@@ -1537,6 +1537,70 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
             domainDecidesEveryVerb('POST', `${prefix}/notifications/read`);
             domainDecidesEveryVerb('POST', `${prefix}/notifications/read/all`);
 
+            // ── Push devices (ADR-0012 §6) ──────────────────────────────
+            // The device registry's two faces, served by the same domain
+            // (`handleNotificationRequest`) behind the same anonymous floor:
+            // `POST /notifications/devices` registers or refreshes the
+            // caller's device, `DELETE /notifications/devices/:deviceId`
+            // removes the caller's own. Mounted here because this is the only
+            // HTTP owner the standalone server has for `/notifications*`; the
+            // cloud hosts reach the domain through `dispatch()` as before.
+            //
+            // The device id is re-encoded on the way in: the router hands
+            // `req.params` decoded, and the domain decodes the segment it
+            // reads, so an id carrying `/` or `%` reaches the service as sent.
+            server.post(`${prefix}/notifications/devices`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.dispatch('POST', '/notifications/devices', deferRequestBody(req), req.query, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+            server.delete(`${prefix}/notifications/devices/:deviceId`, async (req: any, res: any) => {
+                try {
+                    const path = `/notifications/devices/${encodeURIComponent(String(req.params?.deviceId ?? ''))}`;
+                    const result = await dispatcher.dispatch('DELETE', path, undefined, req.query, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+            // [#24024] As for the three inbox faces: every other verb on the two
+            // device paths is mounted too, so it reaches the domain's anonymous
+            // floor (401) instead of the adapter's 405, and a signed-in caller
+            // gets the domain's 404. No body is handed on: none is a face.
+            const mountDevicesRefusal = (
+                pattern: '/notifications/devices' | '/notifications/devices/:deviceId',
+                method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
+            ) => {
+                const register =
+                    method === 'GET' ? server.get
+                        : method === 'POST' ? server.post
+                            : method === 'PUT' ? server.put
+                                : method === 'PATCH' ? server.patch
+                                    : server.delete;
+                register.call(server, `${prefix}${pattern}`, async (req: any, res: any) => {
+                    try {
+                        const path = pattern === '/notifications/devices'
+                            ? pattern
+                            : `/notifications/devices/${encodeURIComponent(String(req.params?.deviceId ?? ''))}`;
+                        const result = await dispatcher.dispatch(method, path, undefined, req.query, { request: req });
+                        sendResult(result, res);
+                    } catch (err: any) {
+                        errorResponse(err, res);
+                    }
+                });
+            };
+            for (const method of ['GET', 'PUT', 'PATCH', 'DELETE'] as const) {
+                mountDevicesRefusal('/notifications/devices', method);
+            }
+            for (const method of ['GET', 'POST', 'PUT', 'PATCH'] as const) {
+                mountDevicesRefusal('/notifications/devices/:deviceId', method);
+            }
+            domainDecidesEveryVerb('POST', `${prefix}/notifications/devices`);
+            domainDecidesEveryVerb('GET', `${prefix}/notifications/devices/:deviceId`);
+
             // ── Packages ────────────────────────────────────────────────
             // Single pipeline (ADR-0076 D11 / OQ#9): every package route flows
             // through dispatch() — like analytics / i18n / automation / AI —
 
@@ -20,16 +20,18 @@
  * as it did from the if-chain.
  *
  * Routes (path is the sub-path after `/notifications`):
- *   GET  ''          → listInbox    (query: read, type, limit — validated, #6928)
- *   POST /read       → markRead     (body: { ids: string[] })
- *   POST /read/all   → markAllRead
+ *   GET    ''                  → listInbox         (query: read, type, limit — validated, #6928)
+ *   POST   /read               → markRead          (body: { ids: string[] })
+ *   POST   /read/all           → markAllRead
+ *   POST   /devices            → registerDevice    (body: RegisterDeviceRequestSchema, ADR-0012 §6)
+ *   DELETE /devices/:deviceId  → unregisterDevice  (the caller's own device; another's is 404)
  */
 
 import {
     shouldDenyAnonymous, ANONYMOUS_DENY_STATUS, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE,
 } from '@objectstack/core';
 import { CoreServiceName } from '@objectstack/spec/system';
-import { MarkNotificationsReadRequestSchema } from '@objectstack/spec/api';
+import { MarkNotificationsReadRequestSchema, RegisterDeviceRequestSchema } from '@objectstack/spec/api';
 import type { INotificationService } from '@objectstack/spec/contracts';
 import { isServiceServeable } from '../service-serveable.js';
 import { validationFailure, fieldsFromZodIssues } from '../validation-failure.js';
@@ -98,6 +100,20 @@ function parseTypeFilter(raw: unknown): string | undefined {
     return parseStringParam('type', raw);
 }
 
