Say when a session wants you, and stop calling a stop an error

Three things Bryan asked for, and one the second of them exposed.

**Notifications.** A session that asks a question or finishes a turn now
says so on the phone, per session, switchable from its settings screen.

The switch is stored on the backend rather than the phone, because it is a
fact about the session: one that runs unattended overnight should be quiet
on every device, and answering that question again on each device is how two
of them come to disagree. It is on by default -- a notification nobody
wanted is turned off in one tap, where one that never arrived is not
diagnosable at all.

Which moments count is `notification_for`, and the asymmetry in it is the
point. *Waiting on a person* is worth saying however it was reached.
*Finished* is only worth saying when this server watched the work happen:
sessions settle into idle for several reasons that are not "your work
ended", including every one of them being adopted at startup, and announcing
those would put "finished" on the phone for the whole config on every
backend restart. That is the failure that makes somebody switch the feature
off, so it has a test naming every transition rather than the two that
work.

The stream is `GET /notifications`, live only and with no cursor -- the one
place this server does not offer to catch a client up. A notification is a
claim about now; replaying "your turn" from an hour ago sends somebody to a
session that may have been answered from another device since, and a
notification that is wrong costs the trip *and* the credibility of the next
one. What was missed is still on the session list, which says what is
waiting without claiming to be news.

On the phone it is a foreground service, because Android has had no
long-lived background service since 8.0 -- it is what Syncthing does, and
Discord is not a counter-example since it takes a push from Google, which
would mean this backend talking to Google about somebody's sessions. The
ongoing notification Android charges for it sits on an `IMPORTANCE_MIN`
channel: no sound, no status-bar icon, bottom of the shade. `specialUse`
rather than `dataSync`, which is what it looks like: Android 15 caps
dataSync at six hours a day, and a connection that stops listening after six
hours misses the overnight run it exists for.

**A stop is not an error.** The CLI reports an interrupted turn exactly as
it reports a broken one -- `is_error` on a `result` -- so pressing Stop
showed "the turn ended with an error" for doing what the button says. The
line cannot distinguish them; what does is that this side asked, so the
driver says so before the request goes out and the translator spends that on
the next result. The test's second half is the one that matters: the naive
fix passes the first half and silences every genuine failure after it.

**Every status says which one it is.** The session screen's status row named
only `exited` and left the rest blank, so idle and "nobody could read it"
looked identical -- and a just-stopped turn showed nothing, which reads as
the app having lost the session rather than as the stop having worked. The
words are the session list's own, so a state is not called two things
depending which screen you are on. Red on a quota bar now starts at 90%.

**`GET /sessions/{id}`**, which the notification switch found missing. A
screen opened from a list row carries the row the list last fetched: fine
for a title, wrong for a switch, which is *set to* something. Caught on the
emulator, where the switch read on against a backend that said off, with
nothing on screen to say which was true. The screen now reads the session
when it opens, and until that answers the switch is disabled and says so --
a two-position control cannot say "I do not know", so it does not pretend
to.

Verified on the emulator with the app backgrounded: the service holds the
stream (`isForeground=true types=0x40000000`), a finished turn posts
"Finished" and a question replaces it with "Waiting for you" on the same
tag, turning the switch off silences it with no restart, and turning it back
on from the phone reaches config.ron. The interrupt is a translator test
rather than a live turn, which is where that logic is anyway.

app/androidApp/src/main/AndroidManifest.xml

@@ -10,6 +10,14 @@
          dev-updater's manifest for the full story. -->
     <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
 
+    <!-- Telling somebody a session wants them. POST_NOTIFICATIONS is a
+         runtime permission from Android 13; the foreground-service pair
+         below is what lets the connection outlive the app being closed,
+         which is the entire point (see Notifications.kt). -->
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+
     <!-- tools:ignore MissingApplicationIcon: there is no icon yet, and
          that is a decision rather than an oversight. An app with no icon
          of its own is obvious to anyone who opens a launcher, so the
@@ -49,6 +57,23 @@
             </intent-filter>
         </activity>
 
