ghost 6.63.0 → 6.65.0

package/core/server/services/email-analytics/jobs/email-analytics-job-scheduler.js

@@ -47,10 +47,11 @@ function randomFiveMinuteCron() {
     const minutes = Math.floor(Math.random() * 5); // 0-4
     return `${seconds} ${minutes}/5 * * * *`;
 }
+function thirtyDaysAgo() {
+    return moment_1.default.utc().subtract(30, 'days').toDate();
+}
 class EmailAnalyticsJobScheduler {
-    #hasScheduledNewslettersJob = false;
-    #hasScheduledAutomationsJob = false;
-    #hasScheduledGiftDeliveriesJob = false;
+    #scheduledJobNames = new Set();
     #models;
     #config;
     #jobManager;
@@ -64,76 +65,46 @@ class EmailAnalyticsJobScheduler {
             this.#config.get('backgroundJobs:emailAnalytics'));
     }
     async scheduleRecurringNewslettersJob(skipNewsletterEmailCheck = false) {
-        if (this.#hasScheduledNewslettersJob) {
-            return;
-        }
-        if (!this.#isConfigured()) {
-            return;
-        }
         // Don't register email analytics job if we have no emails,
         // processor usage from many sites spinning up threads can be high.
         // Mega service will re-run this scheduling task when an email is sent
-        const emailCount = skipNewsletterEmailCheck
-            ? 1
-            : Number(await this.#models.Email.where('created_at', '>', moment_1.default.utc().subtract(30, 'days').toDate())
-                .where('status', '<>', 'failed')
-                .count());
-        if (emailCount > 0 && !this.#hasScheduledNewslettersJob) {
-            const at = randomFiveMinuteCron();
-            logging.info(`[Background Job] email-analytics-fetch-latest scheduled at ${at}`);
-            this.#jobManager.addJob({
-                at,
-                job: path.resolve(__dirname, 'fetch-latest/index.js'),
-                name: 'email-analytics-fetch-latest',
-            });
-            this.#hasScheduledNewslettersJob = true;
-        }
+        await this.#scheduleOnce({
+            name: 'email-analytics-fetch-latest',
+            workerPath: path.resolve(__dirname, 'fetch-latest/index.js'),
+        }, skipNewsletterEmailCheck, async () => Number(await this.#models.Email.where('created_at', '>', thirtyDaysAgo())
+            .where('status', '<>', 'failed')
+            .count()) > 0);
     }
     async scheduleRecurringAutomationsJob(skipAutomationEmailCheck = false) {
-        if (this.#hasScheduledAutomationsJob) {
-            return;
-        }
-        if (!this.#isConfigured()) {
-            return;
-        }
-        const hasAutomatedEmailRecipient = skipAutomationEmailCheck ||
-            Boolean(await this.#models.AutomatedEmailRecipient.query()
-                .where('created_at', '>', moment_1.default.utc().subtract(30, 'days').toDate())
-                .whereNotNull('mailgun_message_id')
-                .first('id'));
-        if (!hasAutomatedEmailRecipient || this.#hasScheduledAutomationsJob) {
-            return;
-        }
-        const at = randomFiveMinuteCron();
-        logging.info(`[Background Job] email-analytics-automation-fetch-latest scheduled at ${at}`);
-        this.#jobManager.addJob({
-            at,
-            job: path.resolve(__dirname, 'automation-fetch-latest/index.js'),
+        await this.#scheduleOnce({
             name: 'email-analytics-automation-fetch-latest',
-        });
-        this.#hasScheduledAutomationsJob = true;
+            workerPath: path.resolve(__dirname, 'automation-fetch-latest/index.js'),
+        }, skipAutomationEmailCheck, async () => Boolean(await this.#models.AutomatedEmailRecipient.query()
+            .where('created_at', '>', thirtyDaysAgo())
+            .whereNotNull('mailgun_message_id')
+            .first('id')));
     }
     async scheduleRecurringGiftDeliveriesJob(skipGiftDeliveryCheck = false) {
-        if (this.#hasScheduledGiftDeliveriesJob || !this.#isConfigured()) {
+        await this.#scheduleOnce({
+            name: 'email-analytics-gift-fetch-latest',
+            workerPath: path.resolve(__dirname, 'gift-fetch-latest/index.js'),
+        }, skipGiftDeliveryCheck, async () => Boolean(await this.#models.GiftDelivery.query()
+            .where('email_sent_at', '>', thirtyDaysAgo())
+            .whereNotNull('email_provider_message_id')
+            .first('id')));
+    }
+    async #scheduleOnce(job, skipRecentSendsCheck, hasRecentSends) {
+        if (this.#scheduledJobNames.has(job.name) || !this.#isConfigured()) {
             return;
         }
-        const hasGiftDelivery = skipGiftDeliveryCheck ||
-            Boolean(this.#models.GiftDelivery &&
-                (await this.#models.GiftDelivery.query()
-                    .where('email_sent_at', '>', moment_1.default.utc().subtract(30, 'days').toDate())
-                    .whereNotNull('email_provider_message_id')
-                    .first('id')));
-        if (!hasGiftDelivery || this.#hasScheduledGiftDeliveriesJob) {
+        const shouldSchedule = skipRecentSendsCheck || (await hasRecentSends());
+        if (!shouldSchedule || this.#scheduledJobNames.has(job.name)) {
             return;
         }
         const at = randomFiveMinuteCron();
-        logging.info(`[Background Job] email-analytics-gift-fetch-latest scheduled at ${at}`);
-        this.#jobManager.addJob({
-            at,
-            job: path.resolve(__dirname, 'gift-fetch-latest/index.js'),
-            name: 'email-analytics-gift-fetch-latest',
-        });
-        this.#hasScheduledGiftDeliveriesJob = true;
+        logging.info(`[Background Job] ${job.name} scheduled at ${at}`);
+        this.#jobManager.addJob({ at, job: job.workerPath, name: job.name });
+        this.#scheduledJobNames.add(job.name);
     }
 }
 exports.EmailAnalyticsJobScheduler = EmailAnalyticsJobScheduler;