+/**
+ * The `:deviceId` path segment, decoded as the self-hosted router decodes a
+ * parameter. An escape that does not decode is kept raw rather than thrown on
+ * (the `meta` / `automation-hooks` precedent): a malformed id names no device
+ * this caller holds, so it gets the ordinary 404, never a 500.
+ */
+function decodeDeviceSegment(segment: string): string {
+    try {
+        return decodeURIComponent(segment);
+    } catch {
+        return segment;
+    }
+}
+
 export function createNotificationsDomain(deps: DomainHandlerDeps): DomainRoute {
     return {
         prefix: '/notifications',
@@ -169,19 +185,60 @@ export async function handleNotificationRequest(
     // is mounted, so that produced a ROUTE_NOT_FOUND whose hint ("check the API
     // discovery endpoint") pointed at a page that correctly does not list the
     // route. See ./unavailable.ts. The slot key is `notification`, singular.
-    if (!service || !isServiceServeable(service) || typeof service.listInbox !== 'function') {
+    if (!service || !isServiceServeable(service)) {
         return capabilityUnavailable(deps, 'notification');
     }
-    // Narrowed for the routes below: the entry probe established `listInbox`.
-    const inbox = service as INotificationService & Required<Pick<INotificationService, 'listInbox'>>;
 
     const m = method.toUpperCase();
     // split+filter drops leading/trailing/duplicate slashes without a regex
     // over request-controlled input (CodeQL js/polynomial-redos) — same
     // treatment the security domain got for the identical latent pattern.
     // Surfaced when the extraction (#3507) made this line "changed code":
     // the legacy `.replace(/\/+$/, '')` had carried the trap since ADR-0030.
-    const subPath = path.split('/').filter(Boolean).join('/');
+    const segments = path.split('/').filter(Boolean);
+    const subPath = segments.join('/');
+
+    // ── Push devices (ADR-0012 §6) ─────────────────────────────────────────
+    // The device registry is a capability of its own, separately optional on
+    // the contract from the inbox, so these faces probe THEIR member and sit
+    // ahead of the inbox probe below: a provider with a device registry and no
+    // inbox still serves them, and one with an inbox and no registry answers
+    // the 501 capability disclosure, never a 404. The owner is the session's
+    // user (bound above, after the anonymous floor); no body member names one.
+    if (segments[0] === 'devices') {
+        // POST /notifications/devices — register or refresh this user's device.
+        if (segments.length === 1 && m === 'POST') {
+            if (typeof service.registerDevice !== 'function') return capabilityUnavailable(deps, 'notification');
+            // Validated against the declared contract (`RegisterDeviceRequestSchema`,
+            // the catalog row's `requestSchema`), as mark-read is (#3899).
+            const parsed = RegisterDeviceRequestSchema.safeParse(body ?? {});
+            if (!parsed.success) {
+                const fields = fieldsFromZodIssues(parsed.error.issues);
+                throw validationFailure(
+                    `Invalid device registration body: ${fields.map((f) => `${f.field}: ${f.message}`).join('; ')}`,
+                    fields,
+                );
+            }
+            const result = await service.registerDevice(userId, parsed.data);
+            return { handled: true, response: deps.success(result) };
+        }
+        // DELETE /notifications/devices/:deviceId — the caller's own device only.
+        // A device id the caller does not hold (unknown, or another user's) is
+        // the service's `NOT_FOUND` throw, which the dispatcher answers 404:
+        // never a distinct "forbidden", so the id's existence is not disclosed.
+        if (segments.length === 2 && m === 'DELETE') {
+            if (typeof service.unregisterDevice !== 'function') return capabilityUnavailable(deps, 'notification');
+            const result = await service.unregisterDevice(userId, decodeDeviceSegment(segments[1]));
+            return { handled: true, response: deps.success(result) };
+        }
+        return { handled: false };
+    }
+
+    if (typeof service.listInbox !== 'function') {
+        return capabilityUnavailable(deps, 'notification');
+    }
+    // Narrowed for the routes below: the entry probe established `listInbox`.
+    const inbox = service as INotificationService & Required<Pick<INotificationService, 'listInbox'>>;
 
     // Each write route probes its OWN method rather than riding the entry
     // `listInbox` probe (#4127). The three are separately optional on the
 
@@ -399,6 +399,26 @@ export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
     note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no inbox)' },
   { route: 'DELETE /notifications/read/all', domain: '/notifications', disposition: 'server-only',
     note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no inbox)' },
+  // Push devices (ADR-0012 §6): the device registry's two faces and their
+  // refusal-only verbs, mounted for the same every-face anonymous floor.
+  { route: 'POST /notifications/devices', domain: '/notifications', disposition: 'sdk', client: 'notifications.registerDevice' },
+  { route: 'DELETE /notifications/devices/:deviceId', domain: '/notifications', disposition: 'sdk', client: 'notifications.unregisterDevice' },
+  { route: 'GET /notifications/devices', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'PUT /notifications/devices', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'PATCH /notifications/devices', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'DELETE /notifications/devices', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'GET /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'POST /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'PUT /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
+  { route: 'PATCH /notifications/devices/:deviceId', domain: '/notifications', disposition: 'server-only',
+    note: 'refusal-only, mounted for the v18 every-face anonymous floor (changeset 23225): anonymous 401 UNAUTHENTICATED, signed-in the notifications domain\'s 404 (or its 501 with no notification service)' },
 