+        <!-- specialUse rather than dataSync, which is the type this looks
+             like: Android 15 caps dataSync at six hours a day, and a
+             connection that stops listening after six hours is one that
+             misses the overnight run it exists for. The subtype below is
+             the reason string that type requires. -->
+        <service
+            android:name=".NotificationService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="Holds one connection to the user's own backend so a session
+                    that needs an answer can be reported while the app is closed. There is no
+                    push service: the backend is reachable only over the user's WireGuard
+                    tunnel and never talks to a third party." />
+        </service>
+
         <!-- The scanner behind Settings' "Scan QR code". Declared here so
              it can drop the library CaptureActivity's landscape pin: the
              code being scanned is usually on a monitor in front of someone

app/androidApp/src/main/kotlin/com/example/aiapp/Api.kt

@@ -141,6 +141,14 @@ data class SessionSummary(
      * Whether this continues a session the machine already had, which changes what deleting means.
      */
     val imported: Boolean,
+    /**
+     * Whether this session announces itself when it wants attention.
+     *
+     * Reported rather than assumed, for the same reason [permissionMode] is: a switch that draws
+     * itself from a default is one you can turn off while believing you are reading it. Defaults to
+     * on when a backend is too old to say, which matches what that backend actually does.
+     */
+    val notify: Boolean,
     val status: String,
     val lastActivity: Double,
 )
@@ -156,6 +164,7 @@ private fun parseSession(session: JSONObject) =
         model = session.optString("model").ifEmpty { null },
         permissionMode = session.optString("permissionMode").ifEmpty { null },
         imported = session.optBoolean("imported", false),
+        notify = session.optBoolean("notify", true),
         status = session.getString("status"),
         lastActivity = session.getDouble("lastActivity"),
     )
@@ -163,6 +172,17 @@ private fun parseSession(session: JSONObject) =
 fun fetchSessions(settings: ServerSettings): List<SessionSummary> =
     requestFromServer(settings, "/sessions") { it.jsonObjects(::parseSession) }
 
+/**
+ * One session as the server has it now.
+ *
+ * For screens whose controls are *set to* something rather than merely showing it. A screen opened
+ * from a list row carries the row the list last fetched, which is a snapshot: fine for a title,
+ * wrong for a switch, since a switch drawn from a stale row shows a position that may have been
+ * changed since -- here or on another device -- and nothing on screen says which.
+ */
+fun fetchSession(settings: ServerSettings, sessionId: String): SessionSummary =
+    requestFromServer(settings, "/sessions/$sessionId") { parseSession(it.jsonObject()) }
+
 // What the server offers, so the spawn screen has no hardcoded lists: a
 // setup added to the server's config.ron appears here with no app rebuild.
 //
@@ -588,6 +608,16 @@ fun setSessionPermissionMode(settings: ServerSettings, sessionId: String, mode:
     ) {}
 }
 
+/** Turns this session's notifications on or off. Stored on the backend -- see `SessionConfig`. */
+fun setSessionNotify(settings: ServerSettings, sessionId: String, notify: Boolean) {
+    requestFromServer(
+        settings,
+        "/sessions/$sessionId/notify",
+        method = "POST",
+        jsonBody = JSONObject().put("notify", notify).toString(),
+    ) {}
+}
+
 /**
  * Asks the session to run one of its own commands.
  *

app/androidApp/src/main/kotlin/com/example/aiapp/MainActivity.kt

@@ -33,6 +33,16 @@ class MainActivity : ComponentActivity() {
     private val requestLocalNetworkPermission =
         registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
 
+    /**
+     * The service starts either way, and posts nothing if this is refused.
+     *
+     * Deliberately not gated on the answer: the permission can be granted later from Android's own
+     * settings, and a service that only ever started at the moment it was granted would then stay
+     * down until the app was launched again -- which is the case notifications exist to avoid.
+     */
+    private val requestNotificationPermission =
+        registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
 
