Report what a session last did and what it cost, not what this page holds

Three readings that were each a part presented as the whole.

**"just now", everywhere, after a restart.** A relaunched session took its
last-activity from the clock, so every session the backend brought back
claimed to have been active that instant. On the phone that is every row
reading "just now" and the list -- which sorts by it -- coming back in an
order that means nothing, with the conversation somebody was in the middle
of buried among sessions untouched for days. It comes from the transcript
now, in the pass `Transcript::open` already makes, which is the same
correction `last_status` got and for the same reason: a server that has just
started has been told nothing, and the file is the only thing it knows. The
test backdates a transcript by a day, so it cannot pass by the test being
fast; it fails on the old code with the clock's answer in the message.

**The token total was the newest page's.** The phone added up the
`UsageDelta`s it had received, and it opens a session on the newest page of
the transcript -- so a long conversation reported its last few turns as the
total, and a page with no turn in it reported nothing at all, since zero is
drawn as blank. That is the reading Bryan saw: no tokens, on sessions that
had certainly spent some.

The count belongs to the server, which is the only side that sees every
turn. `UsageDelta` now carries the running total beside the delta, filled in
by the pump rather than by each driver -- a driver knows what its own turn
cost and nothing else does, so a new one cannot get this wrong by leaving it
out -- and the session row reports it for a screen that has not opened the
stream yet. The phone takes the largest total it has seen instead of
accumulating, which also means paging older history cannot move it, and
leaves the seeded figure alone for transcripts recorded before the field
existed. Seeded by summing deltas at startup for exactly that reason.

**The header said the model twice and the machine backwards.** A session's
subtitle now reads `machine · provider`, in that order and with no "on"
joining them, matching the list and the usage dialog -- the "on" made it a
phrase, which works in one order and stops working the moment the same pair
is shown somewhere else. The model is gone from it: the footer's picker
already shows what the session is set to, and two places showing it meant
two things to keep in step, which disagreed for a moment on every switch
since one follows the request and the other the session's own answer.

Checked on the emulator against a twelve-turn session whose visible page
held the last six: the header reads "this machine · echo", the status row
reads "idle", and the total reads 42 tok, which is what `GET
/sessions/{id}` says rather than what the page adds up to.

server/src/session/mod.rs

@@ -143,6 +143,9 @@ pub struct SessionInfo {
     pub imported: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cwd: Option<PathBuf>,
+    /// Every token this session has spent, so a phone showing a total does
+    /// not have to add up a transcript it only holds part of.
+    pub total_tokens: u64,
     /// Whether this session announces itself -- reported for the same
     /// reason `permission_mode` is: a switch that guesses its own position
     /// is how you turn something off while believing you are reading it.
@@ -253,6 +256,12 @@ struct Shared {
     /// session was *launched* with, so reporting from it would show the
     /// mode a change had already replaced.
     permission_mode: Mutex<Option<String>>,
+    /// Every token this session has spent.
+    ///
+    /// Kept here because only the pump sees every turn, and reported on the
+    /// session row so a phone opening a long conversation has the real
+    /// figure rather than the newest page's share of it.
+    total_tokens: Mutex<u64>,
     /// Whether this session's attention-wanting moments are announced.
     ///
     /// Mirrored out of the config so the pump can read it without taking
@@ -370,6 +379,7 @@ impl LiveSession {
             title: self.shared.title.lock().unwrap().clone(),
             model: self.shared.model.lock().unwrap().clone(),
             permission_mode: self.shared.permission_mode.lock().unwrap().clone(),
+            total_tokens: *self.shared.total_tokens.lock().unwrap(),
             notify: *self.shared.notify.lock().unwrap(),
             imported,
             keeps_own_transcript,
@@ -706,6 +716,7 @@ impl SessionManager {
                     title: meta.title.clone(),
                     model: meta.model.clone(),
                     permission_mode: meta.permission_mode.clone(),
+                    total_tokens: 0,
                     notify: meta.notify,
                     imported: import::read_cursor(&self.data_dir.join(&meta.id)).is_some(),
                     keeps_own_transcript: keeps_own_transcript(
@@ -1213,9 +1224,14 @@ fn launch(
         // this is then the only true answer available.
         status: Mutex::new(transcript.last_status().unwrap_or(SessionStatus::Idle)),
         title: Mutex::new(meta.title.clone()),
-        last_activity: Mutex::new(now()),
+        // What the transcript last recorded, not the clock: this server has
+        // just been told nothing, and `now()` claimed every relaunched
+        // session had been active this instant -- see
+        // `Transcript::last_activity`.
+        last_activity: Mutex::new(transcript.last_activity().unwrap_or_else(now)),
         model: Mutex::new(meta.model.clone()),
         permission_mode: Mutex::new(meta.permission_mode.clone()),
+        total_tokens: Mutex::new(transcript.total_tokens()),
         notify: Mutex::new(meta.notify),
         written: Mutex::new(0),
     });
@@ -1348,6 +1364,18 @@ async fn pump(
         // for where a user's message sits: where the session read it.
         let event = match event {
             Event::MessageTaken { id, text } => Event::UserMessage { id, text },
+            // The running total is the pump's to keep, for the reason the
+            // field gives: a driver knows what its own turn cost and
+            // nothing else does. Added here rather than at each driver so
+            // a new one cannot get it wrong by leaving it out.
+            Event::UsageDelta { tokens, .. } => {
+                let mut total = shared.total_tokens.lock().unwrap();
+                *total += tokens;
+                Event::UsageDelta {
+                    tokens,
+                    total: *total,
+                }
+            }
             other => other,
         };
         // Nothing changed, so there is nothing to record. Both of these
@@ -1893,6 +1921,115 @@ mod tests {
         )));
     }
 