package/core/server/services/email-rendering/finalize.js

@@ -1,4 +1,4 @@
-const cheerio = require('cheerio');
+const cheerio = require('cheerio/slim');
 const juice = require('juice');
 const htmlToPlaintext = require('@tryghost/html-to-plaintext');
 
@@ -12,7 +12,12 @@ const finalizeHtml = (html) => {
   $('figcaption').addClass('kg-card-figcaption');
   html = $.html();
 
-  const juicedHtml = juice(html, { inlinePseudoElements: true, removeStyleTags: true });
+  // resolveCSSVariables crashes on nameless declarations in user-authored style attributes
+  const juicedHtml = juice(html, {
+    inlinePseudoElements: true,
+    removeStyleTags: true,
+    resolveCSSVariables: false,
+  });
 
   // Many email clients, like Outlook and Yahoo, [lack support for <figure>
   // and <figcaption>][0]. To work around this, change the tags to <div>s.

package/core/server/services/email-service/README.md

@@ -4,6 +4,41 @@ Renders newsletter emails, splits them into recipient batches, and submits the
 batches to the configured email provider. Domain terms live in
 [CONTEXT.md](CONTEXT.md).
 
+## Job lifecycle
+
+New sends, retries, and boot recovery dispatch a data-only `SendEmailJob`
+containing the email ID through the class-based jobs service. Boot injects
+that service and registers `EmailService.handleSendEmailJob`, which delegates
+to `BatchSendingService.emailJob`. The batch sender refetches the email and
+acquires its status lock before preparing or submitting batches. See the
+[jobs guide](../../../../../../docs/codebase/jobs.md#queues) for queue isolation
+and concurrency limits.
+
+`scheduleEmail()` waits for dispatch to complete, not for submission. The
+current in-memory backend provides no durable acceptance guarantee and drops
+dispatches after shutdown starts without rejecting them. Email status records
+the sending outcome; a job handler returning does not imply submission, since
+it may have skipped the send, recorded a failure, or stopped for shutdown.
+
+Shutdown first stops workers from claiming new batches. The batch sender's
+separate cleanup task waits for active batch preparation and submission even
+if the jobs backend's shutdown wait times out. This tracking currently ends
+before the final email status write. On boot, recovery reschedules eligible
+interrupted sends within `bulkEmail:resumeMaxAgeMs` and skips batches already
+submitted.
+
+## Testing
+
+Tests that publish or retry a newsletter should mock the email provider and
+await `waitForEmailStatus(emailId)` from
+[`test/utils/batch-email-utils.js`](../../../../test/utils/batch-email-utils.js)
+before restoring mocks or deleting fixtures. The helper returns on either
+`submitted` or `failed`, so assert the expected status explicitly.
+
+A terminal email status describes the send's outcome; it does not prove that
+every competing retry or job attempting the status lock has finished. Tests
+which create competing attempts must also wait for those attempts to settle.
+
 ## Sending status
 
