[jayleaton]

Summary

Phones register their Expo push token directly with each server. No T3 Connect relay. First layer of three; #230 sends the pushes and #231 is the iOS app. Rebased onto main after the Ada rebrand (#235–#242).

phone ──pushRegistrations.register { installId, expoPushToken, label? }──▶ server
                                                  │  (scope: orchestration:read)
                                                  ▼
             push_registrations (install_id PK, session_id, expo_push_token UNIQUE, label, updated_at)
                                                  │
     listDeliverable: first deletes rows whose session is revoked, expired or missing in auth_sessions

• pushRegistrations.register / unregister RPCs, in CLIENT_GUARDED_RPC_SCOPES behind orchestration:read. A push only reveals thread titles and states that a reader already sees.
• Fork migration 024 push_registrations. A row belongs to one install, and re-registering replaces it. A token that moves to a new install id (reinstall) drops its old row.
• A row is tied to the calling session. Revoking or expiring the phone's session stops its pushes at the next delivery, with no extra stream subscription. The phone re-registers on every connect.
• capabilities.pushNotifications lets the phone skip older servers.

Evidence

• Before: no way for a phone to register for pushes. The fork removed T3 Connect in 6147526 / b4424b9.
• After: apps/server/src/push/PushRegistrations.test.ts passes. It covers upsert by install id, a token moving to a new install, and rows of revoked and expired sessions being deleted. RpcAuthorization.test.ts scope coverage includes the new RPCs.
• vp run check:changed on the rebased layer: all pass (format, lint, knip, typecheck, tests). The one local ServerEnvironment.test.ts mismatch is the macOS /tmp → /private/tmp symlink and passes with TMPDIR=/private/tmp.

Merge Danger

Door: two-way. The new table is additive. A revert leaves an unused table.

Blast Radius: server. Two new RPCs and one capability flag. Existing RPCs are unchanged.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 6dec7c9 · PR result: 0d4dfa9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.