Ah ha! Here's what's going on: there's the HTTP status code, and then the responseObject status code, and that's not at all clear in the documentation. The HTTP status code will come back 200, from the production URL when you are supposed to retry with sandbox URL, because that's not the status to check: the 21007 code is the status inside the response object with the status code 200.