review fixes: broadcast session state on working, guard the CodemanSessionOrder global

The running group sorts on lastSubmitAt, but nothing pushed a session:updated when a turn STARTS — the browser kept whatever stamp it loaded with, so a 30-second-old turn could rank (and read) as an hour-long one. The working handler now rides the same debounced state broadcast idle already uses. And both call sites of window.CodemanSessionOrder now degrade to tab order when the global is missing (iOS Safari's documented stale-cached-JS after a deploy) instead of TypeErroring the whole home screen away. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat: sort both home-screen session lists by activity, not tab order
2026-10-02 13:39:41 +02:00 · 2026-08-16 19:18:49 +02:00 · 2026-08-16 05:11:00 +02:00
21 changed files with 495 additions and 908 deletions
@@ -230,8 +230,6 @@ Codeman is a Claude Code session manager with web interface and autonomous Ralph

 **Attachments** (live external document references; all wiring in `file-routes.ts`): a **registry** maps a stable `attachmentId` to a realpath-resolved, extension-allowlisted absolute path, so browser requests never carry arbitrary absolute paths. ⚠️ The **magic-link scanner** (`codeman://attach?...` in terminal output) is **prompt-injectable**, so its scan path is force-confined to the session workspace; a hostile prompt could otherwise exfiltrate arbitrary host files over SSE. The security gate is an extension **allowlist**, not a blocklist. `document-conversion-limiter.ts` caps converter spawns globally: without it, N large docs detected at once fork N multi-minute processes, which is a resource-exhaustion vector. → [architecture-invariants#attachments](docs/architecture-invariants.md#attachments)

-**File-path links (terminal + chat)**: a path an agent prints is clickable on BOTH surfaces and opens the file-preview overlay. ⚠️ ONE pattern (`FILE_PATH_LINK_PATTERN` / `absoluteFilePathPattern()` in constants.js) feeds the xterm link provider AND the response viewer's `_linkifyFilePaths()`; a fresh instance per call, since `lastIndex` is per-object state. The chat linkifier walks TEXT NODES with DOM APIs (the source is model output; never rebuild sanitized markup as a string) and skips subtrees already inside an `<a>`. ⚠️ **An out-of-workspace path is served through the ATTACHMENT routes, not the file routes** — `file-content`/`file-raw` are workspace-confined and 404 exactly the paths agents print most (a `/tmp` capture, Claude's scratchpad), so `openFilePreview()` registers such a path via `POST /api/sessions/:id/attachments` with **`notify: false`** (suppresses only the `attachment:detected` broadcast — same guard, same routes; without it every click also popped a card announcing the file already on screen) and renders by id. The click is an explicit action on the explicit, Origin-guarded route, which is what distinguishes it from the force-confined magic-link scanner. ⚠️ **Media extensions are single-sourced** (`VIDEO_ATTACHMENT_EXTENSIONS`/`AUDIO_ATTACHMENT_EXTENSIONS` in `attachment-registry.ts`, imported by `file-content`'s classification) so a clip plays the same in or out of the workspace; a player needs all THREE of allowlist + a real `MIME_TYPES` entry (octet-stream renders a dead player) + the range-aware body. ⚠️ **`TEXT_ATTACHMENT_EXTENSIONS` IS `EDITABLE_EXTENSIONS`** (never a second list): if the viewer would edit it inside the workspace, it can be read outside. Widening READ must never widen RUN, so `html`/`htm` joined `svg` in `serveRawFile`'s download-only branch, other text goes out as inert `text/plain`+`nosniff`, and `~/.codeman*/state.json` joined `isSensitivePath` (it persists `envOverrides`, which can hold `GEMINI_API_KEY`). ⚠️ The terminal sends an **out-of-workspace** path to the preview instead of the log viewer (that one spawns `tail -f` and reaches only workspace + `/var/log` + `~/logs`); in-workspace text keeps the tail viewer and `file-stream-manager`'s allowlist is untouched. The image-watcher keeps its own narrow detection list, so none of this cards every file an agent writes. → [architecture-invariants#file-path-links-terminal--response-viewer](docs/architecture-invariants.md#file-path-links-terminal--response-viewer)
-
 **Filesystem path picker** (Link Existing "Browse" + the mobile keyboard's `📁 Path` key): lazy one-directory browsing via `GET /api/filesystem/browse`, with `GET /api/filesystem/preview` for the tapped file. Inserts the path **without** Enter, so the prompt is never submitted; the sibling `⌫ All` key clears only the unsent prompt and must never send the agent's `/clear`. ⚠️ This is a **second file-serving surface and inherits neither the attachment confinement nor its ownership scoping** — it allowlists Home, `CASES_DIR`, `/mnt/d` and `CODEMAN_FILE_PICKER_ROOTS`, blocks sensitive trees, and rejects symlink escapes **after** `realpath`. ⚠️ The optional `sessionId` is an ownership boundary that must be `canAccessOwned`-checked by hand (it does not go through `findSessionOrFail`), and in multi-user mode a non-admin gets only their own `userSpacePath` as a root: per-user spaces live INSIDE `homedir()`, so a `Home` root exposes every other user's workspace. Previews go through the same global conversion limiter, and Markdown/TXT/JSON are served as inert `text/plain`. → [architecture-invariants#filesystem-path-picker](docs/architecture-invariants.md#filesystem-path-picker)

 **File Viewer edit mode** (issue #212): the file-preview overlay edits workspace text files in place — `GET .../file-content?edit=1` + `PUT /api/sessions/:id/file-content`, policy in `src/config/file-editing.ts`. This is a **third file surface and the only one that WRITES**: read-path confinement (realpath + workspace + ownership) plus sensitive/blocked/`.git` denies and an extension **allowlist**; writes are `wx`-temp + rename (no `O_CREAT` anywhere = edit-in-place is structural); optimistic concurrency via sha256 `baseHash` → 409. ⚠️ `edit=1` never truncates and the client must never save a plain-preview buffer (the 500-line truncation would silently delete the rest). ⚠️ CRLF/UTF-8 guards: EOL re-applied server-side, non-UTF-8 refused via round-trip compare. → [architecture-invariants#file-viewer-edit-mode](docs/architecture-invariants.md#file-viewer-edit-mode), `docs/file-viewer-edit-plan.md`
@@ -264,7 +262,9 @@ Frontend JS modules have `@fileoverview` with `@dependency`/`@loadorder` tags. L

 **Phone overview home screen** (`mobile-overview.js`, phones only, per-device `mobileOverviewEnabled`, default ON): under 430px the "C" logo shows a session overview (NEEDS YOU / CURRENT SESSIONS / PAST SESSIONS) instead of the welcome overlay; tablet and desktop are unchanged. The branch lives in `showWelcome()`/`hideWelcome()` (terminal-ui.js) behind `shouldUseMobileOverview()`, which is **width-driven** (`getDeviceType() === 'mobile'`) because this is a layout decision, unlike the settings namespace which stays handheld-based. ⚠️ The container ships with the `hidden` attribute and only this module removes it: never give `.mobile-overview` a bare `display` rule, since desktop does not load `mobile.css` (`media="(max-width: 1023px)"`) and would then render it unstyled. Live re-renders ride on the tail of `_renderSessionTabsImmediate()` (every state change it needs already funnels there); PAST rows come from one `_fetchUnifiedSessions(60)` per home-screen visit and resume through the shared `resumeHistorySession()`, so they behave exactly like the welcome screen's Resume list. ⚠️ Two things must stay in lockstep with surfaces outside this module, because divergence reads as a bug rather than a style: the split Run button carries the **toolbar's own classes** (`btn-toolbar btn-run mode-<backend>` / `btn-run-gear`) so the per-backend gradient and the light-skin overrides apply unchanged (mobile.css must therefore set no `background`/`color` on it), and row status uses the **session-tab language** (green dot when fine, `pulse` while working, yellow blinking row when waiting for input, red blinking row when a question is pending, mirroring `tab-alert-idle`/`tab-alert-action`). The picker mirrors the toolbar run-mode menu (`setRunMode()` + `run()`, `openWebviewFromMenu()` for saved dashboards) and deliberately omits its Recent-Sessions block, since PAST SESSIONS is that. Status pills carry `data-i18n-skip` (generic words like "idle" collide with state strings elsewhere).

-**Desktop home tab rail** (`home-sessions.js`, desktop only): the welcome overlay centers ~560px of content in a ~1400px window, so its left gutter is dead space; it carries the open tabs as a rail **docked flush to the left edge, full height** (a vertically centered card floating mid-gutter read as debris). Rows are in **tab order**, not sorted by urgency like the phone overview, because the row badges are the Alt+1..9 indices, and each carries **created / last-active** stamps. State classification is REUSED from mobile-overview.js (`_mobileOverviewState`/`_mobileOverviewCaseFor`), which is why the module loads after it. ⚠️ The rail is `position: absolute` so the centered content never moves, which is exactly why it needs a **width gate in two places** — `HOME_SESSIONS_MIN_WIDTH` (1180) in the JS plus a `max-width: 1179px` media query as the backstop for a resize that outruns the matchMedia listener; drift between them means a rail overlapping the search panel, and `test/home-sessions.test.ts` pins them equal. ⚠️ `.home-sessions` is `display: flex`, so `[hidden]` must be re-asserted as `display: none` or the module's only visibility lever does nothing. ⚠️ Size scales with the viewport off **one knob**: `width: clamp(250px, 19vw, 430px)` plus a fluid `font-size` on `.home-sessions`, with every child sized in `em` — reintroducing `rem`/px type inside the block silently breaks the scaling, and widening the clamp past the gutter reintroduces the overlap the gate exists to prevent. The age stamps are refreshed **in place** by a 20s clock (`_tickHomeSessionsTimes()`, disarmed in `hideHomeSessions()`), never by re-rendering, which would restart every row's blink and working ring. Working state is deliberately byte-identical to the phone's: pulsing green dot + the `tab-load-spin` ring reused from the tab strip + the same green halo (added to `.mobile-overview-dot--working` at the same time), so "working" reads the same on every surface; **idle** is deliberately NOT that green — dot and pill mix toward `--text-muted` so a glance separates running from sitting. Live re-renders ride the tail of `_renderSessionTabsImmediate()` alongside the phone overview.
+**Desktop home tab rail** (`home-sessions.js`, desktop only): the welcome overlay centers ~560px of content in a ~1400px window, so its left gutter is dead space; it carries the open tabs as a rail **docked flush to the left edge, full height** (a vertically centered card floating mid-gutter read as debris). Rows are in **overview order** (see below), and each carries a **created** stamp plus the **state duration** the order is computed from (`created 3d ago · working 12m`, word and anchor from `_mobileOverviewSince()` so both home screens say the same thing). A rail sorted by a number it does not show reads as arbitrarily shuffled, and a working row's plain last-active stamp always says "just now". ⚠️ The number badge is the **Alt+1..9 index**, i.e. the position in the TAB STRIP, so on a sorted rail it deliberately does NOT run 1,2,3 downward: it names a shortcut, not a row position, and renumbering it to look tidy would make every badge lie. State classification is REUSED from mobile-overview.js (`_mobileOverviewState`/`_mobileOverviewCaseFor`), which is why the module loads after it. ⚠️ The rail is `position: absolute` so the centered content never moves, which is exactly why it needs a **width gate in two places** — `HOME_SESSIONS_MIN_WIDTH` (1180) in the JS plus a `max-width: 1179px` media query as the backstop for a resize that outruns the matchMedia listener; drift between them means a rail overlapping the search panel, and `test/home-sessions.test.ts` pins them equal. ⚠️ `.home-sessions` is `display: flex`, so `[hidden]` must be re-asserted as `display: none` or the module's only visibility lever does nothing. ⚠️ Size scales with the viewport off **one knob**: `width: clamp(250px, 19vw, 430px)` plus a fluid `font-size` on `.home-sessions`, with every child sized in `em` — reintroducing `rem`/px type inside the block silently breaks the scaling, and widening the clamp past the gutter reintroduces the overlap the gate exists to prevent. The age stamps are refreshed **in place** by a 20s clock (`_tickHomeSessionsTimes()`, disarmed in `hideHomeSessions()`), never by re-rendering, which would restart every row's blink and working ring. Working state is deliberately byte-identical to the phone's: pulsing green dot + the `tab-load-spin` ring reused from the tab strip + the same green halo (added to `.mobile-overview-dot--working` at the same time), so "working" reads the same on every surface; **idle** is deliberately NOT that green — dot and pill mix toward `--text-muted` so a glance separates running from sitting. Live re-renders ride the tail of `_renderSessionTabsImmediate()` alongside the phone overview.
+
+**Home-screen session order** (`CodemanSessionOrder` in constants.js, pure + unit-tested in `test/session-overview-order.test.ts`): BOTH home screens (phone overview and desktop rail) order rows through this ONE comparator, because they list the same sessions and must answer "which of these wants me next?" the same way. Rank is `needs` → `error` → `waiting` → `working` → `idle` → `done`, and ⚠️ **the tiebreak flips direction halfway down**: states a session is still IN sort **oldest-first** (blocked longest / running longest = most urgent), states it has STOPPED in sort **newest-first** (the session that just went quiet is the one you came back for). ⚠️ The running group keys off **`lastSubmitAt`** (the pane's last Enter), never `lastActivityAt`: a working Claude pane repaints about once a second, so its last-activity stamp is always "now" and would rank every running turn as freshly started. A working pane with no submit stamp falls back to last activity, which lands it at the SHORT end of the group rather than falsely leading it. ⚠️ A **0 stamp means "unknown", not "the epoch"**, and it sorts last within its state either way, or a brand-new session would head every oldest-first group. Final tiebreak is the user's tab order (`orderIndex`), so the list is deterministic and cannot shuffle between renders. The tab strip itself is NOT sorted by this; it stays user-ordered and drag-reorderable.

 **Welcome "Resume Conversation" list** (terminal-ui.js): `loadHistorySessions()` fetches once and caches the corpus on `_historyAll`/`_historyCases`; every subsequent view (filter box, sort select, expand, the periodic refresh in panels-ui.js) goes through `_renderHistoryList()`, so never append rows to `#historyList` directly or re-fetch to re-sort. ⚠️ The box height is **class-driven**: expanding the list without `.history-list.expanded` leaves the collapsed `max-height` in place and just deepens a scroll well, which is the bug #260 reported (35 sessions in a ~4-row box). ⚠️ The A–Z sort keys off `_historyRowLabel()`, the SAME string the row renders (`name || firstPrompt || path`), most rows are transcript-backed and have no session name, so sorting on `name` alone silently does nothing. ⚠️ A filter implies expansion, and `_renderSearch()` hides `#historyHeader` (title + controls) as one unit while a search is active. Tests: `test/history-list-controls.test.ts`.