   // ── security (ADR-0090 suggested audience bindings) ───────────────────────
   { route: 'GET /security/suggested-bindings', domain: '/security', disposition: 'sdk', client: 'security.suggestedBindings.list' },
 
@@ -514,13 +514,17 @@ describe('plugin-rest-api.zod', () => {
       expect(DEFAULT_NOTIFICATION_ROUTES.methods).toContain('listNotifications');
       expect(DEFAULT_NOTIFICATION_ROUTES.methods).toContain('markNotificationsRead');
       expect(DEFAULT_NOTIFICATION_ROUTES.methods).toContain('markAllNotificationsRead');
-      // 3 = list + read + read/all, the routes the dispatcher actually mounts.
-      // The devices/preferences endpoints this table used to declare were
-      // removed as server routes in #3612 (in fact never built) and are gone
-      // from the catalog too (#3899) — same cure as DEFAULT_AI_ROUTES (#3718).
-      expect(DEFAULT_NOTIFICATION_ROUTES.endpoints).toHaveLength(3);
+      expect(DEFAULT_NOTIFICATION_ROUTES.methods).toContain('registerDevice');
+      expect(DEFAULT_NOTIFICATION_ROUTES.methods).toContain('unregisterDevice');
+      // 5 = list + read + read/all + the two device routes, the routes the
+      // dispatcher actually mounts. The device rows came back with their
+      // handlers (#29068); `/preferences` stays gone, removed as a server
+      // route in #3612 (in fact never built) and from the catalog in #3899.
+      expect(DEFAULT_NOTIFICATION_ROUTES.endpoints).toHaveLength(5);
+      const routes = DEFAULT_NOTIFICATION_ROUTES.endpoints?.map(e => `${e.method} ${e.path}`) ?? [];
+      expect(routes).toContain('POST /devices');
+      expect(routes).toContain('DELETE /devices/:deviceId');
       const paths = DEFAULT_NOTIFICATION_ROUTES.endpoints?.map(e => e.path) ?? [];
-      expect(paths).not.toContain('/devices');
       expect(paths).not.toContain('/preferences');
     });
 
 
@@ -1204,17 +1204,18 @@ export const DEFAULT_NOTIFICATION_ROUTES: RestApiRouteRegistration = {
   category: 'notification',
   methods: [
     'listNotifications', 'markNotificationsRead', 'markAllNotificationsRead',
+    'registerDevice', 'unregisterDevice',
   ],
   authRequired: true,
-  // The device-registration and preferences endpoints are GONE from this table
-  // (#3899). `POST/DELETE /devices*` and `GET/PATCH /preferences` were removed
-  // as SERVER routes in #3612 — in fact they were never built ("the
-  // /notifications/devices and /notifications/preferences server routes that
-  // ADR-0012 describes were never built", packages/client/src/index.ts) — yet
-  // this table kept declaring them, requestSchema and all, so the catalog
-  // promised validation on routes that 404. Same disease, same cure as
-  // DEFAULT_AI_ROUTES (#3718). The `RegisterDevice*` / `*Preferences*` schemas
-  // in protocol.zod.ts remain exported as protocol-method contracts.
+  // The two device rows came back with their handlers (#29068): the device
+  // registry's `POST /devices` and `DELETE /devices/:deviceId` are served by
+  // the runtime's notifications domain and mounted by its dispatcher plugin,
+  // and `request-schema-gate.conformance.test.ts` walks this table against
+  // that dispatcher, so a row and its handler cannot land apart. They were
+  // removed in #3899 because nothing served them then (#3612: "never
+  // built"), the same cure as DEFAULT_AI_ROUTES (#3718). `/preferences` stays
+  // gone: no server route serves it, and its `*Preferences*` schemas in
+  // protocol.zod.ts remain exported as protocol-method contracts only.
   endpoints: [
     {
       method: 'GET',
@@ -1258,6 +1259,31 @@ export const DEFAULT_NOTIFICATION_ROUTES: RestApiRouteRegistration = {
       responseSchema: 'MarkAllNotificationsReadResponseSchema',
       cacheable: false,
     },
+    {
+      method: 'POST',
+      path: '/devices',
+      handler: 'registerDevice',
+      category: 'notification',
+      public: false,
+      summary: 'Register or refresh a push device',
+      description: 'Registers the current user\'s push device, or refreshes it when its deviceId is already registered',
+      tags: ['Notifications'],
+      requestSchema: 'RegisterDeviceRequestSchema',
+      responseSchema: 'RegisterDeviceResponseSchema',
+      cacheable: false,
+    },
+    {
+      method: 'DELETE',
+      path: '/devices/:deviceId',
+      handler: 'unregisterDevice',
+      category: 'notification',
+      public: false,
+      summary: 'Unregister a push device',
+      description: 'Removes one of the current user\'s push devices; a device the user does not hold answers 404',
+      tags: ['Notifications'],
+      responseSchema: 'UnregisterDeviceResponseSchema',
+      cacheable: false,
+    },
   ],
   middleware: [
     { name: 'auth', type: 'authentication', enabled: true, order: 10 },