   type SubscribeResult,
   type SyncResult,
+  // crawlproof tracking, A/B variants, stats
+  newsletterTracking,
+  TRACKING_SECRETS,
+  TRACKING_ID,
+  trackingBase,
+  signTracking,
+  openPixelUrl,
+  clickUrl,
+  trackedUnsubscribeUrl,
+  fetchTrackingEvents,
+  syncTrackingUnsubscribes,
+  syncAllUnsubscribes,
+  buildVariants,
+  variantIndex,
+  variantsFor,
+  newsletterStats,
+  fetchNewsletterStats,
+  type Tracking,
+  type TrackingEvent,
+  type TrackingIds,
+  type TrackingSyncResult,
+  type Variant,
+  type VariantStats,
+  type NewsletterStats,
 } from "./core/newsletter.ts";
diff --git a/packages/core/src/store/newsletters.ts b/packages/core/src/store/newsletters.ts
index a827111..b1ccb63 100644
--- a/packages/core/src/store/newsletters.ts
+++ b/packages/core/src/store/newsletters.ts
@@ -37,6 +37,15 @@ export interface Newsletter {
   replyTo: string | null;
   /** Overrides settings.newsletter.address for this issue. */
   address: string | null;
+  /** A second subject line: variants A/B test it against `subject`. */
+  subjectB?: string | null;
+  /** The CTA set (settings.newsletter.ctaSets) each variant takes one call to action from; null is none. */
+  ctaSet?: string | null;
+  /**
+   * The service the list has accounts at. Set, the footer says why they get
+   * mail ("an account at <service>; our Terms say..."), not that they subscribed.
+   */
+  service?: string | null;
   createdAt: string;
   updatedAt: string;
   sentAt: string | null;
@@ -50,6 +59,12 @@ export interface Delivery {
   to: string;
   messageId?: string;
   error?: string;
+  /** The tracking msgId crawlproof reports events against. */
+  msgId?: string;
+  /** Which variant this person got, and what it was. */
+  variant?: string;
+  subjectKey?: string;
+  cta?: string;
 }
 
 export interface NewslettersFile {
@@ -62,6 +77,8 @@ export interface NewslettersFile {
   inbox: { id: string; server: string } | null;
   /** The newest unsubscribe already pulled from myna cloud. */
   unsubscribesSince: string | null;
+  /** The newest unsubscribe already pulled from crawlproof tracking. */
+  trackingSince: string | null;
 }
 
 export function readNewsletters(): NewslettersFile {
@@ -72,6 +89,7 @@ export function readNewsletters(): NewslettersFile {
     tokens: file.tokens ?? {},
     inbox: file.inbox ?? null,
     unsubscribesSince: file.unsubscribesSince ?? null,
+    trackingSince: file.trackingSince ?? null,
   };
 }
 
@@ -91,6 +109,9 @@ export interface NewsletterInput {
   smtp?: string | null;
   replyTo?: string | null;
   address?: string | null;
+  subjectB?: string | null;
+  ctaSet?: string | null;
+  service?: string | null;
 }
 
 export function getNewsletter(id: string, file = readNewsletters()): Newsletter | undefined {
@@ -124,6 +145,9 @@ export function createNewsletter(input: NewsletterInput, file = readNewsletters(
     smtp: input.smtp ?? null,
     replyTo: input.replyTo ? oneLine(input.replyTo) : null,
     address: input.address ?? null,
+    subjectB: input.subjectB ? oneLine(input.subjectB) || null : null,
+    ctaSet: input.ctaSet ?? null,
+    service: input.service ? oneLine(input.service) || null : null,
     createdAt: now,
     updatedAt: now,
     sentAt: null,
@@ -154,6 +178,11 @@ export function editNewsletter(id: string, patch: NewsletterPatch, file = readNe
   if (patch.smtp !== undefined) newsletter.smtp = patch.smtp;
   if (patch.replyTo !== undefined) newsletter.replyTo = patch.replyTo ? oneLine(patch.replyTo) : null;
   if (patch.address !== undefined) newsletter.address = patch.address;
+  if ((patch.subjectB !== undefined || patch.ctaSet !== undefined) && newsletter.status === "sending")
+    throw new Error(`${newsletter.id} is part way out; changing its variants now would break the A/B test.`);
+  if (patch.subjectB !== undefined) newsletter.subjectB = patch.subjectB ? oneLine(patch.subjectB) || null : null;
+  if (patch.ctaSet !== undefined) newsletter.ctaSet = patch.ctaSet;
+  if (patch.service !== undefined) newsletter.service = patch.service ? oneLine(patch.service) || null : null;
   if (patch.scheduledFor !== undefined) newsletter.scheduledFor = patch.scheduledFor;
   if (patch.draft) newsletter.scheduledFor = null;
   if (newsletter.status !== "sending") newsletter.status = newsletter.scheduledFor ? "scheduled" : "draft";
diff --git a/packages/core/src/store/settings.ts b/packages/core/src/store/settings.ts
index 917d982..7b10cf6 100644
--- a/packages/core/src/store/settings.ts
+++ b/packages/core/src/store/settings.ts
@@ -237,9 +237,47 @@ export interface NewsletterSettings {
    * mynaposter.com, which needs `myna cloud login`.
    */
   unsubscribeUrl: string;
+  /**
+   * The crawlproof.com tracking id (24 hex). Set, every issue gets signed
+   * click links, an open pixel and crawlproof's signed unsubscribe link. Its
+   * secret is in the vault, never here.
+   */
+  trackingId: string;
+  /** Where tracking lives. Only a test or a staging host changes it. */
+  trackingHost: string;
+  /** Milliseconds between two messages of one send. */
+  paceMs: number;
+  /** Named sets of calls to action; an issue with a set rotates through it, one per variant. */
+  ctaSets: Record<string, NewsletterCta[]>;
+}
+
+/** A call to action in a newsletter: the button text and where it goes. */
+export interface NewsletterCta {
+  label: string;
+  url: string;
 }
 
-export const DEFAULT_NEWSLETTER: NewsletterSettings = { address: "", unsubscribeUrl: "" };
+export const DEFAULT_CTAS: NewsletterCta[] = [
+  { label: "Book a demo", url: "https://profullstack.com/book" },
+  { label: "Schedule a call", url: "https://profullstack.com/contact" },
+  { label: "See our plans", url: "https://profullstack.com/plans" },
+  { label: "Support us", url: "https://profullstack.com/support-us" },
+];
+
+export const DEFAULT_NEWSLETTER: NewsletterSettings = {
+  address: "",
+  unsubscribeUrl: "",
+  trackingId: "",
+  trackingHost: "https://crawlproof.com",
+  paceMs: 1000,
+  ctaSets: { default: DEFAULT_CTAS },
+};
+
+/** Stored over the defaults, with the CTA sets copied so an edit never reaches the defaults. */
+function newsletterSettings(stored: Partial<NewsletterSettings> | undefined): NewsletterSettings {
+  const sets = stored?.ctaSets && typeof stored.ctaSets === "object" ? stored.ctaSets : DEFAULT_NEWSLETTER.ctaSets;
+  return { ...DEFAULT_NEWSLETTER, ...stored, ctaSets: structuredClone(sets) };
+}
 
 export interface SynconfigSettings {
   /** Let the daemon pull and push on a schedule. On by default; it only runs once signed in to myna cloud. */
@@ -307,7 +345,7 @@ export const DEFAULT_SETTINGS: Settings = {
   engage: { ...DEFAULT_ENGAGE },
   did: { ...DEFAULT_DID },
   outreach: { ...DEFAULT_OUTREACH },
-  newsletter: { ...DEFAULT_NEWSLETTER },
+  newsletter: newsletterSettings(undefined),
   synconfig: { ...DEFAULT_SYNCONFIG },
   plugins: [],
   directories: [],
@@ -342,7 +380,7 @@ export function loadSettings(): Settings {
     engage: { ...DEFAULT_ENGAGE, ...stored.engage },
     did: { ...DEFAULT_DID, ...stored.did },
     outreach: { ...DEFAULT_OUTREACH, ...stored.outreach },
-    newsletter: { ...DEFAULT_NEWSLETTER, ...stored.newsletter },
+    newsletter: newsletterSettings(stored.newsletter),
     synconfig: { ...DEFAULT_SYNCONFIG, ...stored.synconfig },
     skills: {
       defaults: { ...(stored.skills?.defaults ?? {}) },
diff --git a/packages/core/test/newsletter-tracking.test.ts b/packages/core/test/newsletter-tracking.test.ts
new file mode 100644
index 0000000..43a0118
--- /dev/null
+++ b/packages/core/test/newsletter-tracking.test.ts
@@ -0,0 +1,364 @@
+/**
+ * Newsletters with crawlproof tracking and A/B variants: signed URLs to the
+ * letter of the contract (crawlproof.com PR #266), variants that stay put per
+ * person, whole sends against a fake SMTP server with crawlproof played by a
+ * stubbed fetch, and stats joined through the ledger. No real mail leaves
+ * this file.
+ */
+import { test, expect, beforeEach, afterEach } from "bun:test";
+import { createServer, type Socket } from "node:net";
+import { createHmac } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createNewsletter, readNewsletters, requireNewsletter } from "../src/store/newsletters.ts";
+import {
+  buildVariants,
+  clickUrl,
+  composeNewsletter,
+  fetchTrackingEvents,
+  newsletterStats,
+  openPixelUrl,
+  sendNewsletter,
+  subscribe,
+  syncTrackingUnsubscribes,
+  trackedUnsubscribeUrl,
+  variantIndex,
+  variantsFor,
+  type Tracking,
+  type TrackingEvent,
+} from "../src/core/newsletter.ts";
+import { quotedPrintable, buildMime } from "../src/core/smtp.ts";
+import { readContacts, recipients } from "../src/store/contacts.ts";
+import { readOutreach } from "../src/store/outreach.ts";
+import { DEFAULT_CTAS, loadSettings, saveSettings } from "../src/store/settings.ts";
+
+let dir = "";
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "myna-newsletter-tracking-"));
+  process.env.MYNA_HOME = dir;
+  const settings = loadSettings();
+  settings.newsletter.address = "Profullstack, Inc., 1 Main St, San Jose, CA 95112, USA";
+  // No myna cloud here: with tracking the link is crawlproof's; without, this one.
+  settings.newsletter.unsubscribeUrl = "https://example.com/u/{token}";
+  saveSettings(settings);
+});
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+  delete process.env.MYNA_HOME;
+});
+
+const SECRET = "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
+const tracking: Tracking = { id: "0123456789abcdef01234567", secret: SECRET, host: "https://crawlproof.test" };
+const hmac32 = (value: string): string => createHmac("sha256", SECRET).update(value).digest("hex").slice(0, 32);
+const BASE = "https://crawlproof.test/t/0123456789abcdef01234567";
+
+/** A fake SMTP server that keeps every message, one per connection, dot-stuffing undone. */
+function fakeSmtp() {
+  const messages: { rcpt: string[]; data: string }[] = [];
+  const server = createServer((socket: Socket) => {
+    let inData = false;
+    let buffer = "";
+    let data = "";
+    const rcpt: string[] = [];
+    socket.write("220 fake.example ESMTP\r\n");
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString();
+      let index: number;
+      while ((index = buffer.indexOf("\r\n")) !== -1) {
+        const line = buffer.slice(0, index);
+        buffer = buffer.slice(index + 2);
+        if (inData) {
+          if (line === ".") {
+            inData = false;
+            messages.push({ rcpt: [...rcpt], data });
+            socket.write("250 2.0.0 Ok: queued\r\n");
+          } else data += `${line.startsWith("..") ? line.slice(1) : line}\n`;
+          continue;
+        }
+        if (line.startsWith("EHLO")) socket.write("250-fake.example\r\n250 8BITMIME\r\n");
+        else if (line.startsWith("MAIL FROM")) socket.write("250 Ok\r\n");
+        else if (line.startsWith("RCPT TO")) {
+          rcpt.push(line.slice(9, -1));
+          socket.write("250 Ok\r\n");
+        } else if (line === "DATA") {
+          inData = true;
+          socket.write("354 go ahead\r\n");
+        } else if (line === "QUIT") {
+          socket.write("221 Bye\r\n");
+          socket.end();
+        } else socket.write("500 what\r\n");
+      }
+    });
+  });
+  return {
+    messages,
+    listen: () => new Promise<number>((resolve) => server.listen(0, "127.0.0.1", () => resolve((server.address() as { port: number }).port))),
+    close: () => new Promise<void>((resolve) => server.close(() => resolve())),
+  };
+}
+
+const smtp = (port: number) => ({ id: "fake", host: "127.0.0.1", port, secure: "none" as const, user: "", pass: "", from: "Profullstack <news@profullstack.com>" });
+
+/** crawlproof's events endpoint as a fetch: pages of `pageSize`, `next` an absolute URL. */
+function fakeCrawlproof(events: TrackingEvent[], options: { status?: number; pageSize?: number } = {}) {
+  const calls: { url: string; auth: string | null }[] = [];
+  const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(String(input));
+    calls.push({ url: url.toString(), auth: new Headers(init?.headers as Record<string, string>).get("authorization") });
+    if (options.status) return new Response("<html>nope</html>", { status: options.status });
+    const type = url.searchParams.get("type");
+    const since = url.searchParams.get("since") ?? "";
+    const matching = events.filter((event) => (!type || event.type === type) && event.at >= since);
+    const cursor = Number(url.searchParams.get("cursor") ?? 0);
+    const size = options.pageSize ?? 500;
+    const page = matching.slice(cursor, cursor + size);
+    const nextUrl = cursor + size < matching.length ? new URL(url) : null;
+    nextUrl?.searchParams.set("cursor", String(cursor + size));
+    return Response.json({ events: page, next: nextUrl ? nextUrl.toString() : null });
+  }) as typeof fetch;
+  return { fetcher, calls };
+}
+
+test("tracking URLs follow the crawlproof contract, signatures included", () => {
+  const ids = { m: "abc123", c: "moshcode-001", v: "C" };
+  expect(openPixelUrl(tracking, ids)).toBe(`${BASE}/o.png?m=abc123&c=moshcode-001&v=C`);
+  const url = "https://moshcode.com/thing?a=1&b=2";
+  const click = clickUrl(tracking, url, ids);
+  expect(click).toBe(`${BASE}/c?u=${encodeURIComponent(url)}&m=abc123&c=moshcode-001&v=C&s=${hmac32(url)}`);
+  expect(new URL(click).searchParams.get("u")).toBe(url);
+  expect(trackedUnsubscribeUrl(tracking, { m: "abc123", c: "moshcode-001", email: "Ada@Example.com" })).toBe(
+    `${BASE}/u?m=abc123&c=moshcode-001&e=ada%40example.com&s=${hmac32("ada@example.com")}`,
+  );
+  expect(openPixelUrl({ id: "x", secret: "y" }, ids).startsWith("https://crawlproof.com/t/x/o.png")).toBe(true);
+});
+
+test("variants are subjects x CTAs, and each person keeps theirs, split evenly", () => {
+  const variants = buildVariants(["A subject", "B subject"], DEFAULT_CTAS);