@@ -298,7 +298,7 @@ Frontend JS modules have `@fileoverview` with `@dependency`/`@loadorder` tags. L

 **SSE staleness watchdog** (`computeSseStale()` in constants.js, `_checkSseStale()` + a 5s interval in app.js): an `EventSource` that stops delivering does not always error, so `onerror` never fires, the header dot stays green, and every SSE-driven surface (tab status dots, sessions created on another device, renames) freezes until the user reloads. ⚠️ The 15s server keepalive was an SSE **comment** (`:keepalive`), and comments are **invisible to `EventSource` by spec**, so there was nothing a client could observe: it is now the named `sse:heartbeat` event (`cleanupDeadClients()`, sse-stream-manager.ts), which is exactly why the frame had to change type. ⚠️ Staleness is judged **only while the status is `connected`** and the device is online; that guard is the loop breaker, since a forced `connectSSE()` leaves `connected` immediately and cannot re-fire while a reconnect is in flight. ⚠️ The liveness stamp is applied inside `addListener` itself, so every registered handler (the `_SSE_HANDLER_MAP` wrappers AND the directly-registered ones) feeds it from one place; the heartbeat's own listener is a no-op that exists **only** to be registered, since `EventSource` drops named events nobody listens for. ⚠️ The watchdog interval is cleared at the top of `connectSSE()` and nowhere else (its only teardown path); clearing it elsewhere stacks intervals. Recovery needs no new sync path: the reconnect re-runs `handleInit` → `_resetAllAppState()`. The forced reconnect logs one diagnostic line, because a middlebox that strips heartbeats presents as "silently reconnects every 45s".

-**Z-index layers**: subagent windows (1000), plan agents (1100), mobile/tablet fixed header (1200, `mobile.css`), modals on ≤768px (1300 — must beat the fixed header or the modal close button is buried), log viewers (2000), connection-loss overlay (2500, above the fixed header and modals), image popups (3000), response viewer (5000, backdrop 4999), file-preview overlay (5100 — must outrank the response viewer, which can launch it; at its old 2000 a path clicked in the chat opened BEHIND the chat), toasts/path picker (10000+, deliberately above the preview), local echo overlay (7).
+**Z-index layers**: subagent windows (1000), plan agents (1100), mobile/tablet fixed header (1200, `mobile.css`), modals on ≤768px (1300 — must beat the fixed header or the modal close button is buried), log viewers (2000), connection-loss overlay (2500, above the fixed header and modals), image popups (3000), local echo overlay (7).

 **Respawn presets**: `solo-work` (3s/60min), `subagent-workflow` (45s/240min), `team-lead` (90s/480min), `ralph-todo` (8s/480min), `overnight-autonomous` (10s/480min).

@@ -122,24 +122,6 @@ Implementation detail extracted from `CLAUDE.md` so that file stays small enough

 **Attachments** (live external document references; COD-37/#119 core, COD-38/#120 previews, COD-39/#121 history): all wiring in `file-routes.ts`. **Registry** (`attachment-registry.ts`): an **in-memory** map of a stable `attachmentId` → an absolute, `realpath`-resolved, extension-allowlisted file path, so browser requests (`GET /api/sessions/:id/attachments/:attachmentId/raw`) never carry arbitrary absolute paths; `POST /api/sessions/:id/attachments` registers one. **Magic links** (`attachment-magic.ts`): parses `codeman://attach?...` out of terminal output — ⚠️ this scanner is prompt-injectable, so the scan path is **force-confined to the session workspace** (a hostile prompt could otherwise make it read arbitrary host files over SSE); emits the `attachment:detected` SSE event. Security gate is an extension **allowlist** (`isSupportedAttachmentExtension`, in the registry/magic modules), not a blocklist; a separate path layer (`config/attachment-guard.ts`) confines reads to the workspace (`attachmentConfineToWorkspace`) and blocks sensitive trees (`/root`, `/etc`). **Previews + thumbnails** (COD-38): `:attachmentId/preview` + `:attachmentId/thumbnail` (and the workspace-file equivalents `file-preview`/`file-thumbnail`) render Office docs/PDFs via external converters (`pdftoppm` / LibreOffice `soffice` / Word-COM `powershell`); `document-preview-cache.ts` is a shared disk cache (de-dups _identical_ in-flight inputs), `document-thumbnailer.ts` does best-effort first-page images, and `document-conversion-limiter.ts` is a **global converter-spawn concurrency cap** (`runWithConversionLimit`) — without it, N distinct large docs detected at once fork N multi-minute converter processes = a localhost fork-bomb-shaped resource-exhaustion vector. **History drawer** (COD-39): `session-attachment-history.ts` tracks the last `ATTACHMENT_HISTORY_LIMIT` (100) attachments per session (`Session._attachmentHistory`, persisted via `SessionState.attachmentHistory`, replayed so externals re-register on reconnect); `GET /api/sessions/:id/attachments` is the list endpoint. ⚠️ The history drawer's launcher button is desktop-only — hidden on phones (regression-guarded; see `mobile-header-buttons-policy` test). Session-local files keep using the existing workspace-scoped `file-routes` paths; the registry is only for explicit live externals. **Codex generated artifacts** (COD-166/#150, `generated-artifact-attachments.ts`): codex-mode sessions ALSO scan (ANSI-stripped) output for `Saved to: file:///…` lines and surface those files as attachment cards with a relaxed trust policy — the allow decision runs on the **realpath-resolved** path against `os.homedir()`-anchored `~/.codex` marker dirs (symlink escapes fall back to force-confinement); gated to `mode === 'codex'` only (`source` is a REQUIRED param through the listener-deps chain — a dropped arg here silently kills the feature). Image thumbnails pass through jpg/jpeg/gif/webp.

-### File-path links (terminal + response viewer)
-
-A file path an agent prints is a link on both surfaces it can appear on, and clicking it opens the file-preview overlay. Three things make that work and each has bitten:
-
-**One pattern, two consumers.** `FILE_PATH_LINK_PATTERN` / `absoluteFilePathPattern()` live in `constants.js`; the xterm link provider (`registerFilePathLinkProvider`, terminal-ui.js) and the response viewer's `_linkifyFilePaths()` (app.js) both build a fresh instance from it. ⚠️ Fresh per call, never one shared object: `lastIndex` is per-object state on a `/g` regex. The pattern is anchored on a known absolute root and terminated by a known extension, so a fraction (`3/4`) or a date can't match and trailing punctuation stays out. Roots include `Users` and `mnt`, without which nothing was clickable on macOS or WSL. The linear-time guard and the "terminal-ui builds from the factory" structural check are in `test/link-provider-regex.test.ts`.
-
-**The chat linkifier walks text nodes.** `_linkifyFilePaths()` builds anchors with `createElement`/`textContent` on the rendered subtree, never by rebuilding sanitized markup as a string — the source is model output. Subtrees already inside an `<a>` are skipped (marked autolinks URLs; a nested anchor would swallow the click), and the anchor's text is the path verbatim so "copy code" still yields what the agent printed. `test/response-viewer-file-links.test.ts` pins both properties.
-
-**Out-of-workspace paths go through the attachment routes, not the file routes.** `file-content`/`file-raw` resolve against `workingDir` and 404 anything that escapes it, which is correct and unchanged — but the paths agents most often print (a `/tmp` capture, Claude's own scratchpad, another checkout) are exactly that, so clicking one used to report "File not found" for a file sitting on disk. `openFilePreview()` now detects the case (`_isExternalPreviewPath`, a string compare for ROUTING only; the real decision stays server-side) and registers the path via `POST /api/sessions/:id/attachments` first, rendering by id. ⚠️ That registration passes `notify: false`, which suppresses ONLY the `attachment:detected` broadcast — the guard, the registry entry and the by-id routes are identical either way. Without it every click also popped an attachment card announcing the file already filling the screen. ⚠️ The click is an explicit user action on the **explicit, Origin-guarded** registration route, which is why it may cross the workspace boundary at all; the passive magic-link scanner stays force-confined. A type outside `SUPPORTED_ATTACHMENT_EXTENSIONS` (`.svg`, `.bmp`) is refused with a message naming what IS previewable, rather than the registry's own policy term.
-
-⚠️ **The terminal routes an out-of-workspace path to the preview, not the log viewer.** The log viewer spawns `tail -f` and allows only the workspace, `/var/log` and `~/logs`, so an external `.log`/`.json`/code path answered `Path must be within working directory or allowed log directories` while the SAME path clicked in the response viewer previewed fine. `activate()` now checks `_isExternalPreviewPath` alongside `previewsInFileViewer`. In-workspace text keeps the tail viewer, which is the point of it (live follow); nothing widened `file-stream-manager`'s allowlist, so no `tail -f` is spawned on an arbitrary host path.
-
-**Text reuses the edit-mode allowlist; markup stays download-only.** `TEXT_ATTACHMENT_EXTENSIONS` IS `EDITABLE_EXTENSIONS` (`config/file-editing.ts`) rather than a second curated list that would drift from it: if the viewer would open a file for editing inside the workspace, the same file outside it can be read. The justification for widening is that the agent in the session can already `cat` any of these and the picker already previews them, so the suffix was never the confidentiality gate; the path guard is (sensitive-file blocklist, `/root` and `/etc` trees, realpath first). ⚠️ Two consequences had to be handled at the same time: `~/.codeman*/state.json` joined `isSensitivePath` (it persists `SessionState.envOverrides`, and the env allowlist admits key-shaped names like `GEMINI_API_KEY`, so it can hold a live credential), and `html`/`htm` joined `svg` in `serveRawFile`'s **download-only** branch so that widening what can be READ never widens what can RUN on our own origin. Text with no dedicated MIME entry goes out as inert `text/plain; charset=utf-8` + `nosniff`, matching the picker. The by-id text preview is bounded like the workspace one: a `Range` request for the first 512KB (a real partial read, not a discarded 50MB download) plus a 500-line cap, with the footer saying so.
-
-**Media is single-sourced across the two preview paths.** `VIDEO_ATTACHMENT_EXTENSIONS` / `AUDIO_ATTACHMENT_EXTENSIONS` live in `attachment-registry.ts` and are imported by `file-content`'s media classification, so a clip plays identically whether it is in the workspace or reached by id from outside it. They diverged first: the workspace path had its own inline sets and the registry allowlist had no media at all, so a video an agent wrote to `/tmp` was refused as an unsupported type while the same file inside the repo played. ⚠️ Three things have to line up for a player rather than a dead frame: the extension in the allowlist, a **real MIME entry** in `MIME_TYPES` (a `<video>` refuses to decode `application/octet-stream`, which presents as a player that renders and then does nothing), and the range-aware body (`serveRawFile` → `sendFileBody`) that makes the scrub bar work. `getAttachmentType()` returns the `video`/`audio` members of `AttachmentDetectedType` for them; the attachment card has no per-type CSS and its thumbnail falls back to the type label, since `generateFirstPageThumbnail` has no media branch and answers 204. ⚠️ The image-watcher keeps its OWN narrow detection list (`png/pdf/docx/pptx`), so this does not start popping cards for every video an agent writes.
-
-⚠️ **The preview overlay must outrank the panel that launched it.** `.file-preview-overlay` sits at `z-index: 5100`, above the response viewer (5000) and its backdrop (4999); at its historical 2000 a path clicked in the chat opened the overlay *behind* the chat, which reads as a dead link. It stays below the toast/picker band (10000+) so a "Saved" toast still lands on top.
-
 ### Filesystem path picker

 **Filesystem path picker** (Link Existing "Browse" button + the extended mobile keyboard's `📁 Path` key): a lazy one-directory-at-a-time browser over `GET /api/filesystem/browse`, with `GET /api/filesystem/preview` serving the tapped file. It starts at the active session's working directory (falling back to `/mnt/d`), hides dot entries, and inserts the chosen path **without** Enter so the prompt is not submitted. The companion `⌫ All` key clears only the current unsent prompt buffer and must never emit the agent's `/clear` command.
@@ -11,46 +11,9 @@ import { realpathSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { basename, extname, isAbsolute } from 'node:path';
 import { isBlockedAttachmentPath, loadAttachmentGuardConfig } from './config/attachment-guard.js';
-import { EDITABLE_EXTENSIONS } from './config/file-editing.js';
 import { validateSessionFilePath } from './web/route-helpers.js';
 import type { AttachmentDetectedEvent, AttachmentDetectedType } from './types.js';

-/**
- * Playable media extensions, single-sourced here because the WORKSPACE preview
- * (`file-content`'s media classification) and the out-of-workspace attachment
- * path must agree on what plays. They diverged once: a video an agent wrote
- * inside the workspace played with a working scrub bar, while the same file in
- * `/tmp` was refused as an unsupported type, which reads as a bug rather than a
- * boundary. Serving is range-aware in both, which is what makes seeking work.
- */
-export const VIDEO_ATTACHMENT_EXTENSIONS: ReadonlySet<string> = new Set(['mp4', 'webm', 'mov', 'm4v', 'ogv']);
-export const AUDIO_ATTACHMENT_EXTENSIONS: ReadonlySet<string> = new Set([
-  'mp3',
-  'wav',
-  'ogg',
-  'oga',
-  'm4a',
-  'aac',
-  'flac',
-  'opus',
-]);
-
-/**
- * Plain-text extensions, REUSING the File Viewer's edit-mode allowlist rather
- * than curating a second list that would drift from it. The rule reads: if the
- * viewer would open that file for editing inside the workspace, the same file
- * outside it can be read here. `svg` and `env` are absent from that list by
- * design and stay absent here.
- *
- * Why widen at all: the agent in the session can already `cat` any of these,
- * and every path-shaped surface (the picker, the workspace viewer) can already
- * show them. Refusing a `.log` an agent just wrote to `/tmp` bought no
- * confidentiality, it only made the click fail. The confidentiality gate is the
- * path guard that still runs on every registration (sensitive-file blocklist,
- * `/root` and `/etc` trees, realpath before the check), not the file's suffix.
- */
-export const TEXT_ATTACHMENT_EXTENSIONS: ReadonlySet<string> = EDITABLE_EXTENSIONS;
-
 const SUPPORTED_ATTACHMENT_EXTENSIONS = new Set([
  'png',
  'jpg',
@@ -62,9 +25,6 @@ const SUPPORTED_ATTACHMENT_EXTENSIONS = new Set([
  'pptx',
  'md',
  'txt',
-  ...VIDEO_ATTACHMENT_EXTENSIONS,
-  ...AUDIO_ATTACHMENT_EXTENSIONS,
-  ...TEXT_ATTACHMENT_EXTENSIONS,
 ]);

 export type AttachmentSource = 'detected' | 'external';
@@ -148,14 +108,10 @@ export function isSupportedAttachmentExtension(extension: string): boolean {
 export function getAttachmentType(extension: string): AttachmentDetectedType {
  const normalized = extension.toLowerCase().replace(/^\./, '');
  if (['png', 'jpg', 'jpeg', 'gif', 'webp'].includes(normalized)) return 'image';
-  if (VIDEO_ATTACHMENT_EXTENSIONS.has(normalized)) return 'video';
-  if (AUDIO_ATTACHMENT_EXTENSIONS.has(normalized)) return 'audio';
  if (normalized === 'pdf') return 'pdf';
  if (normalized === 'pptx') return 'presentation';
  if (normalized === 'md') return 'markdown';
-  // Everything else in the text family reads as text, including code and
-  // config: the card and the preview both treat it as a plain-text file.
-  if (normalized === 'txt' || TEXT_ATTACHMENT_EXTENSIONS.has(normalized)) return 'text';
+  if (normalized === 'txt') return 'text';
  return 'document';
 }

@@ -63,15 +63,7 @@ export interface ImageDetectedEvent {
  size: number;
 }

-export type AttachmentDetectedType =
-  | 'image'
-  | 'video'
-  | 'audio'
-  | 'pdf'
-  | 'document'
-  | 'presentation'
-  | 'markdown'
-  | 'text';
+export type AttachmentDetectedType = 'image' | 'pdf' | 'document' | 'presentation' | 'markdown' | 'text';

 /**
 * Event emitted when a new previewable attachment file is detected in a session's
@@ -2004,17 +2004,6 @@ class CodemanApp {
    if (!body || body.dataset.rvBound === '1') return;
    body.dataset.rvBound = '1';
    body.addEventListener('click', async (ev) => {
-      // File path (_linkifyFilePaths): open it in the preview overlay, which
-      // resolves workspace and out-of-workspace paths alike.
-      const pathLink = ev.target.closest('a.rv-path');
-      if (pathLink) {
-        ev.preventDefault();
-        ev.stopPropagation();
-        const filePath = pathLink.dataset.path;
-        if (filePath) this.openFilePreview(filePath, this.activeSessionId);
-        return;
-      }
-
      // One-click copy: lift the raw source from the sibling <pre><code>.
      const copyBtn = ev.target.closest('.rv-copy-btn');
      if (copyBtn) {
@@ -2085,66 +2074,10 @@ class CodemanApp {
    const renderedText = document.createElement('div');
    renderedText.className = 'rv-text';
    renderedText.innerHTML = this._renderMarkdown(text);
-    this._linkifyFilePaths(renderedText);
    div.appendChild(renderedText);
    return div;
  }

-  /**
-   * Make absolute file paths in a rendered message clickable.
-   *
-   * The terminal's link provider never sees these: the response viewer is
-   * markdown, and a path the agent wrote as prose or inline code renders as
-   * inert text — so the file it just produced (a screenshot, a report) was one
-   * copy-paste away from being viewable instead of one click. Same pattern the
-   * terminal uses (constants.js), same destination (the file-preview overlay).
-   *
-   * Walks TEXT NODES and builds anchors with DOM APIs — never innerHTML, and
-   * never a string rebuild of already-sanitized markup: the source is model
-   * output. Subtrees already inside an `<a>` are skipped so an autolinked URL
-   * is never re-cut, and the anchor's textContent is the path verbatim, so
-   * "copy code" still yields exactly what the agent printed.
-   */
-  _linkifyFilePaths(root) {
-    if (!root || typeof document === 'undefined') return;
-    // Guarded: a stale cached constants.js must degrade to plain text, not throw
-    // out of the middle of rendering a message.
-    if (typeof absoluteFilePathPattern !== 'function') return;
-    const pattern = absoluteFilePathPattern();
-
-    // Collect first: replacing a node while the walker is positioned on it
-    // invalidates the traversal.
-    const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
-    const targets = [];
-    for (let node = walker.nextNode(); node; node = walker.nextNode()) {
-      if (node.parentElement?.closest('a')) continue;
-      pattern.lastIndex = 0;
-      if (pattern.test(node.nodeValue || '')) targets.push(node);
-    }
-
-    for (const node of targets) {
-      const value = node.nodeValue;
-      const frag = document.createDocumentFragment();
-      let cursor = 0;
-      let match;
-      pattern.lastIndex = 0;
-      while ((match = pattern.exec(value)) !== null) {
-        const path = match[1];
-        if (match.index > cursor) frag.appendChild(document.createTextNode(value.slice(cursor, match.index)));
-        const link = document.createElement('a');
-        link.className = 'rv-path';
-        link.href = '#';
-        link.dataset.path = path;
-        link.title = path;
-        link.textContent = path;
-        frag.appendChild(link);
-        cursor = match.index + path.length;
-      }
-      if (cursor < value.length) frag.appendChild(document.createTextNode(value.slice(cursor)));
-      node.parentNode?.replaceChild(frag, node);
-    }
-  }
-
  _getResponseViewerAgentLabel() {
    const mode = this.sessions.get(this.activeSessionId)?.mode;
    return mode === 'codex'
@@ -437,6 +437,94 @@ function computeSseStale(input) {
  return now - lastMessageAt >= timeoutMs;
 }

+// Home-screen session order: one comparator for both overviews.
+//
+// The phone overview (mobile-overview.js) and the desktop tab rail
+// (home-sessions.js) list the same sessions, so they answer the same question
+// and must answer it the same way: "which of these wants me next?".
+//
+//   1. Anything blocked on a human first (red question, then error, then a
+//      yellow idle prompt), longest-blocked at the top: a session that has been
+//      sitting on a permission dialog for 20 minutes is starving, one that
+//      raised it 5 seconds ago is not.
+//   2. Then whatever is running, LONGEST-RUNNING first, since that is the turn most
+//      likely to be finished, or stuck, by the time you look.
+//   3. Then everything quiet, MOST RECENTLY quiet first: when nothing is
+//      running, the session that just finished is the one you came back for,
+//      and the one you abandoned yesterday sinks.
+//
+// So the tiebreak flips direction halfway down the list, and that is the point:
+// for a state something is still doing, longer = more urgent; for a state
+// something has stopped in, more recent = more relevant.
+//
+// Pure: no DOM, no clock (every input is an epoch-ms stamp already on the
+// session payload), no `this`. Unit-tested in test/session-overview-order.test.ts.
+const SESSION_ACTIVITY_RANK = {
+  needs: 0,
+  error: 1,
+  waiting: 2,
+  working: 3,
+  idle: 4,
+  done: 5,
+};
+
+/** States still in progress, where the OLDEST stamp sorts first. */
+const SESSION_ACTIVITY_OLDEST_FIRST = ['needs', 'error', 'waiting', 'working'];
+
+/**
+ * When the row entered the state it is in.
+ *
+ * For everything quiet that is `lastActivityAt`, the last byte the pane printed:
+ * a Claude pane sitting at its composer prints nothing, so the end of the last
+ * turn is exactly when it went quiet.
+ *
+ * A WORKING pane is the opposite: it repaints about once a second, so its
+ * last-activity stamp is always "now" and would rank every running turn as
+ * freshly started. Its real start is the pane's last Enter (`lastSubmitAt`),
+ * persisted server-side and therefore stable across a Codeman restart. A
+ * working pane that has never submitted (spawned with its prompt on the command
+ * line, or an external CLI) falls back to last activity, which puts it at the
+ * short end of the running group rather than falsely at the head of it.
+ */
+function sessionActivityAnchor(row) {
+  const activeAt = Number(row && row.lastActivityAt) || 0;
+  if (row && row.state === 'working') return Number(row.lastSubmitAt) || activeAt;
+  return activeAt;
+}
+
+/**
+ * Sort comparator for one overview row against another.
+ * @param {{state: string, lastActivityAt?: number, lastSubmitAt?: number, orderIndex?: number}} a
+ * @param {{state: string, lastActivityAt?: number, lastSubmitAt?: number, orderIndex?: number}} b
+ */
+function compareSessionActivity(a, b) {
+  const rankA = SESSION_ACTIVITY_RANK[a.state];
+  const rankB = SESSION_ACTIVITY_RANK[b.state];
+  const rank = (rankA === undefined ? 99 : rankA) - (rankB === undefined ? 99 : rankB);
+  if (rank !== 0) return rank;
+
+  const atA = sessionActivityAnchor(a);
+  const atB = sessionActivityAnchor(b);
+  if (atA !== atB) {
+    // A row with no stamp at all gets no opinion: it sorts last either way
+    // rather than claiming to be the oldest (0) thing on the screen.
+    if (!atA) return 1;
+    if (!atB) return -1;
+    return SESSION_ACTIVITY_OLDEST_FIRST.includes(a.state) ? atA - atB : atB - atA;
+  }
+
+  // Equal stamps (or two unstamped rows): fall back to the user's tab order so
+  // the list is deterministic and cannot shuffle between renders.
+  const orderA = Number.isFinite(a.orderIndex) ? a.orderIndex : Number.MAX_SAFE_INTEGER;
+  const orderB = Number.isFinite(b.orderIndex) ? b.orderIndex : Number.MAX_SAFE_INTEGER;
+  return orderA - orderB;
+}
+
+/** Copy of `rows`, in overview order. Never sorts in place, so callers keep their array. */
+function sortSessionsByActivity(rows) {
+  return (Array.isArray(rows) ? rows.slice() : []).sort(compareSessionActivity);
+}
+
 if (typeof window !== 'undefined') {
  window.WEBGL_FALLBACK = WEBGL_FALLBACK;
  window.evaluateWebGLLongTaskTrip = evaluateWebGLLongTaskTrip;
@@ -464,6 +552,12 @@ if (typeof window !== 'undefined') {
    compute: computeSseStale,
    TIMEOUT_MS: SSE_STALE_TIMEOUT_MS,
  };
+  window.CodemanSessionOrder = {
+    RANK: SESSION_ACTIVITY_RANK,
+    anchor: sessionActivityAnchor,
+    compare: compareSessionActivity,
+    sort: sortSessionsByActivity,
+  };
 }

 // Scheduler API — prioritize terminal writes over background UI updates.
@@ -893,45 +987,6 @@ function computeRewriteScrollLine(input) {
  return Math.max(0, (input?.baseY || 0) - linesFromBottom);
 }

-/**
- * Absolute file paths in agent output, as ONE pattern with two consumers: the
- * xterm link provider (terminal-ui.js) and the response viewer's markdown
- * linkifier (app.js). They used to be able to drift, and a path that is
- * clickable in the terminal but inert in the chat reads as a bug, not a policy.
- *
- * Anchored on a known absolute root (so an ordinary fraction or a date can
- * never match) and terminated by a known extension (so the end of the path is
- * unambiguous — a trailing `)` or `.` after the extension stays out). Longer
- * extensions come first in each family (`tsx|ts`), so the trailing `\b` cannot
- * be satisfied by the shorter branch mid-word.
- *
- * ⚠ Consumers must never share one instance: `lastIndex` is per-object state on
- * a `/g` regex, so {@link absoluteFilePathPattern} mints a fresh one per call.
- */
-const FILE_PATH_LINK_PATTERN =
-  /(\/(?:home|Users|tmp|var|private|etc|opt|mnt|srv|media|data|workspace)\/[^\s"'<>|;&\n\x00-\x1f]*\.(?:log|txt|json|md|ya?ml|csv|xml|sh|py|tsx|ts|jsx|js|mjs|cjs|css|html|toml|ini|sql|png|jpe?g|gif|webp|bmp|svg|pdf|docx|pptx|mp4|webm|mov|mp3|wav))\b/g;
-
-/** A fresh, zero-state instance of {@link FILE_PATH_LINK_PATTERN}. */
-function absoluteFilePathPattern() {
-  return new RegExp(FILE_PATH_LINK_PATTERN.source, 'g');
-}
-
-/**
- * Extensions the file-preview overlay renders itself. Everything else a link
- * points at goes to the tail/log viewer, which is the right home for a growing
- * text file and the wrong one for bytes (tailing a PNG shows binary noise).
- */
-const FILE_PREVIEW_EXTENSIONS = new Set(
-  ('png jpg jpeg gif webp bmp svg pdf docx pptx mp4 webm mov mp3 wav').split(' ')
-);
-
-/** Whether a path's extension is one {@link FILE_PREVIEW_EXTENSIONS} covers. */
-function previewsInFileViewer(filePath) {
-  const ext = String(filePath || '').split('.').pop().toLowerCase();
-  return FILE_PREVIEW_EXTENSIONS.has(ext);
-}
-
 if (typeof window !== 'undefined') {
  window.CodemanHistoryFormat = { formatHistoryBytes, computeHistoryTruncationNotice, computeRewriteScrollLine };
-  window.CodemanFilePaths = { absoluteFilePathPattern, previewsInFileViewer, FILE_PREVIEW_EXTENSIONS };
 }
@@ -5,8 +5,13 @@
 * The welcome screen centers ~560px of content in a window that is usually
 * 1400px+, so the two gutters are dead space. The left one now carries the same
 * list a phone gets on its home screen (mobile-overview.js), turned vertical:
- * one row per live tab, in TAB ORDER (not sorted by state) so it reads as the
- * tab strip rotated, and so Alt+1..9 still matches what you see.
+ * one row per live tab.
+ *
+ * Rows are ordered by `CodemanSessionOrder` (constants.js), the same comparator
+ * the phone overview uses: blocked on you first, then running longest-first,
+ * then quiet most-recently-quiet first. The number badge stays the tab-strip
+ * index (Alt+1..9), so it is deliberately NOT sequential down a sorted rail:
+ * it names a shortcut, not a row position.
 *
 * DESKTOP ONLY, and only in a wide enough window: the rail is absolutely
 * positioned so the centered welcome content never moves, which means it can
@@ -16,11 +21,13 @@
 * both scale with the viewport (see the `.home-sessions` block in styles.css) —
 * a fixed 256px card looks abandoned on a 2560px display.
 *
- * Each row carries when the session was FIRST CREATED and when it was LAST
- * ACTIVE, both relative. Those two stamps go stale on their own (a sitting
- * session emits no event), so a slow clock refreshes them IN PLACE from the
- * epoch-ms values parked on the elements, rather than re-rendering: a re-render
- * would restart every row's blink animation and its working ring.
+ * Each row carries when the session was FIRST CREATED and how long it has been
+ * in the state it is in ("created 3d ago · working 12m"), and that second stamp is
+ * the value the order above is computed from, so the rail explains itself
+ * rather than looking arbitrarily shuffled. Both stamps go stale on their own
+ * (a sitting session emits no event), so a slow clock refreshes them IN PLACE
+ * from the epoch-ms values parked on the elements, rather than re-rendering: a
+ * re-render would restart every row's blink animation and its working ring.
 *
 * The working state is deliberately identical to the phone's: a pulsing green
 * dot ringed by the spinner a tab shows while it loads (`tab-load-spin`, reused
@@ -34,6 +41,7 @@
 *
 * @mixin Extends CodemanApp.prototype via Object.assign
 * @dependency app.js (this.sessions, this.cases, this.pendingHooks, selectSession)
+ * @dependency constants.js (CodemanSessionOrder, the shared row comparator)
 * @dependency mobile-overview.js (_mobileOverviewState, _mobileOverviewCaseFor, shouldUseMobileOverview)
 * @dependency ralph-panel.js (formatRelativeTime — the app's one relative-time formatter)
 * @dependency webview-tabs.js (this.webviews, this.webviewOrder, openWebview)
@@ -158,11 +166,18 @@ Object.assign(CodemanApp.prototype, {
  // ═══════════════════════════════════════════════════════════════

