Mountable Plug endpoint for open-pixel + click-redirect URLs.

Mount

# In adopter's endpoint or router:
forward "/track", Mailglass.Tracking.Plug

Routes

• GET /o/:token.gif — 43-byte transparent GIF89a when valid. Failed verify returns HTTP 204 (not 404 — per , no URL enumeration).
• GET /c/:token — HTTP 302 redirect to the signed target_url. Failed verify returns HTTP 404.

Security headers

Pixel response:

• Cache-Control: no-store, private, max-age=0
• Pragma: no-cache
• X-Robots-Tag: noindex
• Content-Type: image/gif

Telemetry

Emits [:mailglass, :tracking, kind, :recorded] only after a successful event-ledger append. Returned or raised ledger failures emit [:mailglass, :tracking, kind, :failed] while retaining the GIF/redirect response. Metadata is %{delivery_id: binary, tenant_id: binary} plus a finite :failure_class on failed events — no PII.