Answer the review: carry test 4 over as the direction words it, make milestone 4 wait for milestone 2, fix ADR 0461's clause numbers in the glossary

00-META/glossary.md

@@ -794,9 +794,9 @@ and no session (ADR 0278), in its plain sense.
   §2), with the states `mail_send_status` answers (ADR 0440 §7). Only a caller granted asking to send for that
   account may ask for one (ADR 0460).
 - **mail web client** — the module `mesh-mail-web`, holder of `mail-webclient`: the operator's mail in a browser on
-  the private network (ADR 0440 §1); also called *the mail page*.
+  the private network (ADR 0440 §1). The page it serves is the mail page.
 - **mail notice** — `mesh-mail-notifier`'s desktop pop-up for a new inbox mail (ADR 0378 §7, §9). It retires when
-  `mesh-mail-notifier` is unassigned everywhere (ADR 0461 §6) and then moves to *mail signal*'s *Not:* line
+  `mesh-mail-notifier` is unassigned everywhere (ADR 0461 §7) and then moves to *mail signal*'s *Not:* line
   (issue 1418).
 - **mail reading** — the model's reading of each new mail as it arrives, in batches, into its mail group and mail
   entry; the seat `mail-reading`, held by `mesh-mail-reader` (ADR 0459). Not *triage* (the issue tracker's
@@ -805,7 +805,7 @@ and no session (ADR 0278), in its plain sense.
   due date; never the body (ADR 0459 §4). Not *catalogue entry*: the catalogue is Delivery's.
 - **mark** — what a mail entry says the mail is to the operator: *matters*, *scam warning* or neither, never two
   (ADR 0459 §7). Not *kind* (Media's).
-- **mail group** — a set of mails the model put together because they belong to one subject. Not *delivery
+- **mail group** — a set of mails the model put together because they belong to one subject (ADR 0459 §4). Not *delivery
   group* or *account group*.
 - **reading lesson** — one correction the operator made on the mail page (a mark or a mail group), kept so later
   mail reading follows it (ADR 0459 §8 to §10). Always qualified: the bare *lesson* is Operator and conversation's.
@@ -813,7 +813,7 @@ and no session (ADR 0278), in its plain sense.
   top of the mail page, that tells the operator mail matters (ADR 0461). Always qualified: the bare *signal* is
   Health and repair's.
 - **scam warning** — the mark of a mail the model judges an attempt to deceive the operator, with why; shown in
-  its own place on the mail page and never a mail signal (ADR 0459 §7, ADR 0461 §5).
+  its own place on the mail page and never a mail signal (ADR 0459 §7, ADR 0461 §6).
 - **mail conversation** — a thread (ADR 0383) with a mail context, followed on the mail page: the mail questions
   and their answers, each answer with the mails it found. The mail context is the framing that a mail is data, the
   tools `mail_search` and `mail_read` only, the operator's senders and folders, and the reading lessons (ADR 0462).

03-DESIGN/01-to-be/59-the-mail-web-client.md

@@ -44,7 +44,7 @@ thread with a mail context. Betterbird is removed once mail reading works on the
 every account `mesh-mail` holds, opens an attachment, and writes a mail that goes out on their Approve on Telegram;
 the same page is not reachable from a machine outside the private network. A new mail that matters reaches the
 operator's phone as one mail signal and stands at the top of the mail page in its mail group; a mail that does not
-matter shows nothing anywhere.
+matter gives no pop-up and no mail signal anywhere.
 
 ## 1. The parts
 
@@ -87,7 +87,7 @@ outside. Two things hold it:
 Measured on 2026-10-19: the laptop and the workstation hold the mesh's authority (`mesh-internal-ca.crt`) as a trust anchor, and
 Firefox on both reads the system's trust through p11-kit, so the page opens there without a warning. Away from the
 private network (the laptop travelling without its tunnel) the page is unreachable; Betterbird stays the offline client
-until it is removed (milestone 4, §11).
+until it is removed (milestone 3, §11).
 
