feat: launch work directly from mobile queues (Closes #645)

Closes #637

README.md

@@ -271,7 +271,12 @@ session linked to the credential is revoked atomically; unrelated credentials an
 sessions remain valid. Removing the current device's passkey keeps its current
 session active, so the sheet warns that the recovery token will be required after
 sign-out. Remotely revoking an enrolled device also deletes its passkey; signing out
-normally keeps the passkey available for the next sign-in.
+normally keeps the passkey available for the next sign-in. Passkey assertion counters
+advance with an atomic compare-and-swap across workers: stale or equal nonzero counters
+fail before a session or authorization grant is issued, while counterless authenticators
+remain compatible. The bounded **Passkey counter anomaly** Security activity entry names
+only the device label and attempted action; repeated alerts should prompt removal and
+re-enrollment of that passkey.
 
 High-impact actions—merging a pull request, closing an assigned issue, revoking a
 remote device, or signing out every device—require a passkey assertion or the

frontend/dashboard.css

@@ -134,6 +134,15 @@ textarea { resize: vertical; min-height: 120px; }
 .plan-today-available { display:flex; align-items:center; justify-content:space-between; gap:12px; margin:10px 0; font-weight:700; }
 .plan-today-available span { display:flex; align-items:center; gap:6px; }
 .plan-today-available input, .plan-today-estimate { box-sizing:border-box; min-height:44px; width:108px; }
+.plan-today-build { min-height:44px; width:100%; font-weight:700; }
+.plan-today-build-status { min-height:1.4em; margin-top:6px; color:#bfdbfe; }
+.plan-today-estimates { margin:12px 0; padding:12px; border:1px solid #31577f; border-radius:12px; background:#10233a; }
+.plan-today-estimates h3, .plan-today-estimates p { margin-top:0; }
+.plan-today-estimates input { min-height:44px; width:108px; box-sizing:border-box; }
+.plan-today-estimate-row { display:grid; grid-template-columns:minmax(0,1fr) auto; align-items:center; gap:10px; padding:8px 0; border-top:1px solid #29496d; }
+.plan-today-estimate-row label { display:flex; align-items:center; gap:6px; }
+.plan-today-skipped { display:grid; gap:6px; margin:8px 0; }
+.plan-today-skipped-item { padding:8px 10px; border-left:3px solid #b45309; background:#261a13; overflow-wrap:anywhere; }
 .plan-today-estimate-wrap { display:flex; align-items:center; gap:6px; margin-top:8px; }
 .plan-today-error { min-height:1.4em; color:#fca5a5; }
 .discard-recap-replan { min-height:44px; margin-bottom:8px; }
@@ -211,6 +220,10 @@ textarea { resize: vertical; min-height: 120px; }
 .create-issue-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(140px,1fr)); gap:8px; padding-bottom:env(safe-area-inset-bottom); }
 .create-issue-actions button { min-height:44px; max-width:100%; width:100%; }
 .create-issue-actions #create-issue-status { grid-column:1/-1; }
+.draft-filing-session { position:sticky; top:0; z-index:2; display:grid; gap:6px; margin-bottom:12px; padding:10px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); border:1px solid #31577f; border-radius:12px; background:rgba(11,21,38,.98); }
+.draft-filing-session[hidden] { display:none; }
+.draft-filing-session-actions { display:grid; grid-template-columns:1fr 1fr; gap:8px; }
+.draft-filing-session-actions button { min-height:44px; width:100%; }
 .my-work-card { min-height: 44px; display:grid; gap:8px; padding:12px; border:1px solid #1f3a5f; border-radius:12px; background:#0f1d33; color:var(--text); }
 .my-work-card-main { display:block; width:100%; color:var(--text); text-align:left; font:inherit; background:transparent; border:0; padding:0; }
 .my-work-card-main.review-trigger { width:100%; text-align:left; font:inherit; }
@@ -580,11 +593,13 @@ textarea { resize: vertical; min-height: 120px; }
   .create-issue-panel.composer-keyboard-active,
   .issue-sheet-panel.composer-keyboard-active,
   .pull-sheet-panel.composer-keyboard-active,
+  .review-sheet-panel.composer-keyboard-active,
   .update-sheet-panel.composer-keyboard-active { position:fixed; top:var(--composer-viewport-top,0px); right:0; height:var(--composer-viewport-height,100dvh); overscroll-behavior:contain; padding-bottom:calc(14px + env(safe-area-inset-bottom)); }
   .composer-keyboard-active .create-issue-form :is(input,textarea,select,button) { scroll-margin-block:12px; }
   .composer-keyboard-active .create-issue-form,
   .composer-keyboard-active .issue-comment-composer,
   .composer-keyboard-active .pull-comment-composer,
+  .composer-keyboard-active .review-inline-composer,
   .composer-keyboard-active .update-reply { scroll-margin-block:12px; padding-bottom:env(safe-area-inset-bottom); }
   .mobile-task-dock { position:fixed; inset:auto 0 0; z-index:45; display:grid; grid-template-columns:repeat(5,minmax(0,1fr)); gap:2px; padding:6px 8px; padding-bottom:env(safe-area-inset-bottom); border-top:1px solid #2a496e; background:rgba(11,21,38,.98); backdrop-filter:blur(12px); }
   .mobile-queue-sheet { width:100%; max-width:none; margin:auto 0 0; padding:0; border:0; border-radius:18px 18px 0 0; color:var(--text); background:#102641; }

