1.28.0 — Push verification and realtime disconnect fixes

2026-09-14

Fixes server-enforced WebSocket disconnection and makes push verification truthful. Includes stricter push-test input and authentication requirements.

Breaking

• Push-test messages must be nonblank strings of at most 1,000 characters; config-test device tokens must be strings of at most 4,096 characters.
• Caller-device push tests reject API keys and key-backed sessions. Push diagnostics return safe error codes instead of raw provider details.

Added

• Administrators can check readiness and send a real test push to one registered device.

Fixed

• FCM checks validate with the provider; simulations and invalid-token rejections no longer count as successful verification.

Security

• disconnect_user() now sends the server control command that closes current WebSockets, without relying on the client to cooperate.

Upgrade notes

• Confirm push receipt on the device; provider acceptance is not delivery confirmation. Check the device before retrying an unknown outcome.
• Realtime disconnect remains best-effort through Redis and does not prevent a new connection from authenticating. No migrations.