@@ -0,0 +1,10 @@
+---
+'@object-ui/console': patch
+---
+
+fix(console): a Console served from a host with an underscore or a trailing dot registers the mobile shell's push device again, without an origin
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@object-ui/console`:** the push device registration sent `window.location.origin` for any `http:` or `https:` page. The server refuses an `origin` its host pattern cannot carry, an underscore (`http://my_svc:3000`, a container or compose service name) or a trailing dot (`https://crm.example.com.`), and a refused member refuses the whole registration, so that device got no pushes at all. The Console now keeps the origin only when the published `RegisterDeviceRequestSchema` (`@objectstack/spec/api`) accepts it, the same schema the server parses the body with; otherwise the device registers without `origin`, as the spec describes, and its pushes carry no origin. Every other host still sends its origin.
@@ -19,6 +19,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest';
 import { act, cleanup, render } from '@testing-library/react';
 import { useEffect, type ReactNode } from 'react';
+import { RegisterDeviceRequestSchema } from '@objectstack/spec/api';
 import { AuthCtx, type AuthContextValue } from '../../../../packages/auth/src/AuthContext';
 import { useAuth } from '../../../../packages/auth/src/useAuth';
 import { resetBeforeSignOutForTests, runBeforeSignOut } from '../../../../packages/auth/src/beforeSignOut';
@@ -366,3 +367,42 @@ describe('the origin a registration sends (objectstack#29042)', () => {
     expect(registrationOrigin({ protocol: 'data:', origin: 'null' })).toBeUndefined();
   });
 });
+
+describe('a host the origin pattern cannot carry still registers, with no origin (objectstack#31472)', () => {
+  const pageUrl = window.location.href;
+  afterEach(() => {
+    (window as unknown as { happyDOM: { setURL(url: string): void } }).happyDOM.setURL(pageUrl);
+  });
+
+  it('an underscore host and a trailing-dot host send no origin; a normal host keeps its own', () => {
+    expect(registrationOrigin({ protocol: 'http:', origin: 'http://my_svc:3000' })).toBeUndefined();
+    expect(registrationOrigin({ protocol: 'https:', origin: 'https://crm.example.com.' })).toBeUndefined();
+    expect(registrationOrigin({ protocol: 'https:', origin: 'https://crm.example.com:8443' })).toBe('https://crm.example.com:8443');
+    expect(registrationOrigin({ protocol: 'http:', origin: 'http://10.0.0.7:3000' })).toBe('http://10.0.0.7:3000');
+  });
+
+  it.each([
+    ['an underscore host', 'http://my_svc:3000/home'],
+    ['a trailing-dot host', 'https://crm.example.com./home'],
+  ])('%s: the device is registered without origin, and the server accepts the body', async (_label, url) => {
+    (window as unknown as { happyDOM: { setURL(url: string): void } }).happyDOM.setURL(url);
+    installBridge({ installId: 'install-7' });
+    render(<Harness auth={{ userId: 'u1' }} pathname="/home" />);
+    await passPromptDelay();
+    await settle();
+
+    const requests = deviceRequests();
+    expect(requests).toEqual([
+      {
+        method: 'POST',
+        url: expect.stringContaining(DEVICES),
+        body: { token: 'tok-1', vendor: 'apns', platform: 'ios', deviceId: 'install-7' },
+      },
+    ]);
+    // The door parses the whole body with this schema: the body sent passes,
+    // and the same body naming the page origin is the refusal it avoids.
+    expect(RegisterDeviceRequestSchema.safeParse(requests[0]!.body).success).toBe(true);
+    const named = { ...(requests[0]!.body as object), origin: window.location.origin };
+    expect(RegisterDeviceRequestSchema.safeParse(named).success).toBe(false);
+  });
+});
@@ -41,6 +41,7 @@
 
 import { useEffect, useRef, useState } from 'react';
 import { ObjectStackClient } from '@objectstack/client';
+import { RegisterDeviceRequestSchema } from '@objectstack/spec/api';
 import { createAuthenticatedFetch, registerBeforeSignOut, useAuth } from '@object-ui/auth';
 import {
   NATIVE_PUSH_TOKEN_CHANGED_EVENT,
@@ -134,12 +135,18 @@ function platformOf(host: ObjectStackNative): 'ios' | 'android' | null {
 
 /**
  * The `origin` a registration sends: the page's origin, only when it was loaded
- * over http or https. A sandboxed or `about:blank` / `data:` page reads the
- * opaque `"null"`, which the request grammar refuses, and that would refuse the
- * whole registration; such a page sends no `origin`.
+ * over http or https and the registration's own `origin` member accepts it. A
+ * refused member refuses the whole registration, so a page whose origin the
+ * request grammar cannot carry sends no `origin` and the device still
+ * registers. That covers a sandboxed or `about:blank` / `data:` page, which
+ * reads the opaque `"null"`, and a host the spec's DNS-label pattern is
+ * narrower than: an underscore (`http://my_svc:3000`) or a trailing dot
+ * (`https://crm.example.com.`). The judge is the published request schema the
+ * server parses the body with, so the two cannot disagree.
  */
 export function registrationOrigin(location: Pick<Location, 'protocol' | 'origin'>): string | undefined {
-  return location.protocol === 'http:' || location.protocol === 'https:' ? location.origin : undefined;
+  if (location.protocol !== 'http:' && location.protocol !== 'https:') return undefined;
+  return RegisterDeviceRequestSchema.shape.origin.safeParse(location.origin).success ? location.origin : undefined;
 }
 
 function isPushToken(value: unknown): value is NativePushToken {