@@ -55,7 +65,15 @@ class MainActivity : ComponentActivity() {
             requestLocalNetworkPermission.launch(Manifest.permission.ACCESS_LOCAL_NETWORK)
         }
 
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            requestNotificationPermission.launch(Manifest.permission.POST_NOTIFICATIONS)
+        }
+
         handleEnrollment(intent)
+        // After enrollment, so a first launch that arrives with a token
+        // starts the service with something to connect to rather than
+        // stopping it and waiting for the next launch.
+        NotificationService.sync(this)
 
         setContent {
             MaterialTheme(colorScheme = AiAppColors) {
@@ -94,6 +112,9 @@ class MainActivity : ComponentActivity() {
         }
         saveServerSettings(this, settings)
         settingsVersion++
+        // Enrolling is the moment there is a backend to watch, and
+        // re-enrolling elsewhere is the moment the old one stops being it.
+        NotificationService.sync(this)
         Toast.makeText(this, "Enrolled with ${settings.baseUrl}", Toast.LENGTH_LONG).show()
     }
 }

app/androidApp/src/main/kotlin/com/example/aiapp/Notifications.kt

@@ -0,0 +1,273 @@
+package com.example.aiapp
+
+import android.Manifest
+import android.app.Notification
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.content.pm.ServiceInfo
+import android.os.Build
+import android.os.IBinder
+import androidx.core.app.NotificationChannelCompat
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.app.ServiceCompat
+import androidx.core.content.ContextCompat
+import java.io.IOException
+import java.net.HttpURLConnection
+import java.net.URL
+import kotlin.concurrent.thread
+import org.json.JSONObject
+
+/**
+ * Telling somebody a session wants them, when they are not looking at the app.
+ *
+ * This is a **foreground service**, which on Android is the only way to keep a connection open
+ * while the app is closed -- there has been no such thing as a long-lived background service since
+ * Android 8. It is what Syncthing does for the same reason. Discord is not a counter-example: it
+ * gets a push from Google's servers, which would mean this backend talking to Google about
+ * somebody's coding sessions, and the whole point of the tunnel is that it does not.
+ *
+ * The cost Android charges for it is a notification of its own that cannot be dismissed. That is
+ * made as quiet as the platform allows: [ONGOING_CHANNEL] is `IMPORTANCE_MIN`, so it makes no
+ * sound, shows no status-bar icon, and sits at the bottom of the shade -- the same arrangement
+ * Syncthing's "hide the persistent notification" option produces. It is not hidden outright,
+ * because it cannot be and because it should not be: it is the honest indicator that something is
+ * holding a connection open.
+ */
+class NotificationService : Service() {
+    @Volatile private var stream: HttpURLConnection? = null
+    @Volatile private var stopping = false
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        val settings = loadServerSettings(this)
+        if (settings == null) {
+            // Nothing to connect to. Stopping rather than idling: a service
+            // holding no connection still costs the ongoing notification,
+            // which would then be announcing work that is not happening.
+            stopSelf()
+            return START_NOT_STICKY
+        }
+        // Through ServiceCompat so the type is stated once and ignored on
+        // the versions that predate types, rather than branching here.
+        ServiceCompat.startForeground(this, ONGOING_ID, ongoingNotification(), foregroundType())
+        thread(isDaemon = true, name = "ai-app-notifications") { follow(settings) }
+        // Restarted if Android kills it, which is the whole point: the
+        // window this covers is exactly the one where nobody is watching.
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        stopping = true
+        stream?.disconnect()
+    }
+
+    /**
+     * Follows the backend's notification stream, reconnecting until stopped.
+     *
+     * A dropped connection is the ordinary case here rather than an error -- a phone changes
+     * networks, the tunnel comes and goes, the backend restarts -- so it retries quietly and
