Keep visited transcripts on the phone

Reopening a session downloaded the conversation again, every time, over
the tunnel. It now draws from a copy of what the server has already sent
and asks for one event to check that copy is still current.

Per session, under cacheDir, the server's own event lines in chunks named
for the range they cover -- so a coalesced page, whose lines do not say
what they cover, still records it. Only the contiguous run ending at the
newest chunk is served; a gap is closed by paging through it, bounded by
`after` on /transcript so the page stops where the phone's copy starts
and can therefore be kept. Nothing is derived and stored: rows are a
rendering, and a cache of them would need throwing away on every change
to the fold.

Nothing here is load-bearing. Missing, evicted, damaged or unwritable all
degrade to the cold open this screen did before, and the check before the
stream resumes -- one request, one event -- is what stops a replaced or
truncated file being spliced onto a copy of a different conversation.
What that check cannot see, a line changed mid-file with the tail intact,
is what Reload in session settings is for.

Measured on the emulator against ui-sandbox, on a 505-event session:
reopening it costs one request for one event, including scrolling the
whole conversation back; a cold open is two requests and 100 events. A
reset after falling 300 behind fetched the gap as four coalesced rows
rather than re-fetching 104 events and discarding them. Every chunk was
checked line by line against what the server says for the range its name
claims, across the reset and the gap-fill.

transcript-bench.sh, same viewport content and gestures, before and
after: p50 16.9ms both, p90 25.6 -> 23.2ms, p99 33.5 -> 36.7ms, and the
transcript's own draw accounting 0.33ms -> 0.32ms with place 0.31ms
either way. Within the emulator's noise, which is what a cache must be:
it changes what is fetched, not what is drawn.

Building it also found that the server handed out the same transcript
line two different ways. serde_json's default float parser is not
correctly rounded, so a ts written as ...0757 came back from /transcript
as ...0755 while the SSE stream sent the original -- invisible on screen,
since a ts is drawn as a relative time, and visible here only because the
cache compares a line it holds against the server's answer. Fixed with
float_roundtrip, with a test that fails the moment it is dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/Cargo.toml

@@ -23,7 +23,13 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 serde = { version = "1", features = ["derive"] }
-serde_json = "1"
+# `float_roundtrip` because this server hands out the same transcript line two ways -- the
+# `/transcript` page and the SSE backlog both parse it out of the file and serialize it again --
+# and serde_json's default float parser is not correctly rounded. Measured 2026-09-04: a `ts` of
+# 1788546972.6030757 in the file came back as ...0755, so the two answers to "what is line 30"
+# differed in the last bit while looking identical. What made that visible was the phone's
+# transcript cache, which compares a line it already holds against the server's own answer.
+serde_json = { version = "1", features = ["float_roundtrip"] }
 # The config file's format. Not JSON, because this file is written and read
 # by hand and RON says a sum type as syntax. The two house rules both
 # projects write it under live in wg-app-link; this is here for the error

server/src/routes.rs

@@ -21,6 +21,9 @@
 //! GET    /sessions/{id}/events?after=N SSE: backlog after N, then live
 //!                                     (a backlog past CATCH_UP_LIMIT arrives as a
 //!                                      `reset` frame plus the newest window)
+//! GET    /sessions/{id}/transcript    a page of history: ?before=N (newest when absent),
+//!                                     ?limit=N, ?coalesce=true to count rows not deltas,
+//!                                     ?after=N to floor it at what the caller already holds
 //! POST   /sessions/{id}/message        {text, attachmentIds?}
 //!                                     (starts the process first if it has exited)
 //! POST   /sessions/{id}/unqueue        {messageId} -- take back one not read yet
@@ -1647,6 +1650,11 @@ struct TranscriptQuery {
     /// counts events to reach a known seq. See `read_window`.
     #[serde(default)]
     coalesce: bool,
+    /// Return nothing at or below this seq; the page stops here instead of at `limit`.
+    /// The phone passes the end of what it already holds, so a page never overlaps it.
+    /// Named to match the SSE route's `after`, and exclusive in the same way.
+    #[serde(default)]
+    after: Option<u64>,
 }
 
 fn default_window() -> usize {
@@ -1668,6 +1676,7 @@ async fn transcript(
     let events = crate::session::transcript::read_window(
         session.transcript_path(),
         query.before,
+        query.after,
         query.limit,
         query.coalesce,
     )
@@ -1679,6 +1688,7 @@ async fn transcript(
     tracing::debug!(
         session = %id,
         before = ?query.before,
+        after = ?query.after,
         limit = query.limit,
         got = events.len(),
         oldest = ?events.first().map(|entry| entry.seq),