+  expect(variants.map((v) => v.key)).toEqual(["A", "B", "C", "D", "E", "F", "G", "H"]);
+  expect(variants[0]).toMatchObject({ subjectKey: "A", subject: "A subject", cta: { label: "Book a demo" } });
+  expect(variants[1]).toMatchObject({ subjectKey: "B", cta: { label: "Book a demo" } });
+  expect(variants[7]).toMatchObject({ subjectKey: "B", cta: { label: "Support us" } });
+  expect(buildVariants(["only"], [null]).map((v) => v.key)).toEqual(["A"]);
+  expect(variantIndex("c1", "Ada@Example.com", 8)).toBe(variantIndex("c1", "ada@example.com", 8));
+  const counts = new Array(8).fill(0);
+  for (let i = 0; i < 8000; i++) counts[variantIndex("c1", `user${i}@example.com`, 8)]++;
+  for (const count of counts) expect(Math.abs(count - 1000)).toBeLessThan(150);
+  expect(variantsFor({ subject: "s", subjectB: null, ctaSet: null })).toHaveLength(1);
+  expect(variantsFor({ subject: "s", subjectB: "t", ctaSet: "default" })).toHaveLength(8);
+  expect(() => variantsFor({ subject: "s", subjectB: null, ctaSet: "nope" })).toThrow(/No CTA set/);
+});
+
+test("a tracked message: CTA where {{cta}} was, every link signed, the pixel, crawlproof's unsubscribe, the account footer", () => {
+  const cta = DEFAULT_CTAS[2]!;
+  const ids = { m: "m1", c: "moshcode-001", v: "E" };
+  const link = trackedUnsubscribeUrl(tracking, { m: "m1", c: "moshcode-001", email: "ada@example.com" });
+  const message = composeNewsletter(
+    { subject: "Issue", body: "Intro https://moshcode.com/a.\n\n{{cta}}\n\nMore at [docs](https://moshcode.com/docs?x=1&y=2).", list: "moshcode-users", replyTo: null, service: "moshcode" },
+    { link, address: "1 Main St", from: "News <news@profullstack.com>", token: "tok", subject: "Subject B", cta, tracking: { tracking, ids } },
+  );
+  const amp = (value: string): string => value.replace(/&/g, "&amp;");
+  expect(message.subject).toBe("Subject B");
+  expect(message.html).not.toContain("{{cta}}");
+  expect(message.html).toContain(`href="${amp(clickUrl(tracking, "https://profullstack.com/plans", ids))}"`);
+  expect(message.html).toContain(">See our plans</a>");
+  expect(message.html).toContain(`href="${amp(clickUrl(tracking, "https://moshcode.com/docs?x=1&y=2", ids))}"`);
+  expect(message.html).not.toContain('href="https://moshcode.com');
+  expect(message.html!.indexOf("See our plans")).toBeLessThan(message.html!.indexOf("More at"));
+  expect(message.html).toContain(`<img src="${amp(openPixelUrl(tracking, ids))}"`);
+  expect(message.html).toContain(`<a href="${amp(link)}">Unsubscribe</a>`);
+  expect(message.html).toContain("You get this because you have an account at moshcode; our Terms say we may email news and updates.");
+  expect(message.text).toContain(`Intro ${clickUrl(tracking, "https://moshcode.com/a", ids)}.`);
+  expect(message.text).toContain(`See our plans: ${clickUrl(tracking, "https://profullstack.com/plans", ids)}`);
+  expect(message.text).toContain(`Unsubscribe with one click: ${link}`);
+  expect(message.headers?.["List-Unsubscribe"]).toBe(`<${link}>, <mailto:news@profullstack.com?subject=unsubscribe%20tok>`);
+  expect(message.headers?.["List-Unsubscribe-Post"]).toBe("List-Unsubscribe=One-Click");
+  expect(message.headers?.Precedence).toBe("bulk");
+  expect(message.text).not.toContain("—");
+  expect(message.html).not.toContain("—");
+});
+
+test("without {{cta}} the CTA goes last before the footer; with no CTA a stray marker is dropped; untracked links stay as they are", () => {
+  const base = { subject: "S", list: "moshcode-users", replyTo: null };
+  const opts = { link: "https://example.com/u/t", address: "1 Main St", from: "news@profullstack.com", token: "t" };
+  const appended = composeNewsletter({ ...base, body: "Just text, see https://moshcode.com" }, { ...opts, cta: DEFAULT_CTAS[0] });
+  expect(appended.text.indexOf("Book a demo: https://profullstack.com/book")).toBeGreaterThan(appended.text.indexOf("Just text"));
+  expect(appended.text.indexOf("Book a demo")).toBeLessThan(appended.text.indexOf("Unsubscribe"));
+  expect(appended.text).toContain("see https://moshcode.com");
+  expect(appended.html).not.toContain("<img");
+  expect(appended.text).toContain("because you subscribed to moshcode-users");
+  const plain = composeNewsletter({ ...base, body: "A\n\n{{cta}}\n\nB" }, opts);
+  expect(plain.text).not.toContain("{{cta}}");
+  expect(plain.html).not.toContain("{{cta}}");
+});
+
+test("a tracked A/B send: crawlproof unsubscribes first, variants per person, resumable, paced", async () => {
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", ["one", "two", "three", "four", "gone"].map((x) => ({ email: `${x}@example.com` })));
+    createNewsletter({ id: "moshcode-001", subject: "Subject A", subjectB: "Subject B", ctaSet: "default", service: "moshcode", body: "# News\n\nWe shipped [it](https://moshcode.com/it).\n\n{{cta}}", list: "moshcode-users" });
+    const crawlproof = fakeCrawlproof([{ type: "unsubscribe", email: "GONE@example.com", m: "old", c: "aug", at: "2026-09-20T00:00:00.000Z" }]);
+    const sleeps: number[] = [];
+    const common = { server: smtp(port), tracking, fetcher: crawlproof.fetcher, paceMs: 1000, sleep: async (ms: number) => void sleeps.push(ms) };
+
+    const first = await sendNewsletter("moshcode-001", { ...common, limit: 2 });
+    expect(readContacts().contacts.find((c) => c.id === "gone@example.com")?.optedOut).toBe(true);
+    expect(crawlproof.calls[0]?.auth).toBe(`Bearer ${SECRET}`);
+    expect(crawlproof.calls[0]?.url).toContain("https://crawlproof.test/api/v1/tracking/0123456789abcdef01234567/events?since=");
+    expect(crawlproof.calls[0]?.url).toContain("type=unsubscribe");
+    expect(first.audience).toBe(4);
+    expect(first.sent).toHaveLength(2);
+    expect(first.remaining).toBe(2);
+    expect(first.status).toBe("sending");
+    expect(first.variants).toHaveLength(8);
+    expect(Object.values(first.split).reduce((a, b) => a + b, 0)).toBe(4);
+    expect(sleeps).toEqual([1000]);
+    // The next pull asks only for what is new.
+    await sendNewsletter("moshcode-001", common);
+    expect(crawlproof.calls[1]?.url).toContain(`since=${encodeURIComponent("2026-09-20T00:00:00.000Z")}`);
+    const third = await sendNewsletter("moshcode-001", common);
+    expect(third.sent).toEqual([]);
+    expect(third.alreadySent).toBe(4);
+    expect(requireNewsletter("moshcode-001").status).toBe("sent");
+    expect(fake.messages).toHaveLength(4);
+
+    const variants = variantsFor(requireNewsletter("moshcode-001"));
+    const ledger = readNewsletters().deliveries["moshcode-001"]!;
+    expect(Object.keys(ledger).sort()).toEqual(["four@example.com", "one@example.com", "three@example.com", "two@example.com"]);
+    expect(new Set(Object.values(ledger).map((d) => d.msgId)).size).toBe(4);
+    for (const [email, delivery] of Object.entries(ledger)) {
+      const variant = variants[variantIndex("moshcode-001", email, 8)]!;
+      expect(delivery).toMatchObject({ state: "sent", variant: variant.key, subjectKey: variant.subjectKey, cta: variant.cta?.label });
+      const data = fake.messages.find((m) => m.rcpt[0] === email)!.data;
+      expect(data).toContain(`Subject: ${variant.subject}`);
+      expect(data).toContain(`o.png?m=${delivery.msgId}&amp;c=moshcode-001&amp;v=${variant.key}`);
+      expect(data).toContain(`List-Unsubscribe: <${trackedUnsubscribeUrl(tracking, { m: delivery.msgId!, c: "moshcode-001", email })}>`);
