Fig 6While you're awayTap the alert or a Live Activity rowThe Push Relay sees only the outside
Notification Key: one per Host, also on your phoneLive Activity counts travel in plaintextSSH events line: shut 20 s after you leaveOnce you leave Heeler, SSH closes after a 20 s grace, and the Host's plugin seals each Blocked or Done alert with that Host's Notification Key. The Push Relay passes it to APNs; both see only the outside (the address and the Live Activity counts), never the content. Your phone opens it with the same key, which it made and gave the Host over SSH.