frontend/dashboard.js

@@ -9,6 +9,7 @@
       { panel:qs('#issue-sheet .issue-sheet-panel'), workspace:qs('.issue-comment-composer'), composer:qs('#issue-comment'), submit:qs('#send-issue-comment'), status:qs('#issue-comment-status') },
       { panel:qs('#pull-sheet .pull-sheet-panel'), workspace:qs('.pull-comment-composer'), composer:qs('#pull-comment'), submit:qs('#send-pull-comment'), status:qs('#pull-comment-status') },
       { panel:qs('#update-sheet .update-sheet-panel'), workspace:qs('.update-reply'), composer:qs('#update-reply'), submit:qs('#send-update-reply'), status:qs('#update-reply-status') },
+      { panel:qs('#review-sheet .review-sheet-panel'), workspace:qs('#review-inline-composer'), composer:qs('#review-inline-body'), submit:qs('#save-inline-comment'), status:qs('#review-submit-status') },
       { panel:qs('.create-issue-panel'), workspace:qs('#create-issue-form'), focusWithin:true },
     ],
   });
@@ -55,7 +56,7 @@
     qs('#my-work').scrollIntoView({block:'start'});
     qs('#my-work').focus();
   }
-  function openMobileQueue(name) {
+  function selectMobileQueue(name) {
     if (name === 'attention' && workSession.checkpointed()) timer.beginAttention();
     renderAttentionInterruption();
     timerView.render();
@@ -74,6 +75,12 @@
     planToday: () => openPlanToday(mobileTaskButtons.work),
     openFallback: openMobileWorkFallback,
   });
+  const mobileQueueLauncher = createMobileQueueLauncher({
+    openToday: () => mobileWorkEntry.open(),
+    selectFilter: selectMobileQueue,
+    firstAction: name => qs('#my-work-list .my-work-card-main, #my-work-list .draft-resume, #my-work-list .draft-continue, #my-work-list .draft-edit'),
+    announce: message => { qs('#my-work-action-status').textContent = message; },
+  });
   const mobileTaskDock = createMobileTaskDock({
     nav: qs('#mobile-task-dock'),
     sessionHud: qs('[data-mobile-today-hud]'),
@@ -88,7 +95,7 @@
       Array.from(document.querySelectorAll('[data-mobile-queue-count]')).map(element => [element.dataset.mobileQueueCount, element])
     ),
     queueBadge: qs('#mobile-queue-count'),
-    onSelectQueue: openMobileQueue,
+    onSelectQueue: name => mobileQueueLauncher.open(name),
     overlays: mobileTaskOverlays,
     actions: {
       work: () => mobileWorkEntry.open(),
@@ -407,7 +414,13 @@
     getCaptureLogin: () => String(lastContextSnapshot?.user?.login || '').trim(),
     getCurrentLogin: () => activeFlushLogin,
   });
-  let resumedUnfiledCaptureId = '';
+  const dFS = createDraftFilingSession({list:()=>unfiledCaptures.list().filter(item=>!item.quarantined)});
+  dFS.attach(qs, {
+    captures:unfiledCaptures, issueCapture, attachment:createIssueAttachmentController,
+    getLogin:()=>activeFlushLogin, setResumedId:id=>{ rUC = id; },
+    openSheet:openCreateIssueSheet, setFilingMode:setIssueFilingMode,
+  });
+  let rUC = '';
   let backgroundIssueSync = null;
   if ('indexedDB' in window) {
     const backgroundIssueStore = createIssueSyncStore();
@@ -936,7 +949,7 @@
   qs('#retry-work-route').addEventListener('click', () => workRoute.sync());
 
   function closeOpenWorkSheets() {
-    ['#issue-sheet .issue-sheet-panel', '#pull-sheet .pull-sheet-panel', '#update-sheet .update-sheet-panel']
+    ['#issue-sheet .issue-sheet-panel', '#pull-sheet .pull-sheet-panel', '#review-sheet .review-sheet-panel', '#update-sheet .update-sheet-panel']
       .forEach(selector => mobileComposerViewport.close(qs(selector)));
     ['#issue-sheet', '#pull-sheet', '#review-sheet', '#update-sheet'].forEach(selector =>
       qs(selector).classList.remove('open')
@@ -1388,6 +1401,24 @@
       formatPlanMinutes(state.planned_minutes) + ' · ' + capacityText +
       (state.unestimated_count ? ' · ' + state.unestimated_count + ' unestimated' : '');
     qs('#plan-today-available').value = state.capacity_minutes || '';
+    const build = state.build;
+    qs('#plan-today-build-status').textContent = build ?
+      ('Built ' + build.selected.length + ' ready ' + (build.selected.length === 1 ? 'item' : 'items') +
+        (build.skipped.length ? ' · Skipped ' + build.skipped.length + ' blocked or unverified' : '') +
+        (build.needs_estimate.length ? ' · ' + build.needs_estimate.length + ' need estimates' : '')) : '';
+    const estimateSection = qs('#plan-today-estimates');
+    estimateSection.hidden = !build?.needs_estimate.length;
+    qs('#plan-today-estimate-list').innerHTML = (build?.needs_estimate || []).map(id => {
+      const item = planToday.item(id);
+      const key = escapeHtml(item?.key || ((item?.repository || '') + '#' + (item?.number || '')));
+      return '<div class="plan-today-estimate-row"><div><span class="small">' + key + '</span><strong class="my-work-card-title">' +
+        escapeHtml(item?.title || 'Untitled work') + '</strong></div><label class="small"><input type="number" inputmode="numeric" min="5" max="1440" step="5" data-plan-missing-estimate="' +
+        escAttr(id) + '" aria-label="Estimate for ' + escAttr(item?.title || key) + ' in minutes" /> min</label></div>';
+    }).join('');
+    qs('#plan-today-skipped').innerHTML = (build?.skipped || []).map(entry =>
+      '<div class="small plan-today-skipped-item"><strong>' + escapeHtml(planToday.item(entry.id)?.title || entry.id) +
+      '</strong> · ' + escapeHtml(entry.reason) + '</div>'
+    ).join('');
     qs('#plan-today-list').innerHTML = state.ids.length ? state.ids.map((id, index) =>
       planTodayItemMarkup(planToday.item(id), true, index)
     ).join('') : '<p class="muted">No work selected yet.</p>';
@@ -1423,6 +1454,17 @@
       planToday.setEstimate(input.dataset.planEstimate, Number(input.value));
       renderPlanToday();
     }));
+    document.querySelectorAll('[data-plan-missing-estimate]').forEach(input => input.addEventListener('change', () => {
+      const id = input.dataset.planMissingEstimate;
+      if (!input.checkValidity() || !planToday.setEstimate(id, Number(input.value))) {
+        qs('#plan-today-error').textContent = 'Enter an estimate from 5 minutes to 24 hours.';
+        input.focus();
+        return;
+      }
+      qs('#plan-today-error').textContent = '';
+      renderPlanToday();
+      document.querySelector('[data-plan-missing-estimate]')?.focus();
+    }));
     document.querySelectorAll('[data-plan-recommendation]').forEach(button => button.addEventListener('click', () => {
       planToday.applyRecommendation(button.dataset.planRecommendation);
       renderPlanToday();
@@ -1431,6 +1473,9 @@
   }
 
   function closePlanToday(navigate = true) {
+    planTodayReadiness.cancel();
+    qs('#build-today-plan').disabled = false;
+    qs('#plan-today-build-status').textContent = '';
     if (navigate) {
       taskOverlayHistory.close();
       return;
@@ -1479,6 +1524,34 @@
     },
   });
 