+      expect(data).toContain("List-Unsubscribe-Post: List-Unsubscribe=One-Click");
+      expect(data).toContain("an account at moshcode");
+      expect(data).not.toContain("example.com/u/");
+    }
+    expect(readOutreach().sent.filter((row) => row.ok)).toHaveLength(4);
+  } finally {
+    await fake.close();
+  }
+});
+
+test("a crawlproof outage stops a tracked send before anyone is mailed; --max-per-day overrides the cap", async () => {
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", ["a", "b", "c"].map((x) => ({ email: `${x}@example.com` })));
+    createNewsletter({ id: "i1", subject: "S", body: "b", list: "moshcode-users" });
+    await expect(sendNewsletter("i1", { server: smtp(port), tracking, fetcher: fakeCrawlproof([], { status: 503 }).fetcher })).rejects.toThrow(/crawlproof events: 503\); not sending/);
+    expect(fake.messages).toHaveLength(0);
+    expect(readNewsletters().deliveries.i1).toBeUndefined();
+
+    const settings = loadSettings();
+    settings.outreach.maxEmailsPerDay = 1;
+    saveSettings(settings);
+    const ok = fakeCrawlproof([]).fetcher;
+    const capped = await sendNewsletter("i1", { server: smtp(port), tracking, fetcher: ok });
+    expect(capped.sent).toHaveLength(1);
+    const raised = await sendNewsletter("i1", { server: smtp(port), tracking, fetcher: ok, maxPerDay: 10 });
+    expect(raised.sent).toHaveLength(2);
+    expect(raised.status).toBe("sent");
+  } finally {
+    await fake.close();
+  }
+});
+
+test("--to: one tracked test copy as variant A, outside the ledger; an opted-out address is refused", async () => {
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", [{ email: "one@example.com" }]);
+    createNewsletter({ id: "moshcode-001", subject: "Subject A", subjectB: "Subject B", ctaSet: "default", body: "Hi {{cta}}", list: "moshcode-users" });
+    const lines: string[] = [];
+    const copy = await sendNewsletter("moshcode-001", { server: smtp(port), tracking, test: "owner@profullstack.com", log: (line) => lines.push(line) });
+    expect(copy.sent).toEqual(["owner@profullstack.com"]);
+    expect(lines.some((line) => line.includes("as variant A"))).toBe(true);
+    const data = fake.messages[0]!.data;
+    expect(data).toContain("Subject: [test] Subject A");
+    expect(data).toContain("Book a demo");
+    expect(data).toContain("&amp;v=A");
+    expect(data).toContain(`${BASE}/u?`);
+    expect(readNewsletters().deliveries["moshcode-001"]).toBeUndefined();
+    expect(requireNewsletter("moshcode-001").status).toBe("draft");
+
+    const { fetcher } = fakeCrawlproof([{ type: "unsubscribe", email: "owner@profullstack.com", at: "2026-09-24T00:00:00.000Z" }]);
+    expect((await syncTrackingUnsubscribes(tracking, { fetcher })).optedOut).toEqual(["owner@profullstack.com"]);
+    await expect(sendNewsletter("moshcode-001", { server: smtp(port), tracking, test: "owner@profullstack.com" })).rejects.toThrow(/opted out/);
+  } finally {
+    await fake.close();
+  }
+});
+
+test("events follow `next` as an absolute URL; an unsubscribe without an email is found by msgId", async () => {
+  subscribe("moshcode-users", [{ email: "one@example.com" }, { email: "two@example.com" }]);
+  createNewsletter({ id: "i1", subject: "S", body: "b", list: "moshcode-users" });
+  const file = readNewsletters();
+  file.deliveries.i1 = { "one@example.com": { state: "sent", at: "2026-09-21T00:00:00.000Z", to: "one@example.com", msgId: "m-one", variant: "A" } };
+  (await import("../src/store/newsletters.ts")).writeNewsletters(file);
+  const events: TrackingEvent[] = [
+    { type: "unsubscribe", m: "m-one", c: "i1", at: "2026-09-22T00:00:00.000Z" },
+    ...Array.from({ length: 5 }, (_, i) => ({ type: "unsubscribe", email: `stranger${i}@example.com`, at: `2026-09-23T00:00:0${i}.000Z` })),
+  ];
+  const crawlproof = fakeCrawlproof(events, { pageSize: 2 });
+  expect(await fetchTrackingEvents(tracking, { fetcher: crawlproof.fetcher })).toHaveLength(6);
+  expect(crawlproof.calls).toHaveLength(3);
+  expect(crawlproof.calls[1]?.url).toContain("cursor=2");
+  const synced = await syncTrackingUnsubscribes(tracking, { fetcher: fakeCrawlproof(events).fetcher });
+  expect(synced.optedOut).toContain("one@example.com");
+  expect(synced.optedOut).toHaveLength(6);
+  expect(recipients({ list: "moshcode-users" }).map((c) => c.id)).toEqual(["two@example.com"]);
+  expect(readNewsletters().trackingSince).toBe("2026-09-23T00:00:04.000Z");
+});
+
+test("stats join events to variants by msgId: human opens, all opens, human clicks, CTR, unsubscribes, a leader", () => {
+  const d = (msgId: string, variant: string, state: "sent" | "failed" = "sent") => ({ state, at: "2026-09-24T00:00:00.000Z", to: `${msgId}@x.co`, msgId, variant, subjectKey: variant === "A" ? "A" : "B", cta: "Book a demo" });
+  const deliveries = { a1: d("a1", "A"), a2: d("a2", "A"), b1: d("b1", "B"), b2: d("b2", "B"), f1: d("f1", "B", "failed") };
+  const at = "2026-09-24T01:00:00.000Z";
+  const events: TrackingEvent[] = [
+    { type: "open", m: "a1", at },
+    { type: "open", m: "a1", at },
+    { type: "open", m: "a2", machine: true, at },
+    { type: "open", m: "b1", at },
+    { type: "click", m: "b1", url: "https://profullstack.com/book", at },
+    { type: "click", m: "b1", url: "https://profullstack.com/book", at },
+    { type: "click", m: "a2", machine: true, at },
+    { type: "unsubscribe", m: "b2", at },
+    { type: "open", m: "test-copy", at },
+  ];
+  const stats = newsletterStats("i1", events, deliveries);
+  expect(stats.rows).toEqual([
+    { variant: "A", subjectKey: "A", cta: "Book a demo", sent: 2, opens: 1, opensTotal: 2, clicks: 0, ctr: 0, unsubscribes: 0 },
+    { variant: "B", subjectKey: "B", cta: "Book a demo", sent: 2, opens: 1, opensTotal: 1, clicks: 1, ctr: 0.5, unsubscribes: 1 },
+  ]);
+  expect(stats).toMatchObject({ leader: "B", basis: "clicks" });
+  expect(newsletterStats("i1", events.filter((e) => e.type === "open"), deliveries)).toMatchObject({ leader: "A", basis: "opens" });
+  expect(newsletterStats("i1", [], deliveries).leader).toBeNull();
+});
+
+test("a line past 998 octets goes quoted-printable, and decodes back to itself", () => {
+  const long = `<p>${"x".repeat(1200)} = done é</p>\n.dot line `;
+  const encoded = quotedPrintable(long);
+  for (const line of encoded.split("\n")) expect(line.length).toBeLessThanOrEqual(76);
+  const decoded = Buffer.from(
+    encoded.replace(/=\n/g, "").replace(/=([0-9A-F]{2})/g, (_, hex: string) => String.fromCharCode(Number.parseInt(hex, 16))),
+    "latin1",
+  ).toString("utf8");
+  expect(decoded).toBe(long);
+  const mime = buildMime({ id: "t", host: "h", port: 25, secure: "none", user: "", from: "a@b.c" }, { to: ["d@e.f"], subject: "s", text: "short", html: long }, "<id@b.c>");
+  expect(mime).toContain("Content-Transfer-Encoding: quoted-printable");
+  expect(mime).toContain("Content-Transfer-Encoding: 8bit");
+});
+
+test("settings: tracking off by default, the default CTA set, copied rather than shared", () => {
+  const settings = loadSettings();
+  expect(settings.newsletter.trackingId).toBe("");
+  expect(settings.newsletter.paceMs).toBe(1000);
+  expect(settings.newsletter.ctaSets.default?.map((cta) => cta.label)).toEqual(["Book a demo", "Schedule a call", "See our plans", "Support us"]);
+  settings.newsletter.ctaSets.default!.push({ label: "x", url: "https://x" });
+  expect(loadSettings().newsletter.ctaSets.default).toHaveLength(4);
+});

From fb4cf5671fd50dbeae7485eac2605c720c6a4759 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 24 Sep 2026 05:29:46 +0000
Subject: [PATCH 2/4] newsletter: fail closed when the myna cloud unsubscribe
 pull fails

A list send, the daemon's newsletter job and myna newsletter sync now
treat a failed myna cloud pull the way they already treated crawlproof:
the send stops before anyone is mailed, the daemon job fails that turn,
and sync exits 1. syncAllUnsubscribes tries every configured source and
names each that failed. A --to test copy still goes out, with a warning.
Error text is plain; the HTTP helper's dash is shown as a colon.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md                                     |   7 +-
 apps/cli/src/cli/newsletter.ts                |  18 ++-
 packages/core/src/core/daemon.ts              |   3 +-
 packages/core/src/core/newsletter.ts          |  69 ++++++++----
 packages/core/src/index.ts                    |   2 +
 .../core/test/newsletter-tracking.test.ts     | 105 ++++++++++++++++++
 6 files changed, 176 insertions(+), 28 deletions(-)

diff --git a/README.md b/README.md
index 97e422d..a0977c9 100644
--- a/README.md
+++ b/README.md
@@ -938,8 +938,11 @@ myna newsletter cta list | add "<label>" <url> | rm "<label>"   [--set name]
   have an account at moshcode; our Terms say we may email news and updates."
   instead of "you subscribed to <list>", for a list of your users.
 - **Unsubscribes.** Before every send, myna pulls unsubscribes from every source
-  that is set up and makes them permanent opt-outs. If crawlproof cannot be
-  read, a tracked send refuses to go.
+  that is set up (the myna cloud inbox, and crawlproof when tracking is on) and
+  applies them. Both fail closed: if either cannot be read, a list send stops
+  before anyone is mailed, the daemon sends nothing that turn, and
+  `myna newsletter sync` exits non-zero. A `--to` test copy still goes out,
+  with a warning.
 - **Stats.** Events are joined to variants through each recipient's msgId in
   `newsletters.json`. Opens and clicks count unique messages, with machine-flagged
   ones (mail proxies, scanners, Apple's prefetch) left out; all opens are shown
diff --git a/apps/cli/src/cli/newsletter.ts b/apps/cli/src/cli/newsletter.ts
index 81b4ecf..7fbb296 100644
--- a/apps/cli/src/cli/newsletter.ts
+++ b/apps/cli/src/cli/newsletter.ts
@@ -458,13 +458,21 @@ export async function runNewsletter(positional: string[], flags: Flags): Promise
     case "sync-optouts": {
       const result = await syncAllUnsubscribes();
       const cloud = result.cloud;
-      out(
-        `myna cloud: ${cloud.pulled} change${cloud.pulled === 1 ? "" : "s"} read: ${cloud.optedOut.length} newly unsubscribed, ${cloud.resubscribed.length} re-subscribed` +
-          `${cloud.unknown ? `, ${cloud.unknown} for tokens this install never sent` : ""}.`,
-      );
-      if (result.tracking)
+      const failed = (source: string): string | undefined => result.errors.find((line) => line.startsWith(source));
+      if (failed("myna cloud")) out(`myna cloud: FAILED, ${failed("myna cloud")}`);
+      else
+        out(
+          `myna cloud: ${cloud.pulled} change${cloud.pulled === 1 ? "" : "s"} read: ${cloud.optedOut.length} newly unsubscribed, ${cloud.resubscribed.length} re-subscribed` +
+            `${cloud.unknown ? `, ${cloud.unknown} for tokens this install never sent` : ""}.`,
+        );
+      if (failed("crawlproof")) out(`crawlproof: FAILED, ${failed("crawlproof")}`);
+      else if (result.tracking)
         out(`crawlproof: ${result.tracking.pulled} unsubscribe${result.tracking.pulled === 1 ? "" : "s"} read, ${result.tracking.optedOut.length} newly opted out${result.tracking.optedOut.length ? `: ${result.tracking.optedOut.join(", ")}` : ""}.`);
       else out("crawlproof: tracking is off.");
+      if (result.errors.length) {
+        out(`Could not read unsubscribes from ${result.errors.join(" or ")}. Sends stay stopped until this works.`);
+        return 1;
+      }
       return 0;
     }
 
diff --git a/packages/core/src/core/daemon.ts b/packages/core/src/core/daemon.ts
index dc2565d..2801753 100644
--- a/packages/core/src/core/daemon.ts
+++ b/packages/core/src/core/daemon.ts
@@ -16,7 +16,7 @@ import { pluginContext } from "../plugins/context.ts";
 import { runEvergreen } from "./evergreen.ts";
 import { runRecap } from "./recap.ts";
 import { canSync, syncConfigOnce } from "../store/synconfig.ts";
-import { runDueNewsletters, syncAllUnsubscribes } from "./newsletter.ts";
+import { runDueNewsletters, syncAllUnsubscribes, unsubscribePullError } from "./newsletter.ts";
 import { readNewsletters } from "../store/newsletters.ts";
 
 export interface DaemonJob {
@@ -70,6 +70,7 @@ export function builtinJobs(log: (line: string) => void, tickMs: number): Daemon
     async run() {
       if (!readNewsletters().newsletters.some((entry) => entry.scheduledFor && entry.status !== "sent")) {
         const synced = await syncAllUnsubscribes();
+        if (synced.errors.length) throw unsubscribePullError(synced.errors);
         const out = synced.cloud.optedOut.length + (synced.tracking?.optedOut.length ?? 0);
         if (out || synced.cloud.resubscribed.length) return `${out} unsubscribed, ${synced.cloud.resubscribed.length} re-subscribed`;
         return;
diff --git a/packages/core/src/core/newsletter.ts b/packages/core/src/core/newsletter.ts
index 4c56e34..5f66c9e 100644
--- a/packages/core/src/core/newsletter.ts
+++ b/packages/core/src/core/newsletter.ts
@@ -641,6 +641,12 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
   if (options.test) {
     const variant = variants[0] as Variant;
     log(`Test copy to ${options.test} as variant ${variant.key} (subject ${variant.subjectKey}${variant.cta ? `, CTA "${variant.cta.label}"` : ""}).`);
+    if (!options.dryRun) {
+      // One copy to yourself may go out without the pull; a list send may not.
+      const synced = await syncAllUnsubscribes({ tracking: tracking ?? null, fetcher: options.fetcher });
+      if (synced.errors.length)
+        log(`warning: could not read unsubscribes from ${synced.errors.join(" or ")}. The test copy goes out anyway; a list send would stop here until they are applied.`);
+    }
     const known = readContacts().contacts.find((c) => c.id === options.test!.trim().toLowerCase());
     if (known?.optedOut) throw new Error(`${options.test} has opted out. It is never written to again.`);
     const server = options.server ?? smtpServer(newsletter.smtp ?? undefined);
@@ -667,22 +673,14 @@ export async function sendNewsletter(id: string, options: SendNewsletterOptions
     return report;
   }
 
