6t. Web push — BY HAND, once per environment

The portal's bell can also go to customers' phones and computers (DESIGN.md §17, the Communications row). The pusher Worker sends each notice to the devices its person turned push on for, from the PUSH queue, signed with a VAPID key that is this environment's own and the pusher's alone.

1. The key pair. Per environment, run node scripts/push-keys.mjs. It prints two lines: DIVVENT_PUSH_KEY (the private key, a JWK on one line) and DIVVENT_PUSH_PUBLIC_KEY (its public half). Set both, from the same run, in that GitHub environment's secrets (gh secret set DIVVENT_PUSH_KEY --env staging, then the public key the same way), and clear the terminal. Never copy one environment's into another.
2. The register. Add DIVVENT_PUSH_KEY to the credential register for the environment (owner: Ant; rotated yearly, ROTATION_BY_NAME).
3. The next deploy puts the private key on the pusher and no other Worker, and the public key on the portal. Until then the portal's notification settings say push is not switched on, and the pusher lets every batch go and logs pusher: not configured (no DIVVENT_PUSH_KEY).

Rotating is the same two steps with a new pair. Every device was subscribed with the old public key, so every push service refuses the new signature for it: each person turns notifications on again, on each device, from the bell. The bell is unaffected.

Generated applications need nothing. A tenant target that pushes is given a VAPID key of its own by its first deploy (generatedSecrets in its infra.json), kept on its Worker from then on; it never leaves the tenant's account and the control plane never holds it.