server/src/session/transcript.rs

@@ -148,9 +148,18 @@ impl Transcript {
 /// `before` pages backwards for history somebody actually scrolls to. Only
 /// the window is parsed; see [`Indexed`] for why that is the whole cost of
 /// this call.
+///
+/// `after` is a floor: nothing at or below it is returned, and the page
+/// stops there rather than at `limit`. A phone holding a cached run of the
+/// transcript passes the end of what it already has, so the page it gets
+/// back is exactly the gap and never overlaps its copy -- an overlap it
+/// cannot store, since a coalesced event cannot be cut at a seq inside its
+/// own delta run. A run cut by this floor is emitted as the partial it is,
+/// exactly as one cut by `limit` already is.
 pub fn read_window(
     path: &Path,
     before: Option<u64>,
+    after: Option<u64>,
     limit: usize,
     coalesce: bool,
 ) -> Result<Vec<SeqEvent>> {
@@ -161,15 +170,21 @@ pub fn read_window(
         Some(before) => indexed.first_at_or_after(before)?,
         None => indexed.lines.len(),
     };
+    let start = match after {
+        Some(after) => indexed.first_at_or_after(after.saturating_add(1))?,
+        None => 0,
+    };
+    // A floor above the window is an empty page, not a walk backwards past it.
+    let start = start.min(end);
     // Coalescing counts *rows*, not events, and would misread the newest window: a message still
     // streaming there would fold to one event whose seq is its first delta, and the phone resumes
     // its live stream from the newest seq it applied -- so the deltas the coalesced event hid
     // would replay and double. Only settled history (`before` set) is safe, and it is the only
     // place the phone asks for it. See `parse_coalesced`.
     if coalesce && before.is_some() {
-        indexed.parse_coalesced(end, limit)
+        indexed.parse_coalesced(start, end, limit)
     } else {
-        indexed.parse(end.saturating_sub(limit)..end)
+        indexed.parse(start.max(end.saturating_sub(limit))..end)
     }
 }
 
@@ -350,8 +365,9 @@ impl<'a> Indexed<'a> {
     /// next page pages from, land where they always did. A run cut by the `limit` (its older
     /// deltas beyond this page) is emitted as the partial it is; the next page carries the rest and
     /// the phone's `healSplitMessage` welds the two, exactly as it does for a run cut by any page
-    /// boundary.
-    fn parse_coalesced(&self, end: usize, limit: usize) -> Result<Vec<SeqEvent>> {
+    /// boundary. `start` is the same kind of cut from the other end -- the floor `read_window`'s
+    /// `after` computes -- and a run reaching it is partial in the same way.
+    fn parse_coalesced(&self, start: usize, end: usize, limit: usize) -> Result<Vec<SeqEvent>> {
         // Newest first while walking back, reversed to transcript order at the end.
         let mut out: Vec<SeqEvent> = Vec::new();
         // The run currently being gathered: its oldest seq/ts so far, and its deltas newest-first.
@@ -369,7 +385,7 @@ impl<'a> Indexed<'a> {
             }
         };
         let mut index = end;
-        while index > 0 {
+        while index > start {
             // A row is counted when it lands in `out`; an open run is the row being gathered, so
             // stopping while one is open would drop the deltas already read. Break only between
             // rows, and flush the last run after the loop.
@@ -528,7 +544,7 @@ mod tests {
         }
 
         // No cursor is the newest page, which is what opening a session asks for.
-        let newest = read_window(&path, None, 3, false).expect("window");
+        let newest = read_window(&path, None, None, 3, false).expect("window");
         assert_eq!(
             newest.iter().map(|entry| entry.seq).collect::<Vec<_>>(),
             [8, 9, 10]
@@ -536,7 +552,7 @@ mod tests {
 
         // Then backwards from the oldest of those, exclusive: the page a phone
         // scrolling up asks for must not repeat the row it is scrolling from.
-        let older = read_window(&path, Some(8), 3, false).expect("window");
+        let older = read_window(&path, Some(8), None, 3, false).expect("window");
         assert_eq!(
             older.iter().map(|entry| entry.seq).collect::<Vec<_>>(),
             [5, 6, 7]
@@ -544,24 +560,108 @@ mod tests {
 
         // Asking for more than there is gives what there is, rather than failing.
         assert_eq!(
-            read_window(&path, None, 100, false).expect("window").len(),
+            read_window(&path, None, None, 100, false)
+                .expect("window")
+                .len(),
             10
         );
 
         // Nothing before the first event, which is how the phone learns to stop
         // paging. An empty answer here is the end of the history, not a fault.
         assert!(
-            read_window(&path, Some(1), 3, false)
+            read_window(&path, Some(1), None, 3, false)
                 .expect("window")
                 .is_empty()
         );
         assert!(
-            read_window(&dir.path().join("nope.jsonl"), None, 3, false)
+            read_window(&dir.path().join("nope.jsonl"), None, None, 3, false)
                 .expect("window")
                 .is_empty()
         );
     }
 
