Thanks. This is consistent with my guess that it uses the log table to determine last online time.
It depends how each person in your scenarios "goes offline" or "goes online". Did they leave the Lush tab open, close the browser, use the Remember Me checkbox? Did their VPN cycle IP in the meantime?
It's not clear in the first two. But...
Scenario 3: no reauthentication means it's a REM (remembered, cookie) login, so no change in state. Therefore the time is counted from the last time they presented login details. So each day, the last online time will increment by one.
Scenario 4: no account, therefore no login event tied to them, so no way of knowing when they last logged in.
Also, different browsers use different mechanisms to deal with cookies and sessions and re-presenting credentials. Firefox treats an incognito session singularly. You are free to open new tabs to the same site and it'll share credentials. Safari (and maybe others) treat each tab in a private session as a silo and each tab needs reauthentication.
Think about how any web-based real-time system knows someone is "online". How does it know, when HTTP is, by design, stateless.
I'm typing this reply in a single browser tab in a textarea. I've been typing it for ten minutes or so. I haven't interacted with any of the other Lush tabs I have open. So, as far as the site thinks, I was "last seen online" ten minutes ago. If the site decides that five minutes of "inactivity" constitutes me "going offline" then it may have removed my online status indicator, even though I'm "using" the site.
As soon as I hit Submit, my stored credentials will be resent to the server along with my post. Lush might then update my status, or it might not. If it is programmed to consider 15 minutes of idle time as the period after which I am "offline" then as far as my status is concerned, I'm still active right now.
The point is, determining online status is fraught with nuances and the vagaries of HTTP statelessness. How a site chooses to harness the information and present it may not gel with what you or I deem "logical". But the bottom line is that the more messages and dialogue that goes back and forth between browser and server, and the more interaction with the database goes on, the slower the site is for everyone.
Thus, sometimes, developers use cached information such as "last time we saw login credentials for this user" as a baseline so as not to bog the database down with injecting up-to-the-minute log data for every page served to a user, and have endless packets of data flying around for very little real-world gain compared to keeping site performance reasonable.