Two thousand signatures, one afternoon

The first large campaign we ran taught us more in an afternoon than the previous quarter of planning. Everything worked. Almost nothing worked *well*.

Failure one: the recipient list is always dirty

Two thousand rows from an HR export contain duplicates, three number formats, a dozen blanks and at least one address that is a distribution list. Sent naively, that produces two thousand envelopes and a hundred support requests.

So a campaign is now checked before it is anything else. Numbers are normalised, duplicates collapsed with the reason shown, blanks isolated, and the sender sees exactly what will go out and what will not — before a single message is sent. The most valuable screen in the feature is the one that refuses to send.

Failure two: everything at once is not a feature

Two thousand SMS messages fired in one burst hit network rate limits, land in the spam heuristics of every mail provider at once, and produce a support queue where all two thousand people call in the same ten minutes.

Sending is now paced. Messages go out over a window with a per-minute ceiling, so delivery holds up, the sender's help desk sees a queue it can survive, and a delivery problem is caught in the first fifty rather than discovered in the last five hundred.

Failure three: one document, many facts

A campaign is rarely truly identical. The same policy goes to everyone, but each copy has to carry a name, a payroll number, a branch. Doing that by producing two thousand documents by hand is not a plan.

Templates take merge fields from the recipient row, so one template plus one list produces two thousand individual documents — each sealed on its own, each with its own audit trail, each verifiable on its own. That last part is the point: a campaign is not one signed document with two thousand names on it. It is two thousand documents that happen to have been sent together.

Failure four: the sender needs a different view

Nobody administering a campaign wants a list of two thousand envelopes. They want four numbers — sent, opened, signed, failed — and the ability to act on the fourth without touching the first three.

• Progress reads as a whole, with the failures pulled out as their own working list.
• Reminders go to the outstanding only, on a schedule, without re-sending to anyone who has finished.
• A bad row can be corrected and re-sent individually without rebuilding the campaign.
• The completed set exports as one file, with every document's evidence attached to it.

The lesson we would offer anyone building something similar: at scale, the product is not the sending. The sending is trivial. The product is everything that happens to the twenty rows that go wrong, in public, while eighteen hundred people watch their colleagues finish.