+    #[test]
+    fn a_floor_stops_a_page_at_what_the_caller_already_holds() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("transcript.jsonl");
+        let mut transcript = Transcript::open(&path).expect("open");
+        for n in 1..=10 {
+            transcript
+                .append(text(&n.to_string()), 0.0)
+                .expect("append");
+        }
+
+        // The floor is exclusive, like the SSE route's `after`, and it -- not the
+        // limit -- is what the page stops at. This is the gap between a phone's
+        // cached run and the window on its screen, fetched exactly.
+        let page = read_window(&path, Some(9), Some(5), 100, false).expect("window");
+        assert_eq!(
+            page.iter().map(|entry| entry.seq).collect::<Vec<_>>(),
+            [6, 7, 8]
+        );
+
+        // A limit smaller than the gap still bites; the floor is a bound, not a
+        // replacement for one.
+        let page = read_window(&path, Some(9), Some(2), 3, false).expect("window");
+        assert_eq!(
+            page.iter().map(|entry| entry.seq).collect::<Vec<_>>(),
+            [6, 7, 8]
+        );
+
+        // A floor at or above the window is an empty page, not a walk past it.
+        assert!(
+            read_window(&path, Some(4), Some(9), 10, false)
+                .expect("window")
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn a_floor_inside_a_delta_run_leaves_the_partial_run_it_cuts() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("transcript.jsonl");
+        let mut transcript = Transcript::open(&path).expect("open");
+        for d in ["a", "b", "c", "d"] {
+            transcript.append(text(d), 0.0).expect("append"); // seq 1..4
+        }
+        transcript
+            .append(
+                Event::ToolStart {
+                    id: "t".into(),
+                    tool: "Bash".into(),
+                    input: serde_json::Value::Null,
+                },
+                0.0,
+            )
+            .expect("append"); // seq 5
+
+        // Cut inside the run: what comes back is the deltas above the floor, seq'd
+        // at the first of them -- the partial the phone's `healSplitMessage` welds
+        // onto the rest, the same as a run cut by the limit.
+        let rows = read_window(&path, Some(6), Some(2), 10, true).expect("window");
+        assert_eq!(rows.len(), 2);
+        assert!(matches!(
+            &rows[0],
+            SeqEvent { seq: 3, event: Event::AssistantText { delta }, .. } if delta == "cd"
+        ));
+        assert!(matches!(
+            &rows[1],
+            SeqEvent {
+                seq: 5,
+                event: Event::ToolStart { .. },
+                ..
+            }
+        ));
+
+        // And with no floor the whole run is one row, as before.
+        let rows = read_window(&path, Some(6), None, 10, true).expect("window");
+        assert_eq!(rows.len(), 2);
+        assert!(matches!(
+            &rows[0],
+            SeqEvent { seq: 1, event: Event::AssistantText { delta }, .. } if delta == "abcd"
+        ));
+    }
+
     #[test]
     fn coalescing_counts_rows_and_joins_delta_runs() {
         let dir = tempfile::tempdir().expect("tempdir");
@@ -588,7 +688,7 @@ mod tests {
 
         // Three rows asked for, three rows returned -- each delta run one event -- where a raw
         // window of three would have shown one and a half tokens of the newer reply.
-        let rows = read_window(&path, Some(8), 3, true).expect("window");
+        let rows = read_window(&path, Some(8), None, 3, true).expect("window");
         assert_eq!(rows.len(), 3);
         // A run keeps its oldest delta's seq, so the phone anchors and pages from where it always
         // did.
@@ -610,14 +710,43 @@ mod tests {
         ));
 
         // The next page pages from the oldest row's seq and returns the rest, no repeat, no gap.
-        let older = read_window(&path, Some(1), 3, true).expect("window");
+        let older = read_window(&path, Some(1), None, 3, true).expect("window");
         assert!(older.is_empty());
 
         // The newest window never coalesces even when asked: the live cursor depends on real seqs.
-        let newest = read_window(&path, None, 2, true).expect("window");
+        let newest = read_window(&path, None, None, 2, true).expect("window");
         assert_eq!(newest.iter().map(|e| e.seq).collect::<Vec<_>>(), [6, 7]);
     }
 
+    #[test]
+    fn a_line_read_back_is_the_line_that_was_written() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("transcript.jsonl");
+        // A timestamp with enough digits to be lost: the clock produces these all day, and this
+        // one is real (2026-09-04). serde_json's default float parser is not correctly rounded,
+        // so it read this back as ...0755 and every reader got a line one bit different from the
+        // one in the file -- while the SSE stream, which serializes the same struct, had already
+        // sent the original. Two answers to "what is line 1", indistinguishable by eye.
+        //
+        // Nothing on screen showed it: a `ts` is drawn as a relative time. What found it was the
+        // phone's transcript cache, which keeps the line it was sent and checks it against the
+        // server's own answer before resuming a stream from it -- so the mismatch turned into a
+        // cache thrown away and a transcript downloaded again, silently and only sometimes. The
+        // `float_roundtrip` feature in Cargo.toml is the fix; this is what keeps it.
+        let mut transcript = Transcript::open(&path).expect("open");
+        transcript
+            .append(text("hello"), 1788546972.6030757)
+            .expect("append");
+        drop(transcript);
+
+        let written = std::fs::read_to_string(&path).expect("read");
+        let entry = read_window(&path, None, None, 10, false).expect("window");
+        assert_eq!(
+            serde_json::to_string(&entry[0]).expect("serialize"),
+            written.trim()
+        );
+    }
+
     #[test]
     fn a_missing_file_reads_as_empty() {
         let dir = tempfile::tempdir().expect("tempdir");