The webmail failure turned out to be a compatibility clash between a bundled webmail component and a newer PHP release. The component ships a small helper written for older PHP versions, and newer PHP now provides the same helper natively. Declaring it a second time stops the page before it can load.
The fix is deliberately small: only declare the helper if it does not already exist. It is applied as an exact-match patch rather than a blind edit, so if the upstream package ever changes, the patch simply does not fire and the diagnostics page says so. We verified it against a copy of the real source first, confirmed the result is valid PHP, and confirmed that applying it a second time changes nothing.
Because a package upgrade can restore the original file, the patch is applied by the panel’s existing hostname and certificate provisioning step, which runs routinely, so the guard reapplies itself whenever that happens.
The lesson: when a page fails with no visible error, make the real error visible before guessing at causes. Reading what the runtime was actually reporting resolved in one step what several earlier theories had not.
Tested (2506/2506).