 The sending status served by the Admin API's `emails/:id/status` endpoint is
@@ -25,6 +60,9 @@ failed email.
 The rough ETA measures recent recipient throughput, including work completed by
 concurrent workers. It stays `null` until enough timing samples are available in
 the current phase and attempt, so short sends may finish without showing an ETA.
+The rate uses the last minute of completions, including the interval crossing
+the window boundary. Early estimates use the available history. Sparse sends
+retain at least two measured intervals.
 Progress counts update independently of the estimate.
 
 The ETA is always `null` for failed emails and `0` once no work remains in the

package/core/server/services/email-service/batch-sending-service.js

@@ -2,6 +2,7 @@ const logging = require('@tryghost/logging');
 const ObjectID = require('bson-objectid').default;
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
+const SendEmailJob = require('./jobs/send-email-job').default;
 const messages = {
   emailErrorPartialFailure:
     'An error occurred, and your newsletter was only partially sent. Please retry sending the remaining emails.',
@@ -17,7 +18,7 @@ const SHUTDOWN_CODE = 'BULK_EMAIL_SHUTDOWN_IN_PROGRESS';
  * @typedef {import('./email-renderer')} EmailRenderer
  * @typedef {import('./domain-warming-service').DomainWarmingService} DomainWarmingService
  * @typedef {import('./email-renderer').MemberLike} MemberLike
- * @typedef {object} JobsService
+ * @typedef {import('../jobs-service/jobs-service').JobsService} JobsService
  * @typedef {object} Email
  * @typedef {object} Newsletter
  * @typedef {object} Post
@@ -188,23 +189,20 @@ class BatchSendingService {
   }
 
   /**
-   * Schedules a background job that sends the email in the background if it is pending or failed.
+   * Dispatches the job that sends the email; the job itself only proceeds if the email
+   * is pending or failed.
+   * Resolves when dispatch completes, not when the email is sent.
    * @param {Email} email
-   * @returns {void}
+   * @returns {Promise<void>}
    */
-  scheduleEmail(email) {
+  async scheduleEmail(email) {
+    await this.#jobsService.dispatch(new SendEmailJob({ emailId: email.id }));
     logging.info(`[Background Job] batch-sending-service-job queued for email ${email.id}`);
-    return this.#jobsService.addJob({
-      name: 'batch-sending-service-job',
-      job: this.emailJob.bind(this),
-      data: { emailId: email.id },
-      offloaded: false,
-    });
   }
 
   /**
-   * @private
-   * @param {{emailId: string}} data Data passed from the job service. We only need the emailId because we need to refetch the email anyway to make sure the status is right and 'locked'.
+   * Sends an email after refetching it and acquiring its status lock.
+   * @param {{emailId: string}} data Identifier of the email to refetch and lock.
    */
   async emailJob({ emailId }) {
     logging.info(`[Background Job] batch-sending-service-job started for email ${emailId}`);
@@ -270,6 +268,7 @@ class BatchSendingService {
         { ...this.#getAfterRetryConfig(), description: `email ${emailId} -> submitted` },
       );
       logging.info(
+        { system: { event: 'send_email.submitted', email_id: emailId } },
         `[Background Job] batch-sending-service-job completed for email ${emailId} in ${Date.now() - startTime}ms`,
       );
     } catch (e) {
@@ -820,7 +819,7 @@ class BatchSendingService {
     let succeeded = false;
 
     try {
-      let members = await this.retryDb(
+      const members = await this.retryDb(
         async () => {
           const m = await this.getBatchMembers(batch.id);
 
