app: the history row was naming the wrong document's privacy level

A row read "22 kB · full" directly beneath "uploaded to fmr", while the status
line above said the upload went as BALANCED. Both were true and they described
different documents: the row showed ArchivedRun.anonymization, which describes
the *archived* copy - deliberately unredacted, so always "full" - and the status
line described the *uploaded* copy.

Read together, that says the complete data was uploaded when a redacted copy was
sent. A privacy display that overstates what left the device is worse than none,
and telling the user what left the device is the one thing this screen is for.

The level a run was uploaded at is now recorded separately (uploaded_as) and the
row says "kept complete on this device" / "uploaded to fmr as balanced" - each
label naming the copy it belongs to.

Two more from the same screenshot:

  - Every row showed no verdict. The archive read summary.verdict; the schema
    calls it summary.overall. Silently null on every run, so the list's most
    prominent element was blank while everything else looked fine. The test
    fixture had the same wrong field name, which is why it passed.
  - The status line rendered the server's raw JSON index entry into the UI.

Verified on device: a fresh run archives with verdict "yellow" and
uploaded_as "balanced" beside anonymization "full".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

echolot-app/app/src/main/kotlin/app/echo_lot/app/HistoryScreen.kt

@@ -72,12 +72,20 @@ fun HistoryScreen(
                             )
                         }
                         Text(
-                            "${r.findingCount} finding(s) · ${r.sizeBytes / 1024} kB · ${r.anonymization}",
+                            "${r.findingCount} finding(s) · ${r.sizeBytes / 1024} kB · " +
+                                "kept complete on this device",
                             style = MaterialTheme.typography.bodySmall,
                         )
+                        // The upload line names the level the upload was made at, not the
+                        // archive's. They describe different documents, and showing the archive's
+                        // level here claimed more had left the device than actually did.
                         Text(
-                            if (r.uploaded) "uploaded to ${r.uploadedTo ?: "a server"}"
-                            else "on this device only",
+                            if (r.uploaded) {
+                                "uploaded to ${r.uploadedTo ?: "a server"}" +
+                                    (r.uploadedAs?.let { " as $it" } ?: "")
+                            } else {
+                                "on this device only"
+                            },
                             style = MaterialTheme.typography.bodySmall,
                             color = if (r.uploaded) Color(0xFF7FD17F) else Color(0xFFBBBBBB),
                         )

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunStore.kt

@@ -164,8 +164,10 @@ class RunStore(context: Context, private val settings: Settings) {
             )
             val body = redactedForUpload(docJson, level)
             val reply = client.uploadRun(settings.serverCredential, body)
-            archive.markUploaded(runId, profile.name)
-            UploadOutcome.Sent(profile.name, "as $level, ${body.toByteArray().size} bytes: ${reply.take(120)}")
+            archive.markUploaded(runId, profile.name, level.wire)
+            // Deliberately not echoing `reply`: it is the server's index entry as raw JSON, and
+            // it ended up rendered verbatim in the UI. Size and level are what a person wants.
+            UploadOutcome.Sent(profile.name, "as $level, ${body.toByteArray().size} bytes")
         } catch (e: VersionRefused) {
             UploadOutcome.Incompatible(e.message ?: "the server refused this app's version")
         } catch (e: UploadRefused) {