diff --git a/android/PLAN.md b/android/PLAN.md
index 9020d83..c7537d8 100644
--- a/android/PLAN.md
+++ b/android/PLAN.md
@@ -966,6 +966,17 @@ The ntfy relay is treated as **untrusted infrastructure**, and the design makes
   write to `/auth/me/notifications/subscriptions`. Tapping a notification deep-links to the relevant
   screen (§ open item below).
 
+> **Gotcha — the PUT body must always carry `streams`, even when empty.** The backend validator
+> requires the field (`body('streams').isArray()`), so an empty set has to be sent as
+> `{"streams":[]}`, never `{}`. kotlinx.serialization omits a property equal to its default
+> (`encodeDefaults=false`), so a DTO field like `streams: List<String> = emptyList()` gets *dropped*
+> from the body when the set is empty — the app then sends `{}` and the server rejects it `400`.
+> Symptom: clearing your **last** subscription fails with "could not save" and the toggle sticks
+> (any non-empty set still includes the field, so only the final toggle-off breaks). Fix: give the
+> request DTO field **no default** so kotlinx always encodes it (Android-app
+> `fix/notifications-empty-subscriptions`). The same trap applies to any "replace the full set"
+> `PUT`/`POST` whose empty value equals a DTO default — prefer no default on required request fields.
+
 ## 12. Build & CI (Gitea Actions)
 
 Builds run on the org's existing self-hosted runners (`runs-on: ubuntu-latest`, same label the other