Say the notifier's bundle is its own process under its own account, as main.go says

03-DESIGN/00-as-is/18-the-mail-modules.md

@@ -51,7 +51,7 @@ mesh-mail (mail-store, once for the mesh — the control-node)
 - **`mesh-mail-notifier`** is a module of its own as well (`modules/mesh-mail-notifier`), and keeps a
   byte-identical copy of `mesh-mail`'s `mailevent.go`, held to it by its `copies_test.go`, because each module
   builds alone. ADR 0378 §9 and ADR 0440 §1 say both are "built from `mesh-mail`'s source"; as built, they are
-  separate modules that share no code but that copied file. It claims `mail-notifier`, held once per machine; a
+  separate modules that share none of `mesh-mail`'s own code but that copied file. It claims `mail-notifier`, held once per machine; a
   module claiming it needs `node-notifier` held on the same machine (ADR 0378 §7). It is assigned today to two
   machines, the laptop and the workstation (live read of each machine's modules, 2026-10-20); the control-node
   and the home server hold no instance of it.
@@ -167,9 +167,10 @@ mesh-mail (mail-store, once for the mesh — the control-node)
   for five minutes, healthy otherwise; its `send` process is a plain unit (ADR 0359 §6; `health.go`).
 - **`mesh-mail-web`**'s own tool `mail_web_health` reads the one state its HTTP endpoint keeps: still setting up
   sign-in, listening, or ended with its error — unhealthy whenever it is not listening (`main.go`).
-- **`mesh-mail-notifier`** has no process of its own: its manifest declares only its account and its state
-  directory, and its bundle, loaded by the machine's tool runner, runs the watcher inside the runner's own
-  invocation (commit 12d78520, issue 859). Its tool `mail_notifier_health` is unhealthy once an account's notice
+- **`mesh-mail-notifier`** declares no process resource: its manifest declares only its account and its state
+  directory. Its bundle is the one process the machine's runtime launches for it and keeps alive, under its own
+  account (`runs-as`); it serves its tools and runs the watcher beside them (`main.go`'s opening note; commit
+  12d78520, issue 859). Its tool `mail_notifier_health` is unhealthy once an account's notice
   has failed to show for more than ten minutes, and answers only when asked; no check of the node-engine judges
   the module by it. A watching process of its own is tracked by issue 841, not yet decided (its `README.md`).
   The comment in its `health.go` that still names a process `notify` predates that commit. It keeps one state

03-DESIGN/01-to-be/59-the-mail-web-client.md

@@ -294,7 +294,7 @@ order (each depends on the one before unless said):
   1430 and 1227), 1418 (`mesh-mail-notifier` unassigned; after 1431 and test 13 live).
 - Milestone 3: 806 (Betterbird removed; after 1418).
 - Milestone 4: 1433 (`mail_search`'s folder case and `-any` switches; depends on none), 1419 (the thread's
-  reading-only caller; a decision first, after design 58's milestone 3, issue 880), 1432 (the mail conversation;
+  reading-only caller; a decision first, after 1227 and design 58's milestone 3, issue 880), 1432 (the mail conversation;
   after 1431, 1419 and issue 880).
 
 Milestone 2 is one release of `mesh-catalog`: the grant split, the new seat, the new