@@ -0,0 +1,18 @@
+---
+'@objectstack/service-messaging': patch
+'@objectstack/runtime': patch
+'@objectstack/client': patch
+'@objectstack/spec': patch
+---
+
+feat(notifications): the push device registry is served: `sys_user_device`, `POST /api/v1/notifications/devices` and `DELETE /api/v1/notifications/devices/:deviceId`, and the client's `notifications.registerDevice` / `unregisterDevice` (ADR-0012 §6)
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+Nothing a client or an operator sends today is refused, and no metadata an author writes changes: the routes and the client methods are new, and the spec change is two catalog rows and description text.
+
+- **`@objectstack/service-messaging`** registers `sys_user_device` (one row per user and app install: `device_id`, `user_id`, `vendor`, `token`, `platform`, `app_id`, `locale`, `name`, `enabled`, `invalidated_at`, `last_seen_at`) and implements `INotificationService`'s four device members on `MessagingService`. The table is system-owned: the generic data API neither reads nor writes it (`apiEnabled: false`), and it has no organization column, because a device belongs to its user. `registerDevice` refreshes a device id the user already holds, mints one when the request carries none, and moves a token another device holds to the registering device (the previous holder's row is removed, so a push meant for a phone's previous user never reaches its new one). A token has one holder: a unique index on `token` refuses a second one, and a registration that loses a race re-reads and moves the token. `invalidateDeviceToken` keeps the row with `enabled: false` and `invalidated_at`, and the device's next registration re-enables it. A `web` registration without `vendor` is refused `400 VALIDATION_FAILED`.
+- **`@objectstack/runtime`** serves `POST /api/v1/notifications/devices` (body: `RegisterDeviceRequestSchema`; answers `{ deviceId, success }`) and `DELETE /api/v1/notifications/devices/:deviceId` (the caller's own device; another user's or an unknown id answers `404 NOT_FOUND` and nothing is removed), behind the domain's anonymous floor (`401 UNAUTHENTICATED`). A notification service without the device members answers `501`. The standalone server mounts both, with the other verbs on the two paths mounted refusal-only like the inbox faces.
+- **`@objectstack/client`**: `client.notifications.registerDevice(request)` and `client.notifications.unregisterDevice(deviceId)`, removed earlier because no server served them, are back.
+- **`@objectstack/spec`**: `DEFAULT_NOTIFICATION_ROUTES` lists the two device routes again, and the `[PLANNED — not yet served]` markers come off the four device registration schemas and `UserDeviceSchema`.
@@ -24,7 +24,8 @@
  *  - `[body]` a body outside `RegisterDeviceRequestSchema`, and a web
  *    registration with no vendor, answer `400 VALIDATION_FAILED`;
  *  - `[data-api]` the generic data API neither lists, reads nor writes
- *    `sys_user_device` for a plain member: the device routes are the only door.
+ *    `sys_user_device` for a plain member (`404 OBJECT_API_DISABLED`, the
+ *    exposure gate's answer): the device routes are the only door.
  *
  * Refusals assert `code` AND `status` (ADR-0112).
  */
@@ -158,7 +159,8 @@ describe('push device registry over HTTP (ADR-0012 §6)', () => {
   });
 
   it('[data-api] the generic data API neither lists, reads nor writes sys_user_device for a member', async () => {
-    const [own] = await rows({ user_id: bobId });
+    await call(bobTok, 'POST', '/notifications/devices', { token: 'bob-data-api-tok', platform: 'ios', deviceId: 'bob-data-api' });
+    const [own] = await rows({ device_id: 'bob-data-api' });
     expect(own, 'bob holds a device row to aim at').toBeTruthy();
     const attempts = [
       await call(bobTok, 'GET', `/data/${OBJ}`),
@@ -167,10 +169,10 @@ describe('push device registry over HTTP (ADR-0012 §6)', () => {
       await call(bobTok, 'PATCH', `/data/${OBJ}/${own.id}`, { token: 'patched' }),
       await call(bobTok, 'DELETE', `/data/${OBJ}/${own.id}`),
     ];
+    // The exposure gate's answer for an object not exposed via the API.
     for (const res of attempts) {
-      expect(res.status, res.text).toBeGreaterThanOrEqual(400);
-      expect(res.status, res.text).toBeLessThan(500);
-      expect(codeOf(res.body), res.text).toBeTruthy();
+      expect(res.status, res.text).toBe(404);
+      expect(codeOf(res.body), res.text).toBe('OBJECT_API_DISABLED');
     }
     expect(await rows({ token: 'via-data-api' })).toHaveLength(0);
     const [still] = await rows({ id: own.id });