audit F5 [tech-debt]: PWA manifest icons missing `purpose: maskable`; manifest missing `scope` and `id`

[intendednull]

File: crates/web/manifest.json:9
Severity: tech-debt
Obvious? no

Both icon entries lack "purpose": "any maskable", so on Android the OS does not have a safe-zone-aware version of the launcher icon and may crop the SVG awkwardly in adaptive-icon containers. The manifest also lacks "scope": "/" and "id": "/" — without them, two installed instances on the same origin (e.g. dev vs production builds at root) may collide, and the browser falls back to using the URL as identity.

Fix: add purpose to both icons (or, ideally, ship a separate maskable icon with appropriate padding) and add scope/id fields. Five-minute fix; ships better install-on-mobile experience and prevents a future origin-sharing bug.

---

Filed by /general-audit @ 88498a5 (2026-05-04). master: #600.