diff --git a/frontend/src/admin/UploadLinks.tsx b/frontend/src/admin/UploadLinks.tsx
index 06efb82..6e3ea9f 100644
--- a/frontend/src/admin/UploadLinks.tsx
+++ b/frontend/src/admin/UploadLinks.tsx
@@ -63,7 +63,6 @@ export default function UploadLinks() {
   async function create() {
     setCreating(true);
     setError(null);
-    setMailed(null);
 
     const res = await fetch('/api/admin/upload-links', {
       method: 'POST',
@@ -87,8 +86,12 @@ export default function UploadLinks() {
     }
 
     const created = await res.json();
-    setIssued(created.url);
+    // Reset here, not before the request: a 400 returns before this point, so
+    // rejecting a second link (say, a mistyped address) can no longer clear
+    // the warning that belongs to a still-displayed token from an earlier,
+    // successful create.
     setMailed(created.mail.sent);
+    setIssued(created.url);
     setLabel('');
     setEmail('');
     setCap(DEFAULT_CAP);
@@ -182,7 +185,12 @@ export default function UploadLinks() {
         pagination={false}
         columns={[
           { title: 'Label', dataIndex: 'label' },
-          { title: 'Sent to', dataIndex: 'contact_email' },
+          // Not "Sent to": contact_email records only the address the admin
+          // gave when the link was created, never whether delivery actually
+          // happened — that outcome is shown once, at creation, and is not
+          // persisted. In QA, where every send is blocked by design, "Sent
+          // to" would be false for every row on the page.
+          { title: 'Email', dataIndex: 'contact_email' },
           {
             title: 'Used',
             render: (_, row) =>