[witbrock]

Enables deliberate device opt-in for private direct-message alerts, including coding-agent reports, with test, disable and access-checked message navigation. Durable canonical messages drive bounded delivery independently of workflow/model launches. JVNAUTOSCI-2757.

Subscriptions are encrypted and bound to the authenticated actor, device and organisation. A real push challenge confirms enrolment; live checks, generation binding and logout revocation protect account changes and queued alerts. Provider restrictions and disabled redirects confine outbound transport. Lock-screen content stays generic.

Settings now waits for its registered worker to activate: its iframe is outside the worker scope, so waiting for a controlling worker left Enable disabled. Permanently rejected confirmation subscriptions are retired and the UI offers fresh opt-in. Chromium's newer Web Push route works with the existing FCM allowlist; no staging-host exception or relaxed window-context check was added.

Merge decision: ready. Clean code candidate 70fc2819b67975cdc426eda47519106470ffd5ae passed the actual opt-in → canonical message → visible background alert → desktop click → accessible message → Disable path. Separate synthetic Alice/Bob sessions were authenticated and candidate-bound through the existing operator fixtures. Bob received 404 for Alice's receipt. Alice's Von tab was closed when her one generic alert arrived; a real X11 click opened the correct exchange. Device Disable removed the subscription and alerts.

Validation: 80 targeted backend notification/message/window tests passed; after the final expiry repair, all 29 notification backend tests passed. All 12 notification frontend tests and affected static/diff checks passed. Security/recovery coverage includes denial/dismissal, other actors/devices/scopes, suppressed workflow launches, stale/expired subscriptions, retry/duplicate/crash bounds, logout and navigation. CI runs on the final published head.

Browser evidence: Linux ARM64, headed persistent Chromium 153.0.8010.12, ordinary tab with automation-granted permission, real encrypted FCM preprod Web Push using Chromium's PushMessagingGcmEndpointWebpushPath. Native display used task-local Dunst and private D-Bus on isolated Xvfb :98; both temporary processes stopped afterward. No synthetic Push event is counted as display evidence. Receipt/screenshots remain in .run/push-resume/ and the delivery/configuration/rollback handoff is in docs/engineering/mobile_web_push.md.

Physical Android/iOS and installed-app results remain unavailable. The controller owns deployment and public read-back; public VAPID/encryption configuration and sender activation must be verified separately from fixture keys. Offline or expired-login alerts may be missed because display rechecks current authority. Jira currently requires connector reauthentication. Shared manifest/service-worker work in JVNAUTOSCI-2758 must preserve this path.