fix(campaign): align adaptive handbook with shipped UI

docs/CAMPAIGN_HANDBOOK.md

@@ -144,6 +144,11 @@ paths, storage keys, worker claim tokens, and raw provider diagnostics require
 the dedicated diagnostic permission and must not leak through ordinary campaign,
 version, job, or report responses.
 
+The current Campaign Report Web UI additionally requires recipient-read access
+and does not yet hide every action control that the actor lacks. The server
+still authorizes each action, but an aggregate-only reader UI remains open
+work; do not promise that experience from `campaigns:report:read` alone.
+
 ### Deliver and resolve outcomes
 
 Use the [delivery runbook](CAMPAIGN_DELIVERY_RUNBOOK.md) for the detailed
@@ -151,9 +156,11 @@ operator sequence.
 
 At a minimum:
 
-1. Queue only a validated, locked, built version.
-2. Use worker delivery for ordinary batches; synchronous send is intentionally
-   limited to small controlled runs.
+1. Queue only a validated, locked, built version. The current Web UI does not
+   expose Queue; use an authorized supporting client or API.
+2. Use worker delivery for ordinary batches. Synchronous Send now has no
+   server-enforced job-count bound and must be used only after an operator has
+   deliberately confirmed a small controlled run.
 3. Treat `smtp_accepted` as protected from ordinary retry.
 4. Retry `failed_temporary` explicitly after inspecting the cause.
 5. Include `failed_permanent` only after correcting the cause and making a
@@ -174,7 +181,7 @@ it cannot recall accepted mail.
 
 ### Test and one-message actions
 
-The current baseline includes mock send, queue dry-run, synchronous small-run
+The current baseline includes mock send, queue dry-run, synchronous immediate
 delivery, sending one selected job, retry selection, and unattempted-job
 selection. Their audit and state behavior is not yet the final vocabulary
 accepted for issue `govoplan-campaign#69`.