News that finds you, including when nothing of ours is open

The dots covered Reports and Messages from the day those sections existed. The
announcement did not: only a chat reply produced an HX-Trigger, so a scheduled
run that filed a report or posted into Messages lit a green dot in a corner and
said nothing at all. That is precisely the arrival nobody is watching for -- a
chat reply is one you asked for a moment ago and are probably looking at.

So every kind announces, each with its own once-only flag, and the payload is a
list of items rather than of titles, because a notification is a thing you click
and a title cannot say where.

One arrival, three channels, and they must not all fire. A toast for somebody
looking at the page; a count in the tab title while it is hidden, cleared on
focus; a system notification for somebody elsewhere entirely. The service worker
is the only place that can tell them apart -- the server cannot see whether a
window is focused and the page cannot see a push it did not receive -- so it
stays quiet when one of its own windows has focus.

And web push, hand-rolled against RFC 8291 and RFC 8292 with the cryptography
already here for Fernet. It exists because everything else is polled by an open
page, and the arrival worth interrupting somebody for is a schedule firing at
seven in the morning with the laptop shut.

The trade is real and is written down rather than glossed: the POST goes to
Google's or Mozilla's push service, the payload is sealed end to end so they
cannot read it, and what they do learn is that this server sent something and
when. Opt-in per device, off until asked for, and the rest of the system works
without it. Nothing else in LLeMbas contacts an outside service on its own.

The encryption is tested by decrypting it back with an independent
implementation of the specification's other half. There is no other way to know:
a push service accepts the POST and forwards bytes it cannot read, so a wrong
derivation is a notification that never appears, with a 201 in the log.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PLAN.md

@@ -9,7 +9,7 @@ reasoning, tool calling with web search, custom HTTP tools and MCP servers,
 agent chats that work on a machine over SSH, a knowledge library, notes, memory
 and skills, speech in and out, image generation over ComfyUI, users and groups,
 model administration, installable as an app, reports, messages, and scheduled
-work that runs on its own. 1824 tests, `ruff` clean.
+work that runs on its own. 1897 tests, `ruff` clean.
 
 What remains before the first stable release is written out below, in phases,
 under [The road to 1.0.0](#the-road-to-100).
@@ -52,8 +52,10 @@ be a different project, not a refactor.
       are already an objective. Renameable from the heading and from the sidebar
       row; one response updates both
 - [x] Chats created on first message, so an abandoned composer leaves nothing
-- [x] **Unread indicator** — a green dot and a toast when a reply lands while
-      you were elsewhere
+- [x] **You are told when something arrives** — a dot and a toast for a reply,
+      a report or a scheduled run; a count in the tab title while you are
+      looking elsewhere; and a browser notification, opt-in per device, that
+      reaches you with LLeMbas closed
 - [x] **A reply that started without you asking still arrives** — the open chat
       page polls for turns it has not got, so a background job waking the model
       appears where you are looking instead of only after a reload. Quiet while
@@ -422,7 +424,21 @@ seen working.
       `tool.notes` and `tool.memory` as well, because those are what the model
       actually reached for
 
-### Phase 2 — image generation admin (`0.9.1`)
+### Notifications (`0.9.1`)
+- [x] **Everything that arrives is announced**, not only chat replies. The dots
+      covered Reports and Messages; the announcement did not, so a scheduled run
+      lit a dot in a corner and said nothing
+- [x] **A count in the tab title** while you are looking elsewhere, cleared when
+      you come back
+- [x] **Web push**, so a schedule firing at seven in the morning reaches a
+      browser that is shut. Hand-rolled against RFC 8291 and 8292 with the
+      `cryptography` already here. Opt-in per device, asked for once in a dialog
+      of ours before the browser's own — and the one thing in LLeMbas that
+      contacts an outside service, which `services/push.py` says plainly
+- [x] One arrival never announced three times: the service worker stays quiet
+      when a window of its own has focus
+
+### Phase 2 — image generation admin (`0.9.2`)
 - [ ] **Defaults an administrator can set** — steps, cfg, size, sampler,
       scheduler, denoise, negative, batch. There were none: one hardcoded set
       from the SD1.5 era, and prose in a box as the only way to change it