+  // Fail closed: a list send never goes out while any unsubscribe source that
+  // is set up could not be read, so nobody who left is written to again.
   if (!options.dryRun) {
-    try {
-      const synced = await syncUnsubscribes();
-      if (synced.optedOut.length) log(`${synced.optedOut.length} unsubscribed since the last send: ${synced.optedOut.join(", ")}`);
-    } catch (error) {
-      log(`warning: could not read unsubscribes from myna cloud (${(error as Error).message}); sending to the list as it stands.`);
-    }
-    if (tracking) {
-      // The tracked link is the one people press, so a send never goes without its unsubscribes.
-      try {
-        const synced = await syncTrackingUnsubscribes(tracking, { fetcher: options.fetcher });
-        if (synced.optedOut.length) log(`${synced.optedOut.length} unsubscribed through crawlproof: ${synced.optedOut.join(", ")}`);
-      } catch (error) {
-        throw new Error(`Could not read unsubscribes from crawlproof (${(error as Error).message}); not sending until they are applied.`);
-      }
-    }
+    const synced = await syncAllUnsubscribes({ tracking: tracking ?? null, fetcher: options.fetcher });
+    if (synced.errors.length) throw unsubscribePullError(synced.errors);
+    if (synced.cloud.optedOut.length) log(`${synced.cloud.optedOut.length} unsubscribed since the last send: ${synced.cloud.optedOut.join(", ")}`);
+    if (synced.cloud.resubscribed.length) log(`${synced.cloud.resubscribed.length} re-subscribed: ${synced.cloud.resubscribed.join(", ")}`);
+    if (synced.tracking?.optedOut.length) log(`${synced.tracking.optedOut.length} unsubscribed through crawlproof: ${synced.tracking.optedOut.join(", ")}`);
   }
 
   const ledger = readNewsletters().deliveries[newsletter.id] ?? {};
@@ -853,12 +851,43 @@ export async function fetchNewsletterStats(id: string, tracking: Tracking, optio
   return newsletterStats(newsletter.id, events.filter((event) => !event.c || event.c === newsletter.id), deliveries);
 }
 
-/** Every unsubscribe source that is set up: myna cloud's hosted link, and crawlproof tracking. */
-export async function syncAllUnsubscribes(options: { tracking?: Tracking | null; fetcher?: Fetch } = {}): Promise<{ cloud: SyncResult; tracking: TrackingSyncResult | null }> {
+/** An error's message as plain text for a refusal: the HTTP helper's dash becomes a colon. */
+const plainError = (error: unknown): string => (error as Error).message.replace(/\s*—\s*/g, ": ");
+
+export interface AllSyncResult {
+  cloud: SyncResult;
+  tracking: TrackingSyncResult | null;
+  /** One line per source that could not be read, e.g. "myna cloud (503)". Empty when every pull worked. */
+  errors: string[];
+}
+
+/**
+ * Every unsubscribe source that is set up: myna cloud's hosted link, and
+ * crawlproof tracking. Both are tried; a source that fails is named in
+ * `errors` rather than thrown, so the caller decides, and every caller that
+ * sends treats any error as a reason not to.
+ */
+export async function syncAllUnsubscribes(options: { tracking?: Tracking | null; fetcher?: Fetch } = {}): Promise<AllSyncResult> {
   const tracking = options.tracking === undefined ? newsletterTracking() : (options.tracking ?? undefined);
-  const cloud = await syncUnsubscribes();
-  const tracked = tracking ? await syncTrackingUnsubscribes(tracking, { fetcher: options.fetcher }) : null;
-  return { cloud, tracking: tracked };
+  const result: AllSyncResult = { cloud: { pulled: 0, optedOut: [], resubscribed: [], unknown: 0 }, tracking: null, errors: [] };
+  try {
+    result.cloud = await syncUnsubscribes();
+  } catch (error) {
+    result.errors.push(`myna cloud (${plainError(error)})`);
+  }
+  if (tracking) {
+    try {
+      result.tracking = await syncTrackingUnsubscribes(tracking, { fetcher: options.fetcher });
+    } catch (error) {
+      result.errors.push(`crawlproof (${plainError(error)})`);
+    }
+  }
+  return result;
+}
+
+/** The refusal a send gives when an unsubscribe source could not be read. */
+export function unsubscribePullError(errors: string[]): Error {
+  return new Error(`Could not read unsubscribes from ${errors.join(" or ")}; not sending until they are applied.`);
 }
 
 /**
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index fb740cc..cddc18c 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -471,6 +471,8 @@ export {
   fetchTrackingEvents,
   syncTrackingUnsubscribes,
   syncAllUnsubscribes,
+  unsubscribePullError,
+  type AllSyncResult,
   buildVariants,
   variantIndex,
   variantsFor,
diff --git a/packages/core/test/newsletter-tracking.test.ts b/packages/core/test/newsletter-tracking.test.ts
index 43a0118..ecccacc 100644
--- a/packages/core/test/newsletter-tracking.test.ts
+++ b/packages/core/test/newsletter-tracking.test.ts
@@ -362,3 +362,108 @@ test("settings: tracking off by default, the default CTA set, copied rather than
   settings.newsletter.ctaSets.default!.push({ label: "x", url: "https://x" });
   expect(loadSettings().newsletter.ctaSets.default).toHaveLength(4);
 });
+
+// ---------------------------------------------------------------- fail closed on myna cloud too
+
+/** A signed-in install whose myna cloud unsubscribe inbox answers 503. */
+async function cloudDown(): Promise<() => void> {
+  const { saveSession } = await import("../src/store/cloud.ts");
+  const { writeNewsletters } = await import("../src/store/newsletters.ts");
+  saveSession({ server: "https://myna.test/api", email: "me@example.com", token: "tok", since: new Date().toISOString() });
+  const file = readNewsletters();
+  file.inbox = { id: "INBOXINBOXINBOX1", server: "https://myna.test/api" };
+  writeNewsletters(file);
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = (async () => new Response("unavailable", { status: 503 })) as unknown as typeof fetch;
+  return () => {
+    globalThis.fetch = realFetch;
+  };
+}
+
+test("a failed myna cloud pull stops a list send before anyone is mailed, tracked or not", async () => {
+  const restore = await cloudDown();
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", [{ email: "one@example.com" }, { email: "two@example.com" }]);
+    createNewsletter({ id: "i1", subject: "S", body: "b", list: "moshcode-users" });
+    await expect(sendNewsletter("i1", { server: smtp(port), tracking: null })).rejects.toThrow(/^Could not read unsubscribes from myna cloud \(.*503.*\); not sending until they are applied\.$/);
+    // With crawlproof working, the cloud failure still stops it.
+    await expect(sendNewsletter("i1", { server: smtp(port), tracking, fetcher: fakeCrawlproof([]).fetcher })).rejects.toThrow(/myna cloud/);
+    // Both down: both named.
+    await expect(sendNewsletter("i1", { server: smtp(port), tracking, fetcher: fakeCrawlproof([], { status: 503 }).fetcher })).rejects.toThrow(/myna cloud .* or crawlproof \(crawlproof events: 503\)/);
+    expect(fake.messages).toHaveLength(0);
+    expect(readNewsletters().deliveries.i1).toBeUndefined();
+    expect(requireNewsletter("i1").status).toBe("draft");
+  } finally {
+    restore();
+    await fake.close();
+  }
+});
+
+test("the daemon fails closed too: a due issue is not sent, and the idle pull reports the failure", async () => {
+  const restore = await cloudDown();
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", [{ email: "one@example.com" }]);
+    createNewsletter({ id: "due", subject: "Due", body: "d", list: "moshcode-users", scheduledFor: new Date(Date.now() - 60_000).toISOString() });
+    const { runDueNewsletters } = await import("../src/core/newsletter.ts");
+    await expect(runDueNewsletters(new Date(), { server: smtp(port), tracking: null })).rejects.toThrow(/myna cloud/);
+    expect(fake.messages).toHaveLength(0);
+    expect(requireNewsletter("due").status).toBe("scheduled");
+
+    const { builtinJobs } = await import("../src/core/daemon.ts");
+    const job = builtinJobs(() => undefined, 1000).find((entry) => entry.id === "newsletter")!;
+    await expect(job.run()).rejects.toThrow(/not sending until they are applied/);
+    expect(fake.messages).toHaveLength(0);
+    // With nothing scheduled, the job's own pull still fails loudly rather than quietly.
+    const { writeNewsletters } = await import("../src/store/newsletters.ts");
+    const file = readNewsletters();
+    file.newsletters = [];
+    writeNewsletters(file);
+    await expect(job.run()).rejects.toThrow(/Could not read unsubscribes from myna cloud/);
+  } finally {
+    restore();
+    await fake.close();
+  }
+});
+
+test("a --to test copy still goes out when a pull fails, with a warning", async () => {
+  const restore = await cloudDown();
+  const fake = fakeSmtp();
+  const port = await fake.listen();
+  try {
+    subscribe("moshcode-users", [{ email: "one@example.com" }]);
+    createNewsletter({ id: "i1", subject: "S", body: "b", list: "moshcode-users" });
+    const lines: string[] = [];
+    const copy = await sendNewsletter("i1", { server: smtp(port), tracking, fetcher: fakeCrawlproof([]).fetcher, test: "owner@profullstack.com", log: (line) => lines.push(line) });
+    expect(copy.sent).toEqual(["owner@profullstack.com"]);
+    expect(fake.messages).toHaveLength(1);
+    expect(lines.some((line) => line.startsWith("warning: could not read unsubscribes from myna cloud") && line.includes("a list send would stop here"))).toBe(true);
+    for (const line of lines) expect(line).not.toContain("—");
+  } finally {
+    restore();
+    await fake.close();
+  }
+});
+
+test("syncAllUnsubscribes tries every source and names each that failed", async () => {
+  const restore = await cloudDown();
+  try {
+    const { syncAllUnsubscribes } = await import("../src/core/newsletter.ts");
+    const result = await syncAllUnsubscribes({
+      tracking,
+      fetcher: fakeCrawlproof([{ type: "unsubscribe", email: "x@example.com", at: "2026-09-24T00:00:00.000Z" }]).fetcher,
+    });
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]).toMatch(/^myna cloud \(/);
+    // crawlproof still ran and applied its opt-out.
+    expect(result.tracking?.optedOut).toEqual(["x@example.com"]);
+    const none = await syncAllUnsubscribes({ tracking: null });
+    expect(none.errors).toHaveLength(1);
+    expect(none.tracking).toBeNull();
+  } finally {
+    restore();
+  }
+});

