[Silthus]

Part of map #461 (sandbox sender for API sends, slice SA1). Sits on sbx-api/integration-node, a merge of #584 and #587.

Problem

• A project without a verified domain gets 202 for a code send through the sandbox sender, even when the sandbox skips it after the queue: a non-member recipient, a spent daily allowance, or a paused sender.
• The caller learns about the skip only from the run log, so an SDK can't tell a sent email from a dropped one.

Merge Danger

Warning

🔴 Merge risk: high · two-way door: a revert brings back the 202 for every sandbox code send

• Email delivery path. The worker's sandbox SES envelope lists a repeated address once, and the allowance charges it once.
• Every CDP integration lookup now reads an id the read replica lacks from the primary.
• The new checks run only for a sandbox integration, which exists only behind workflows-sandbox-sender.

Changes

• A sandbox code send that the sandbox would skip is refused before it is queued. Nothing is queued on a refusal.

Case	Answer
A To, CC or BCC recipient is not a verified member, or a stored copy can't be read	400 sandbox_recipient_not_allowed
The project or recipient allowance is spent	400 sandbox_limit_reached
The sandbox is switched off or paused, or the organization is blocked	422 sending_suspended
A check can't run	503 sandbox_check_failed

• The allowance check only reads the buckets, so a burst past what is left still gets 202, and the worker skips the extra sends.
• The 202 answer carries delivery_mode (own or sandbox), and a replay answers with the first send's mode.
• A refusal emits workflows sandbox email blocked with source: api, and waits at most a second for it.

How did you test this code?

Test seams: the cdp-api code-send route over HTTP (cdp-api.serial.test.ts), the worker's executeSendEmail, and IntegrationManagerService.get.

Proofs:

• Live run through posthog-node, with feat(messaging): send code emails through the sandbox sender without a domain #633 on top: a member send is delivered from the sandbox address with no Reply-To. A non-member, a send past the cap, a named from and a reply_to are refused with nothing sent. A replay claims nothing.
• Cross-version: an old Django with this cdp-api still delivers own-sender sends.
• Shadow diff against the stack without feat(cdp): refuse a sandbox code send before it is queued #632 and feat(messaging): send code emails through the sandbox sender without a domain #633: own-sender sends are unchanged (answers, deliveries, From, Reply-To). Every no-sender difference is the sandbox fallback or one of its refusals. A keyed record written by either cdp-api version replays in the other.
• Prod shape: a gap until read-only production access exists on 2026-11-02.

CI: this PR sits on an integration base until the sandbox stack (through #587) and the send stacks (through #584 and #585) reach master.

Release status

• This change is behind a feature flag and is not available to users

Docs update

• docs/internal/workflows-email-sending-tiers.md is updated in feat(messaging): send code emails through the sandbox sender without a domain #633.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /tdd, /writing-tests, /qa-swarm, /pr-description, /writing-pr-descriptions

Question	Answer	Who	Where
Which codes do the recipient and allowance refusals use?	400 sandbox_recipient_not_allowed and 400 sandbox_limit_reached	👤 Human	map #461, 2026-10-26
Are the allowances refilling buckets?	Yes, accepting about twice the cap on the first day and one recipient bucket per organization	👤 Human	map #461, 2026-10-26
What answers a suspended sandbox?	422 sending_suspended, the master code for a suspension	🤖 Agent	this PR
Where does a sender the replica lacks get found?	In the integration loader, for admission and the worker, not per caller	🤖 Agent	this PR

Involvement: one design pass, a 7-lens security swarm, a 4-lens fix round and one clean final read (GPT-6.1 Sol and Claude Opus 5.5); live-run, cross-version and shadow-diff proof captured.

More context for AI agents

• Session: lane sbx-api of map Map: send code-managed email templates with one PostHog call #461, Claude Code.
• Follow-ups: a template send by id with a stored sandbox sender ignores a caller's reply_to; a suppressed copy can make the allowance check refuse a send the worker would deliver; the worker's own captureBlocked calls, from the sandbox stack, still wait with no deadline.
• Read closely: sandbox-send-gate.ts, the envelope change in email.service.ts, and integration-manager.service.ts.

🤖 Generated with Claude Code