+  const planTodayReadiness = createPlanTodayReadiness({
+    concurrency:3,
+    identity:item => todayWork.identity(item),
+    inspect:async item => {
+      if (item.kind !== 'issue') return { status:'ready' };
+      const detail = await inspectTodayDependencies(item);
+      if (!detail.available) return { status:'unverified' };
+      if (detail.dependencies.length) return {
+        status:'blocked', reason:detail.dependencies.length + ' open ' +
+          (detail.dependencies.length === 1 ? 'dependency' : 'dependencies'),
+      };
+      return { status:'ready' };
+    },
+  });
+
+  async function buildTodayPlan() {
+    const button = qs('#build-today-plan');
+    const state = planToday.snapshot();
+    const candidates = state.ids.map(id => planToday.item(id)).concat(planToday.candidates());
+    button.disabled = true;
+    qs('#plan-today-build-status').textContent = 'Checking readiness and fitting your highest-ranked work…';
+    const checks = await planTodayReadiness.run(candidates);
+    if (!checks) return;
+    planToday.buildRecommendation(checks);
+    button.disabled = false;
+    renderPlanToday();
+  }
+
   function canPreviewPlanItem(item) {
     if (!item || !offlineWorkMode) return Boolean(item);
     const login = planningOwnerLogin || confirmedOwnerLogin ||
@@ -2118,12 +2191,8 @@
         if (!item) return;
         if (item.kind === 'unfiled-issue') {
           try {
-            const resumed = await unfiledCaptures.resume(item.capture_id, activeFlushLogin);
-            issueCapture.saveDraft(resumed);
-            resumedUnfiledCaptureId = item.capture_id;
-            await openCreateIssueSheet();
-            if (resumed.attachment) createIssueAttachmentController.restore(resumed.attachment);
-            qs('#create-issue-status').textContent = 'Capture restored. Choose a repository to file it.';
+            dFS.start(item.capture_id);
+            await dFS.nextCapture();
           } catch (error) { qs('#my-work-action-status').textContent = error.message; }
         } else if (item.kind === 'new-issue') openCreateIssueSheet();
         else if (item.route) workRoute.open(item.route);
@@ -3344,6 +3413,7 @@
   }
 
   function closeInlineComposer() {
+    mobileComposerViewport.close(qs('#review-sheet .review-sheet-panel'));
     qs('#review-inline-composer').hidden = true;
     qs('#review-inline-body').value = '';
     activeInlineTarget = null;
@@ -3477,6 +3547,7 @@
       workRoute.close();
       return;
     }
+    mobileComposerViewport.close(qs('#review-sheet .review-sheet-panel'));
     qs('#review-sheet').classList.remove('open');
     selectedReview = null;
     offlineReview = false;
@@ -4053,6 +4124,7 @@
     }
   });
   qs('#new-issue').addEventListener('click', openCreateIssueSheet);
+  dFS.bind();
   qs('#file-new-issue').addEventListener('click', () => {
     if (!qs('#create-issue-title').value.trim()) {
       qs('#create-issue-capture-status').textContent = 'Add a title before filing.';
@@ -4073,9 +4145,9 @@
       };
       if (showDraftCapacityDialog(unfiledCaptures)) return;
       const savedCapture = await unfiledCaptures.save(captureDraft);
-      if (resumedUnfiledCaptureId) {
-        await unfiledCaptures.completeResume(resumedUnfiledCaptureId);
-        resumedUnfiledCaptureId = '';
+      if (rUC) {
+        await unfiledCaptures.completeResume(rUC);
+        rUC = '';
       }
       issueCapture.clearDraft();
       qs('#create-issue-title').value = '';
@@ -4217,14 +4289,20 @@
       const durableDraft = {
         ...captureDraft,
         attachment: await createIssueAttachmentController.serialize(),
+        ...(rUC ? { sourceCaptureId: rUC } : {}),
         ...(createAndStartRequested ? { completionIntent: 'create-and-start' } : {}),
       };
       const admission = editingOutboxId ? await issueOutbox.updateDurably(editingOutboxId, durableDraft) :
         await issueOutbox.enqueueDurably(durableDraft);
       const queued = admission.item;
-      if (resumedUnfiledCaptureId && (!durableDraft.attachment || admission.background)) {
-        await unfiledCaptures.completeResume(resumedUnfiledCaptureId);
-        resumedUnfiledCaptureId = '';
+      const fS = dFS.current();
+      if (rUC && (!durableDraft.attachment || admission.background)) {
+        await unfiledCaptures.completeResume(rUC);
+        rUC = '';
+      }
+      if (fS && !rUC && await dFS.advance(fS.id)) {
+        refreshMyWorkView();
+        return;
       }
       if (!admission.background) {
         editingOutboxId = queued.id;
@@ -5348,6 +5426,7 @@
     qs('#plan-today-error').textContent = '';
     renderPlanToday();
   });
+  qs('#build-today-plan').addEventListener('click', () => buildTodayPlan());
   function commitPlanToday(start, button) {
     const result = planToday.commit({ start, confirmOverCapacity: button.dataset.confirmOverCapacity === 'true' });
     if (result === 'saved') {

frontend/draft-filing-session.js

@@ -0,0 +1,92 @@
+function createDraftFilingSession({list}) {
+  let orderedIds = [];
+  let currentId = '';
+
+  function visibleIds() {
+    const available = new Set(list().map(item => item.id));
+    orderedIds = orderedIds.filter(id => available.has(id));
+    for (const item of list()) {
+      if (!orderedIds.includes(item.id)) orderedIds.push(item.id);
+    }
+    return orderedIds;
+  }
+
+  function state() {
+    const ids = visibleIds();
+    if (!ids.length) {
+      currentId = '';
+      return null;
+    }
+    if (!ids.includes(currentId)) currentId = ids[0];
+    const index = ids.indexOf(currentId);
+    return {id:currentId, position:index + 1, total:ids.length, remaining:ids.length - index - 1};
+  }
+
+  function start(id) {
+    orderedIds = list().map(item => item.id);
+    if (!orderedIds.includes(id)) throw new Error('This capture is no longer available.');
+    currentId = id;
+    return state();
+  }
+
+  function move(offset) {
+    const ids = visibleIds();
+    if (!ids.length) return state();
+    const index = Math.max(0, ids.indexOf(currentId));
+    currentId = ids[(index + offset + ids.length) % ids.length];
+    return state();
+  }
+
+  function removeCurrentAndNext(removedId) {
+    const previousIds = orderedIds.slice();
+    const removedIndex = Math.max(0, previousIds.indexOf(removedId));
+    orderedIds = previousIds.filter(id => id !== removedId);
+    const ids = visibleIds();
+    if (!ids.length) return state();
+    currentId = ids[Math.min(removedIndex, ids.length - 1)];
+    return state();
+  }
+
+  const session = {start, current:state, next:()=>move(1), previous:()=>move(-1), removeCurrentAndNext};
+  session.attach = (qs, dependencies) => {
+    const openCapture = async captureId => {
+      const resumed = await dependencies.captures.resume(captureId, dependencies.getLogin());
+      dependencies.issueCapture.saveDraft(resumed);
+      dependencies.setResumedId(captureId);
+      await dependencies.openSheet();
+      dependencies.attachment[resumed.attachment ? 'restore' : 'clear'](resumed.attachment);
+      dependencies.setFilingMode(true);
+      session.render();
+    };
+    return Object.assign(session, {
+    nextCapture() { const state = session.current(); return state ? openCapture(state.id) : null; },
+    render() {
+      const state = session.current();
+      qs('#draft-filing-session').hidden = !state;
+      if (!state) return;
+      qs('#draft-filing-progress').textContent = `Draft ${state.position} of ${state.total}`;
+      qs('#draft-filing-remaining').textContent = state.remaining ? `${state.remaining} remaining` : 'Last Draft';
+      qs('#previous-draft').disabled = qs('#skip-draft').disabled = state.total < 2;
+      qs('#submit-new-issue').textContent = state.remaining ? 'File & next' : 'File final Draft';
+    },
+    bind() {
+      [['#previous-draft','previous'],['#skip-draft','next']].forEach(([selector, method]) =>
+        qs(selector).addEventListener('click', async () => {
+          const state = session[method]();
+          if (state) await openCapture(state.id);
+        })
+      );
+    },
+    async advance(completedId) {
+      const state = session.removeCurrentAndNext(completedId);
+      if (state) { await openCapture(state.id); return true; }
+      qs('#draft-filing-session').hidden = true;
+      qs('#submit-new-issue').textContent = 'Create & assign to me';
+      return false;
+    },
+  });
+  };
+  return session;
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createDraftFilingSession;