From fc07975fae062884dd490e8c648ef29f6f664a1e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 24 Sep 2026 05:30:17 +0000
Subject: [PATCH 3/4] newsletter: spell the dash as \u2014 in source, not as
 the character

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/core/src/core/newsletter.ts           | 2 +-
 packages/core/test/newsletter-tracking.test.ts | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/core/newsletter.ts b/packages/core/src/core/newsletter.ts
index 5f66c9e..b7bd0f5 100644
--- a/packages/core/src/core/newsletter.ts
+++ b/packages/core/src/core/newsletter.ts
@@ -852,7 +852,7 @@ export async function fetchNewsletterStats(id: string, tracking: Tracking, optio
 }
 
 /** An error's message as plain text for a refusal: the HTTP helper's dash becomes a colon. */
-const plainError = (error: unknown): string => (error as Error).message.replace(/\s*—\s*/g, ": ");
+const plainError = (error: unknown): string => (error as Error).message.replace(/\s*\u2014\s*/g, ": ");
 
 export interface AllSyncResult {
   cloud: SyncResult;
diff --git a/packages/core/test/newsletter-tracking.test.ts b/packages/core/test/newsletter-tracking.test.ts
index ecccacc..7ad6267 100644
--- a/packages/core/test/newsletter-tracking.test.ts
+++ b/packages/core/test/newsletter-tracking.test.ts
@@ -174,8 +174,8 @@ test("a tracked message: CTA where {{cta}} was, every link signed, the pixel, cr
   expect(message.headers?.["List-Unsubscribe"]).toBe(`<${link}>, <mailto:news@profullstack.com?subject=unsubscribe%20tok>`);
   expect(message.headers?.["List-Unsubscribe-Post"]).toBe("List-Unsubscribe=One-Click");
   expect(message.headers?.Precedence).toBe("bulk");
-  expect(message.text).not.toContain("—");
-  expect(message.html).not.toContain("—");
+  expect(message.text).not.toContain("\u2014");
+  expect(message.html).not.toContain("\u2014");
 });
 
 test("without {{cta}} the CTA goes last before the footer; with no CTA a stray marker is dropped; untracked links stay as they are", () => {
@@ -441,7 +441,7 @@ test("a --to test copy still goes out when a pull fails, with a warning", async
     expect(copy.sent).toEqual(["owner@profullstack.com"]);
     expect(fake.messages).toHaveLength(1);
     expect(lines.some((line) => line.startsWith("warning: could not read unsubscribes from myna cloud") && line.includes("a list send would stop here"))).toBe(true);
-    for (const line of lines) expect(line).not.toContain("—");
+    for (const line of lines) expect(line).not.toContain("\u2014");
   } finally {
     restore();
     await fake.close();

From e8d38827c839b5b72a86e72f2bd3864704ca0ab6 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 24 Sep 2026 05:32:25 +0000
Subject: [PATCH 4/4] newsletter: the newest opt-out or re-subscribe wins
 across both sources