@@ -958,7 +957,7 @@ class BatchSendingService {
    * @returns {Promise<MemberLike[]>}
    */
   async getBatchMembers(batchId) {
-    let models = await this.#models.EmailRecipient.findAll({
+    const models = await this.#models.EmailRecipient.findAll({
       filter: `batch_id:'${batchId}'`,
       withRelated: ['member', 'member.stripeSubscriptions', 'member.products'],
     });

package/core/server/services/email-service/email-renderer.js

@@ -65,6 +65,19 @@ function escapeHtml(unsafe) {
     .replace(/'/g, ''');
 }
 
+/**
+ * @param {string} html
+ * @returns {string}
+ */
+function fixOutlookChars(html) {
+  return html
+    .replace(/'/g, ''')
+    .replace(/→/g, '→')
+    .replace(/–/g, '–')
+    .replace(/“/g, '“')
+    .replace(/”/g, '”');
+}
+
 /**
  * @param {string} locale
  * @returns {boolean}
@@ -192,7 +205,7 @@ function escapeRegExp(string) {
  * @return {ReturnType<typeof cheerio.load>}
  */
 function cheerioLoad(html) {
-  const cheerio = require('cheerio');
+  const cheerio = require('cheerio/slim');
   return cheerio.load(html);
 }
 
@@ -709,7 +722,12 @@ class EmailRenderer {
 
     // Juice HTML (inline CSS)
     const juice = require('juice');
-    html = juice(html, { inlinePseudoElements: true, removeStyleTags: true });
+    // resolveCSSVariables crashes on nameless declarations in user-authored style attributes
+    html = juice(html, {
+      inlinePseudoElements: true,
+      removeStyleTags: true,
+      resolveCSSVariables: false,
+    });
 
     // happens after inlining of CSS so we can change element types without worrying about styling
     $ = cheerioLoad(html);
@@ -749,23 +767,52 @@ class EmailRenderer {
     // Convert DOM back to HTML
     html = $.html(); // () Fix for vscode syntax highlighter
 
+    // Personalize the entire name row after CSS inlining so an absent name also
+    // removes its label and markup, including in clients that discard stylesheets.
+    const nameRow = $('.subscription-details .subscription-name');
+    const nameHtml = nameRow.length ? $.html(nameRow) : '';
+    const nameText = nameRow.text();
+    const plaintextHtml = nameHtml
+      ? html.replace(nameHtml, '<p>%%{subscription_name_text}%%</p>')
+      : html;
+    if (nameHtml) {
+      html = html.replace(nameHtml, '%%{subscription_name_html}%%');
+    }
+
     // Replacement strings
     const replacementDefinitions = this.buildReplacementDefinitions({
       html,
       newsletterUuid: newsletter.get('uuid'),
     });
 
+    if (nameHtml) {
+      const outlookNameHtml = fixOutlookChars(nameHtml);
+      replacementDefinitions.push(
+        {
+          id: 'subscription_name_html',
+          token: /%%\{subscription_name_html\}%%/g,
+          getValue: (member) =>
+            member.name?.trim()
+              ? outlookNameHtml.replace('%%{name}%%', () => escapeHtml(member.name))
+              : '',
+          trusted: true, // Member name is already HTML-escaped
+        },
+        {
+          id: 'subscription_name_text',
+          token: /%%\{subscription_name_text\}%%/g,
+          getValue: (member) =>
+            member.name?.trim() ? nameText.replace('%%{name}%%', () => member.name) : '',
+        },
+      );
+    }
+
     // TODO: normalizeReplacementStrings (replace unsupported replacement strings)
 
     // Convert HTML to plaintext
-    const plaintext = htmlToPlaintext.email(html);
+    const plaintext = htmlToPlaintext.email(plaintextHtml);
 
