swarm-nats-auth: grant every hive the shared hive-notices stream subjects

swarm-queue-client/Cargo.toml

@@ -17,12 +17,19 @@ edition.workspace = true
 # to live in one of them, and neither end of that bucket is senior to the
 # other.
 kv = ["async-nats/kv"]
-# `jetstream` (streams, publish, consumers) is already in async-nats's
-# default feature set — `kv` above only adds the KV-specific type
-# surface on top of it. This feature exists purely to keep `notices.rs`
-# out of a consumer's compiled surface unless it asks for it, matching
-# `kv`'s organizational role rather than gating a real async-nats flag.
-notices = []
+# 🩸 `jetstream` is NOT in async-nats's default feature set here — the
+# workspace-level dependency turns default features off entirely (see
+# root `Cargo.toml`: `server_2_14`/`nkeys`/`ring` only). `kv` above works
+# standalone only because async-nats's own `kv` feature pulls `jetstream`
+# in transitively; `notices.rs` uses `async_nats::jetstream` directly and
+# needs the same request explicitly, or it only compiles by accident when
+# something else in the same build happens to also enable `kv` (which is
+# exactly how this went unnoticed: `cargo test` at the workspace level
+# unifies features across every crate being built, so `hive-c0re`'s own
+# `kv` request silently carried `notices.rs` until a single-crate
+# `cargo check -p swarm-nats-auth` — no `kv` anywhere in that build —
+# surfaced it as `cannot find jetstream in async_nats`).
+notices = ["async-nats/jetstream"]
 
 [dependencies]
 # Bare (no `kv`/`jetstream`) unless a consumer opts into the `kv` feature