Whether a person may be sent a project's contents by email.

Being sent a project's contents is the same standing as opening them in the app, so this asks :access_project rather than deciding again — one call covering the project existing, it not winding down, the person holding standing in it, and the MFA requirement.

Account state is what :access_project does not carry. The request path learns it at authentication, which a cron job and a run-completion callback never reach. An unconfirmed address counts for more here than it does there, because nothing has established that the mailbox belongs to the member.

Only for mail carrying a project's own contents — run logs, digests, retention notices. Account mail must not be routed through this: the notice that an account is being deleted has to reach an account this refuses.