review fixes: broadcast session state on working, guard the CodemanSessionOrder global

The running group sorts on lastSubmitAt, but nothing pushed a session:updated
when a turn STARTS — the browser kept whatever stamp it loaded with, so a
30-second-old turn could rank (and read) as an hour-long one. The working
handler now rides the same debounced state broadcast idle already uses.

And both call sites of window.CodemanSessionOrder now degrade to tab order
when the global is missing (iOS Safari's documented stale-cached-JS after a
deploy) instead of TypeErroring the whole home screen away.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/web/public/home-sessions.js

@@ -216,7 +216,10 @@ Object.assign(CodemanApp.prototype, {
       };
     });
 
-    return window.CodemanSessionOrder.sort(rows);
+    // Guarded like every other constants.js consumer: a stale cached
+    // constants.js (iOS Safari serves old JS after a deploy) must degrade to
+    // tab order, not TypeError the whole home screen away.
+    return window.CodemanSessionOrder ? window.CodemanSessionOrder.sort(rows) : rows;
   },
 
   // ═══════════════════════════════════════════════════════════════

src/web/public/mobile-overview.js

@@ -195,7 +195,12 @@ Object.assign(CodemanApp.prototype, {
     // Order is `CodemanSessionOrder` (constants.js), shared with the desktop
     // rail: blocked first (longest-blocked at the top), then running
     // longest-first, then quiet most-recent-first.
-    const inSection = (states) => window.CodemanSessionOrder.sort(rows.filter((r) => states.includes(r.state)));
+    // Guarded: a stale cached constants.js (iOS Safari after a deploy) must
+    // degrade to tab order, not TypeError the overview away.
+    const inSection = (states) => {
+      const filtered = rows.filter((r) => states.includes(r.state));
+      return window.CodemanSessionOrder ? window.CodemanSessionOrder.sort(filtered) : filtered;
+    };
 
     // Past = conversations from the unified list that are not currently live.
     // The endpoint already folds a transcript into its owning session (via the

src/web/session-listener-wiring.ts

@@ -224,6 +224,11 @@ export function createSessionListeners(session: Session, deps: SessionListenerDe
       // re-capture instead).
       approvalInbox.resolveForSession(session.id, 'resolved_in_terminal', ['idle']);
       deps.broadcast(SseEvent.SessionWorking, { id: session.id });
+      // Full state ride-along: the home screens sort the running group on
+      // lastSubmitAt, and without this the browser keeps the stamp it loaded
+      // with (a turn started after page load ranks by the PREVIOUS turn's
+      // Enter). Debounced, so working-signal flaps cost one broadcast.
+      deps.broadcastSessionStateDebounced(session.id);
       const tracker = deps.getRunSummaryTracker(session.id);
       if (tracker) {
         tracker.recordWorking();