     // Fix any unsupported chars in Outlook
-    html = html.replace(/&apos;/g, '&#39;');
-    html = html.replace(/→/g, '&rarr;');
-    html = html.replace(/–/g, '&ndash;');
-    html = html.replace(/“/g, '&ldquo;');
-    html = html.replace(/”/g, '&rdquo;');
+    html = fixOutlookChars(html);
 
     return {
       html,
@@ -808,7 +855,7 @@ class EmailRenderer {
   isMemberTrialing(member) {
     // Do we have an active subscription?
     if (member.status === 'paid') {
-      let activeSubscription = member.subscriptions.find((subscription) => {
+      const activeSubscription = member.subscriptions.find((subscription) => {
         return subscription.status === 'trialing';
       });
 
@@ -960,12 +1007,6 @@ class EmailRenderer {
           return member.name;
         },
       },
-      {
-        id: 'name_class',
-        getValue: (member) => {
-          return member.name ? '' : 'hidden';
-        },
-      },
       {
         id: 'email',
         getValue: (member) => {
@@ -1178,7 +1219,7 @@ class EmailRenderer {
    */
   #getEmailPreheader(postModel, audience, html) {
     let plaintext = postModel.get('plaintext');
-    let customExcerpt = postModel.get('custom_excerpt');
+    const customExcerpt = postModel.get('custom_excerpt');
     if (customExcerpt) {
       return customExcerpt;
     } else {

package/core/server/services/email-service/email-service-wrapper.js

@@ -1,3 +1,4 @@
+const assert = require('node:assert/strict');
 const debug = require('@tryghost/debug')('i18n');
 const url = require('../../api/endpoints/utils/serializers/output/utils/url');
 const events = require('../../lib/common/events');
@@ -14,10 +15,11 @@ class EmailServiceWrapper {
     return jsonModel.url;
   }
 
-  init({ ghostServer } = {}) {
+  init({ ghostServer, jobsService } = {}) {
     if (this.service) {
       return;
     }
+    assert(jobsService, 'Email service requires the jobs service');
 
     const EmailService = require('./email-service');
     const EmailController = require('./email-controller');
@@ -36,7 +38,6 @@ class EmailServiceWrapper {
     const configService = require('../../../shared/config');
     const settingsCache = require('../../../shared/settings-cache');
     const settingsHelpers = require('../settings-helpers');
-    const jobsService = require('../jobs');
     const membersService = require('../members');
     const db = require('../../data/db');
     const sentry = require('../../../shared/sentry');
@@ -44,7 +45,7 @@ class EmailServiceWrapper {
     const limitService = require('../limits');
     const labs = require('../../../shared/labs');
     const emailAddressService = require('../email-address');
-    const i18nLib = require('@tryghost/i18n');
+    const i18nLib = require('@tryghost/i18n').default;
     const lexicalLib = require('../../lib/lexical');
     const urlUtils = require('../../../shared/url-utils').default;
     const memberAttribution = require('../member-attribution');

package/core/server/services/email-service/email-service.js

@@ -29,12 +29,15 @@ const messages = {
   retryEmailNotFailed: 'Only failed emails can be retried',
 };
 
-// Resume scanner won't pick up `submitting` rows older than this. Rows beyond the cutoff
-// are flipped to `failed` on first boot so they surface in admin UI for operator review
-// rather than being silently resumed (and sending stale newsletters to current members).
+// Resume scanner won't pick up `pending` or `submitting` rows older than this. Rows beyond
+// the cutoff are flipped to `failed` on first boot so they surface in admin UI for operator
+// review rather than being silently resumed (and sending stale newsletters to current members).
 // Override via `bulkEmail:resumeMaxAgeMs` in config.
 const DEFAULT_RESUME_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 
+// Non-terminal email statuses, both of which the boot scanner recovers.
+const RESUMABLE_EMAIL_STATUSES = ['pending', 'submitting'];
+
 class EmailService {
   #batchSendingService;
   #sendingService;
@@ -201,7 +204,7 @@ class EmailService {
     });
 
     try {
-      this.#batchSendingService.scheduleEmail(email);
+      await this.#batchSendingService.scheduleEmail(email);
     } catch (e) {
       await email.save(
         {
@@ -223,28 +226,31 @@ class EmailService {
   }
 