newsletters.json keeps, per contact, the newest unsubscribe or
re-subscribe applied from myna cloud or crawlproof, with the source's
timestamp. A pulled event older than that is skipped, so a myna cloud
re-subscribe is not undone by an older crawlproof unsubscribe that
arrives in the same or a later pull, and the reverse.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md                                     |  4 +-
 packages/core/src/core/newsletter.ts          |  5 ++
 packages/core/src/store/newsletters.ts        | 29 +++++++++++
 .../core/test/newsletter-tracking.test.ts     | 51 +++++++++++++++++++
 4 files changed, 88 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a0977c9..057d15f 100644
--- a/README.md
+++ b/README.md
@@ -942,7 +942,9 @@ myna newsletter cta list | add "<label>" <url> | rm "<label>"   [--set name]
   applies them. Both fail closed: if either cannot be read, a list send stops
   before anyone is mailed, the daemon sends nothing that turn, and
   `myna newsletter sync` exits non-zero. A `--to` test copy still goes out,
-  with a warning.
+  with a warning. When one person has both a myna cloud re-subscribe and a
+  crawlproof unsubscribe, the one with the later timestamp wins, whichever
+  arrives first.
 - **Stats.** Events are joined to variants through each recipient's msgId in
   `newsletters.json`. Opens and clicks count unique messages, with machine-flagged
   ones (mail proxies, scanners, Apple's prefetch) left out; all opens are shown
diff --git a/packages/core/src/core/newsletter.ts b/packages/core/src/core/newsletter.ts
index b7bd0f5..724a73a 100644
--- a/packages/core/src/core/newsletter.ts
+++ b/packages/core/src/core/newsletter.ts
@@ -37,6 +37,7 @@ import { outreachSentToday, recordSent, smtpServer } from "../store/outreach.ts"
 import { getPluginSecrets } from "../store/accounts.ts";
 import { session, DEFAULT_SERVER } from "../store/cloud.ts";
 import {
+  claimOptChange,
   contactForToken,
   readNewsletters,
   recordDelivery,
@@ -178,6 +179,8 @@ export async function syncTrackingUnsubscribes(tracking: Tracking, options: { fe
     const contacts = readContacts();
     const id = contactId({ email }) as string;
     const contact = contacts.contacts.find((entry) => entry.id === id || entry.email?.toLowerCase() === email);
+    // A myna cloud re-subscribe newer than this unsubscribe wins; see claimOptChange.
+    if (!claimOptChange(contact?.id ?? id, { state: "unsubscribed", at: event.at, source: "crawlproof" })) continue;
     if (contact?.optedOut) continue;
     if (contact) optOut(contact.id, contacts);
     else {
@@ -378,6 +381,8 @@ export async function syncUnsubscribes(): Promise<SyncResult> {
     }
     const contact = contacts.contacts.find((c) => c.id === id);
     if (!contact) continue;
+    // An older event than the last one applied for this person, from either source, is stale.
+    if (!claimOptChange(id, { state: entry.state === "resubscribed" ? "resubscribed" : "unsubscribed", at: entry.at, source: "cloud" })) continue;
     if (entry.state === "resubscribed") {
       if (optIn(id, contacts)) result.resubscribed.push(id);
     } else if (!contact.optedOut && optOut(id, contacts)) result.optedOut.push(id);
diff --git a/packages/core/src/store/newsletters.ts b/packages/core/src/store/newsletters.ts
index b1ccb63..670f234 100644
--- a/packages/core/src/store/newsletters.ts
+++ b/packages/core/src/store/newsletters.ts
@@ -79,6 +79,20 @@ export interface NewslettersFile {
   unsubscribesSince: string | null;
   /** The newest unsubscribe already pulled from crawlproof tracking. */
   trackingSince: string | null;
+  /**
+   * contact id → the newest unsubscribe or re-subscribe applied from either
+   * source, with the time the source recorded it. A pulled event older than
+   * this is stale and skipped, so a myna cloud re-subscribe is never undone by
+   * an older crawlproof unsubscribe that arrives later, or the reverse.
+   */
+  optChanges: Record<string, OptChange>;
+}
+
+export interface OptChange {
+  state: "unsubscribed" | "resubscribed";
+  /** When the source recorded it (its own clock), ISO. */
+  at: string;
+  source: "cloud" | "crawlproof";
 }
 
 export function readNewsletters(): NewslettersFile {
@@ -90,6 +104,7 @@ export function readNewsletters(): NewslettersFile {
     inbox: file.inbox ?? null,
     unsubscribesSince: file.unsubscribesSince ?? null,
     trackingSince: file.trackingSince ?? null,
+    optChanges: file.optChanges ?? {},
   };
 }
 
@@ -97,6 +112,20 @@ export function writeNewsletters(file: NewslettersFile): void {
   writeJson(NEWSLETTERS_FILE, file);
 }
 
+/**
+ * Whether an unsubscribe or re-subscribe pulled from a source is newer than
+ * the last one applied for that contact; if so it is recorded, and the caller
+ * applies it. Timestamps compare as instants, not strings.
+ */
+export function claimOptChange(contactId: string, change: OptChange): boolean {
+  const file = readNewsletters();
+  const last = file.optChanges[contactId];
+  if (last && Date.parse(change.at) < Date.parse(last.at)) return false;
+  file.optChanges[contactId] = change;
+  writeNewsletters(file);
+  return true;
+}
+
 /** One line: a subject or an address with a newline in it is a header injection. */
 const oneLine = (value: string): string => value.replace(/[\r\n]+/g, " ").trim();
 
diff --git a/packages/core/test/newsletter-tracking.test.ts b/packages/core/test/newsletter-tracking.test.ts
index 7ad6267..b22864a 100644
--- a/packages/core/test/newsletter-tracking.test.ts
+++ b/packages/core/test/newsletter-tracking.test.ts
@@ -448,6 +448,57 @@ test("a --to test copy still goes out when a pull fails, with a warning", async
   }
 });
 
+test("the newest unsubscribe or re-subscribe wins across myna cloud and crawlproof, whichever arrives first", async () => {
+  const { saveSession } = await import("../src/store/cloud.ts");
+  const { writeNewsletters, tokenFor } = await import("../src/store/newsletters.ts");
+  const { syncAllUnsubscribes } = await import("../src/core/newsletter.ts");
+  saveSession({ server: "https://myna.test/api", email: "me@example.com", token: "tok", since: new Date().toISOString() });
+  const file = readNewsletters();
+  file.inbox = { id: "INBOXINBOXINBOX1", server: "https://myna.test/api" };
+  writeNewsletters(file);
+  subscribe("moshcode-users", ["ada", "bob", "cy", "di"].map((x) => ({ email: `${x}@example.com` })));
+  const token = (who: string): string => tokenFor(`${who}@example.com`);
+  let cloudRows: { token: string; at: string; state: "unsubscribed" | "resubscribed" }[] = [];
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = (async () => Response.json({ ok: true, unsubscribes: cloudRows })) as unknown as typeof fetch;
+  const out = (who: string): boolean => Boolean(readContacts().contacts.find((c) => c.id === `${who}@example.com`)?.optedOut);
+  try {
+    // One pull, both sources: ada unsubscribed through crawlproof at 10:00, re-subscribed on the cloud page at 11:00.
+    // bob re-subscribed on the cloud page at 10:00 (after an earlier cloud unsubscribe), then unsubscribed through crawlproof at 11:00.
+    cloudRows = [
+      { token: token("bob"), at: "2026-09-24T09:00:00.000Z", state: "unsubscribed" },
+      { token: token("bob"), at: "2026-09-24T10:00:00.000Z", state: "resubscribed" },
+      { token: token("ada"), at: "2026-09-24T11:00:00.000Z", state: "resubscribed" },
+    ];
+    await syncAllUnsubscribes({
+      tracking,
+      fetcher: fakeCrawlproof([
+        { type: "unsubscribe", email: "ada@example.com", at: "2026-09-24T10:00:00.000Z" },
+        { type: "unsubscribe", email: "bob@example.com", at: "2026-09-24T11:00:00.000Z" },
+      ]).fetcher,
+    });
+    expect(out("ada")).toBe(false);
+    expect(out("bob")).toBe(true);
+
+    // Across pulls: cy re-subscribes on the cloud page at 12:00; crawlproof's older 11:30 unsubscribe arrives a pull later.
+    cloudRows = [{ token: token("cy"), at: "2026-09-24T12:00:00.000Z", state: "resubscribed" }];
+    await syncAllUnsubscribes({ tracking, fetcher: fakeCrawlproof([]).fetcher });
+    await syncAllUnsubscribes({ tracking, fetcher: fakeCrawlproof([{ type: "unsubscribe", email: "cy@example.com", at: "2026-09-24T11:30:00.000Z" }]).fetcher });
+    expect(out("cy")).toBe(false);
+
+    // The reverse: di unsubscribes through crawlproof at 13:00; an older 12:30 cloud re-subscribe arrives later and does not lift it.
+    cloudRows = [];
+    await syncAllUnsubscribes({ tracking, fetcher: fakeCrawlproof([{ type: "unsubscribe", email: "di@example.com", at: "2026-09-24T13:00:00.000Z" }]).fetcher });
+    expect(out("di")).toBe(true);
+    cloudRows = [{ token: token("di"), at: "2026-09-24T12:30:00.000Z", state: "resubscribed" }];
+    await syncAllUnsubscribes({ tracking, fetcher: fakeCrawlproof([]).fetcher });
+    expect(out("di")).toBe(true);
+    expect(readNewsletters().optChanges["di@example.com"]).toEqual({ state: "unsubscribed", at: "2026-09-24T13:00:00.000Z", source: "crawlproof" });
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+});
+
 test("syncAllUnsubscribes tries every source and names each that failed", async () => {
   const restore = await cloudDown();
   try {