EPIC-KEYS-001A T2 — operator-authorized one-shot custody-notice delivery

Send the reviewed custody notice to the pending cohort, once each.

This is the operator action itself. Flipping PROVIDER_CUSTODY_NOTICE_ENABLED makes the endpoint exist; calling it with a body that transcribes the previewed cohort size and copy hash is what authorizes the send. Neither alone sends anything.

The copy is services/provider_custody_notice.render_...() UNCHANGED — this handler never templates, personalizes, or interpolates anything into it, which is what keeps the reviewed identity-free copy module identity-free.

Responses: 200 — counts-only delivery result (see the service dataclass). 400 — the gate flipped off between the request and the service call. 409 — the confirmed recipient count or notice version no longer matches the live cohort. A stale preview never sends. 422 — confirm_delivery was not explicitly true. 503 — flag on, no Resend key (Sentry-allowlisted; see observability).

Authorization / flag gates identical to the preview endpoint.

Durability note: the per-recipient record of what was sent is the provider_custody_notice_deliveries ledger, committed per recipient as delivery proceeds. The audit row below is the operator-attribution record for the batch and is written after the batch completes, so a process death mid-batch leaves the ledger authoritative and the batch un-audited — the next preview shows the ledger state, and re-authorizing is safe because already-sent recipients are skipped.