 ## 3. Signing in (ADR 0440 §3)
 
@@ -149,14 +149,16 @@ mail-store (mesh-mail) ── MAIL: mail.<account>.message.added ──▶ mesh-
 - **A mail entry per mail, never the body.** Its own database (`postgres-database`) keeps each mail's mail group,
   a one-line summary, its mark (*matters*, *scam warning* or neither) and why, and a due date where the mail gives
   one, beside the mail groups and the reading lessons.
-- **Batches.** One judgement reads at most 10 mails. Its question is filled in order, under 60 KiB of the
-  judgement's 64 KiB: the framing that a mail is data and never an instruction; the mail groups, at most 4 KiB; the
-  reading lessons that apply, at most 40 within 12 KiB, sender and mail group first, then the newest, under the
-  framing that a reading lesson outranks anything a mail says; then the mails, each cut to its first 3 KiB, a mail
-  in a Junk folder said to be so. A batch asks for up to 40 s with `within` and collects with
+- **Batches.** One judgement reads at most 10 mails, and every part of its question has a bound, so it never
+  passes 55 KiB of the judgement's 64 KiB: the framing that a mail is data and never an instruction, at most 4 KiB;
+  the mail groups, at most 4 KiB, the largest first; the reading lessons that apply, at most 40 within 12 KiB,
+  sender and mail group first, then the newest, under the framing that a reading lesson outranks anything a mail
+  says; then each mail, at most 3.5 KiB (its headers at most 512 bytes, its text cut to its first 3 KiB), a mail in
+  a Junk folder said to be so. A batch asks for up to 40 s with `within` and collects with
   `claude_code_judged` (built under issue 508, recorded by ADR 0459 §14). Research 066 measured 1.9 to 3.1 s per
   mail, so a batch of 10 takes about 19 to 31 s; the bound keeps an issue tracker's check that waits behind a batch
-  on the same machine within its two minutes (ADR 0278 §2), which research 066's 15 mails and 120 s would not. Batches stay judgements; whether they become threads is issue 1417.
+  on the same machine within its two minutes (ADR 0278 §2), which research 066's 15 mails and 120 s would not.
+  Batches stay judgements; whether they become threads is issue 1417.
 - **Reading lessons.** When the operator changes a mail's mark or mail group on the page, `mesh-mail-web` calls
   `correct` and the correction is kept at once as a reading lesson (headers, the change, when; never body text),
   with no further Approve: it is the signed-in operator's own act. The page lists the reading lessons, undoes one
@@ -192,7 +194,8 @@ mail-store (mesh-mail) ── MAIL: mail.<account>.message.added ──▶ mesh-
 ## 8. The mail conversation (ADR 0462)
 
 A mail conversation is a thread (ADR 0383), run by the thread handler (ADR 0384), with a mail context: the
-framing that a mail is data, the tools `mail_search` and `mail_read` only under a caller granted reading only, the
+framing that a mail is data, the tools `mail_search` and `mail_read` only under a caller granted reading only (a caller of the thread's own,
+issue 1419), the
 operator's real senders and folder names, and the reading lessons. The operator writes a mail question on the mail
 page; each answer names the mails it found, and a question with no answer says so. `mesh-mail-web` creates and
 follows the thread over the bus on its server side; the page loads one script from its own origin and talks only to
@@ -235,17 +238,15 @@ Tests 1 to 9 are milestone 1's; tests 10 to 17 are research 066's eight, in its
    answers whether it serves and the accounts it is granted (a unit test of `mesh-mail-web`, issue 1262).
 9. The acceptance sentence at the top, live: in a browser on the laptop and on the workstation, for every account.
 
-Tests 1 to 4 are one integration test that starts the module whole against the real bus (playbook 07 step 3 item 4);
-tests 5 and 7 are `mesh-mail`'s own and test 8 `mesh-mail-web`'s, unit tests; test 6 is read before the module is
-assigned; test 9 is proven live after the delivery.
 10. A new mail on each account has a mail entry, in a mail group, within 5 minutes of its mail event; a test searches
     `mesh-mail-reader`'s database for a known body line and finds none.
 11. The reader's caller is refused by `mail_send` for every account, and no mail is moved, flagged or deleted by it.
-12. (Milestone 3.) On the mail page, a mail question by a person, by a time range and by "what needs a reply" finds
+12. (Milestone 4.) On the mail page, a mail question by a person, by a time range and by "what needs a reply" finds
     its target mails, research 066's three failed kinds included; a question with no answer says so; the conversation
     is a thread readable through the thread seat; and the browser makes no request but to the mail page's own origin.
 13. A batch with one mail that matters sends exactly one `tell` naming it, with no URL, mail address or host name in
-    its words, and the mail is at the top of the page; a subject carrying a host name still gives a mail signal.
+    its words, and the mail is at the top of the page; a sender whose name carries a host name still gives a
+    mail signal, in the safe form.
 14. Research 066's 20 steering mails, read again, mark no injected words as mattering, and every phishing decoy that
     is marked is a scam warning, which sends no `tell`.
 15. A reading lesson given on a real mail changes how the next mail of that sender is noted; undone, it no longer
@@ -256,11 +257,14 @@ assigned; test 9 is proven live after the delivery.
 17. With `mesh-mail-notifier` unassigned, a new mail that does not matter shows nothing on the laptop or the
     workstation, and one that matters gives one mail signal.
 
+Tests 1 to 4 are one integration test that starts the module whole against the real bus (playbook 07 step 3 item 4);
+tests 5 and 7 are `mesh-mail`'s own and test 8 `mesh-mail-web`'s, unit tests; test 6 is read before the module is
+assigned; test 9 is proven live after the delivery.
+
 Tests 11, 13 (with a stand-in router), 16 and the grant split's refusals are one integration test that starts
 `mesh-mail` and `mesh-mail-reader` whole against the real bus and store; the batch's budget, the seat's verbs and the
-mail signal's words are unit tests; tests 10, 14, 15 and 17 are proven live after milestone 2's delivery; test 12
-with milestone 3.
-
+mail signal's words are unit tests; tests 10, 13, 14, 15 and 17 are proven live after milestone 2's delivery, test 13
+before `mesh-mail-notifier` is unassigned; test 12 with milestone 4.
 
 ## 11. Milestones
 
@@ -268,8 +272,8 @@ with milestone 3.
 |---|---|---|---|---|
 | 1 | In a browser on the laptop and the workstation, the operator signs in and browses, searches and reads every account's mail with its attachments, and writes a mail that goes out on their Approve | tests 1 to 9 | mesh-catalog: `mesh-mail`'s account bucket (issue 1255, ADR 0439 §2); the module `mesh-mail-web` (manifest, sign-in, the pages, the send, the seat's verbs, the integration test) | — |
 | 2 | Each new mail is read into a mail group on the mail page; the mail that matters reaches the operator's phone as one mail signal, a scam warning shows on the page only, the operator's corrections become reading lessons, and the pop-up for every new mail is gone | tests 10, 11, 13 to 17 | mesh-catalog: `mesh-mail`'s grants split (issue 1227) and the seat `mail-reading` declared; the module `mesh-mail-reader` (batches, mail entries, reading lessons, mail signals, health, the integration test); `mesh-mail-web`'s mail groups, mail signals, scam warnings and reading lessons; `mesh-mail-notifier` unassigned (issue 1418) | 1 |
-| 3 | On the mail page the operator asks questions about their mail and gets the mails that answer them, in a mail conversation kept as a thread | test 12 | mesh-catalog: `mesh-mail-web`'s mail conversation as a client of the thread seat; `mesh-mail`'s folder case and `-any` switches | 1; design 58's milestone 3 (issue 880) |
-| 4 | Betterbird is gone from the laptop and the workstation, its profile and mail kept in the home | ADR 0379 §2 | mesh-catalog: Betterbird unassigned on the operator's Approve, then the `betterbird` module removed from the catalogue (issue 806) | 2 |
+| 3 | Betterbird is gone from the laptop and the workstation, its profile and mail kept in the home | ADR 0379 §2 | mesh-catalog: Betterbird unassigned on the operator's Approve, then the `betterbird` module removed from the catalogue (issue 806) | 2 |
+| 4 | On the mail page the operator asks questions about their mail and gets the mails that answer them, in a mail conversation kept as a thread | test 12 | mesh-catalog: `mesh-mail-web`'s mail conversation as a client of the thread seat; the thread's mail tools under a caller of their own granted reading only (issue 1419); `mesh-mail`'s folder case and `-any` switches | 2 (the grant split and the reading lessons); design 58's milestone 3 (issue 880) |
 
 **Milestone 1, confirmed by the operator on 2026-10-19, is delivered;** its live proof on the laptop and the
 workstation (a search, an attachment, one send on the Approve) is still the operator's. Its issues, one repository
@@ -282,5 +286,7 @@ the operator's Approve: `mesh-mail-web`'s `reach` on its machine (`internal`), i
 Milestones 2 to 4 are written by research 066's graduation and wait for the operator's confirmation and their issues
 (playbook 04, steps 5 and 6). Milestone 2 is one release of `mesh-catalog`: the grant split, the new seat, the new
 module and the page change ship together, and `mesh-mail-reader` is granted reading only after that delivery, on the
-operator's Approve; `mesh-mail-notifier` is unassigned only after test 13 passes live. Milestone 4 is issue 806;
-Betterbird stays until mail reading (milestone 2) works, not until the mail conversation.
+operator's Approve; `mesh-mail-notifier` is unassigned only after test 13 passes live. Milestone 3 is issue 806.
+ADR 0379 §2's bar for removing Betterbird is milestone 1's; keeping Betterbird until mail reading (milestone 2) works,
+and not until the mail conversation, is the lead's proposal, for the operator to confirm with the milestones
+(playbook 04, step 5). Milestone 4 waits for threads and for the caller of issue 1419.