   /**
-   * Boot-time scanner: resumes newsletter emails left in `submitting` after a
-   * previous container's interrupted send. Iterates sequentially; one failure
-   * does not skip others. Rows older than the configured max-age are flipped
-   * to `failed` (not resumed) so stale content does not get sent to current members.
+   * Boot-time scanner: recovers newsletter emails a previous container left without work.
+   * Two shapes, both resumed through the normal emailJob path:
+   *   - `submitting` — the send was cut off mid-flight.
+   *   - `pending` — dispatch was dropped from the in-memory job queue before the job ever
+   *     started, so no batch work exists and nothing else will ever pick the row up.
+   * Iterates sequentially; one failure does not skip others. Rows older than the configured
+   * max-age are flipped to `failed` (not resumed) so stale content does not get sent to
+   * current members.
    */
   async resumeInterruptedSends() {
     const maxAgeMs = this.#config?.get?.('bulkEmail:resumeMaxAgeMs') ?? DEFAULT_RESUME_MAX_AGE_MS;
     const cutoffIso = new Date(Date.now() - maxAgeMs).toISOString();
 
     // Stale rows: too old to safely resume. Flip to `failed` so they surface in admin UI
-    // for operator review instead of being silently left in `submitting` forever.
+    // for operator review instead of being silently stuck in their current status forever.
     const stale = await this.#models.Email.findAll({
-      filter: `status:submitting+created_at:<'${cutoffIso}'`,
+      filter: `status:[${RESUMABLE_EMAIL_STATUSES.join(',')}]+created_at:<'${cutoffIso}'`,
     });
-    const staleList = stale.models || stale;
-    for (const email of staleList) {
+    for (const email of stale.models) {
       try {
         const locked = await this.#batchSendingService.updateStatusLock(
           this.#models.Email,
           email.id,
           'failed',
-          ['submitting'],
+          [email.get('status')],
         );
         if (locked) {
           logging.warn(
@@ -257,20 +263,19 @@ class EmailService {
     }
 
     // Fresh rows: within the cutoff. Resume through the normal emailJob path.
-    const emails = await this.#models.Email.findAll({
-      filter: `status:submitting+created_at:>'${cutoffIso}'`,
+    const fresh = await this.#models.Email.findAll({
+      filter: `status:[${RESUMABLE_EMAIL_STATUSES.join(',')}]+created_at:>'${cutoffIso}'`,
     });
-    const list = emails.models || emails;
-    if (staleList.length === 0 && list.length === 0) {
+    if (stale.models.length === 0 && fresh.models.length === 0) {
       return;
     }
-    if (list.length > 0) {
+    if (fresh.models.length > 0) {
       logging.info(
-        `Email resume: found ${list.length} email(s) in submitting status within max age (${maxAgeMs}ms)`,
+        `Email resume: found ${fresh.models.length} pending or submitting email(s) within max age (${maxAgeMs}ms)`,
       );
     }
 
-    for (const email of list) {
+    for (const email of fresh.models) {
       try {
         await this.#resumeOneEmail(email);
       } catch (e) {
@@ -279,23 +284,24 @@ class EmailService {
     }
 
     logging.info(
-      `Email resume scan complete: ${staleList.length} stale email(s) flipped to failed, ${list.length} fresh email(s) rescheduled`,
+      `Email resume scan complete: ${stale.models.length} stale email(s) flipped to failed, ${fresh.models.length} fresh email(s) rescheduled`,
     );
   }
 
   async #resumeOneEmail(email) {
+    const status = email.get('status');
     const post = await email.getLazyRelation('post');
     const postStatus = post ? post.get('status') : null;
     const sendable = postStatus === 'published' || postStatus === 'sent';
 
     if (!sendable) {
       // Parent post was unpublished or deleted while the email was in flight.
-      // Can't resume — mark the email as failed so it stops showing as "submitting".
+      // Can't resume — mark the email as failed so it stops showing as unsent.
       const locked = await this.#batchSendingService.updateStatusLock(
         this.#models.Email,
         email.id,
         'failed',
-        ['submitting'],
+        [status],
       );
       if (locked) {
         logging.warn(
@@ -305,19 +311,22 @@ class EmailService {
       return;
     }
 