  /**
-   * One row per live session, in the user's tab order. State classification is
-   * `_mobileOverviewState()` (mobile-overview.js) so both home screens agree on
-   * what counts as needing you; the ORDER differs on purpose — the phone sorts
-   * by urgency because it shows one screenful at a time, this column mirrors the
-   * tab strip so the number badges line up with Alt+1..9.
+   * One row per live session, in overview order: whatever is blocked on you
+   * first, then whatever is running (longest turn first), then the quiet ones
+   * most-recently-quiet first. The comparator is `CodemanSessionOrder`
+   * (constants.js), shared with the phone overview, and state classification is
+   * `_mobileOverviewState()` (mobile-overview.js), so the two home screens can
+   * neither disagree about what "working" means nor about what sorts first.
+   *
+   * `orderIndex` stays the position in the TAB STRIP, because that is what the
+   * number badge means (Alt+1..9). Once the rows are sorted those badges no
+   * longer run 1,2,3 down the rail: the badge answers "which key selects this",
+   * not "how far down the list is it".
+   *
   * @returns {Array<object>} row descriptors, ready to render
   */
  buildHomeSessionRows() {
@@ -173,14 +188,14 @@ Object.assign(CodemanApp.prototype, {
    // invisible here while its tab already exists.
    for (const id of this.sessions?.keys() || []) if (!ids.includes(id)) ids.push(id);

-    return ids.map((id, index) => {
+    const rows = ids.map((id, orderIndex) => {
      const session = this.sessions.get(id);
      const matched = this._mobileOverviewCaseFor(session.workingDir, cases);
      const state = this._mobileOverviewState(session, this.pendingHooks?.get(id));
      const mode = session.mode || 'claude';
      return {
        id,
-        index,
+        orderIndex,
        name: this.getSessionName ? this.getSessionName(session) : session.name || id.slice(0, 8),
        mode,
        modeBadge: HOME_SESSIONS_MODE_BADGE[mode] || '',
@@ -192,8 +207,19 @@ Object.assign(CodemanApp.prototype, {
        // render time so the clock below can redo it without a re-render.
        createdAt: Number(session.createdAt) || 0,
        lastActivityAt: Number(session.lastActivityAt) || 0,
+        // The running group is ordered by the pane's last Enter, since a
+        // working pane's last-activity stamp is always "now".
+        lastSubmitAt: Number(session.lastSubmitAt) || 0,
+        // "how long has it been like this", resolved by the phone overview's
+        // helper so both home screens label the same stamp with the same word.
+        since: this._mobileOverviewSince(state, session),
      };
    });
+
+    // Guarded like every other constants.js consumer: a stale cached
+    // constants.js (iOS Safari serves old JS after a deploy) must degrade to
+    // tab order, not TypeError the whole home screen away.
+    return window.CodemanSessionOrder ? window.CodemanSessionOrder.sort(rows) : rows;
  },

  // ═══════════════════════════════════════════════════════════════
@@ -234,32 +260,40 @@ Object.assign(CodemanApp.prototype, {
  // ═══════════════════════════════════════════════════════════════

  /**
-   * The "created 2h ago · active 3m ago" footer line. Both stamps keep their raw
+   * The "created 2h ago · working 12m" footer line. Both stamps keep their raw
   * epoch-ms on the element (`data-hs-ts`) so `_tickHomeSessionsTimes()` can
   * rewrite the text without rebuilding the row.
+   *
+   * The second stamp is the row's state duration, NOT a plain last-active
+   * stamp: it is the number the rail is sorted by, and a working row that reads
+   * "active just now" (every working pane repaints about once a second) hides
+   * exactly the value that decided its position. `_mobileOverviewSince()` owns
+   * both the word and the anchor, so the phone says the same thing.
   */
  _buildHomeSessionsMeta(row) {
    const meta = document.createElement('span');
    meta.className = 'home-sessions-row-meta';
-    // Relative times are generated text, and "created"/"active" here are the
+    // Relative times are generated text, and "created"/"idle" here are the
    // same generic words that mean something else on other surfaces.
    meta.setAttribute('data-i18n-skip', '');

-    meta.appendChild(this._buildHomeSessionsStamp('created', row.createdAt, 'home-sessions-meta-created'));
+    meta.appendChild(this._buildHomeSessionsStamp('created', row.createdAt, 'ago', 'home-sessions-meta-created'));

-    const sep = document.createElement('span');
-    sep.className = 'home-sessions-meta-sep';
-    sep.setAttribute('aria-hidden', 'true');
-    sep.textContent = '·';
-    meta.appendChild(sep);
+    if (row.since) {
+      const sep = document.createElement('span');
+      sep.className = 'home-sessions-meta-sep';
+      sep.setAttribute('aria-hidden', 'true');
+      sep.textContent = '·';
+      meta.appendChild(sep);

-    meta.appendChild(this._buildHomeSessionsStamp('active', row.lastActivityAt, 'home-sessions-meta-active'));
+      meta.appendChild(this._buildHomeSessionsStamp(row.since.key, row.since.at, 'for', 'home-sessions-meta-since'));
+    }

    return meta;
  },

-  /** One labelled stamp: a dim key, the relative value, full date in the title. */
-  _buildHomeSessionsStamp(key, timestamp, className) {
+  /** One labelled stamp: a dim key, the value, full date in the title. */
+  _buildHomeSessionsStamp(key, timestamp, format, className) {
    const wrap = document.createElement('span');
    wrap.className = `home-sessions-meta-item ${className}`;

@@ -270,18 +304,21 @@ Object.assign(CodemanApp.prototype, {

    const value = document.createElement('span');
    value.dataset.hsTs = String(timestamp || 0);
-    value.textContent = this._homeSessionsAgo(timestamp);
+    value.dataset.hsFmt = format;
+    value.textContent = this._homeSessionsStampText(timestamp, format);
    wrap.appendChild(value);

-    if (timestamp)
-      wrap.title = `${key === 'created' ? 'First created' : 'Last active'}: ${new Date(timestamp).toLocaleString()}`;
+    if (timestamp) wrap.title = `${key === 'created' ? 'First created' : key}: ${new Date(timestamp).toLocaleString()}`;
    return wrap;
  },

-  /** Relative label for a stamp. `formatRelativeTime` is the app's one formatter. */
-  _homeSessionsAgo(timestamp) {
-    if (!timestamp) return '—';
-    return this.formatRelativeTime(timestamp) || '—';
+  /**
+   * 'ago' points at a moment ("3d ago"), 'for' measures a span to now ("12m").
+   * Both come from the phone overview's formatter, so a duration is written the
+   * same way on both home screens.
+   */
+  _homeSessionsStampText(timestamp, format) {
+    return this._mobileOverviewStampText(timestamp, format);
  },

  /**
@@ -311,7 +348,7 @@ Object.assign(CodemanApp.prototype, {
    if (!el) return;
    for (const node of el.querySelectorAll('[data-hs-ts]')) {
      const ts = Number(node.dataset.hsTs) || 0;
-      const text = this._homeSessionsAgo(ts);
+      const text = this._homeSessionsStampText(ts, node.dataset.hsFmt);
      if (node.textContent !== text) node.textContent = text;
    }
  },
@@ -348,11 +385,14 @@ Object.assign(CodemanApp.prototype, {
    item.dataset.hsSession = row.id;
    item.title = row.dir ? `${row.name} (${row.dir})` : row.name;

-    if (row.index < 9) {
+    // The badge is the Alt+N key for this tab, so it keeps the tab-strip index
+    // even though the rows are sorted by activity: it will not read 1,2,3 down
+    // the rail, and must not, or the shortcut it names would be wrong.
+    if (row.orderIndex < 9) {
      const number = document.createElement('span');
      number.className = 'home-sessions-number';
      number.setAttribute('data-i18n-skip', '');
-      number.textContent = String(row.index + 1);
+      number.textContent = String(row.orderIndex + 1);
      item.appendChild(number);
    }

@@ -8,6 +8,10 @@
 * errored sessions), then SPACES (cases, expandable to their sessions), then
 * WORKING and IDLE / DONE.
 *
+ * Rows inside a section are ordered by `CodemanSessionOrder` (constants.js),
+ * the SAME comparator the desktop rail uses: blocked longest-first, then
+ * running longest-first, then quiet most-recently-quiet first.
+ *
 * PHONE ONLY. The gate is `shouldUseMobileOverview()` (viewport < 430px, not a
 * popped-out solo window, per-device setting on). Tablet and desktop keep the
 * welcome overlay untouched. The container ships with the `hidden` attribute and
@@ -25,6 +29,7 @@
 * `buildMobileOverviewModel()` is pure and unit-tested (test/mobile-overview.test.ts).
 *
 * @mixin Extends CodemanApp.prototype via Object.assign
+ * @dependency constants.js (CodemanSessionOrder, the shared row comparator)
 * @dependency app.js (this.sessions, this.cases, this.pendingHooks, selectSession, run)
 * @dependency ralph-panel.js (formatRelativeTime, the app's one relative-time formatter)
 * @dependency mobile-handlers.js (MobileDetection)
@@ -35,16 +40,6 @@
 /** Viewport width that counts as a phone. Matches the mobile.css phone block. */
 const MOBILE_OVERVIEW_PHONE_QUERY = '(max-width: 430px)';

-/** Sort rank per state: the most demanding thing sorts first inside a section. */
-const MOBILE_OVERVIEW_STATE_RANK = {
-  needs: 0,
-  error: 1,
-  waiting: 2,
-  working: 3,
-  idle: 4,
-  done: 5,
-};
-
 /** How many past conversations show before the "Show all" toggle. */
 const MOBILE_OVERVIEW_PAST_LIMIT = 8;

@@ -188,18 +183,25 @@ Object.assign(CodemanApp.prototype, {
        // Epoch ms, straight off the session payload; formatting happens at
        // render time so the clock can redo it without a re-render.
        createdAt: Number(session.createdAt) || 0,
+        // Raw stamps for the shared order comparator; `since` above is the same
+        // pair resolved for DISPLAY, and the two must not drift apart.
+        lastActivityAt: Number(session.lastActivityAt) || 0,
+        lastSubmitAt: Number(session.lastSubmitAt) || 0,
        since: this._mobileOverviewSince(state, session),
        orderIndex: orderIndex === -1 ? Number.MAX_SAFE_INTEGER : orderIndex,
      };
    });

-    const bySeverityThenOrder = (a, b) => {
-      const rank = MOBILE_OVERVIEW_STATE_RANK[a.state] - MOBILE_OVERVIEW_STATE_RANK[b.state];
-      return rank !== 0 ? rank : a.orderIndex - b.orderIndex;
+    // Order is `CodemanSessionOrder` (constants.js), shared with the desktop
+    // rail: blocked first (longest-blocked at the top), then running
+    // longest-first, then quiet most-recent-first.
+    // Guarded: a stale cached constants.js (iOS Safari after a deploy) must
+    // degrade to tab order, not TypeError the overview away.
+    const inSection = (states) => {
+      const filtered = rows.filter((r) => states.includes(r.state));
+      return window.CodemanSessionOrder ? window.CodemanSessionOrder.sort(filtered) : filtered;
    };

-    const inSection = (states) => rows.filter((r) => states.includes(r.state)).sort(bySeverityThenOrder);
-
    // Past = conversations from the unified list that are not currently live.
    // The endpoint already folds a transcript into its owning session (via the
    // claudeSessionId alias map), so a plain id check is enough to avoid listing
@@ -15,11 +15,6 @@

 const AWAY_DIGEST_LAST_VIEWED_KEY = 'codeman-away-digest-last-viewed';
 const FILE_BROWSER_SHOW_HIDDEN_KEY = 'codeman:fileBrowserShowHidden';
-// Bounds for the by-id text preview, mirroring what the workspace text preview
-// already does server-side (500 lines). The byte cap rides a Range request, so
-// a huge log is a partial read rather than a download the viewer throws away.
-const TEXT_PREVIEW_MAX_BYTES = 512 * 1024;
-const TEXT_PREVIEW_MAX_LINES = 500;
 const AWAY_DIGEST_SECTIONS = [
  ['needsAttention', 'Needs Attention'],
  ['completed', 'Completed'],
@@ -3239,65 +3234,6 @@ Object.assign(CodemanApp.prototype, {
    if (headerBtn) headerBtn.setAttribute('aria-expanded', 'false');
  },