frontend/index.html

@@ -254,6 +254,14 @@
     <label class="plan-today-available" for="plan-today-available">Available today
       <span><input id="plan-today-available" type="number" inputmode="numeric" min="15" max="1440" step="15" placeholder="Minutes" /> min</span>
     </label>
+    <button class="plan-today-build" id="build-today-plan" type="button">Build my Today</button>
+    <div class="small plan-today-build-status" id="plan-today-build-status" role="status" aria-live="polite"></div>
+    <section class="plan-today-estimates" id="plan-today-estimates" aria-labelledby="plan-today-estimates-heading" hidden>
+      <h3 id="plan-today-estimates-heading">Estimate to finish your plan</h3>
+      <p class="small muted">Add minutes for ready work and your plan will re-fit immediately.</p>
+      <div id="plan-today-estimate-list"></div>
+    </section>
+    <div class="plan-today-skipped" id="plan-today-skipped"></div>
     <div class="small plan-today-error" id="plan-today-error" role="alert"></div>
     <button class="discard-recap-replan" id="discard-recap-replan" type="button" hidden>Discard recap feedback</button>
     <section aria-labelledby="today-plan-heading">
@@ -550,6 +558,14 @@
         <div class="small" id="create-issue-attachment-status" aria-live="polite"></div>
       </section>
       <section class="create-issue-filing" id="create-issue-filing" hidden>
+      <aside class="draft-filing-session" id="draft-filing-session" aria-live="polite" hidden>
+        <strong id="draft-filing-progress"></strong>
+        <span class="small" id="draft-filing-remaining"></span>
+        <div class="draft-filing-session-actions">
+          <button id="previous-draft" type="button">Previous</button>
+          <button id="skip-draft" type="button">Skip</button>
+        </div>
+      </aside>
       <div class="create-issue-repository-picker">
         <label for="create-issue-repository-search">Repository search
           <input id="create-issue-repository-search" type="search" maxlength="80" placeholder="Search accessible repositories" autocomplete="off" />
@@ -845,6 +861,7 @@
     <div class="mobile-queue-list">
       <button data-mobile-queue="today" type="button"><span><strong>Today</strong><small>Planned work</small></span><span data-mobile-queue-count="today">0</span></button>
       <button data-mobile-queue="attention" type="button"><span><strong>Attention</strong><small>Needs a response</small></span><span data-mobile-queue-count="attention">0</span></button>
+      <button data-mobile-queue="update" type="button" aria-label="Updates, 0 unread conversations"><span><strong>Updates</strong><small>Unread conversations</small></span><span data-mobile-queue-count="update">0</span></button>
       <button data-mobile-queue="later" type="button"><span><strong>Later</strong><small>Deferred work</small></span><span data-mobile-queue-count="later">0</span></button>
       <button data-mobile-queue="draft" type="button"><span><strong>Drafts</strong><small>Unfiled captures</small></span><span data-mobile-queue-count="draft">0</span></button>
     </div>
@@ -870,6 +887,7 @@
 <script src="static/widgets.js"></script>
 <script src="static/drafts.js"></script>
 <script src="static/unfiled-captures.js"></script>
+<script src="static/draft-filing-session.js"></script>
 <script src="static/draft-capacity-dialog.js"></script>
 <script src="static/outbox-coordinator.js"></script>
 <script src="static/background-issue-sync.js"></script>
@@ -890,6 +908,7 @@
 <script src="static/comment-next.js"></script>
 <script src="static/update-reply-read-next.js"></script>
 <script src="static/plan-today.js"></script>
+<script src="static/plan-today-readiness.js"></script>
 <script src="static/plan-today-preview.js"></script>
 <script src="static/today-sync.js"></script>
 <script src="static/today-rollover.js"></script>
@@ -915,6 +934,7 @@
 <script src="static/context-poller.js"></script>
 <script src="static/mobile-task-dock.js"></script>
 <script src="static/mobile-work-entry.js"></script>
+<script src="static/mobile-queue-launcher.js"></script>
 <script src="static/mobile-launch.js"></script>
 <script src="static/install-app.js"></script>
 <script src="static/mobile-device-setup.js"></script>

frontend/issue-outbox.js

@@ -51,6 +51,8 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
       status: 'queued',
       queuedAt: Number(now()),
     };
+    const sourceCaptureId = String(draft?.sourceCaptureId || '').trim().slice(0, 128);
+    if (sourceCaptureId) item.sourceCaptureId = sourceCaptureId;
     if (draft?.completionIntent === 'create-and-start') item.completionIntent = 'create-and-start';
     const attachment = captureAttachment(draft?.attachment);
     if (attachment) item.attachment = attachment;
@@ -76,6 +78,9 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
 
   function enqueue(draft, mirror = true) {
     const items = read();
+    const sourceCaptureId = String(draft?.sourceCaptureId || '').trim().slice(0, 128);
+    const existing = sourceCaptureId && items.find(item => item.sourceCaptureId === sourceCaptureId);
+    if (existing) return { ...existing };
     const item = prepareItem(draft);
     items.push(item);
     write(items, mirror);
@@ -83,6 +88,16 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
   }
 
   async function enqueueDurably(draft) {
+    const sourceCaptureId = String(draft?.sourceCaptureId || '').trim().slice(0, 128);
+    const existing = sourceCaptureId && read().find(item => item.sourceCaptureId === sourceCaptureId);
+    if (existing) {
+      if (!backgroundSync?.reconcile || !backgroundSync?.requestSync) {
+        return { item: { ...existing }, background: false, durability: 'foreground-only', reused: true };
+      }
+      await backgroundSync.reconcile(read());
+      await backgroundSync.requestSync();
+      return { item: { ...existing }, background: true, durability: 'background', reused: true };
+    }
     if (!backgroundSync?.reconcile || !backgroundSync?.requestSync) {
       const item = enqueue(draft, false);
       return { item, background: false, durability: 'foreground-only' };

