Push

Push is a best-effort alert and wake path. messages.send succeeds when PostgreSQL commits. Web Push, FCM, and APNs acceptance is not part of that success, and neither is Centrifugo. Missed events are still recovered with messages.sync.

Direct adapters: Web Push (VAPID, RFC 8291), FCM HTTP v1, APNs HTTP/2 token auth. There is no legacy FCM, firebase-admin, or campaign/topic system.

Default push.enabled is false. Existing deployments keep the previous send path until a host opts in.

Policy defaults

• Notify the DM peer.
• Notify sanitized mention targets.
• Group, channel, and forum members without a mention stay quiet unless you set notifyGroupWithoutMention.
• Conversation mute suppresses, unless an explicit mention overrides it.
• The sender never gets a push for their own message.
• The worker skips only the active foreground installation when heartbeats say so.

Visible alert title and body are generic ("New message" by default). They are not a message preview.

Health and invalidation

Provider auth results pause that channel and stay visible in health. They must not delete user subscriptions. invalid_subscription deactivates only that installation. The client must re-register.

Public config may expose enablement, policy, and the VAPID public key. Never private keys, service-account JSON, .p8 material, tokens, or endpoints.

The local demo opts into Web Push for the playground only. That UI does not register Android or iOS installations.