diff --git a/CLAUDE.md b/CLAUDE.md
index df0fb8e3..e1b20e5f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -212,7 +212,7 @@ ahead of everything, and it re-verifies the token itself so it covers routes tha
 - `permissions/registry.ts` — the single enumeration of what the platform can do, in five kinds:
   `core` (every account, not deniable), `app` (**the grantable surface**), `confined` (grantable, but
   only to an account that has a Linux user), `execution` and `admin` (owner only, and `execution` is
-  never grantable at any level). **21 entries as of 2026-08-23** — verified by `bun run docs:check`, which fails if this number drifts again: 5 core, 4 app, 4 confined, 3 execution, 5 admin. It said 27 for nine days. The execution count dropped by one when Minesweeper became a plugin — see `plugins/minesweeper/manifest.ts` for why that was a fix rather than a downgrade.
+  never grantable at any level). **21 entries as of 2026-08-24** — verified by `bun run docs:check`, which fails if this number drifts again: 6 core, 3 app, 4 confined, 3 execution, 5 admin. `notify` moved from `app` to `core` on 2026-08-24: it was grantable, nothing granted it, and every Member's app was silently 403'd registering its own push token. It said 27 for nine days. The execution count dropped by one when Minesweeper became a plugin — see `plugins/minesweeper/manifest.ts` for why that was a fix rather than a downgrade.
 - `permissions/authorize.ts` — resolves "may this account do this". Owner short-circuits first; every
   other answer is role grants plus core, with `execution`/`admin` stripped even if a row grants them,
   and `confined` stripped for an account with no `osUser`.
diff --git a/src/servers/permissions/registry.ts b/src/servers/permissions/registry.ts
index 5ae186bf..042fcf0c 100644
--- a/src/servers/permissions/registry.ts
+++ b/src/servers/permissions/registry.ts
@@ -198,7 +198,19 @@ const CORE_REGISTRY: Permission[] = [
     key: 'notify',
     label: 'Notifications',
     description: 'Push notifications to your devices',
-    kind: 'app',
+    /*
+      CORE, not `app`, since 2026-08-24.
+
+      It was grantable and nothing granted it, so every Member's app got a 403 the moment it tried to
+      register its push token — silently, at launch, with no notification ever arriving and nothing
+      anywhere saying why. Invisible for days because the owner bypasses the check.
+
+      Making it grantable was the mistake rather than the missing grant. These are the caller's OWN
+      devices, and the send route resolves its target from the authenticated header rather than the body
+      (`sidecar/notify/resolve-user.ts`), so an account can only ever reach its own phone. There is no
+      version of "you may not subscribe to your own notifications" that is a coherent thing to configure.
+    */
+    kind: 'core',
     api: ['/notify'],
     // Device registration is the caller's own — a phone subscribing to its own push channel.
     //