[Bug]: Push notifications fail – server unknown by push server after secret change

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Expected behavior:
Push notifications (Talk, Notifications) should be delivered successfully.

Actual behavior:
All devices are deleted immediately with message:
Deleting device because it is unknown by the push server
Push notification sent, but 1 failed

Steps to reproduce

Steps to reproduce:

1. Regenerated secret in config.php (old value lost)
2. Cleared appdata/*/identityproof and appdata/*/notifications/push*
3. Verified connectivity to https://push-notifications.nextcloud.com (HTTP 404 on / as expected)
4. Users re-logged in on iOS/Android apps
5. Ran occ notification:test-push

Expected behavior

Expected behavior:
Push notifications (Talk, Notifications) should be delivered successfully.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Nginx

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Instance information:
Instance ID:
Nextcloud version: 31.0.9.1
PHP version: 8.x
Deployment: self-hosted (single node)
Apps: all up to date
Push proxy: reachable, responds with 404 on / (normal)

What we already tried:

• Removed all identity proof and push registration data (appdata//identityproof, appdata//notifications/push*)
• Verified overwrite.cli.url -> correct public HTTPS URL
• Verified trusted_domains, overwriteprotocol, and proxy headers
• Switched to cron background jobs
• Reinstalled and re-logged in mobile clients

Problem summary:
After regenerating the instance secret, the server lost its trust relationship with the global Nextcloud Push Proxy.
All new device registrations are rejected as:
"unknown by the push server"

Request:
Please reset our Push Proxy registration / trust for this instance so that new device registrations can be accepted again.

Start with config.php, the identityproof and notifications/push* appdata paths, and the occ notification:test-push command to verify how device registration and push delivery fail after the secret change. Done means new device registrations are accepted by the Push Proxy and test notifications are delivered; the requested trust reset appears to require action outside this repository.