[clbotdev]

Test sends follow the industry pattern (Mailchimp, Klaviyo, Omnisend): any address is allowed, every recipient counts once, and there's a stored cap per account. Tests through an organization's shared mailbox now draw on that mailbox's quota.

Before

• The 50-per-hour limit was held in process memory (Map). It reset on restart or deploy and multiplied with API replicas.
• Tests through a shared mailbox skipped the team's shared-delivery quota, so one team could send about 1,200 tests a day on the organization's ESP.

Now

• Redis sliding windows (sequences/test-send-limits.ts), one atomic Lua script per test:
  • 100 recipients per team in any 24 h, and 50 in any 3 h;
  • 20 per email in any 24 h;
  • all or nothing: a test that doesn't fit records nothing.
  • Errors are test_send_limit_reached and test_send_email_limit_reached, each with retryAfter.
  • Configurable with TEST_SEND_DAILY_LIMIT, TEST_SEND_BURST_LIMIT, TEST_SEND_BURST_HOURS and TEST_SEND_EMAIL_DAILY_LIMIT.
• Shared mailbox quota:
  • chargeOrganizationQuotaForTests counts tests as accepted usage on the grant and organization day/month buckets, all or nothing.
  • refundOrganizationQuotaForTests returns any tests that didn't go out.
  • Bucket checks are shared with reserveOrganizationQuota (lockBucketsWithRoom, lockActiveGrant), so the behaviour is the same. Tests through the team's own ESP aren't charged.
• REST returns 429 for the two test-limit codes and the two shared-quota codes. The MCP tool, contract description, docs (Broadcasts → Test limits) and .env.example are updated.
• Web shows plain-language messages for the new codes.
• PostHog: a sequence_email_test_limited event records error_code, kind, email_id and recipients_count.

Tests

• test-send-limits.test.ts against real Redis: the per-email cap is all or nothing, the team burst spans emails, the rolling day is enforced, retry-after is sane, and the defaults are correct.
• organization/queries.test.ts: charging tests through a shared mailbox (all or nothing at the grant's daily limit), then a refund.
• test-send.test.ts: each deliverable recipient counts once (deduped and case-insensitive), and nothing is sent past the limit.
• Lint, format and typecheck pass for both the API and web.