Write milestones 2 to 4's issues into design 59, as the operator confirmed them

Playbook 04 step 6. Also names ADR 0378 §5 beside ADR 0440 §4 for the page's use of mail-reading, its writes with correct and undo, and issue 1419 in §8's last sentence, as the graduation's review noted.

03-DESIGN/01-to-be/59-the-mail-web-client.md

@@ -169,7 +169,8 @@ mail-store (mesh-mail) ── MAIL: mail.<account>.message.added ──▶ mesh-
 - **The page.** Above the classical list it shows the mail that matters at the top, the mail groups, and the scam
   warnings in a place of their own, each with why; the classical list (accounts, folders, search, one mail) stays
   and always opens. `mesh-mail-web` reads these through `mail-reading`'s verbs and still keeps no mail state
-  (ADR 0440 §4 as ADR 0459 §13 changes it).
+  (ADR 0378 §5 and ADR 0440 §4 as ADR 0459 §13 changes them); it writes the operator's corrections with
+  `correct` and `undo`.
 - **It fails loudly.** Its own health check is unhealthy when a judgement is refused, times out or answers out of
   shape, with the cause and since when; the controller raises its condition, the page shows the cause above the
   classical list instead of mail groups, and no mail signal is sent. On recovery the mail that arrived meanwhile is
@@ -195,17 +196,16 @@ mail-store (mesh-mail) ── MAIL: mail.<account>.message.added ──▶ mesh-
 
 ## 8. The mail conversation (ADR 0462)
 
-A mail conversation is a thread (ADR 0383), run by the thread handler (ADR 0384), with a mail context: the
-framing that a mail is data, the tools `mail_search` and `mail_read` only under a caller granted reading only (a caller of the thread's own,
-issue 1419), the
-operator's real senders and folder names, and the reading lessons. The operator writes a mail question on the mail
-page; each answer names the mails it found, and a question with no answer says so. `mesh-mail-web` creates and
-follows the thread over the bus on its server side; the page loads one script from its own origin and talks only to
-it (content security policy: script from that origin, `connect-src 'self'`), so the browser never reaches the bus.
-The thread keeps the text of each mail it read for good, as every thread is kept (ADR 0383 §3), which the operator
-accepted; mail reading keeps none. In the same milestone `mail_search` matches folder names without regard to case
-and describes its three `-any` switches as true or false only. It is built after design 58's milestone 3 (threads,
-issue 880).
+A mail conversation is a thread (ADR 0383), run by the thread handler (ADR 0384), with a mail context: the framing
+that a mail is data, the tools `mail_search` and `mail_read` only under a caller of the thread's own granted reading
+only (issue 1419), the operator's real senders and folder names, and the reading lessons. The operator writes a mail
+question on the mail page; each answer names the mails it found, and a question with no answer says so.
+`mesh-mail-web` creates and follows the thread over the bus on its server side; the page loads one script from its
+own origin and talks only to it (content security policy: script from that origin, `connect-src 'self'`), so the
+browser never reaches the bus. The thread keeps the text of each mail it read for good, as every thread is kept (ADR
+0383 §3), which the operator accepted; mail reading keeps none. In the same milestone `mail_search` matches folder
+names without regard to case and describes its three `-any` switches as true or false only. It is built after design
+58's milestone 3 (threads, issue 880) and once issue 1419's caller is decided.
 
 ## 9. What stays outside
 
@@ -285,8 +285,16 @@ attachments), 1267 (writing a mail), 1268 (the integration test). After its deli
 the operator's Approve: `mesh-mail-web`'s `reach` on its machine (`internal`), its assignment there, its
 `operators`, and its caller in `mesh-mail`'s `grants` for every account.
 
-Milestones 2 to 4 are written by research 066's graduation and wait for the operator's confirmation and their issues
-(playbook 04, steps 5 and 6). Milestone 2 is one release of `mesh-catalog`: the grant split, the new seat, the new
+**Milestones 2 to 4, confirmed by the operator on 2026-10-20.** Their issues, one repository part each, in their
+order (each depends on the one before unless said):
+
+- Milestone 2: 1227 (`mesh-mail`'s grants split), 1426 (the seat `mail-reading` and the module `mesh-mail-reader`),
+  1427 (batches, mail entries and mail groups), 1428 (reading lessons and the seat's verbs; with 1427 after 1426),
+  1429 (mail signals; after 1427), 1430 (the mail page; after 1428 and 1429), 1431 (the integration test; after
+  1430 and 1227), 1418 (`mesh-mail-notifier` unassigned; after 1431 and test 13 live).
+- Milestone 3: 806 (Betterbird removed; after 1418).
+- Milestone 4: 1419 (the thread's reading-only caller; a decision first), 1433 (`mail_search`'s folder case and
+  `-any` switches), 1432 (the mail conversation; after 1431, 1419 and design 58's milestone 3, issue 880). Milestone 2 is one release of `mesh-catalog`: the grant split, the new seat, the new
 module and the page change ship together, and `mesh-mail-reader` is granted reading only after that delivery, on the
 operator's Approve; `mesh-mail-notifier` is unassigned only after test 13 passes live. Milestone 3 is issue 806.
 ADR 0379 §2's bar for removing Betterbird is milestone 1's; keeping Betterbird until mail reading (milestone 2) works,