The letsencrypt flavor served certbot's April-expired state to live IMAPS users within minutes: autocert's HTTPHandler answers 404 itself for tokens it does not hold and never consults the fallback for challenge paths, so mailu's own client cannot answer through the path-scoped route. cert flavor (valid to Nov 27) until route-proxy's handler actually falls through.