-  /**
-   * Whether a path is absolute and provably OUTSIDE this session's workspace.
-   *
-   * `file-content` / `file-raw` resolve every path against `workingDir` and
-   * refuse anything that escapes it, so an absolute path elsewhere on the host
-   * (an agent's `/tmp` scratchpad capture, a screenshot, another checkout) can
-   * only ever 404 there — it has to go through the attachment routes instead.
-   *
-   * A string compare is enough for ROUTING; the real containment decision stays
-   * server-side (realpath + guard) on whichever route the request lands on. An
-   * unknown workingDir answers false, leaving the historical path untouched.
-   */
-  _isExternalPreviewPath(filePath, sessionId) {
-    if (typeof filePath !== 'string' || !filePath.startsWith('/')) return false;
-    const workingDir = this.sessions.get(sessionId)?.workingDir;
-    if (!workingDir) return false;
-    const root = workingDir.endsWith('/') ? workingDir : `${workingDir}/`;
-    return filePath !== workingDir && !filePath.startsWith(root);
-  },
-
-  /**
-   * Register an out-of-workspace path as a live external attachment and return
-   * its id, so the preview can render it through the by-id attachment routes.
-   *
-   * `notify: false` keeps this quiet: the caller is already opening the file in
-   * the overlay, so the usual attachment card + unread badge would be noise on
-   * top of the thing the user just asked to see. The server still enforces the
-   * full attachment guard (blocked secret trees, extension allowlist, symlinks
-   * resolved), so a refusal here is a policy answer worth showing verbatim.
-   *
-   * @returns {Promise<{attachmentId?: string, size?: number, error?: string}>}
-   */
-  async _registerExternalPreview(filePath, sessionId) {
-    try {
-      const res = await fetch(`/api/sessions/${sessionId}/attachments`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ path: filePath, notify: false }),
-      });
-      const result = await res.json().catch(() => null);
-      if (res.ok && result?.success && result.data?.attachmentId) {
-        return { attachmentId: result.data.attachmentId, size: result.data.size || 0 };
-      }
-      const reason = result?.error || `Cannot open this file (HTTP ${res.status})`;
-      // The registry's type answer is a policy term, not an explanation, and the
-      // user just clicked a file they can see on disk. Say what IS previewable
-      // from outside the workspace instead.
-      if (/unsupported/i.test(reason)) {
-        const ext = (filePath.split('.').pop() || '').toLowerCase();
-        return {
-          error: `Cannot preview .${ext} from outside the session workspace (images, video, audio, PDF, Office documents and text files only).`,
-        };
-      }
-      return { error: reason };
-    } catch (err) {
-      return { error: err.message || 'Cannot open this file' };
-    }
-  },
-
  async openFilePreview(filePath, sessionId = this.activeSessionId, attachmentId = null) {
    if (!sessionId || !filePath) return;

@@ -3322,70 +3258,25 @@ Object.assign(CodemanApp.prototype, {

    const ext = (filePath.split('.').pop() || '').toLowerCase();

-    // Out-of-workspace path: mint an attachment id up front. Every branch below
-    // talks to a workspace-confined route, so without this the image/PDF ones
-    // render a broken frame and the text one reports a bare "File not found"
-    // for a file that is sitting right there on disk.
-    let externalError = '';
-    let externalSize = 0;
-    if (!attachmentId && this._isExternalPreviewPath(filePath, sessionId)) {
-      const external = await this._registerExternalPreview(filePath, sessionId);
-      attachmentId = external.attachmentId || null;
-      externalError = external.error || '';
-      externalSize = external.size || 0;
-    }
-    if (!attachmentId && externalError) {
-      footerEl.textContent = '';
-      bodyEl.innerHTML = `<div class="binary-message">${escapeHtml(externalError)}</div>`;
-      return;
-    }
-
    // Registered attachment: render straight from its by-id routes — images and
    // PDFs inline, Office docs via the server-converted PDF preview, text fetched
    // raw. (Workspace-path previews fall through to the file-content endpoint.)
    if (attachmentId) {
      const base = `/api/sessions/${sessionId}/attachments/${encodeURIComponent(attachmentId)}`;
      const IMAGE_EXTS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp', 'bmp', 'svg']);
-      const VIDEO_EXTS = new Set(['mp4', 'webm', 'mov', 'm4v', 'ogv']);
-      const AUDIO_EXTS = new Set(['mp3', 'wav', 'ogg', 'oga', 'm4a', 'aac', 'flac', 'opus']);
-      // Size when we just registered the file ourselves, so a path opened from a
-      // link reads like a workspace preview instead of a bare "PNG". History
-      // cards arrive with an id and no size and keep the short form.
-      footerEl.textContent = externalSize ? `${this.formatFileSize(externalSize)} • ${ext}` : ext.toUpperCase();
+      footerEl.textContent = ext.toUpperCase();
      if (IMAGE_EXTS.has(ext)) {
        bodyEl.innerHTML = `<img src="${escapeHtml(`${base}/raw`)}" alt="${escapeHtml(filePath)}">`;
-      } else if (VIDEO_EXTS.has(ext)) {
-        // Same markup as the workspace branch below, including playsinline: iOS
-        // otherwise hijacks playback into its own fullscreen player, which
-        // leaves this overlay behind it with no way back but its close button.
-        // The attachment raw route is range-aware, so the scrub bar works.
-        bodyEl.innerHTML = `<video src="${escapeHtml(`${base}/raw`)}" controls autoplay playsinline preload="metadata"></video>`;
-      } else if (AUDIO_EXTS.has(ext)) {
-        bodyEl.innerHTML = `<audio src="${escapeHtml(`${base}/raw`)}" controls autoplay preload="metadata"></audio>`;
      } else if (ext === 'pdf') {
        bodyEl.innerHTML = `<iframe src="${escapeHtml(`${base}/raw`)}" title="${escapeHtml(filePath)}"></iframe>`;
      } else if (ext === 'docx' || ext === 'pptx') {
        bodyEl.innerHTML = `<iframe src="${escapeHtml(`${base}/preview`)}" title="${escapeHtml(filePath)}"></iframe>`;
      } else {
        try {
-          // Bounded like the workspace text preview: a Range for the first
-          // chunk (the route is range-aware, so this is a real partial read,
-          // not a 50MB download thrown away) and a line cap on top. An agent's
-          // log can be enormous, and rendering all of it into one <pre> is how
-          // you lock up the tab on the file you wanted to glance at.
-          const res = await fetch(`${base}/raw`, { headers: { Range: `bytes=0-${TEXT_PREVIEW_MAX_BYTES - 1}` } });
+          const res = await fetch(`${base}/raw`);
          if (!res.ok) throw new Error('Failed to load attachment');
          const text = await res.text();
-          const clippedByBytes = res.status === 206 && text.length >= TEXT_PREVIEW_MAX_BYTES;
-          const lines = text.split('\n');
-          const clippedByLines = lines.length > TEXT_PREVIEW_MAX_LINES;
-          const shown = clippedByLines ? lines.slice(0, TEXT_PREVIEW_MAX_LINES).join('\n') : text;
-          bodyEl.innerHTML = `<pre><code>${escapeHtml(shown)}</code></pre>`;
-          this.filePreviewContent = shown;
-          if (clippedByLines || clippedByBytes) {
-            const note = clippedByLines ? `showing first ${TEXT_PREVIEW_MAX_LINES} lines` : 'showing the start of the file';
-            footerEl.textContent = `${footerEl.textContent} (${note})`;
-          }
+          bodyEl.innerHTML = `<pre><code>${escapeHtml(text)}</code></pre>`;
        } catch (err) {
          bodyEl.innerHTML = `<div class="binary-message">Error: ${escapeHtml(err.message)}</div>`;
        }
@@ -9855,18 +9855,13 @@ kbd {

 /* ========== File Preview Overlay ========== */

-/* Above the response viewer (5000) and its backdrop (4999): a file path in the
-   chat opens this overlay, and at the old 2000 it rendered BEHIND the panel it
-   was launched from — the click looked dead. Same relationship the path picker
-   and its preview already have (10020 / 10030). Still below the toast and
-   picker band (10000+), so a "Saved" toast keeps landing on top. */
 .file-preview-overlay {
  position: fixed;
  inset: 0;
  background: var(--modal-backdrop);
  backdrop-filter: blur(6px);
  -webkit-backdrop-filter: blur(6px);
-  z-index: 5100;
+  z-index: 2000;
  display: none;
  align-items: center;
  justify-content: center;
@@ -12418,16 +12413,6 @@ kbd {
  border-bottom-color: var(--accent);
 }

-/* File paths linkified out of the message text. Monospace so a path still reads
-   as a path in prose, and break-all because these are long and the viewer is
-   narrow on a phone. Colour/underline come from the .rv-text a rule above. */
-.rv-text a.rv-path {
-  font-family: 'Fira Code', 'JetBrains Mono', 'SF Mono', Menlo, Monaco, monospace;
-  font-size: 0.92em;
-  word-break: break-all;
-  cursor: pointer;
-}
-
 /* Tables — scroll wrapper keeps table proper while allowing horizontal overflow */
 .rv-table-wrap {
  margin: 1em 0;
@@ -14917,8 +14902,9 @@ html[data-skin="daylight-blue"] .welcome-btn-tunnel.active:hover {
 }

 /* The freshest signal on the row: while a session is actually doing something,
-   its "active" stamp is the one the eye should land on. */
-.home-sessions-row--working .home-sessions-meta-active {
+   how long it has been doing it is what the eye should land on (and it is what
+   the rail is sorted by). */
+.home-sessions-row--working .home-sessions-meta-since {
  color: var(--green);
  opacity: 0.95;
 }
@@ -1423,19 +1423,19 @@ Object.assign(CodemanApp.prototype, {
        // the whole tab on hover. Non-empty token + bounded reps is O(n).
        const cmdPattern = /\b(tail|cat|head|less|grep|watch|vim|nano)\s+(?:[^\s\/]+\s+){0,4}(\/[^\s"'<>|;&\n\x00-\x1f]+)/g;

-        // Pattern 2: Paths with common extensions. Image/PDF/media extensions are
-        // included so pasted-attachment paths (`.claude-images/paste-*.png`) and
-        // screenshots an agent just wrote are clickable; those open the file
-        // preview rather than the log viewer (see addLink).
-        //
-        // The literal lives in constants.js because the response viewer linkifies
-        // the SAME paths out of markdown — one definition, two consumers. A fresh
-        // instance per call: `lastIndex` is per-object state.
-        const extPattern = absoluteFilePathPattern();
+        // Pattern 2: Paths with common extensions.
+        // Image/PDF extensions are included so pasted-attachment paths
+        // (`.claude-images/paste-*.png`) are clickable; they open the file preview
+        // rather than the log viewer (see addLink).
+        const extPattern =
+          /(\/(?:home|tmp|var|etc|opt)[^\s"'<>|;&\n\x00-\x1f]*\.(?:log|txt|json|md|yaml|yml|csv|xml|sh|py|ts|js|png|jpe?g|gif|webp|bmp|svg|pdf))\b/g;

        // Pattern 3: Bash() tool output
        const bashPattern = /Bash\([^)]*?(\/(?:home|tmp|var|etc|opt)[^\s"'<>|;&\)\n\x00-\x1f]+)/g;

+        /** Extensions that should open the image/document preview, not the log viewer. */
+        const PREVIEW_EXTS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp', 'bmp', 'svg', 'pdf']);
+
        const addLink = (filePath, matchIndex) => {
          const startCol = lineText.indexOf(filePath, matchIndex);
          if (startCol === -1) return;
@@ -1454,19 +1454,9 @@ Object.assign(CodemanApp.prototype, {
            },
            activate(event, text) {
              // Tailing a PNG in the log viewer shows binary noise; the file preview
-              // already renders images, PDFs, documents and media inline — and it
-              // now reaches files outside the workspace too, which is where an
-              // agent's screenshots and scratchpad captures actually land.
-              //
-              // Text goes to the log viewer, which follows a file that is still
-              // being written — but ONLY where it can actually read: it spawns
-              // `tail -f` and allows the workspace, /var/log and ~/logs, so an
-              // out-of-workspace path there answered "Path must be within
-              // working directory or allowed log directories" while the SAME
-              // path clicked in the response viewer previewed fine. The preview
-              // reads those through the guarded attachment routes, so external
-              // paths route there and the two surfaces agree.
-              if (previewsInFileViewer(text) || self._isExternalPreviewPath(text, self.activeSessionId)) {
+              // already renders images and PDFs inline.
+              const ext = (text.split('.').pop() || '').toLowerCase();
+              if (PREVIEW_EXTS.has(ext)) {
                self.openFilePreview(text, self.activeSessionId);
                return;
              }
@@ -23,15 +23,12 @@ import type {
 import { ApiErrorCode, createErrorResponse, getErrorMessage } from '../../types.js';
 import { fileStreamManager } from '../../file-stream-manager.js';
 import {
-  AUDIO_ATTACHMENT_EXTENSIONS,
  AttachmentRegistrationError,
  attachmentRecordToEvent,
  attachmentRegistry,
  buildFileThumbnailRoute,
  isSupportedAttachmentExtension,
  registerExternalAttachment,
-  TEXT_ATTACHMENT_EXTENSIONS,
-  VIDEO_ATTACHMENT_EXTENSIONS,
  type AttachmentRecord,
 } from '../../attachment-registry.js';
 import { generateFirstPageThumbnail } from '../../document-thumbnailer.js';
@@ -70,22 +67,6 @@ const MIME_TYPES: Record<string, string> = {
  webp: 'image/webp',
  ico: 'image/x-icon',
  bmp: 'image/bmp',
-  // Media needs a real type, not the octet-stream fallback: a <video>/<audio>
-  // element refuses to decode an unknown type, so a missing entry here presents
-  // as a player that renders and then does nothing.
-  mp4: 'video/mp4',
-  webm: 'video/webm',
-  mov: 'video/quicktime',
-  m4v: 'video/x-m4v',
-  ogv: 'video/ogg',
-  mp3: 'audio/mpeg',
-  wav: 'audio/wav',
-  ogg: 'audio/ogg',
-  oga: 'audio/ogg',
-  m4a: 'audio/mp4',
-  aac: 'audio/aac',
-  flac: 'audio/flac',
-  opus: 'audio/opus',
  pdf: 'application/pdf',
  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
@@ -194,16 +175,10 @@ async function serveRawFile(
      );
    return;
  }
-  // Markup is download-only: served with a renderable type on our own origin it
-  // would be stored XSS. SVG was always here; HTML/HTM join it now that the text
-  // family is servable, so widening what can be READ never widened what can RUN.
-  // The preview overlay reads these through `fetch()`, which ignores the
-  // disposition, so a clicked .html still shows its source.
-  const markupOnly = extension === 'svg' || extension === 'html' || extension === 'htm';
-  if (download || markupOnly) {
+  if (download || extension === 'svg') {
    reply.header(
      'Content-Type',
-      markupOnly ? 'application/octet-stream' : MIME_TYPES[extension] || 'application/octet-stream'
+      extension === 'svg' ? 'application/octet-stream' : MIME_TYPES[extension] || 'application/octet-stream'
    );
    reply.header('Content-Disposition', buildContentDisposition('attachment', fileName));
    reply.header('X-Content-Type-Options', 'nosniff');
@@ -211,17 +186,6 @@ async function serveRawFile(
    return;
  }

-  // Plain text with no dedicated MIME entry (code, config, logs, csv, xml) goes
-  // out as inert text/plain rather than the octet-stream fallback, matching what
-  // the path picker already does. Never a type the browser would execute.
-  if (!MIME_TYPES[extension] && TEXT_ATTACHMENT_EXTENSIONS.has(extension)) {
-    reply.header('Content-Type', 'text/plain; charset=utf-8');
-    reply.header('Content-Disposition', buildContentDisposition('inline', fileName));
-    reply.header('X-Content-Type-Options', 'nosniff');
-    sendFileBody(reply, resolvedPath, stat.size, rangeHeader);
-    return;
-  }
-
  reply.header('Content-Type', MIME_TYPES[extension] || 'application/octet-stream');
  reply.header('Content-Disposition', buildContentDisposition('inline', fileName));
  reply.header('X-Content-Type-Options', 'nosniff');
@@ -1135,10 +1099,8 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even
      // so the file viewer can open the same files.
      const ext = filePath.split('.').pop()?.toLowerCase() || '';
      const imageExts = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg', 'bmp', 'ico']);
-      // Shared with the attachment registry so a video plays the same whether it
-      // sits in the workspace or is reached by id from outside it.
-      const videoExts = VIDEO_ATTACHMENT_EXTENSIONS;
-      const audioExts = AUDIO_ATTACHMENT_EXTENSIONS;
+      const videoExts = new Set(['mp4', 'webm', 'mov', 'm4v', 'ogv']);
+      const audioExts = new Set(['mp3', 'wav', 'ogg', 'oga', 'm4a', 'aac', 'flac', 'opus']);
      const otherBinaryExts = new Set([
        'pdf',
        'zip',
@@ -1487,7 +1449,7 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even
  app.post('/api/sessions/:id/attachments', async (req, reply) => {
    const { id } = req.params as { id: string };
    const session = findSessionOrFail(ctx, id, req);
-    const body = (req.body || {}) as { path?: string; notify?: boolean };
+    const body = (req.body || {}) as { path?: string };

    if (!body.path || typeof body.path !== 'string') {
      reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Missing attachment path'));
@@ -1496,15 +1458,7 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even

    try {
      const event = await registerExternalAttachment(id, body.path, { sessionWorkingDir: session.workingDir });
-      // `notify: false` registers QUIETLY. The file-preview overlay uses it to
-      // mint an id for a path the user just clicked (a terminal or response-viewer
-      // link pointing outside the workspace): it is already opening the file, so
-      // the attachment card + unread badge would be noise announcing what is
-      // filling the screen. Default stays true — every other caller (the
-      // `codeman attach` CLI, codeman-publish) wants the card.
-      if (body.notify !== false) {
-        ctx.broadcast(SseEvent.AttachmentDetected, event);
-      }
+      ctx.broadcast(SseEvent.AttachmentDetected, event);
      return { success: true, data: event };
    } catch (err) {
      if (err instanceof AttachmentRegistrationError) {
@@ -80,23 +80,6 @@ const SENSITIVE_PATTERNS: RegExp[] = [
  /\/\.claude\/\.credentials\.json$/,
  /\/\.codeman[^/]*\/hook-secret$/,
  /\/\.codeman[^/]*\/users\.json$/,
-  // Codeman's own state files. Named once `.json` became previewable outside
-  // the workspace: `SessionState.envOverrides` persists whatever the user set
-  // for a session, and the env allowlist admits key-shaped names
-  // (`GEMINI_API_KEY`, `CLAUDE_CODE_*`), so state can hold a live credential.
-  // `state[^/]*` rather than `state`: siblings like state-inner.json carry the
-  // same payload. Same reasoning as the two entries above, and it leaves the
-  // rest of ~/.codeman attachable.
-  /\/\.codeman[^/]*\/state[^/]*\.json$/,
-  // settings.json holds a credential BY SCHEMA (`voiceSettings.apiKey`, the
-  // Deepgram key); push-keys.json holds the VAPID PRIVATE key (enough to forge
-  // push notifications to every subscribed device); intents.json is written
-  // 0600 precisely because captured prompts can contain secrets, and is
-  // deliberately kept out of /api/search — it must not be readable through a
-  // different route instead.
-  /\/\.codeman[^/]*\/settings\.json$/,
-  /\/\.codeman[^/]*\/push-keys\.json$/,
-  /\/\.codeman[^/]*\/intents\.json$/,
 ];

 /**
@@ -224,6 +224,11 @@ export function createSessionListeners(session: Session, deps: SessionListenerDe
      // re-capture instead).
      approvalInbox.resolveForSession(session.id, 'resolved_in_terminal', ['idle']);
      deps.broadcast(SseEvent.SessionWorking, { id: session.id });
+      // Full state ride-along: the home screens sort the running group on
+      // lastSubmitAt, and without this the browser keeps the stamp it loaded
+      // with (a turn started after page load ranks by the PREVIOUS turn's
+      // Enter). Debounced, so working-signal flaps cost one broadcast.
+      deps.broadcastSessionStateDebounced(session.id);
      const tracker = deps.getRunSummaryTracker(session.id);
      if (tracker) {
        tracker.recordWorking();
@@ -2,11 +2,11 @@
 //
 // The desktop home screen's tab column (src/web/public/home-sessions.js) fills
 // the welcome overlay's left gutter. Two things about it can silently go wrong
-// and are pinned here: the row ORDER (it mirrors the tab strip, unlike the phone
-// overview which sorts by urgency, and the number badges are only correct if it
-// does), and the WIDTH GATE, which lives in two places at once — the JS constant
-// and a CSS media query — because the column is absolutely positioned and would
-// overlap the search panel in a narrow window.
+// and are pinned here: the row ORDER (shared with the phone overview via
+// CodemanSessionOrder, with the number badge still carrying the TAB index so
+// Alt+N keeps working), and the WIDTH GATE, which lives in two places at once —
+// the JS constant and a CSS media query — because the column is absolutely
+// positioned and would overlap the search panel in a narrow window.
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import vm from 'node:vm';
@@ -35,9 +35,10 @@ function fakeElement(): any {

 /**
 * home-sessions.js reuses `_mobileOverviewState` / `_mobileOverviewCaseFor` /
- * `shouldUseMobileOverview` from mobile-overview.js, so both files run in the
- * same context — which is also the point: if that reuse ever breaks, these
- * tests stop loading rather than quietly testing a divergent copy.
+ * `shouldUseMobileOverview` from mobile-overview.js and the row comparator from
+ * constants.js, so all three files run in the same context, which is also the
+ * point: if that reuse ever breaks, these tests stop loading rather than
+ * quietly testing a divergent copy.
 */
 function loadHomeSessionsApp(overrides: Record<string, any> = {}, innerWidth = 1512) {
  const CodemanApp = function CodemanApp(this: any) {};
@@ -52,7 +53,7 @@ function loadHomeSessionsApp(overrides: Record<string, any> = {}, innerWidth = 1
    },
    MobileDetection: { getDeviceType: () => (innerWidth < 430 ? 'mobile' : 'desktop') },
  });
-  for (const file of ['mobile-overview.js', 'home-sessions.js']) {
+  for (const file of ['constants.js', 'mobile-overview.js', 'home-sessions.js']) {
    vm.runInContext(readFileSync(resolve(PUBLIC, file), 'utf8'), context, { filename: file });
  }

@@ -76,9 +77,9 @@ function sessionMap(list: Array<Record<string, any>>) {
 }

 describe('home sessions column: model', () => {
-  it('lists rows in TAB order, not by urgency, so the number badges match Alt+1..9', () => {
-    // The phone overview would hoist 'needy' to the top; this surface must not,
-    // because its badges are the Alt+N indices.
+  it('hoists a session blocked on you, and keeps its badge on the TAB index', () => {
+    // The badge names the Alt+N shortcut, so a sorted rail shows 2,1,3 rather
+    // than renumbering itself 1,2,3 and lying about which key selects what.
    const app = loadHomeSessionsApp({
      sessions: sessionMap([{ id: 'first' }, { id: 'needy' }, { id: 'third' }]),
      sessionOrder: ['first', 'needy', 'third'],
@@ -87,10 +88,34 @@ describe('home sessions column: model', () => {
    });

    const rows = app.buildHomeSessionRows();
-    expect(rows.map((r: any) => r.id)).toEqual(['first', 'needy', 'third']);
-    expect(rows.map((r: any) => r.index)).toEqual([0, 1, 2]);
-    expect(rows[1].state).toBe('needs');
-    expect(rows[1].pill).toBe('needs you');
+    expect(rows.map((r: any) => r.id)).toEqual(['needy', 'first', 'third']);
+    expect(rows.map((r: any) => r.orderIndex)).toEqual([1, 0, 2]);
+    expect(rows[0].state).toBe('needs');
+    expect(rows[0].pill).toBe('needs you');
+  });
+
+  it('orders running sessions longest-turn-first and quiet ones most-recent-first', () => {
+    // The same rule the phone overview follows, and the reason the rail exists:
+    // what is running longest is what is most likely to be done or stuck, and
+    // once nothing is running the session that just stopped is the one you came
+    // back for.
+    const app = loadHomeSessionsApp({
+      sessions: sessionMap([
+        { id: 'young-turn', status: 'busy', lastSubmitAt: 9_000, lastActivityAt: 10_000 },
+        { id: 'old-turn', status: 'busy', lastSubmitAt: 1_000, lastActivityAt: 10_000 },
+        { id: 'stale-idle', status: 'idle', lastActivityAt: 2_000 },
+        { id: 'fresh-idle', status: 'idle', lastActivityAt: 8_000 },
+      ]),
+      sessionOrder: ['young-turn', 'old-turn', 'stale-idle', 'fresh-idle'],
+      cases: CASES,
+    });
+
+    expect(app.buildHomeSessionRows().map((r: any) => r.id)).toEqual([
+      'old-turn',
+      'young-turn',
+      'fresh-idle',
+      'stale-idle',
+    ]);
  });

  it('shows a session that is not in the order list yet', () => {
@@ -117,11 +142,13 @@ describe('home sessions column: model', () => {
      cases: CASES,
    });

+    // Unstamped rows fall back to the tab order inside a state, so this reads
+    // as the state ranking alone: an errored session is blocked on you.
    expect(app.buildHomeSessionRows().map((r: any) => [r.state, r.pill])).toEqual([
+      ['error', 'error'],
      ['working', 'working'],
      ['idle', 'idle'],
      ['done', 'done'],
-      ['error', 'error'],
    ]);
  });

@@ -236,8 +263,10 @@ describe('home sessions column: wiring', () => {
    expect(aside).toBeGreaterThan(overlayStart);
    expect(aside).toBeLessThan(content);
    // Load order: the module reuses prototype methods installed by
-    // mobile-overview.js. Compare the <script> tags, not any mention: both
-    // files are named in explanatory comments earlier in the document.
+    // mobile-overview.js and the comparator installed by constants.js. Compare
+    // the <script> tags, not any mention: both files are named in explanatory
+    // comments earlier in the document.
    expect(html.indexOf('src="home-sessions.js"')).toBeGreaterThan(html.indexOf('src="mobile-overview.js"'));
+    expect(html.indexOf('src="mobile-overview.js"')).toBeGreaterThan(html.indexOf('src="constants.js"'));
  });
 });
@@ -18,25 +18,18 @@ import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'fs';
 import { join } from 'path';

-const publicFile = (name: string) => readFileSync(join(__dirname, '..', 'src', 'web', 'public', name), 'utf-8');
+const SOURCE = readFileSync(join(__dirname, '..', 'src', 'web', 'public', 'terminal-ui.js'), 'utf-8');

-const SOURCE = publicFile('terminal-ui.js');
-// The file-path pattern lives in constants.js: the response viewer linkifies the
-// same paths out of markdown, and one definition is what keeps a path that is
-// clickable in the terminal from being inert in the chat.
-const CONSTANTS_SOURCE = publicFile('constants.js');
-
-/** Extract `const <name> = /.../g;` from the shipped sources and build the RegExp. */
+/** Extract `const <name> = /.../g;` from the shipped source and build the RegExp. */
 function shippedPattern(name: string): RegExp {
-  const literal = new RegExp(`const ${name} =\\s*\\n?\\s*(/(?:[^/\\\\\\n]|\\\\.)+/[a-z]*)`);
-  const m = SOURCE.match(literal) ?? CONSTANTS_SOURCE.match(literal);
-  if (!m) throw new Error(`pattern ${name} not found in terminal-ui.js or constants.js`);
+  const m = SOURCE.match(new RegExp(`const ${name} =\\s*\\n?\\s*(/(?:[^/\\\\\\n]|\\\\.)+/[a-z]*)`));
+  if (!m) throw new Error(`pattern ${name} not found in terminal-ui.js`);
  const lit = m[1];
  const lastSlash = lit.lastIndexOf('/');
  return new RegExp(lit.slice(1, lastSlash), lit.slice(lastSlash + 1));
 }

-const PATTERN_NAMES = ['urlPattern', 'cmdPattern', 'FILE_PATH_LINK_PATTERN', 'bashPattern'];
+const PATTERN_NAMES = ['urlPattern', 'cmdPattern', 'extPattern', 'bashPattern'];

 /** Lines that made 0.9.10's cmdPattern backtrack exponentially (>2s each). */
 const KILLER_LINES = [
@@ -123,24 +116,15 @@ describe('terminal link-provider regexes (shipped source)', () => {
    }
  });

-  it('the file-path pattern links pasted image/PDF/media attachment paths', () => {
+  it('extPattern links pasted image/PDF attachment paths', () => {
    // `.claude-images/paste-*.png` is what Codeman writes for a pasted screenshot;
    // without image extensions the path rendered as plain, unclickable text.
-    const ext = shippedPattern('FILE_PATH_LINK_PATTERN');
+    const ext = shippedPattern('extPattern');
    const cases = [
      '/home/arkon/default/claudeman/.claude-images/paste-1785164958410-d11eb7d0.png',
      '/tmp/shot.jpeg',
      '/opt/app/report.pdf',
      '/home/a/diagram.svg',
-      // An agent's own scratchpad capture — the path shape this whole feature
-      // exists for, and the one that used to open a "File not found" preview.
-      '/tmp/claude-1000/-home-arkon-default-claudeman/7b3fefd2/scratchpad/probe-run-native.png',
-      // macOS and WSL roots: unmatched before, so Mac users had no clickable
-      // paths at all outside /var and /tmp.
-      '/Users/arbbot/codeman-cases/report.docx',
-      '/mnt/d/captures/demo.mp4',
-      // Longer extension of a family must win over its prefix (tsx over ts).
-      '/home/a/src/App.tsx',
    ];
    for (const path of cases) {
      ext.lastIndex = 0;
@@ -150,13 +134,6 @@ describe('terminal link-provider regexes (shipped source)', () => {
    }
  });