+    #[tokio::test]
+    async fn a_restart_reports_when_a_session_last_did_something() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let config_path = dir.path().join("config.ron");
+        let data_dir = dir.path().join("sessions");
+        seed_echo_only(&config_path);
+
+        let manager = SessionManager::new(
+            config_path.clone(),
+            data_dir.clone(),
+            data_dir.join("models"),
+        )
+        .expect("manager");
+        let info = manager.spawn_session(echo_spec()).expect("spawn");
+        let session = manager.session(&info.id).expect("live session");
+        let mut rx = session.subscribe();
+        session.send_message("something".to_string(), Vec::new());
+        collect_turn(&mut rx).await;
+        let before_restart = manager.sessions()[0].last_activity;
+        drop(rx);
+        drop(session);
+        drop(manager);
+
+        // Far enough back that a restart taking the clock cannot pass by
+        // being fast: the assertion is about which source was used, not
+        // about how long the test took.
+        let long_ago = before_restart - 86_400.0;
+        rewrite_transcript_times(&data_dir.join(&info.id).join("transcript.jsonl"), long_ago);
+
+        let manager = SessionManager::new(config_path, data_dir.clone(), data_dir.join("models"))
+            .expect("manager restart");
+        let listed = manager.sessions();
+        assert_eq!(listed.len(), 1);
+        assert!(
+            (listed[0].last_activity - long_ago).abs() < 1.0,
+            "a relaunched session reported {} instead of the {long_ago} its transcript records \
+             -- every row would read \"just now\" and the list would sort by nothing",
+            listed[0].last_activity,
+        );
+    }
+
+    /// The total covers the whole conversation, not the part a reader holds.
+    ///
+    /// The bug this fixes was invisible in exactly the way that matters: a
+    /// phone opens a session on its newest page and used to add up the
+    /// `UsageDelta`s it found there, so a long conversation reported its
+    /// last few turns as the total -- and a page with no turn in it at all
+    /// reported nothing, since zero is drawn as blank. Both readings looked
+    /// like an answer.
+    #[tokio::test]
+    async fn the_token_total_covers_the_whole_conversation() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let config_path = dir.path().join("config.ron");
+        let data_dir = dir.path().join("sessions");
+        seed_echo_only(&config_path);
+        let manager = SessionManager::new(
+            config_path.clone(),
+            data_dir.clone(),
+            data_dir.join("models"),
+        )
+        .expect("manager");
+        let info = manager.spawn_session(echo_spec()).expect("spawn");
+        let session = manager.session(&info.id).expect("live");
+
+        // Echo charges a token a word, so the arithmetic is checkable.
+        let mut rx = session.subscribe();
+        session.send_message("one two three".to_string(), Vec::new());
+        collect_turn(&mut rx).await;
+        session.send_message("four five".to_string(), Vec::new());
+        collect_turn(&mut rx).await;
+        let running = manager.sessions()[0].total_tokens;
+        assert_eq!(running, 5, "two turns of three and two words");
+
+        // The event carries it too, so a phone never has to add up its own.
+        let last_total = transcript::read_after(session.transcript_path(), 0)
+            .expect("transcript")
+            .iter()
+            .rev()
+            .find_map(|entry| match entry.event {
+                Event::UsageDelta { total, .. } => Some(total),
+                _ => None,
+            })
+            .expect("a usage event");
+        assert_eq!(last_total, running);
+
+        // And a restart picks it up from the file rather than starting over.
+        drop(rx);
+        drop(session);
+        drop(manager);
+        let manager = SessionManager::new(config_path, data_dir.clone(), data_dir.join("models"))
+            .expect("manager restart");
+        assert_eq!(manager.sessions()[0].total_tokens, running);
+    }
+
+    /// Backdates every line in a transcript, so a restart has something to
+    /// report that the clock could not have produced.
+    fn rewrite_transcript_times(path: &Path, ts: f64) {
+        let text = std::fs::read_to_string(path).expect("read transcript");
+        let rewritten: String = text
+            .lines()
+            .map(|line| {
+                let mut entry: serde_json::Value = serde_json::from_str(line).expect("line");
+                entry["ts"] = serde_json::json!(ts);
+                format!("{entry}\n")
+            })
+            .collect();
+        std::fs::write(path, rewritten).expect("write transcript");
+    }
+
     #[tokio::test]
     async fn a_restart_relaunches_sessions_and_continues_the_numbering() {
         let dir = tempfile::tempdir().expect("tempdir");