-    // Flip submitting -> pending so emailJob's status lock (['pending', 'failed']) admits it.
-    // If updateStatusLock returns undefined, another path raced us — just continue.
-    const locked = await this.#batchSendingService.updateStatusLock(
-      this.#models.Email,
-      email.id,
-      'pending',
-      ['submitting'],
-    );
-    if (!locked) {
-      logging.info(
-        `Email resume: ${email.id} status changed before lock could be taken — skipping`,
+    // `pending` is already what emailJob's status lock (['pending', 'failed']) admits, so
+    // only `submitting` needs flipping. If updateStatusLock returns undefined, another path
+    // raced us — leave it to whoever won.
+    if (status === 'submitting') {
+      const locked = await this.#batchSendingService.updateStatusLock(
+        this.#models.Email,
+        email.id,
+        'pending',
+        ['submitting'],
       );
-      return;
+      if (!locked) {
+        logging.info(
+          `Email resume: ${email.id} status changed before lock could be taken — skipping`,
+        );
+        return;
+      }
     }
 
     // Structured breadcrumb so post-incident timing/batch state is recoverable from logs.
@@ -325,7 +334,7 @@ class EmailService {
     logging.warn(`Email resume: scheduling ${email.id} for re-send ${JSON.stringify(breadcrumb)}`);
 
     // Skip checkLimits — this email already passed limits when first sent.
-    this.#batchSendingService.scheduleEmail(email);
+    await this.#batchSendingService.scheduleEmail(email);
   }
 
   async #buildResumeBreadcrumb(email) {
@@ -383,10 +392,22 @@ class EmailService {
     // so we have a immediate response when retrying an email (schedule can take a while to kick off sometimes)
     await email.save({ status: 'pending' }, { patch: true });
 
-    this.#batchSendingService.scheduleEmail(email);
+    try {
+      await this.#batchSendingService.scheduleEmail(email);
+    } catch (e) {
+      await email.save({ status: 'failed' }, { patch: true });
+      throw e;
+    }
     return email;
   }
 
+  /**
+   * @param {import('./jobs/send-email-job').default} job
+   */
+  async handleSendEmailJob(job) {
+    await this.#batchSendingService.emailJob({ emailId: job.emailId });
+  }
+
   /**
    * @params {string|null} [audienceStatus] - the audience's free/paid status
    *   ('status:free' / 'status:-free'), see EmailRenderer#describeSegment
@@ -467,11 +488,24 @@ class EmailService {
    * @return {string}
    */
   replaceDefinitions(htmlOrPlaintext, replacements, member) {
-    // Do manual replacements with an example member
-    for (const replacement of replacements) {
-      htmlOrPlaintext = htmlOrPlaintext.replace(replacement.token, replacement.getValue(member));
+    if (!replacements.length) {
+      return htmlOrPlaintext;
     }
-    return htmlOrPlaintext;
+    const values = replacements.map(({ token, getValue }) => ({ token, value: getValue(member) }));
+    const tokens = new RegExp(
+      replacements.map(({ token }) => `(?:${token.source})`).join('|'),
+      'g',
+    );
+
+    // Only match the original body, never placeholders inside inserted member data.
+    return htmlOrPlaintext.replace(tokens, (match) => {
+      for (const { token, value } of values) {
+        if (match.search(token) !== -1) {
+          return value;
+        }
+      }
+      return match;
+    });
   }
 
   /**
@@ -488,7 +522,7 @@ class EmailService {
     const exampleMember = await this.getExampleMember(null, audience.status);
 
     const subject = this.#emailRenderer.getSubject(post);
-    let { html, plaintext, replacements } = await this.#emailRenderer.renderBody(
+    const { html, plaintext, replacements } = await this.#emailRenderer.renderBody(
       post,
       newsletter,
       renderSegment,