Sys-Originated Communications

When sys needs to talk to people on the platform, it does so through this surface and nowhere else. The broadcast composer can target all tenants, selected tenants, selected roles, or a custom filter, and dispatches over three channels: in-app banner, email through SendGrid in 10 000-recipient batches at 100 rps, and push through FCM/Expo in 100-recipient batches. Test-send is mandatory and per-operator: `/send` returns `412 SysBroadcastTestSendRequired` unless the current operator has a `test_sent_at` within the last 30 minutes, so a handover always forces a fresh test before a real send goes out.

The banner library separates `SysBannerTemplate` (reusable: maintenance, incident, feature) from `SysBannerActivation` rows that bind a template to a start/end window and a tenant/role audience; the admin and app consume them through `GET /me/banners`. Release-notes publisher lets sys author a `SysReleaseNote` with internal context plus a customer-safe public version, dispatch by channel, and link to the release in F21.18. The sys operator inbox routes broadcast replies and inbound support mail through the SendGrid Inbound webhook into `SysSupportInboxMessage` rows; assign and close workflows surface in `sys/comms/inbox`.

The 1:1 DM endpoint at `POST /sys/users/{id}/messages` is the proactive sys-to-user channel for any single-recipient communication: the operator picks channels (email/push/in-app), provides a reason of at least 10 characters, and clears fresh-auth. Rate limit is five DMs per operator per user per 24 hours, a self-test-send is mandatory before real delivery, and users can opt out per channel through `/me/communications`. Every channel write — broadcast, banner, release-note, DM — produces an audit row with metadata, so an operator can prove later who sent what to whom.