docs(push): bring web push into scope

[grunch]

Summary

docs/PUSH_NOTIFICATIONS.md treated Web Push as a non-goal because the server rejects platform: web. This brings it into scope as a real platform, with the server prerequisites named precisely and the client work specified behind a capability flag so it can merge before the server changes land.

• §2.6 Web. How the doorbell works in a browser: the Firebase service worker receives the push with the tab open, hidden or closed. It shows the server's notification for trade_update, shows its own content-free "New message" for chat_wake (Chrome revokes subscriptions whose push events show nothing), and a tap focuses or opens the app at /app/#/notifications. The worker never loads the wasm core, never opens IndexedDB, never decrypts. The tab resyncs on hidden → resumed, which PR-0b already wires.
• §3.5 Server changes. Two, both verified against mostro-push-server at 1ccf425: accept platform: "web" (the Platform enum and the route validation), and CORS for the app's origin. There is no CORS layer today, and the page is cross-origin isolated, so without it the browser blocks every call to the server.
• No refresh outlives the tab. There is no workmanager on the web and periodicSync is Chromium-only for installed PWAs, so a web registration ages out 48 h after the last run. The Settings copy on web says so.
• Browser support. Chrome, Edge and Firefox. Safari only as an installed PWA, which the deployed bundle is not (--pwa-strategy=none). Capability reads the Notification and PushManager APIs, not the user agent.
• T4.5 / PR-4c (closes Web Push: replace placeholder VAPID key with the real value #133): real VAPID key via a build-time define, the worker rewritten with real config, no payload routing, base-path-aware registration through getToken(serviceWorkerScriptPath:), PushPlatform::Web, static guards in pages_bundle_test.dart, and an opt-in smoke assertion that the worker registers on the isolated page next to coi-serviceworker without breaking isolation.
• §14 item 7 now lists what to verify against the real bundle rather than assume: importScripts from gstatic.com under the isolated page, coexistence with the shim's scope and clients.claim(), registration under /app/.

Test plan

• Documentation only. The pre-commit hook ran the full Rust and Flutter suites.
• Every server claim checked in the mostro-push-server checkout (Platform enum in store/mod.rs, validation in routes.rs, no actix-cors in Cargo.toml); every client claim on main (firebase_options.dart web block is real, web/firebase-messaging-sw.js is a REPLACE_ME placeholder with a routeFromPayload mirror, firebase_messaging_web 4.2.5 exposes serviceWorkerScriptPath).

Manual testing

1. Open docs/PUSH_NOTIFICATIONS.md on GitHub and check the new §2.6 and §3.5 anchors resolve from the table of contents.
2. Read §3.5 next to src/store/mod.rs and src/api/routes.rs in mostro-push-server at 1ccf425, and confirm Platform has only Android and Ios and that Cargo.toml has no CORS crate.
3. Read §5's Firebase row next to web/firebase-messaging-sw.js on main, and confirm the REPLACE_ME config and the routeFromPayload mirror it describes.
4. Read §2.6's isolation paragraph next to CLAUDE.md "Web (wasm)" and confirm the constraints it cites (cross-origin isolation, the shim as first script, --pwa-strategy=none).
5. Read T4.5 and confirm every file it names exists on main except the ones it says it adds.
6. Confirm with the operator whether to open the upstream issue for §3.5 now or after PR-4c is drafted.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T19:15:27.697457Z	5fc9cc7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 51c9aca6-2e8f-4ea6-a166-45c523053e49

📥 Commits

Reviewing files that changed from the base of the PR and between d1ef8c0 and 18fcaea.

📒 Files selected for processing (1)

• docs/PUSH_NOTIFICATIONS.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5fc9cc7a19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Specify a supported custom-worker registration path

With the pinned firebase_messaging ^15.1.3, FirebaseMessaging.getToken accepts vapidKey but has no serviceWorkerScriptPath parameter. Therefore T4.5 cannot establish the proposed /app/ worker and separate scope through this call; falling back to Firebase's default worker lookup also conflicts with the sub-path deployment and the existing isolation-worker requirements. Specify a supported upgrade, JS interop, or combined-worker approach before treating PR-4c as implementable.

AGENTS.md reference: AGENTS.md:L39-L40

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Decouple Safari support from the Flutter PWA strategy

--pwa-strategy=none only disables Flutter's generated caching service worker; it does not prevent installation as a Home Screen app, and this bundle already has a standalone manifest and another service worker. Moreover, macOS Safari Web Push does not have iOS's Home Screen-only restriction. Treating Safari as unavailable until this build flag changes would unnecessarily exclude supported users; detect the push APIs and, on iOS/iPadOS, standalone installation instead.

Useful? React with 👍 / 👎.