- Shipped
- August 14, 2026 at 11:43 PM UTC
- Author
- Kamo
- Commit
- 643a051
The twin of the legal relay, because NavTop sums the two counts into one badge and a pair of halves that behaved differently would give the member chrome that was live for signatures and stale for courses — the worst of the three possible states, since it looks live. DocsService publishes **************** on core NATS; this puts it on **************** for the subscription kamo-internal holds over the existing chat connection. No JetStream and no stream to provision: a badge is a live signal, not a durable log, and the client seeds over REST for exactly the frames this loses. The destination is guarded on SEND as well as SUBSCRIBE. The simple broker routes by destination without caring which command carried the frame, so a SUBSCRIBE-only guard still lets any authenticated member publish a forged **************** to a colleague's topic — the payload names the victim, so their client's "is this addressed to me?" check passes and the mark saying they still owe a course goes out.