- Shipped
- October 18, 2026 at 4:39 PM UTC
- Author
- Kamo
- Commit
- 70c4c7a
A send as a shared mailbox skipped the checks EmailController#sendEmail runs: an own-domain recipient that is nobody (422 RECIPIENTS_UNKNOWN), the SI thread-turn guard (aiTurnLimit) and the do-not-contact list for EMAIL. An SI granted support@ could have mailed a listed address from it. All three now run on that path too. The message label endpoints read the folder from ?folder= with ~ in the path, as every other message endpoint does, so a folder with a slash works; a label that is not the caller's (or no uuid) answers 400 instead of 500.