+     * forever. Nothing is shown when it cannot connect: a notification saying "I could not tell you
+     * whether anything happened" on a phone in somebody's pocket is noise about a condition they
+     * cannot act on, and the session list already says what is waiting when they next look.
+     */
+    private fun follow(settings: ServerSettings) {
+        while (!stopping) {
+            try {
+                readStream(settings)
+            } catch (_: IOException) {
+                // Deliberate: see above.
+            }
+            if (stopping) return
+            try {
+                Thread.sleep(RECONNECT_DELAY_MS)
+            } catch (_: InterruptedException) {
+                return
+            }
+        }
+    }
+
+    private fun readStream(settings: ServerSettings) {
+        val connection =
+            URL("${settings.baseUrl}/notifications").openConnection() as HttpURLConnection
+        stream = connection
+        try {
+            connection.applyPinnedTls()
+            connection.connectTimeout = CONNECT_TIMEOUT_MS
+            // No read timeout, for the reason EventStream gives: between
+            // notifications there is nothing to read, possibly for hours.
+            connection.readTimeout = 0
+            connection.setRequestProperty("Authorization", "Bearer ${settings.token}")
+            connection.setRequestProperty("Accept", "text/event-stream")
+            if (connection.responseCode != 200) {
+                throw IOException("HTTP ${connection.responseCode} for the notification stream")
+            }
+            val reader = connection.inputStream.bufferedReader()
+            val data = StringBuilder()
+            while (!stopping) {
+                val line = reader.readLine() ?: break
+                when {
+                    line.isEmpty() -> {
+                        if (data.isNotEmpty()) show(parseNotification(data.toString()))
+                        data.clear()
+                    }
+                    line.startsWith("data:") -> data.append(line.removePrefix("data:").trim())
+                    else -> {} // comments (keep-alives) and ids: nothing to do
+                }
+            }
+        } finally {
+            connection.disconnect()
+            stream = null
+        }
+    }
+
+    /**
+     * One notification per session, replacing that session's previous one.
+     *
+     * Keyed by session id rather than accumulating: two sessions wanting attention are two things
+     * to know about, but one session that finished and then asked a question is one thing -- the
+     * question. A stack of stale rows for the same conversation is how a notification drawer
+     * becomes something to clear rather than read.
+     */
+    private fun show(notification: SessionNotification) {
+        val manager = NotificationManagerCompat.from(this)
+        // Two different noes, and both are answers rather than faults: the runtime permission
+        // refused, and notifications switched off for the app in Android's own settings. Neither
+        // is reported anywhere -- the person said no, and saying it back to them through the
+        // channel they closed is not available anyway.
+        val allowed =
+            ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS) ==
+                PackageManager.PERMISSION_GRANTED
+        if (!allowed || !manager.areNotificationsEnabled()) {
+            return
+        }
+        val open =
+            PendingIntent.getActivity(
+                this,
+                0,
+                Intent(this, MainActivity::class.java)
+                    .setAction(Intent.ACTION_MAIN)
+                    .addCategory(Intent.CATEGORY_LAUNCHER),
+                PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+            )
+        val built =
+            NotificationCompat.Builder(this, ALERT_CHANNEL)
+                .setContentTitle(notification.title)
+                .setContentText(
+                    when (notification.kind) {
+                        // What the reader has to do, not what the session
+                        // did: "awaitingInput" is the wire's word and says
+                        // nothing to somebody reading a lock screen.
+                        "awaitingInput" -> "Waiting for you"
