diff --git a/docs/human-gates.md b/docs/human-gates.md
index fbbbf7a..bc7f24b 100644
--- a/docs/human-gates.md
+++ b/docs/human-gates.md
@@ -27,9 +27,11 @@ The immutable identity is authenticated account + `source` + `project` + `candid
 
 Consumers list `GET /api/v1/human-gates`, inspect `GET /api/v1/human-gates/{id}`, and submit `POST /api/v1/human-gates/{id}/decision` with a new `Idempotency-Key`, `expected_revision`, and either `release` or `hold`. Hold requires a reason. Release requires all three checklist confirmations; if any required check is not successful it also requires an explicit override reason. Durable receipts are available at `GET /api/v1/human-gate-receipts/{receipt_id}`. All endpoints are authenticated, account-bound, and `Cache-Control: no-store`.
 
-## Telegram coalescing contract
+## Privacy-safe notification contract
 
-Telegram or lock-screen adapters MUST coalesce pending changes per authenticated account and expose **count and route only**:
+Web Push is opt-in per authenticated device under **My Work → Settings → Notify me when release decisions are waiting**. The preference is stored with that device's push subscription; revoked sessions are removed before delivery. The poller honors the device's routine-alert quiet hours, coalesces unchanged pending counts, and routes a notification tap to `#/my-work/human-gates`.
+
+Web Push, Telegram, and other lock-screen adapters MUST expose **count and route only**:
 
 ```json
 {