[Silthus]

Part of map #461 (sandbox sender for API sends). SA1 part 3 of 3, split from #632: the delivery_mode answer. Stacked on #637 (part 2), on #636 (part 1). #633 sits on top.

Problem

• A caller of the send API can't tell whether a code send went out from its own domain or from the sandbox sender, which reaches only organization members.
• Django needs that answer to report the mode on its usage events (feat(messaging): send code emails through the sandbox sender without a domain #633).

Merge Danger

Note

🟡 Merge risk: medium · two-way door: a revert drops the field from the 202

• Every keyed code send now stores its mode with its idempotency record. A record from either cdp-api version replays in the other.
• An own-sender send answers delivery_mode: own, and nothing else about it changes.

Changes

• The 202 for a code send carries delivery_mode, own or sandbox.
• A keyed send stores the mode with its idempotency record, so a replay answers with the first send's mode, even when the default sender changed in between.
• A record written before this change replays without the field.

How did you test this code?

Test seams: the cdp-api code-send route over HTTP (cdp-api.serial.test.ts).

Test rationale: the mode on own and sandbox sends, and a keyed replay after the default sender changed.

Proofs:

• Cross-version: a keyed record written by either cdp-api version replays in the other, with nothing sent.
• Shadow diff against the stack without SA1 and feat(messaging): send code emails through the sandbox sender without a domain #633: own-sender sends are unchanged (answers, deliveries, From, Reply-To).
• Both ran on feat(cdp): refuse a sandbox code send before it is queued #632, whose code equals this PR's head. Prod shape is a gap until 2026-11-02.

CI: this PR sits on an integration base until the sandbox stack (through #587) and the send stacks (through #584 and #585) reach master.

Release status

• This change is behind a feature flag and is not available to users

Docs update

• None. docs/internal/workflows-email-sending-tiers.md is updated in feat(messaging): send code emails through the sandbox sender without a domain #633.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /tdd, /writing-tests, /qa-swarm, /pr-description, /writing-pr-descriptions

Question	Answer	Who	Where
How is SA1 split for review?	Three stacked PRs: envelope and source, the admission gate, delivery_mode	👍 Accepted default	map #461 lane handoff, 2026-11-01

Involvement: the SA1 review carries over from #632, whose code these three parts hold: one design pass, a 7-lens security swarm, a 4-lens fix round and one clean final read (GPT-6.1 Sol and Claude Opus 5.5). One GPT-6.1 Sol read of this part came back clean. A GPT-6.1 Sol read of the merge that took the newer base came back clean.

More context for AI agents

• Session: lane sbx-api of map Map: send code-managed email templates with one PostHog call #461, Claude Code.
• Split: the three parts together hold exactly the code of feat(cdp): refuse a sandbox code send before it is queued #632 at 87af9d607ca; this head's tree is the same.
• Read closely: idempotency-keys.ts and the replay branch in cdp-api.ts.

🤖 Generated with Claude Code