+                        else -> "Finished"
+                    }
+                )
+                .setSmallIcon(android.R.drawable.stat_notify_chat)
+                .setContentIntent(open)
+                .setAutoCancel(true)
+                .setWhen((notification.at * 1000).toLong())
+                .setShowWhen(true)
+                .build()
+        manager.notify(notification.sessionId, ALERT_ID, built)
+    }
+
+    /**
+     * The type Android 14+ requires a foreground service to declare, and nothing before it.
+     *
+     * Named behind a version check rather than passed as a constant: the value is inlined at
+     * compile time and would be handed to platforms that have no concept of it, which is exactly
+     * the case lint's InlinedApi exists to catch. Zero is what ServiceCompat wants where types do
+     * not apply.
+     */
+    private fun foregroundType(): Int =
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE
+        } else {
+            0
+        }
+
+    private fun ongoingNotification(): Notification =
+        NotificationCompat.Builder(this, ONGOING_CHANNEL)
+            .setContentTitle("Watching for sessions that need you")
+            .setSmallIcon(android.R.drawable.stat_notify_sync)
+            .setOngoing(true)
+            .setPriority(NotificationCompat.PRIORITY_MIN)
+            .build()
+
+    companion object {
+        /**
+         * Starts the service if there is a server to connect to, and stops it otherwise.
+         *
+         * Called on every launch rather than once: a service Android killed does not restart itself
+         * if the process was replaced, and asking for one that is already running is free.
+         */
+        fun sync(context: Context) {
+            val intent = Intent(context, NotificationService::class.java)
+            if (loadServerSettings(context) == null) {
+                context.stopService(intent)
+                return
+            }
+            createChannels(context)
+            ContextCompat.startForegroundService(context, intent)
+        }
+
+        /**
+         * Two channels, because they are two different things to be told.
+         *
+         * The alerts are what somebody turned this on for, so they get the default importance and
+         * whatever sound and heads-up display the person has chosen for the app. The ongoing one is
+         * the platform's tax for staying connected, so it takes the lowest importance that exists.
+         * Both are created before the service starts, since posting to a channel that does not
+         * exist is silently dropped.
+         */
+        private fun createChannels(context: Context) {
+            val manager = NotificationManagerCompat.from(context)
+            manager.createNotificationChannel(
+                NotificationChannelCompat.Builder(
+                        ALERT_CHANNEL,
+                        NotificationManagerCompat.IMPORTANCE_DEFAULT,
+                    )
+                    .setName("Sessions needing attention")
+                    .build()
+            )
+            manager.createNotificationChannel(
+                NotificationChannelCompat.Builder(
+                        ONGOING_CHANNEL,
+                        NotificationManagerCompat.IMPORTANCE_MIN,
+                    )
+                    .setName("Staying connected")
+                    .build()
+            )
+        }
+
+        private const val ALERT_CHANNEL = "sessions"
+        private const val ONGOING_CHANNEL = "connection"
+        private const val ONGOING_ID = 1
+        /** Shared by every alert; the session id is the tag that separates them. */
+        private const val ALERT_ID = 2
+        private const val RECONNECT_DELAY_MS = 5_000L
+    }
+}
+
+/** One frame of `GET /notifications`. */
+data class SessionNotification(
+    val sessionId: String,
+    val title: String,
+    /** The wire's word: "awaitingInput" or "finished". */
+    val kind: String,
+    val at: Double,
+)
+
+fun parseNotification(json: String): SessionNotification {
+    val body = JSONObject(json)
+    return SessionNotification(
+        sessionId = body.getString("sessionId"),
+        title = body.getString("title"),
+        kind = body.getString("kind"),
+        at = body.optDouble("at", 0.0),
+    )
+}