frontend/mobile-queue-launcher.js

@@ -0,0 +1,25 @@
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory;
+  else root.createMobileQueueLauncher = factory;
+})(typeof self !== 'undefined' ? self : this, function createMobileQueueLauncher(options) {
+  const emptyMessages = {
+    attention: 'No items need attention.',
+    update: 'No unread updates are ready to open.',
+    later: 'No deferred work is ready to open.',
+    draft: 'No drafts are ready to open.',
+  };
+
+  function open(name) {
+    if (name === 'today') return options.openToday();
+    options.selectFilter(name);
+    const action = options.firstAction(name);
+    if (!action) {
+      options.announce(emptyMessages[name] || 'No work is ready to open.');
+      return 'empty';
+    }
+    action.click();
+    return 'opened';
+  }
+
+  return { open };
+});

frontend/mobile-task-dock.js

@@ -95,12 +95,17 @@
   }
 
   function updateQueues(counts) {
-    const names = ['today', 'attention', 'later', 'draft'];
+    const names = ['today', 'attention', 'update', 'later', 'draft'];
     const normalized = Object.fromEntries(names.map(name => [name, Math.max(0, Number(counts?.[name]) || 0)]));
-    const total = names.reduce((sum, name) => sum + normalized[name], 0);
+    // Updates are already represented by the Attention destination, so keep
+    // the dock aggregate non-overlapping while exposing the useful drill-down.
+    const total = ['today', 'attention', 'later', 'draft'].reduce((sum, name) => sum + normalized[name], 0);
     Object.entries(options.queueCounts || {}).forEach(([name, element]) => {
       element.textContent = String(normalized[name] || 0);
     });
+    options.queueRows?.update?.setAttribute(
+      'aria-label', 'Updates, ' + normalized.update + ' unread conversations'
+    );
     if (options.queueBadge) {
       options.queueBadge.textContent = String(total);
       options.queueBadge.hidden = total === 0;

frontend/plan-today-readiness.js

@@ -0,0 +1,41 @@
+function createPlanTodayReadiness({ identity, inspect, concurrency = 3 }) {
+  const workerCount = Math.max(1, Math.floor(Number(concurrency) || 1));
+  let generation = 0;
+
+  async function run(items) {
+    const runGeneration = ++generation;
+    const candidates = Array.from(items || []);
+    const results = new Array(candidates.length);
+    let next = 0;
+
+    async function worker() {
+      while (next < candidates.length) {
+        const index = next;
+        next += 1;
+        const item = candidates[index];
+        let result;
+        try {
+          result = await inspect(item);
+        } catch (_error) {
+          result = { status:'unverified' };
+        }
+        results[index] = [identity(item), result];
+      }
+    }
+
+    await Promise.all(Array.from(
+      { length:Math.min(workerCount, candidates.length) },
+      () => worker(),
+    ));
+    if (runGeneration !== generation) return null;
+    return Object.fromEntries(results);
+  }
+
+  function cancel() {
+    generation += 1;
+  }
+
+  return { run, cancel };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createPlanTodayReadiness;

frontend/plan-today.js

@@ -7,6 +7,8 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
   let recommendations = {};
   let recommendationAware = false;
   let capacityAware = false;
+  let buildState = null;
+  let buildReadiness = null;
 
   function cleanItems(items) {
     const unique = new Map();
@@ -33,6 +35,8 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
     }
     recommendations = {};
     recommendationAware = actualMinutes !== null;
+    buildState = null;
+    buildReadiness = null;
     for (const [id, minutes] of Object.entries(actualMinutes || {})) {
       if (draftIds.includes(id) && Number.isInteger(minutes) && minutes >= 5 && minutes <= 1440 &&
           estimates[id] !== minutes) recommendations[id] = minutes;
@@ -74,6 +78,8 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
     recommendations = {};
     recommendationAware = false;
     capacityAware = false;
+    buildState = null;
+    buildReadiness = null;
   }
 
   function cancel() {
@@ -88,10 +94,12 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
   }
 
   function setEstimate(id, minutes) {
-    if (!openState || !draftIds.includes(id)) return false;
+    const resolvingBuildEstimate = buildState?.needs_estimate?.includes(id);
+    if (!openState || (!draftIds.includes(id) && !resolvingBuildEstimate)) return false;
     capacityAware = true;
-    if (Number.isInteger(minutes) && minutes > 0) estimates[id] = minutes;
-    else delete estimates[id];
+    if (!Number.isInteger(minutes) || minutes < 5 || minutes > 1440) return false;
+    estimates[id] = minutes;
+    if (resolvingBuildEstimate && buildReadiness) buildRecommendation(buildReadiness);
     return true;
   }
 
@@ -104,6 +112,41 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
     return true;
   }
 
+  function buildRecommendation(readiness = {}) {
+    if (!openState) return null;
+    buildReadiness = { ...readiness };
+    const selected = [];
+    const reasons = {};
+    const skipped = [];
+    const needsEstimate = [];
+    let used = 0;
+    for (const [id, item] of itemsById) {
+      if (selected.length >= limit) break;
+      const check = readiness[id] || { status:'unverified' };
+      if (check.status !== 'ready') {
+        skipped.push({
+          id,
+          status:check.status === 'blocked' ? 'blocked' : 'unverified',
+          reason:check.reason || (check.status === 'blocked' ? 'Blocked' : 'Could not verify readiness'),
+        });
+        continue;
+      }
+      const minutes = estimates[id];
+      if (!Number.isInteger(minutes)) {
+        needsEstimate.push(id);
+        continue;
+      }
+      if (capacityMinutes !== null && used + minutes > capacityMinutes) continue;
+      selected.push(id);
+      reasons[id] = item.reason || item.attention_reason || 'Ranked My Work';
+      used += minutes;
+    }
+    draftIds = selected;
+    capacityAware = true;
+    buildState = { selected:[...selected], reasons, skipped, needs_estimate:needsEstimate };
+    return buildState;
+  }
+
   function commit({ start: startAfterSave = false, confirmOverCapacity = false } = {}) {
     if (!openState) return 'closed';
     const ids = [...draftIds];
@@ -138,6 +181,7 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
       remaining_minutes: remainingMinutes,
       unestimated_count: draftIds.length - Object.keys(selectedEstimates).length,
       over_capacity: remainingMinutes !== null && remainingMinutes < 0,
+      ...(buildState ? { build:buildState } : {}),
     };
   }
 
@@ -149,7 +193,7 @@ function createPlanToday({ identity, save, start, limit = 5 }) {
     return [...itemsById.entries()].filter(([id]) => !draftIds.includes(id)).map(([, value]) => value);
   }
 
-  return { open, toggle, move, cancel, setCapacity, setEstimate, applyRecommendation, commit, snapshot, item, candidates };
+  return { open, toggle, move, cancel, setCapacity, setEstimate, applyRecommendation, buildRecommendation, commit, snapshot, item, candidates };
 }
 
 if (typeof module !== 'undefined' && module.exports) module.exports = createPlanToday;

frontend/security-center.js

@@ -128,6 +128,7 @@
       }
       const labels = {
         sign_in: 'Signed in', sign_out: 'Signed out', passkey_enrolled: 'Passkey enrolled',
+        passkey_counter_anomaly: 'Passkey counter anomaly',
         device_revoked: 'Device access revoked', all_sessions_revoked: 'All device access revoked',
         issue_closed: 'Issue closed', pull_merged: 'Pull request merged',
         pull_review_approved: 'Pull request approved',
@@ -141,6 +142,9 @@
         const details = root.document.createElement('span');
         details.className = 'small muted';
         const context = [event.device_label, event.method, event.target,
+          event.kind === 'passkey_counter_anomaly'
+            ? 'Remove and re-enroll this passkey if the alert repeats'
+            : null,
           event.status === 'pending' ? 'Outcome confirmation pending' : null]
           .filter(value => typeof value === 'string' && value).join(' · ');
         details.textContent = `${new Date(event.created_at * 1000).toLocaleString()}${context ? ' · ' + context : ''}`;

frontend/service-worker.js

@@ -1,6 +1,6 @@
 const BASE = new URL('./', self.location.href).pathname;
 importScripts(BASE + 'static/background-issue-sync.js');
-const CACHE = 'stackchain-dashboard-shell-v93';
+const CACHE = 'stackchain-dashboard-shell-v96';
 const OFFLINE_LEASE_URL = new URL(BASE + '__offline-session-lease', self.location.origin).href;
 const OUTAGE_STATUSES = new Set([500, 502, 503, 504]);
 const NAVIGATION_TIMEOUT_MS = self.__STACKCHAIN_NAVIGATION_TIMEOUT_MS || 4000;
@@ -21,6 +21,7 @@ const SHELL = [
   BASE + 'static/widgets.js',
   BASE + 'static/drafts.js',
   BASE + 'static/unfiled-captures.js',
+  BASE + 'static/draft-filing-session.js',
   BASE + 'static/draft-capacity-dialog.js',
   BASE + 'static/outbox-coordinator.js',
   BASE + 'static/issue-outbox.js',
@@ -40,6 +41,7 @@ const SHELL = [
   BASE + 'static/comment-next.js',
   BASE + 'static/update-reply-read-next.js',
   BASE + 'static/plan-today.js',
+  BASE + 'static/plan-today-readiness.js',
   BASE + 'static/plan-today-preview.js',
   BASE + 'static/today-sync.js',
   BASE + 'static/today-rollover.js',
@@ -65,6 +67,7 @@ const SHELL = [
   BASE + 'static/context-poller.js',
   BASE + 'static/mobile-task-dock.js',
   BASE + 'static/mobile-work-entry.js',
+  BASE + 'static/mobile-queue-launcher.js',
   BASE + 'static/mobile-launch.js',
   BASE + 'static/install-app.js',
   BASE + 'static/mobile-device-setup.js',

src/frontend_bundle.py

@@ -29,7 +29,8 @@ FEATURE_SOURCES = {
     "security-center": ("static/security-center.js",),
     "today-timer": (
         "static/mobile-task-dock.js", "static/today-timer.js", "static/today-recap.js",
-        "static/today-rollover.js", "static/unfiled-captures.js", "static/draft-capacity-dialog.js",
+        "static/today-rollover.js", "static/drafts.js", "static/unfiled-captures.js",
+        "static/draft-filing-session.js", "static/draft-capacity-dialog.js",
     ),
 }
 CACHE_DECLARATION = re.compile(

src/main.py

@@ -1595,9 +1595,19 @@ async def verify_passkey_authorization(
             stored=stored,
         )
         updated = await asyncio.to_thread(
-            store.update_counter, stored.credential_id, verified.new_sign_count
+            store.advance_counter,
+            stored.credential_id,
+            expected=stored.sign_count,
+            new=verified.new_sign_count,
         )
         if not updated:
+            await asyncio.to_thread(
+                _security_event_store().record,
+                "passkey_counter_anomaly",
+                method="passkey",
+                device_label=stored.device_label,
+                target=f"{payload.action}:{payload.target}",
+            )
             raise ValueError("stale passkey counter")
         grant = await dashboard_auth.issue_step_up(
             request.state.dashboard_session,
@@ -1686,9 +1696,19 @@ async def verify_passkey_authentication(
             stored=stored,
         )
         updated = await asyncio.to_thread(
-            store.update_counter, stored.credential_id, verified.new_sign_count
+            store.advance_counter,
+            stored.credential_id,
+            expected=stored.sign_count,
+            new=verified.new_sign_count,
         )
         if not updated:
+            await asyncio.to_thread(
+                _security_event_store().record,
+                "passkey_counter_anomaly",
+                method="passkey",
+                device_label=stored.device_label,
+                target="sign_in:dashboard",
+            )
             raise ValueError("stale passkey counter")
         await dashboard_auth.revoke_managed_session(stored.management_id)
         signed, session = await asyncio.to_thread(

src/passkey_store.py

@@ -225,13 +225,26 @@ class PasskeyStore:
             raise SessionStoreError("Passkey registry is temporarily unavailable") from exc
         return StoredPasskey(*row) if row else None
 
-    def update_counter(self, credential_id: bytes, new_sign_count: int) -> bool:
+    def advance_counter(
+        self, credential_id: bytes, *, expected: int, new: int
+    ) -> bool:
+        if expected == 0 and new == 0:
+            comparison = "sign_count = 0"
+        elif new > expected:
+            comparison = "sign_count = ?"
+        else:
+            return False
         try:
             with self._connect() as connection:
+                parameters = (
+                    (new, credential_id)
+                    if expected == 0 and new == 0
+                    else (new, credential_id, expected)
+                )
                 cursor = connection.execute(
-                    "UPDATE passkey_credentials SET sign_count = ? "
-                    "WHERE credential_id = ? AND sign_count <= ?",
-                    (new_sign_count, credential_id, new_sign_count),
+                    f"UPDATE passkey_credentials SET sign_count = ? "
+                    f"WHERE credential_id = ? AND {comparison}",
+                    parameters,
                 )
                 return cursor.rowcount == 1
         except (OSError, sqlite3.Error) as exc:

tests/test_comment_next.py

@@ -303,4 +303,4 @@ async def test_unread_update_offers_reply_mark_read_and_next_independent_of_toda
     assert '.update-reply-actions { display:grid; grid-template-columns:repeat(2,minmax(0,1fr));' in html
     assert '.update-reply-actions button { min-height:44px;' in html
     worker = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
-    assert "stackchain-dashboard-shell-v93" in worker
+    assert "stackchain-dashboard-shell-v96" in worker

tests/test_dashboard_auth.py

@@ -170,6 +170,102 @@ async def test_enrolled_passkey_can_sign_in_without_the_operator_token(
     assert "correct horse battery staple" not in signed_in.text
 
