Also it seems like when a user logouts, all push subscriptions are deleted. So if a user is logged in on multiple devices (phone, browser, tablet) and logouts from one device/session, it prevents other devices from getting notifications as their push subscriptions are deleted.
I mention this as its related to knowing which subscription needs to be replaced during renewal, and which subscription should be deleted on logout.
Well I was just logged out of Meta today and after logging in I got a push notification for your post… Unless it’s only on the user initiated login code path 
When a user comes back to the forum (or logs in), the browsers push subscriptions are sent again and are recreated. But if you logged out, they are deleted and no push notifications will be delivered until that user goes to the forum from that device.
This doesn’t contradict what you stated since you appear to be saying you got the push notification after logging in.
Code Reference:
https://github.com/discourse/discourse/blob/03d28342f87814e997407f6e7bf0309b02d942d2/config/initializers/100-push-notifications.rb#L29
Oh so this is exactly what I suspected
Nice find! We gotta fix this for sure!
Problem is that currently we don’t store for which device a specific subscription exists for…
The Push API does have a unsubscribe function to invalidate the push subscription:
On logout, we would invoke this (client side) would render that subscription on the server as invalid without affecting any other subscriptions.
In fact, the client already has a unsubscribePushNotification function that does this in the “Live Notification” prefrences. Maybe the solution is to invoke this on logout client side if Live Notifications is enabled. Probably good practice to revoke the client side subscription keys instead of just deleting them from server.
So the fix can be in two parts: