[ael-dev3]

Reading notifications in one signed-in session now clears the account’s unread badge in its other sessions. An attested, private SpacetimeDB watermark merges local/offline progress by maximum, so an older session cannot undo newer reads. New notifications still become unread; each open Notifications visit keeps its initial row highlighting and selected tab.

The Rust controller connects after initial page work, uses separate notification credentials, and subscribes only to the caller’s state. It handles reconnects and account changes without creating public chat presence or DM keys. Messages and notification sync share the official SDK loader with owned callback cleanup. The module update is additive; existing chat and encrypted DM tables are unchanged.

Validation

• Rust checks: 670 native tests; 7 isolated module tests; native/Wasm Clippy, formatting and license checks.
• Five real-SDK browser cases across independent contexts cover live sync, fresh-session baseline, offline merging, account-switch fencing and unconfigured/signed-out startup. All pass without retries.
• Existing notification/Messages/attestation regressions: 26 passed. Smoothness: 70 passed and 2 existing fixmes. Static copy: 17 passed and 12 existing skips.
• A real local SpacetimeDB run passed 38 privacy/reducer/session/migration checks, including upgrading the exact previous module without deleting data and preserving seeded chat/DM state.
• Worker and static builds, plus the 10 Node 22 tooling oracles, pass.

Production rollout requires the additive module publish before deploying the app. CI and first-deployment performance checks remain required. No live public messages or DMs are part of validation.