The device is the credential — an opaque secret in a host-only cookie, stored hashed. Signing out revokes this device rather than deleting it, so a push subscription cannot outlive the session.

A known member number on a new device creates a pending device, not a session. Check the code matches the one that device is showing before you admit it.

On iOS this only works from the installed PWA — Share → Add to Home Screen, then open from the home screen.

Play, then lock the phone. The lock screen should show Muster. Press next/prev — they log here and to the spike log. Then open pane 3 and press its "steal media session" button: the lock screen must still say Muster.

iOS install friction is the #1 adoption blocker — push requires the installed PWA, Safari only.