-  it('terminal-ui builds its path pattern from the shared factory', () => {
-    // Structural guard: a local literal here would drift from the response
-    // viewer's linkifier, which is the divergence the move exists to prevent.
-    expect(SOURCE).toContain('absoluteFilePathPattern()');
-    expect(SOURCE).not.toMatch(/const extPattern =\s*\n?\s*\//);
-  });
-
  it('cmdPattern arg group cannot match empty tokens (the exponential trigger)', () => {
    // structural guard: the dangerous construct is an empty-matchable token
    // inside a repeated group — `[^\s\/]*\s+` repeated. Check the pattern
@@ -42,9 +42,12 @@ function loadOverviewApp(overrides: Record<string, any> = {}) {
    },
    MobileDetection: { getDeviceType: () => 'mobile' },
  });
-  vm.runInContext(readFileSync(resolve(PUBLIC, 'mobile-overview.js'), 'utf8'), context, {
-    filename: 'mobile-overview.js',
-  });
+  // constants.js first: it installs the row comparator (window.CodemanSessionOrder)
+  // that buildMobileOverviewModel() sorts every section with, shared with the
+  // desktop rail so the two home screens cannot order the same list differently.
+  for (const file of ['constants.js', 'mobile-overview.js']) {
+    vm.runInContext(readFileSync(resolve(PUBLIC, file), 'utf8'), context, { filename: file });
+  }

  const app = new (CodemanApp as any)();
  app.getSessionName = (session: any) => session.name || session.workingDir?.split('/').pop() || session.id.slice(0, 8);
@@ -123,7 +126,7 @@ describe('mobile overview model', () => {
    expect(model.sessionCount).toBe(4);
  });

-  it('keeps the user tab order as the tiebreak inside a section', () => {
+  it('keeps the user tab order as the tiebreak when nothing is stamped', () => {
    const app = loadOverviewApp();
    const model = app.buildMobileOverviewModel({
      sessions: [session({ id: 'first' }), session({ id: 'second' }), session({ id: 'third' })],
@@ -134,6 +137,42 @@ describe('mobile overview model', () => {
    expect(model.current.map((r: any) => r.id)).toEqual(['third', 'first', 'second']);
  });

+  it('sorts running sessions longest-turn-first and quiet ones most-recent-first', () => {
+    // A working pane repaints about once a second, so its last-activity stamp
+    // is always "now": the running group has to key off the pane's last Enter
+    // instead, or every turn ranks as freshly started.
+    const app = loadOverviewApp();
+    const model = app.buildMobileOverviewModel({
+      sessions: [
+        session({ id: 'quiet-old', status: 'idle', lastActivityAt: 2_000 }),
+        session({ id: 'turn-young', status: 'busy', lastSubmitAt: 9_000, lastActivityAt: 10_000 }),
+        session({ id: 'quiet-new', status: 'idle', lastActivityAt: 8_000 }),
+        session({ id: 'turn-old', status: 'busy', lastSubmitAt: 1_000, lastActivityAt: 10_000 }),
+      ],
+      cases: CASES,
+      sessionOrder: ['quiet-old', 'turn-young', 'quiet-new', 'turn-old'],
+    });
+
+    expect(model.current.map((r: any) => r.id)).toEqual(['turn-old', 'turn-young', 'quiet-new', 'quiet-old']);
+  });
+
+  it('puts the longest-blocked session at the top of NEEDS YOU', () => {
+    const app = loadOverviewApp();
+    const model = app.buildMobileOverviewModel({
+      sessions: [
+        session({ id: 'just-asked', lastActivityAt: 9_000 }),
+        session({ id: 'starving', lastActivityAt: 1_000 }),
+      ],
+      cases: CASES,
+      pendingHooks: new Map([
+        ['just-asked', new Set(['permission_prompt'])],
+        ['starving', new Set(['permission_prompt'])],
+      ]),
+    });
+
+    expect(model.needsYou.map((r: any) => r.id)).toEqual(['starving', 'just-asked']);
+  });
+
  it('matches a session started in a subdirectory to its case (longest prefix)', () => {
    const app = loadOverviewApp();
    const model = app.buildMobileOverviewModel({
@@ -1,140 +0,0 @@
-/**
- * @fileoverview Response-viewer file-path linkifier (`CodemanApp._linkifyFilePaths`).
- *
- * The viewer renders markdown, so a path an agent wrote — "wrote the chart to
- * /tmp/.../chart.png" — arrived as inert text: the terminal's link provider
- * never sees the chat, and the file it just produced was a copy-paste away
- * instead of a click. The linkifier wraps those paths in an anchor the click
- * delegate hands to the file-preview overlay.
- *
- * Two properties matter more than the linking itself and are pinned here:
- *
- *  1. **The text is untouched.** Anchors are built from TEXT NODES with DOM
- *     APIs, never by rebuilding already-sanitized markup as a string, so the
- *     message reads identically and "copy code" still yields exactly what the
- *     agent printed.
- *  2. **Model output cannot become markup.** The source is model text; a
- *     path-shaped string carrying HTML must stay text.
- *
- * Loaded via `vm` with a jsdom document injected (same technique as
- * connection-indicator.test.ts — no per-file jsdom environment, which would
- * externalize node:fs under vite).
- */
-import { readFileSync } from 'node:fs';
-import { performance } from 'node:perf_hooks';
-import { resolve } from 'node:path';
-import vm from 'node:vm';
-import { JSDOM } from 'jsdom';
-import { describe, expect, it, vi } from 'vitest';
-
-const dom = new JSDOM('<!DOCTYPE html><html><body></body></html>');
-const { document, NodeFilter } = dom.window;
-
-function loadCodemanAppClass() {
-  const constants = readFileSync(resolve(import.meta.dirname, '../src/web/public/constants.js'), 'utf8');
-  const source = readFileSync(resolve(import.meta.dirname, '../src/web/public/app.js'), 'utf8');
-  const context = vm.createContext({
-    console,
-    performance,
-    setInterval: vi.fn(),
-    clearInterval: vi.fn(),
-    setTimeout,
-    clearTimeout,
-    requestAnimationFrame: vi.fn(),
-    HTMLCanvasElement: class HTMLCanvasElement {},
-    fetch: vi.fn(),
-    document,
-    NodeFilter,
-    localStorage: { length: 0, key: vi.fn(), getItem: vi.fn(), setItem: vi.fn(), removeItem: vi.fn() },
-    window: { addEventListener: vi.fn(), removeEventListener: vi.fn() },
-    MobileDetection: {},
-  });
-  vm.runInContext(`${constants}\n${source}\nglobalThis.__CodemanApp = CodemanApp;`, context);
-  return (context as { __CodemanApp: { prototype: { _linkifyFilePaths(root: unknown): void } } }).__CodemanApp;
-}
-
-const CodemanApp = loadCodemanAppClass();
-const APP_SOURCE = readFileSync(resolve(import.meta.dirname, '../src/web/public/app.js'), 'utf8');
-
-/** Render `html` into a detached .rv-text div and run the linkifier over it. */
-function linkify(html: string): HTMLElement {
-  const app = Object.create(CodemanApp.prototype) as { _linkifyFilePaths(root: unknown): void };
-  const root = document.createElement('div');
-  root.className = 'rv-text';
-  root.innerHTML = html;
-  app._linkifyFilePaths(root);
-  return root as unknown as HTMLElement;
-}
-
-const paths = (root: HTMLElement) => Array.from(root.querySelectorAll('a.rv-path'));
-
-describe('response viewer file-path linkifier', () => {
-  it('links an absolute path written as prose', () => {
-    const path = '/tmp/claude-1000/-home-arkon-default-claudeman/7b3fefd2/scratchpad/probe-run-native.png';
-    const root = linkify(`<p>Saved the capture to ${path} — have a look.</p>`);
-
-    const links = paths(root);
-    expect(links).toHaveLength(1);
-    expect(links[0].getAttribute('data-path')).toBe(path);
-    expect(links[0].textContent).toBe(path);
-    expect(root.textContent).toBe(`Saved the capture to ${path} — have a look.`);
-  });
-
-  it('links a path inside inline code, which is how agents usually write one', () => {
-    const root = linkify('<p>See <code>/home/a/out/report.pdf</code> for the numbers.</p>');
-
-    const links = paths(root);
-    expect(links).toHaveLength(1);
-    expect(links[0].getAttribute('data-path')).toBe('/home/a/out/report.pdf');
-    // Still inside the <code> span — the code styling is not lost.
-    expect(links[0].closest('code')).not.toBeNull();
-  });
-
-  it('links every path in one text node and preserves the text between them', () => {
-    const root = linkify('<p>Compare /tmp/before.png with /tmp/after.png please</p>');
-
-    expect(paths(root).map((a) => a.getAttribute('data-path'))).toEqual(['/tmp/before.png', '/tmp/after.png']);
-    expect(root.textContent).toBe('Compare /tmp/before.png with /tmp/after.png please');
-  });
-
-  it('never re-cuts text already inside an anchor', () => {
-    // marked autolinks URLs; a path-looking tail inside one must stay whole, and
-    // a nested <a> is invalid markup that would swallow the outer link's click.
-    // ⚠️ The URL's tail MUST be a string the pattern matches on its own
-    // (`/tmp/...` here): with an unmatchable tail this test passes with the
-    // inside-anchor guard deleted, i.e. it pins nothing.
-    const root = linkify('<p><a href="https://example.com/tmp/shot.png">https://example.com/tmp/shot.png</a></p>');
-
-    expect(paths(root)).toHaveLength(0);
-    expect(root.querySelectorAll('a')).toHaveLength(1);
-    expect(root.querySelector('a')!.getAttribute('href')).toBe('https://example.com/tmp/shot.png');
-  });
-
-  it('leaves text with no path untouched', () => {
-    const root = linkify('<p>Ratio 3/4 on 2026/08/16, see src/app.ts</p>');
-
-    expect(paths(root)).toHaveLength(0);
-    expect(root.textContent).toBe('Ratio 3/4 on 2026/08/16, see src/app.ts');
-  });
-
-  it('cannot turn model text into markup', () => {
-    // The anchor is built with createElement + textContent, so even a
-    // path-shaped payload stays text. (`<` also ends a match, so the linkifier
-    // never spans into it in the first place.)
-    const root = linkify('<p>/tmp/x.png&lt;img src=x onerror=alert(1)&gt;.png</p>');
-
-    expect(root.querySelector('img')).toBeNull();
-    expect(root.textContent).toContain('<img src=x onerror=alert(1)>.png');
-    for (const link of paths(root)) {
-      expect(link.innerHTML).toBe(link.textContent);
-    }
-  });
-
-  it('is wired into message rendering and the click delegate', () => {
-    // The linkifier is only reachable through these two call sites; losing
-    // either leaves inert paths (no linkify) or dead links (no handler).
-    expect(APP_SOURCE).toContain('this._linkifyFilePaths(renderedText)');
-    expect(APP_SOURCE).toMatch(/closest\('a\.rv-path'\)/);
-    expect(APP_SOURCE).toMatch(/openFilePreview\(filePath, this\.activeSessionId\)/);
-  });
-});
@@ -56,7 +56,6 @@ import {
  registerExternalAttachment,
  type AttachmentRecord,
 } from '../../src/attachment-registry.js';
-import { SseEvent } from '../../src/web/sse-events.js';

 const mockedStat = vi.mocked(fs.stat);
 const mockedRealpathSync = vi.mocked(realpathSync);
@@ -356,250 +355,4 @@ describe('file-routes attachment path guard (COD-53)', () => {
      attachmentRegistry.clearSession('test-session-mlc');
    });
  });
-
-  // ===== Media (click-to-preview parity with the workspace preview) =====
-  // A video an agent writes inside the workspace plays with a working scrub
-  // bar; the same file in /tmp used to be refused as an unsupported type. Both
-  // now go through the same extension sets, and the raw route has to answer
-  // with a real media Content-Type and a range, or the player renders and then
-  // does nothing.
-  describe('media attachments', () => {
-    it('registers a video and serves it as seekable video/mp4', async () => {
-      const content = Buffer.from('MP4DATA-0123456789');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content.subarray(4, 10)]) as never);
-
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/captures/demo.mp4', notify: false },
-      });
-      expect(res.statusCode).toBe(200);
-      const body = JSON.parse(res.body);
-      expect(body.data.attachmentType).toBe('video');
-
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${body.data.attachmentId}/raw`,
-        headers: { range: 'bytes=4-9' },
-      });
-      expect(rawRes.statusCode).toBe(206);
-      expect(rawRes.headers['content-type']).toBe('video/mp4');
-      expect(rawRes.headers['content-range']).toBe(`bytes 4-9/${content.length}`);
-      expect(rawRes.headers['accept-ranges']).toBe('bytes');
-    });
-
-    it('registers audio with an audio type and its real MIME', async () => {
-      const content = Buffer.from('ID3AUDIO');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content]) as never);
-
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/captures/take.mp3', notify: false },
-      });
-      expect(res.statusCode).toBe(200);
-      const body = JSON.parse(res.body);
-      expect(body.data.attachmentType).toBe('audio');
-
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${body.data.attachmentId}/raw`,
-      });
-      expect(rawRes.statusCode).toBe(200);
-      expect(rawRes.headers['content-type']).toBe('audio/mpeg');
-    });
-
-    it('answers no thumbnail for media instead of spawning a converter', async () => {
-      // generateFirstPageThumbnail has no media branch; the card falls back to
-      // its type label. This pins that the route reports that cleanly.
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/captures/clip.webm', notify: false },
-      });
-      const { attachmentId } = JSON.parse(res.body).data;
-
-      const thumbRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${attachmentId}/thumbnail`,
-      });
-      expect(thumbRes.statusCode).toBe(204);
-    });
-
-    it('still refuses media in a blocked tree', async () => {
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/root/private/recording.mp4', notify: false },
-      });
-      expect(res.statusCode).toBe(403);
-    });
-  });
-
-  // ===== Text family (code, config and logs outside the workspace) =====
-  // The agent in the session can already `cat` these, so refusing the click
-  // bought no confidentiality. The gate that matters is the path guard, which
-  // still runs, and markup must not become executable just because it is now
-  // readable.
-  describe('text attachments', () => {
-    it.each([
-      ['/tmp/run.log', 'log'],
-      ['/tmp/data.json', 'json'],
-      ['/tmp/conf/app.yaml', 'yaml'],
-      ['/tmp/src/index.ts', 'ts'],
-      ['/tmp/export.csv', 'csv'],
-    ])('registers %s as a text attachment', async (path, extension) => {
-      mockedStat.mockResolvedValue({ size: 40, isFile: () => true, mtimeMs: 5 } as never);
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path, notify: false },
-      });
-
-      expect(res.statusCode).toBe(200);
-      const body = JSON.parse(res.body);
-      expect(body.data.extension).toBe(extension);
-      expect(body.data.attachmentType).toBe('text');
-    });
-
-    it('serves a text file with no dedicated MIME as inert text/plain', async () => {
-      const content = Buffer.from('boot ok\nstarted\n');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content]) as never);
-
-      const reg = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/run.log', notify: false },
-      });
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${JSON.parse(reg.body).data.attachmentId}/raw`,
-      });
-
-      expect(rawRes.statusCode).toBe(200);
-      expect(rawRes.headers['content-type']).toBe('text/plain; charset=utf-8');
-      expect(rawRes.headers['x-content-type-options']).toBe('nosniff');
-    });
-
-    it('keeps HTML download-only so readable never means executable', async () => {
-      // Serving markup with a renderable type on our own origin is stored XSS.
-      // The preview reads it through fetch(), which ignores the disposition, so
-      // a clicked .html still shows its source.
-      const content = Buffer.from('<script>alert(1)</script>');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content]) as never);
-
-      const reg = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/report.html', notify: false },
-      });
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${JSON.parse(reg.body).data.attachmentId}/raw`,
-      });
-
-      expect(rawRes.headers['content-type']).toBe('application/octet-stream');
-      expect(String(rawRes.headers['content-disposition'])).toContain('attachment');
-    });
-
-    it('answers a byte range for text so a huge log is a partial read', async () => {
-      const content = Buffer.from('0123456789abcdef');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content.subarray(0, 8)]) as never);
-
-      const reg = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/big.log', notify: false },
-      });
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${JSON.parse(reg.body).data.attachmentId}/raw`,
-        headers: { range: 'bytes=0-7' },
-      });
-
-      expect(rawRes.statusCode).toBe(206);
-      expect(rawRes.headers['content-range']).toBe(`bytes 0-7/${content.length}`);
-    });
-
-    it.each([
-      ['/home/someone/.config/gh/hosts.yml', 'forge token'],
-      ['/home/someone/project/.env.json', 'dotenv'],
-      ['/home/someone/.codeman/state.json', 'codeman state (can hold envOverrides secrets)'],
-      ['/home/someone/deploy/credentials.yaml', 'generic credentials'],
-      ['/etc/codeman/dump.log', 'blocked tree'],
-    ])('still refuses %s (%s) now that text is servable', async (path) => {
-      mockedStat.mockResolvedValue({ size: 40, isFile: () => true, mtimeMs: 5 } as never);
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path, notify: false },
-      });
-
-      expect(res.statusCode).toBe(403);
-    });
-
-    it('still refuses a type outside the family', async () => {
-      mockedStat.mockResolvedValue({ size: 40, isFile: () => true, mtimeMs: 5 } as never);
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: '/tmp/drawing.svg', notify: false },
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(JSON.parse(res.body).error).toMatch(/unsupported/i);
-    });
-  });
-
-  // ===== Quiet registration (click-to-preview) =====
-  // The file-preview overlay registers a clicked out-of-workspace path to mint
-  // an id it can render by. It is already putting the file on screen, so the
-  // usual attachment card + unread badge would announce what the user is
-  // looking at. `notify: false` suppresses ONLY the broadcast — the guard, the
-  // registry entry and the by-id routes are identical either way.
-  describe('quiet registration', () => {
-    const outside = '/tmp/claude-1000/scratchpad/probe-run-native.png';
-
-    it('broadcasts by default, so the CLI and publish paths keep their card', async () => {
-      mockedStat.mockResolvedValue({ size: 128, isFile: () => true, mtimeMs: 5 } as never);
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: outside },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(harness.ctx.broadcast).toHaveBeenCalledWith(SseEvent.AttachmentDetected, expect.anything());
-    });
-
-    it('registers and serves a clicked path without broadcasting when notify is false', async () => {
-      const content = Buffer.from('PNGDATA');
-      mockedStat.mockResolvedValue({ size: content.length, isFile: () => true, mtimeMs: 5 } as never);
-      mockedCreateReadStream.mockReturnValue(Readable.from([content]) as never);
-
-      const res = await harness.app.inject({
-        method: 'POST',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments`,
-        payload: { path: outside, notify: false },
-      });
-
-      expect(res.statusCode).toBe(200);
-      const body = JSON.parse(res.body);
-      expect(body.data.fileName).toBe('probe-run-native.png');
-      expect(harness.ctx.broadcast).not.toHaveBeenCalled();
-
-      // The preview renders from this route, so the id has to be live.
-      const rawRes = await harness.app.inject({
-        method: 'GET',
-        url: `/api/sessions/${harness.ctx._sessionId}/attachments/${body.data.attachmentId}/raw`,
-      });
-      expect(rawRes.statusCode).toBe(200);
-      expect(rawRes.headers['content-type']).toBe('image/png');
-    });
-  });
 });
@@ -73,20 +73,6 @@ describe('isSensitivePath', () => {
      ['codeman hook secret', `${HOME}/.codeman/hook-secret`],
      ['codeman user table', `${HOME}/.codeman/users.json`],
      ['codeman hook secret on a named instance', `${HOME}/.codeman-beta/hook-secret`],
-      // state.json persists SessionState.envOverrides, and the env allowlist
-      // admits key-shaped names (GEMINI_API_KEY, CLAUDE_CODE_*), so it can hold
-      // a live credential. Named once .json became previewable from outside the
-      // workspace.
-      ['codeman state file', `${HOME}/.codeman/state.json`],
-      ['codeman state file on a named instance', `${HOME}/.codeman-beta/state.json`],
-      ['codeman state sibling (same payload)', `${HOME}/.codeman/state-inner.json`],
-      // settings.json holds voiceSettings.apiKey by schema; push-keys.json holds
-      // the VAPID PRIVATE key; intents.json is 0600 because captured prompts can
-      // contain secrets and is deliberately kept out of /api/search.
-      ['codeman settings (Deepgram key)', `${HOME}/.codeman/settings.json`],
-      ['codeman push keys (VAPID private)', `${HOME}/.codeman/push-keys.json`],
-      ['codeman intent profiles', `${HOME}/.codeman/intents.json`],
-      ['codeman intents on a named instance', `${HOME}/.codeman-beta/intents.json`],
    ];

    it.each(blocked)('blocks the %s', (_label, path) => {
@@ -102,7 +88,6 @@ describe('isSensitivePath', () => {
      // The publish skill and the review-card loop attach from these trees, so
      // only their named secret members are blocked, never the whole tree.
      ['a codeman screenshot', `${HOME}/.codeman/screenshots/shot.png`],
-      ['a codeman lifecycle log', `${HOME}/.codeman/session-lifecycle.jsonl`],
      ['a claude transcript', `${HOME}/.claude/projects/proj/session.jsonl`],
      ['a claude team inbox', `${HOME}/.claude/teams/alpha/inboxes/bob.json`],
      // isUnderTree-style separator awareness: a sibling name that merely starts
@@ -0,0 +1,175 @@
+// Port: none (pure comparator — no browser, no server).
+//
+// `CodemanSessionOrder` (src/web/public/constants.js) is the single row order
+// behind both home screens: the phone overview and the desktop tab rail. It is
+// the one place the two surfaces can disagree about which session you should
+// look at next, which is why it is pure and pinned here rather than living
+// inside either renderer.
+//
+// The rule it encodes, and the thing worth protecting: the tiebreak FLIPS
+// direction halfway down the list. For a state a session is still in, older is
+// more urgent (blocked longest, running longest). For a state it has stopped
+// in, newer is more relevant (just finished beats abandoned yesterday).
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { describe, expect, it } from 'vitest';
+
+type Row = {
+  id: string;
+  state: string;
+  lastActivityAt?: number;
+  lastSubmitAt?: number;
+  orderIndex?: number;
+};
+
+function loadOrderHelper() {
+  const context = vm.createContext({ window: {}, globalThis: {} });
+  const source = readFileSync(resolve(import.meta.dirname, '../src/web/public/constants.js'), 'utf8');
+  vm.runInContext(source, context, { filename: 'constants.js' });
+  return (
+    context.window as {
+      CodemanSessionOrder: {
+        RANK: Record<string, number>;
+        anchor: (row: Row) => number;
+        compare: (a: Row, b: Row) => number;
+        sort: (rows: Row[]) => Row[];
+      };
+    }
+  ).CodemanSessionOrder;
+}
+
+const order = loadOrderHelper();
+const ids = (rows: Row[]) => order.sort(rows).map((r) => r.id);
+
+describe('session overview order: state ranking', () => {
+  it('puts everything blocked on a human above everything else', () => {
+    // Red question, then a hard error, then the yellow "waiting for input"
+    // prompt, then work, then whatever has stopped.
+    const rows: Row[] = [
+      { id: 'done', state: 'done' },
+      { id: 'idle', state: 'idle' },
+      { id: 'working', state: 'working' },
+      { id: 'waiting', state: 'waiting' },
+      { id: 'error', state: 'error' },
+      { id: 'needs', state: 'needs' },
+    ];
+    expect(ids(rows)).toEqual(['needs', 'error', 'waiting', 'working', 'idle', 'done']);
+  });
+
+  it('sorts an unknown state last instead of dropping it or crashing', () => {
+    // A state added to one renderer and not to the rank map must still render,
+    // just at the bottom — a missing row is a worse failure than a misplaced one.
+    const rows: Row[] = [
+      { id: 'mystery', state: 'quantum' },
+      { id: 'done', state: 'done' },
+    ];
+    expect(ids(rows)).toEqual(['done', 'mystery']);
+  });
+});
+
+describe('session overview order: in-progress states sort oldest first', () => {
+  it('ranks the longest-running turn above a turn that just started', () => {
+    const rows: Row[] = [
+      { id: 'young', state: 'working', lastSubmitAt: 9_000, lastActivityAt: 10_000 },
+      { id: 'old', state: 'working', lastSubmitAt: 1_000, lastActivityAt: 10_000 },
+    ];
+    expect(ids(rows)).toEqual(['old', 'young']);
+  });
+
+  it('measures a running turn from the last Enter, not the last repaint', () => {
+    // A working pane repaints about once a second, so last-activity is always
+    // "now" and would rank every running turn identically.
+    expect(order.anchor({ id: 'w', state: 'working', lastSubmitAt: 1_000, lastActivityAt: 999_000 })).toBe(1_000);
+    expect(order.anchor({ id: 'i', state: 'idle', lastSubmitAt: 1_000, lastActivityAt: 999_000 })).toBe(999_000);
+  });
+
+  it('falls back to last activity for a working pane that never submitted', () => {
+    // Spawned with its prompt on the command line, or an external CLI whose
+    // Enter never went through Codeman. Its fallback stamp is ~now, so it sits
+    // at the SHORT end of the running group rather than falsely leading it.
+    const rows: Row[] = [
+      { id: 'no-submit', state: 'working', lastActivityAt: 10_000 },
+      { id: 'submitted', state: 'working', lastSubmitAt: 1_000, lastActivityAt: 10_000 },
+    ];
+    expect(ids(rows)).toEqual(['submitted', 'no-submit']);
+  });
+
+  it('ranks the longest-blocked session above one that just asked', () => {
+    const rows: Row[] = [
+      { id: 'just-asked', state: 'needs', lastActivityAt: 9_000 },
+      { id: 'starving', state: 'needs', lastActivityAt: 1_000 },
+    ];
+    expect(ids(rows)).toEqual(['starving', 'just-asked']);
+  });
+});
+
+describe('session overview order: stopped states sort newest first', () => {
+  it('puts the session that just went quiet above one idle since yesterday', () => {
+    const rows: Row[] = [
+      { id: 'yesterday', state: 'idle', lastActivityAt: 1_000 },
+      { id: 'just-now', state: 'idle', lastActivityAt: 9_000 },
+      { id: 'this-morning', state: 'idle', lastActivityAt: 5_000 },
+    ];
+    expect(ids(rows)).toEqual(['just-now', 'this-morning', 'yesterday']);
+  });
+
+  it('applies the same recency rule to finished sessions', () => {
+    const rows: Row[] = [
+      { id: 'old-exit', state: 'done', lastActivityAt: 1_000 },
+      { id: 'fresh-exit', state: 'done', lastActivityAt: 9_000 },
+    ];
+    expect(ids(rows)).toEqual(['fresh-exit', 'old-exit']);
+  });
+});
+
+describe('session overview order: tiebreaks', () => {
+  it('falls back to the tab order when two rows share a stamp', () => {
+    const rows: Row[] = [
+      { id: 'third', state: 'idle', lastActivityAt: 5_000, orderIndex: 2 },
+      { id: 'first', state: 'idle', lastActivityAt: 5_000, orderIndex: 0 },
+    ];
+    expect(ids(rows)).toEqual(['first', 'third']);
+  });
+
+  it('sorts an unstamped row last within its state, never first', () => {
+    // 0 is "we have no stamp", not "the epoch": treating it as a timestamp
+    // would park a brand-new session at the head of the oldest-first groups.
+    expect(
+      ids([
+        { id: 'none', state: 'idle', orderIndex: 0 },
+        { id: 'stamped', state: 'idle', lastActivityAt: 1_000, orderIndex: 1 },
+      ])
+    ).toEqual(['stamped', 'none']);
+    expect(
+      ids([
+        { id: 'none', state: 'working', orderIndex: 0 },
+        { id: 'stamped', state: 'working', lastSubmitAt: 1_000, orderIndex: 1 },
+      ])
+    ).toEqual(['stamped', 'none']);
+  });
+
+  it('is deterministic: two unstamped rows keep tab order in both directions', () => {
+    const a: Row = { id: 'a', state: 'idle', orderIndex: 0 };
+    const b: Row = { id: 'b', state: 'idle', orderIndex: 1 };
+    expect(order.compare(a, b)).toBeLessThan(0);
+    expect(order.compare(b, a)).toBeGreaterThan(0);
+    expect(order.compare(a, a)).toBe(0);
+  });
+
+  it('copies rather than sorting the caller array in place', () => {
+    // Both renderers hand it a filtered slice of a shared row array; mutating
+    // that would reorder the other surface's list as a side effect.
+    const rows: Row[] = [
+      { id: 'b', state: 'idle', lastActivityAt: 1_000 },
+      { id: 'a', state: 'idle', lastActivityAt: 9_000 },
+    ];
+    order.sort(rows);
+    expect(rows.map((r) => r.id)).toEqual(['b', 'a']);
+  });
+
+  it('survives junk input rather than throwing inside a render', () => {
+    expect(order.sort(undefined as unknown as Row[])).toEqual([]);
+    expect(order.anchor({} as Row)).toBe(0);
+  });
+});