app/androidApp/src/main/kotlin/com/example/aiapp/SessionScreen.kt

@@ -1254,16 +1254,25 @@ private fun SessionStatusRow(
                 )
                 Spacer(Modifier.weight(1f))
             }
-            else -> {
-                if (status == "exited") {
-                    Text(
-                        "exited",
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                Spacer(Modifier.weight(1f))
-            }
+            // Every remaining state says which one it is, including the quiet one. The row used
+            // to name only `exited` and leave the rest blank, so a session sitting idle and one
+            // whose status nobody could read looked identical -- and a turn that had just been
+            // stopped showed nothing at all, which reads as the app having lost the session
+            // rather than as the stop having worked. The words are the session list's own, so
+            // one state is not called two things depending which screen you are on.
+            else ->
+                Text(
+                    when (status) {
+                        "idle" -> "idle"
+                        "exited" -> "exited"
+                        "awaitingInput" -> "your turn"
+                        "unknown" -> "can't tell"
+                        else -> status
+                    },
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.weight(1f),
+                )
         }
         // Nothing rather than "0 tok" before anything has been spent: a total of zero is a fact
         // about a conversation that has not started, and it is the one reading nobody needs.

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsScreen.kt

@@ -15,8 +15,10 @@ import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.Button
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
@@ -52,6 +54,43 @@ fun SessionSettingsScreen(
     var name by remember(session.id) { mutableStateOf(session.title) }
     var saving by remember { mutableStateOf(false) }
     var error by remember { mutableStateOf<String?>(null) }
+    // Null until the server has been asked. The row this screen was opened from is a snapshot of
+    // whenever the list was last fetched, so drawing the switch straight from it would show a
+    // position that may have been changed since -- from here or from another device -- with
+    // nothing to say so. Until the answer arrives the switch is disabled and the caption says it
+    // is being read, which is the one honest thing a two-position control can do about not
+    // knowing.
+    var notify by remember(session.id) { mutableStateOf<Boolean?>(null) }
+    var notifyError by remember { mutableStateOf<String?>(null) }
+
+    LaunchedEffect(session.id) {
+        notify =
+            try {
+                withContext(Dispatchers.IO) { fetchSession(settings, session.id).notify }
+            } catch (e: ApiException) {
+                // Left unknown rather than falling back to the stale row: the switch stays
+                // disabled and says why, instead of offering a position nothing confirmed.
+                notifyError = e.message
+                null
+            }
+    }
+
+    // Moved optimistically so the switch answers the finger that moved it, and put back if the
+    // request is refused -- a switch that waits for a round trip reads as broken on a slow
+    // tunnel, and one that stays moved after a refusal lies.
+    fun setNotify(wanted: Boolean) {
+        val was = notify
+        notify = wanted
+        notifyError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { setSessionNotify(settings, session.id, wanted) }
+            } catch (e: ApiException) {
+                notify = was
+                notifyError = e.message
+            }
+        }
+    }
 
     // Nothing to do when the name has not changed, so the button says so rather than sending a
     // request whose success would look exactly like the failure of having typed nothing.
@@ -106,7 +145,40 @@ fun SessionSettingsScreen(
             color = MaterialTheme.colorScheme.onSurfaceVariant,
             modifier = Modifier.padding(top = 4.dp),
         )
-        Spacer(Modifier.height(16.dp))
+        Spacer(Modifier.height(24.dp))
+
+        // The switch gets its own row rather than sitting beside the label: a control is taller
+        // than a line of text, so putting one in a row with a label re-centres that label and
+        // knocks it out of line with everything above it.
+        Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
+            Text("Notify me", modifier = Modifier.weight(1f))
+            Switch(
+                checked = notify == true,
+                onCheckedChange = { setNotify(it) },
+                enabled = notify != null,
+            )
+        }
+        Text(
+            if (notify == null && notifyError == null) "Reading the current setting..."
+            else
+                "A notification when this session asks you something or finishes a turn. Kept " +
+                    "on the backend, so every device agrees about which sessions are worth " +
+                    "interrupting you for.",
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        notifyError?.let {
+            Spacer(Modifier.height(4.dp))
+            // Beside the switch that failed, not with the rename's error: they are two requests
+            // and a reader has to be able to tell which one the server refused.
+            Text(
+                it,
+                color = MaterialTheme.colorScheme.error,
+                style = MaterialTheme.typography.bodySmall,
+            )
+        }
+
+        Spacer(Modifier.height(24.dp))
         // Disabled rather than absent while there is nothing to save: a button that comes and
         // goes makes its own presence the signal, and its absence cannot say why.
         Button(onClick = { save() }, enabled = changed && !saving) {

app/androidApp/src/main/kotlin/com/example/aiapp/Theme.kt

@@ -167,7 +167,7 @@ fun quotaColor(percent: Double): Color =
 private const val WARNING_PERCENT = 75.0
 
 /** Close enough that the next turn may be the one that is refused. */
-private const val OVER_LIMIT_PERCENT = 95.0
+private const val OVER_LIMIT_PERCENT = 90.0
 
 /**
  * Code: a fenced block, an inline span, a tool's input.