 
+@pytest.mark.anyio
+async def test_stale_nonzero_passkey_counter_denies_sign_in_and_records_anomaly(
+    access_control, monkeypatch
+):
+    class StaleAuthentication:
+        new_sign_count = 4
+
+    monkeypatch.setattr(
+        main.passkeys,
+        "verify_authentication",
+        lambda **_kwargs: StaleAuthentication(),
+    )
+    await asyncio.to_thread(
+        main._passkey_store().register,
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        options = await client.post("/api/v1/passkeys/authentication/options")
+        denied = await client.post(
+            "/api/v1/passkeys/authentication/verify",
+            json={
+                "challenge": options.json()["challenge"],
+                "credential": {"id": "cGhvbmUtY3JlZGVudGlhbA"},
+                "device_label": "Phone",
+                "action": "sign_in",
+                "target": "dashboard",
+            },
+        )
+
+    events = main._security_event_store().list(limit=10).events
+    assert denied.status_code == 401
+    assert "stackchain_session=" not in denied.headers.get("set-cookie", "")
+    assert [event.kind for event in events] == ["passkey_counter_anomaly"]
+    assert events[0].device_label == "Phone"
+    assert events[0].target == "sign_in:dashboard"
+
+
+@pytest.mark.anyio
+async def test_stale_nonzero_passkey_counter_denies_fresh_authorization(
+    access_control, monkeypatch
+):
+    class StaleAuthentication:
+        new_sign_count = 4
+
+    monkeypatch.setattr(
+        main.passkeys,
+        "verify_authentication",
+        lambda **_kwargs: StaleAuthentication(),
+    )
+    await asyncio.to_thread(
+        main._passkey_store().register,
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        await client.post(
+            "/api/v1/session",
+            json={"access_token": "correct horse battery staple", "device_label": "Phone"},
+        )
+        headers = {
+            "Origin": "https://test",
+            "X-CSRF-Token": client.cookies["stackchain_csrf"],
+        }
+        options = await client.post(
+            "/api/v1/passkeys/authorization/options",
+            json={"action": "merge_pull", "target": "stackchain/dashboard#42"},
+            headers=headers,
+        )
+        denied = await client.post(
+            "/api/v1/passkeys/authorization/verify",
+            json={
+                "challenge": options.json()["challenge"],
+                "credential": {"id": "cGhvbmUtY3JlZGVudGlhbA"},
+                "action": "merge_pull",
+                "target": "stackchain/dashboard#42",
+            },
+            headers=headers,
+        )
+
+    events = main._security_event_store().list(limit=10).events
+    assert options.status_code == 200
+    assert denied.status_code == 401
+    assert "grant" not in denied.json()
+    assert events[0].kind == "passkey_counter_anomaly"
+    assert events[0].target == "merge_pull:stackchain/dashboard#42"
+
+
 @pytest.mark.anyio
 async def test_passkey_options_are_source_limited_before_challenge_generation(
     access_control, monkeypatch

tests/test_frontend_bundle.py

@@ -187,7 +187,7 @@ def test_legacy_cache_marker_is_normalized_out_of_build_identity(tmp_path):
     worker = changed_frontend / "service-worker.js"
     worker.write_text(
         worker.read_text().replace(
-            "const CACHE = 'stackchain-dashboard-shell-v93';",
+            "const CACHE = 'stackchain-dashboard-shell-v96';",
             "const CACHE = 'stackchain-dashboard-shell-v999';",
         )
     )

tests/test_issue_outbox.py

@@ -744,3 +744,55 @@ async def test_mobile_dashboard_queues_offline_captures_and_exposes_outbox_actio
     assert 'Needs attention' in html
     assert "issueOutbox.discard(item.outbox_id)" in html
     assert '.draft-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr));' in html
+
+
+
+def test_issue_outbox_reuses_the_original_operation_when_a_source_draft_is_retried():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map();
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+let sequence = 0;
+const outbox = createIssueOutbox({{
+  storage, getOwnerLogin:()=> 'timmy', createOperationId:()=> 'draft-op-' + (++sequence),
+}});
+const first = outbox.enqueue({{repository:'o/r',title:'Draft work',body:'Context',sourceCaptureId:'capture-7'}});
+const retried = outbox.enqueue({{repository:'o/r',title:'Draft work',body:'Context',sourceCaptureId:'capture-7'}});
+process.stdout.write(JSON.stringify({{first,retried,items:outbox.list(),sequence}}));
+"""
+    output = run_node(script)
+
+    assert output["sequence"] == 1
+    assert len(output["items"]) == 1
+    assert output["first"]["id"] == output["retried"]["id"] == "draft-op-1"
+    assert output["items"][0]["operationId"] == "draft-op-1"
+    assert output["items"][0]["sourceCaptureId"] == "capture-7"
+
+
+def test_durable_source_draft_retry_reconciles_without_allocating_another_operation():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map();
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+let sequence = 0; const reconciliations = []; let syncRequests = 0;
+const outbox = createIssueOutbox({{
+  storage, getOwnerLogin:()=> 'timmy', createOperationId:()=> 'durable-' + (++sequence),
+  backgroundSync:{{
+    reconcile:async items=>reconciliations.push(items.map(item=>item.operationId)),
+    requestSync:async()=>{{ syncRequests += 1; }},
+  }},
+}});
+(async()=>{{
+  const draft={{repository:'o/r',title:'Draft work',body:'Context',sourceCaptureId:'capture-8'}};
+  const first=await outbox.enqueueDurably(draft);
+  const retried=await outbox.enqueueDurably(draft);
+  process.stdout.write(JSON.stringify({{first,retried,reconciliations,syncRequests,items:outbox.list()}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert "reused" not in output["first"]
+    assert output["retried"]["reused"] is True
+    assert output["reconciliations"] == [["durable-1"], ["durable-1"]]
+    assert output["syncRequests"] == 2
+    assert len(output["items"]) == 1

tests/test_later_sync.py

@@ -347,5 +347,5 @@ async def test_dashboard_syncs_every_later_change_and_exposes_account_status():
 def test_later_sync_ships_atomically_in_the_offline_shell():
     source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/later-sync.js'" in source

tests/test_markdown_renderer.py

@@ -137,4 +137,4 @@ def test_markdown_work_bodies_are_mobile_safe_block_containers():
     assert ".markdown-content { min-width:0; max-width:100%; overflow-wrap:anywhere;" in css
     assert ".markdown-content pre { max-width:100%; overflow-x:auto;" in css
     assert ".markdown-content a { min-height:44px;" in css
-    assert "stackchain-dashboard-shell-v93" in worker
+    assert "stackchain-dashboard-shell-v96" in worker

