fix(activity): an ad-hoc run's row is one run's, a rollback keeps a run whole, Back reads one entry's filters

- The channel-backfill row says "running" from the runs this process has open, not from the table:
  a row whose outcome failed to write no longer reads as running until a restart. The run still
  going leads the row, so a newer run's outcome never sits under the older one's channel.
- Migration 0109's downgrade carries every run's trigger, spend and start in the audit row, and the
  upgrade restores them: a manual run whose admin was deleted stays manual.
- Back/Forward is read by the page's one popstate listener, both halves in one render; the server
  log adopts its half during that render, so no read goes out with one entry's filters and the
  other's range.
- The server log's failed facets use the other tabs' words (the menus may be short); the accounts
  message shows only when the menu really lacks them.

backend/app/jobruns.py

@@ -119,16 +119,6 @@ def recent_runs(db: Session, jobs: list[str], per_job: int) -> dict[str, list[Jo
     return out
 
 
-def running_one(db: Session, job: str) -> JobRun | None:
-    """The newest run of `job` still going, however many runs ended after it started."""
-    return db.scalars(
-        select(JobRun)
-        .where(JobRun.job == job, JobRun.status == RunStatus.RUNNING)
-        .order_by(JobRun.started_at.desc(), JobRun.id.desc())
-        .limit(1)
-    ).first()
-
-
 def gc(db: Session, retention_days: int) -> int:
     """Delete finished runs older than `retention_days` (0 = keep forever). A run still going is
     never reaped. The caller commits."""

backend/app/scheduler.py

@@ -15,7 +15,7 @@ from app import audit, debugsession, jobruns, logs, logsink, progress, quota, sy
 from app.config import settings
 from app.db import SessionLocal
 from app.downloads.gc import run_download_gc
-from app.models import Channel
+from app.models import Channel, JobRun
 from app.plex.sync import sync as run_plex_sync
 from app.plex.tmdb import run_enrich as run_tmdb_enrich
 from app.plex.tmdb import run_people_enrich
@@ -45,6 +45,10 @@ _scheduler: BackgroundScheduler | None = None
 # run did is durable instead: its `job_runs` row (app/jobruns.py), which outlives a restart.
 _activity: dict[str, dict] = {}
 _activity_lock = threading.Lock()
+# The ad-hoc runs this process has open (run id -> job), under the same lock. A row can stay
+# `running` in the table after its outcome failed to write (_close), so the table cannot say what is
+# going; this can, as the one process per database (app/jobruns.py) is the one running them.
+_open_ad_hoc: dict[int, str] = {}
 
 # Set (per-thread) by a manual "run now" trigger to the id of the admin who clicked, so that
 # run — and only that run, not the recurring scheduled ones — posts a completion notification
@@ -243,6 +247,7 @@ def scheduler_snapshot(db) -> dict:
                 live_intervals[job.id] = round(iv.total_seconds() / 60)
     with _activity_lock:
         acts = {k: dict(v) for k, v in _activity.items()}
+        going_id = max((r for r, j in _open_ad_hoc.items() if j == CHANNEL_BACKFILL), default=None)
     recent = jobruns.recent_runs(db, [*JOB_INTERVALS, *AD_HOC_JOBS], RECENT_RUNS)
     jobs = []
     for job_id, default_interval in JOB_INTERVALS.items():
@@ -259,11 +264,17 @@ def scheduler_snapshot(db) -> dict:
         )
     # Work a user starts on one target: no interval, no "run now" (it needs its target), but its
     # runs are shown beside the jobs' — it spends the same quota. Its one in-memory guard is the
-    # target's own (sync/runner), so "running" is what its rows say: two channels can backfill at
-    # once, so a run still going counts even when a newer one already ended, and the row names it.
+    # target's own (sync/runner), so "running" is the runs this process has open: two channels can
+    # backfill at once, so a run still going counts even when a newer one already ended. That run then
+    # leads the row, so its channel, its "no outcome yet" and its dot are one run's, never the
+    # newer run's outcome under the older one's channel.
     backfills = recent.get(CHANNEL_BACKFILL, [])
-    going = jobruns.running_one(db, CHANNEL_BACKFILL)
-    shown = going or (backfills[0] if backfills else None)
+    going = db.get(JobRun, going_id) if going_id is not None else None
+    if going is not None and going.status != RunStatus.RUNNING:
+        going = None  # its outcome is written; only the bookkeeping has not caught up
+    if going is not None:
+        backfills = [going, *(r for r in backfills if r.id != going.id)][:RECENT_RUNS]
+    shown = backfills[0] if backfills else None
     ad_hoc = [
         {
             "id": CHANNEL_BACKFILL,
@@ -596,6 +607,16 @@ def _ad_hoc(job: str, fn: Callable[[], dict], actor_id: int, target: str) -> Non
         # No row to tell it in: the database is what failed. The log is the record.
         log.exception("ad-hoc %s for %s not started: its run could not be recorded", job, target)
         return
+    with _activity_lock:
+        _open_ad_hoc[run_id] = job
+    try:
+        _ad_hoc_work(job, fn, run_id)
+    finally:
+        with _activity_lock:
+            _open_ad_hoc.pop(run_id, None)
+
+
+def _ad_hoc_work(job: str, fn: Callable[[], dict], run_id: int) -> None:
     with logs.bind(run_id=run_id):
         # As in _run: only the work is inside the try.
         try: