[lodystage]

Risk: 🔴 high | Confidence: low — changes authenticated installation ownership and logout ordering; real-provider/browser delivery and production build verification remain incomplete.

Problem / pressure

Hosted notification settings delegate device identity to OneSignal. Clients need to register directly through host-owned notification operations while preserving account isolation and the local-only desktop boundary.

Summary

• Replace the vendor SDK with a native host bridge, browser PushManager and injected authenticated registration operations. Carry native Bundle ID through the portable DTO; keep credentials and provider configuration in the host.
• Enable Web only with HTTPS/browser capabilities and a VAPID public key. Permission prompts and initial opt-in stay explicit. Preserve native permission/subscription behavior and Electron local notifications.
• Serialize Web subscriptions across tabs with Web Locks, await worker acknowledgment of persisted recipients, and reject stale account callbacks. Logout clears durable browser authorization even before delayed in-memory login, and revokes display permission before waiting on an in-flight subscription operation.
• Revoke native registration even before delayed login or port setup; fence scheduled startup work at logout. Distinguish OS permission/opt-in from backend-confirmed registration, and only report successful enablement in settings after confirmation.
• Reconcile missing subscriptions and changed keys on login, focus and subscription-change messages. Preserve language updates, opt-out and bounded logout cleanup. Remove the vendor SDK dependency and document the boundary in bilingual notes.

Visual explanation

flowchart LR
  Settings --> Client[Push lifecycle]
  Client --> Native[Native host bridge]
  Client --> Browser[Browser PushManager]
  Client --> Port[Authenticated platform operations]
  Port --> Backend[Host-owned notification backend]
  Logout --> Revoke[Revoke worker account and callback generation]
  Revoke --> Cleanup[Bounded subscription cleanup]

Loading

Before / after

Before	After
Vendor SDK owns device registration	Native tokens/browser endpoints use authenticated host operations
Shared code loads a vendor runtime	Platform-neutral facade with native/browser paths
In-memory push setup controls logout cleanup	Persisted Web authorization is cleared even before push login

Test plan

• Passed: 17 shared native/Web lifecycle tests; shared component typecheck; platform boundary and documentation checks. Coverage includes explicit opt-in, key/lost-subscription refresh, stale-tab fencing, reload-before-login logout, and worker revocation before a stalled subscribe releases its lock, pre-login native logout, cancelled deferred startup, and confirmed versus failed registration.
• Fresh adversarial review reports no remaining P0/P1 after fixing logout and refresh findings.
• Full embedded workspace typechecks and lint pass; remaining tests are blocked by the unchanged E2EE before-cas process-recovery five-second timeout. Production bundle verification is incomplete due heap exhaustion/termination.
• What I could not verify: real-provider delivery, Safari/iOS Home Screen behavior, Xcode compilation or a complete production build. Private hosts own worker/assets/backend integration; this PR contains no private implementation or credentials.

Keep this PR draft until host integration and remaining validation have been reviewed.