tests/test_mobile_composer_integration.py

@@ -20,6 +20,7 @@ def test_all_text_entry_flows_are_wired_to_keyboard_safe_panels():
         ("#issue-sheet .issue-sheet-panel", ".issue-comment-composer", "#issue-comment", "#send-issue-comment", "#issue-comment-status"),
         ("#pull-sheet .pull-sheet-panel", ".pull-comment-composer", "#pull-comment", "#send-pull-comment", "#pull-comment-status"),
         ("#update-sheet .update-sheet-panel", ".update-reply", "#update-reply", "#send-update-reply", "#update-reply-status"),
+        ("#review-sheet .review-sheet-panel", "#review-inline-composer", "#review-inline-body", "#save-inline-comment", "#review-submit-status"),
     ]:
         for selector in (panel, workspace, composer, submit, status):
             assert repr(selector) in dashboard
@@ -27,10 +28,13 @@ def test_all_text_entry_flows_are_wired_to_keyboard_safe_panels():
     assert "workspace:qs('#create-issue-form')" in dashboard
     assert "focusWithin:true" in dashboard
     assert "mobileComposerViewport.close(qs('.create-issue-panel'))" in dashboard
+    assert "mobileComposerViewport.close(qs('#review-sheet .review-sheet-panel'))" in dashboard
     assert "height:var(--composer-viewport-height,100dvh)" in css
     assert "top:var(--composer-viewport-top,0px)" in css
     assert ".composer-keyboard-active" in css
     assert ".create-issue-panel.composer-keyboard-active" in css
+    assert ".review-sheet-panel.composer-keyboard-active" in css
+    assert ".composer-keyboard-active .review-inline-composer" in css
     assert ".composer-keyboard-active .create-issue-form :is(input,textarea,select,button) { scroll-margin-block:12px;" in css
 
 
@@ -41,7 +45,7 @@ def test_offline_shell_contains_every_local_dashboard_runtime_asset():
     shell_assets = set(re.findall(r"BASE \+ '([^']+)'", worker.split("async function sessionCsrf", 1)[0]))
 
     assert local_assets <= shell_assets, f"Offline shell is missing: {sorted(local_assets - shell_assets)}"
-    assert "stackchain-dashboard-shell-v93" in worker
+    assert "stackchain-dashboard-shell-v96" in worker
 
 
 def test_all_conversation_composers_offer_accessible_mobile_mentions():

tests/test_mobile_device_setup.py

@@ -186,7 +186,7 @@ def test_mobile_dashboard_mounts_phone_safe_device_setup_flow():
     assert "promptStorage:localStorage" in dashboard
     assert "pushControllerReady.then(ensureDeviceSetup)" in dashboard
     assert "BASE + 'static/mobile-device-setup.js'" in worker
-    assert "stackchain-dashboard-shell-v93" in worker
+    assert "stackchain-dashboard-shell-v96" in worker
     assert ".device-setup-panel" in css
     assert ".device-readiness-card" in css
     assert "overflow-x:hidden" in css

tests/test_mobile_task_dock.py

@@ -9,6 +9,7 @@ from tests.dashboard_bundle import dashboard
 
 DOCK = Path(__file__).resolve().parents[1] / "frontend" / "mobile-task-dock.js"
 ENTRY = Path(__file__).resolve().parents[1] / "frontend" / "mobile-work-entry.js"
+QUEUE_LAUNCHER = Path(__file__).resolve().parents[1] / "frontend" / "mobile-queue-launcher.js"
 TIMER = Path(__file__).resolve().parents[1] / "frontend" / "today-timer.js"
 
 
@@ -292,7 +293,7 @@ sheet.showModal = function () {{ this.open = true; }};
 sheet.close = function () {{ this.open = false; this.listeners.close?.(); }};
 const close = new FakeElement();
 const badge = new FakeElement();
-const rows = Object.fromEntries(['today','attention','later','draft'].map(name => [name, new FakeElement()]));
+const rows = Object.fromEntries(['today','attention','update','later','draft'].map(name => [name, new FakeElement()]));
 const counts = Object.fromEntries(Object.keys(rows).map(name => [name, new FakeElement()]));
 const selected = [];
 const dock = createDock({{
@@ -302,16 +303,17 @@ const dock = createDock({{
   observe() {{}},
 }});
 dock.start();
-dock.updateQueues({{today:2, attention:1, later:3, draft:4}});
+dock.updateQueues({{today:2, attention:1, update:5, later:3, draft:4}});
 queues.click();
 const opened = sheet.open;
-rows.later.click();
+rows.update.click();
 const closedAfterSelect = !sheet.open;
 queues.click(); close.click();
 process.stdout.write(JSON.stringify({{
   opened, closedAfterSelect, selected,
   badge:badge.textContent, badgeLabel:queues.attributes['aria-label'],
   counts:Object.fromEntries(Object.entries(counts).map(([name, node]) => [name, node.textContent])),
+  updateLabel:rows.update.attributes['aria-label'],
   queueFocuses:queues.focuses,
   columnState:nav.attributes['data-attention'] || null,
 }}));
@@ -322,15 +324,45 @@ process.stdout.write(JSON.stringify({{
     assert json.loads(result.stdout) == {
         "opened": True,
         "closedAfterSelect": True,
-        "selected": ["later"],
+        "selected": ["update"],
+        # Updates are a drill-down within Attention and must not inflate the aggregate badge.
         "badge": "10",
         "badgeLabel": "Queues, 10 items",
-        "counts": {"today": "2", "attention": "1", "later": "3", "draft": "4"},
+        "counts": {"today": "2", "attention": "1", "update": "5", "later": "3", "draft": "4"},
+        "updateLabel": "Updates, 5 unread conversations",
         "queueFocuses": 2,
         "columnState": None,
     }
 
 
+def test_mobile_queue_launcher_opens_first_actionable_item_after_selecting_queue():
+    script = f"""
+const createLauncher = require({json.dumps(str(QUEUE_LAUNCHER))});
+const calls = [];
+const launcher = createLauncher({{
+  selectFilter: name => calls.push('filter:' + name),
+  firstAction: name => name === 'attention' ? {{click() {{ calls.push('open:first'); }}}} : null,
+  announce: message => calls.push('announce:' + message),
+}});
+const opened = launcher.open('attention');
+const empty = launcher.open('later');
+process.stdout.write(JSON.stringify({{opened, empty, calls}}));
+"""
+    result = subprocess.run(["node", "-e", script], capture_output=True, text=True)
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "opened": "opened",
+        "empty": "empty",
+        "calls": [
+            "filter:attention",
+            "open:first",
+            "filter:later",
+            "announce:No deferred work is ready to open.",
+        ],
+    }
+
+
 @pytest.mark.anyio
 async def test_dashboard_renders_and_wires_mobile_queue_switcher():
     html = await dashboard()
@@ -340,11 +372,16 @@ async def test_dashboard_renders_and_wires_mobile_queue_switcher():
     assert 'aria-labelledby="mobile-queue-heading"' in html
     assert 'data-mobile-queue="today"' in html
     assert 'data-mobile-queue="attention"' in html
+    assert 'data-mobile-queue="update"' in html
+    assert '<strong>Updates</strong><small>Unread conversations</small>' in html
     assert 'data-mobile-queue="later"' in html
     assert 'data-mobile-queue="draft"' in html
     assert 'id="mobile-queue-count"' in html
     assert 'mobileTaskDock.updateQueues(counts)' in html
-    assert "onSelectQueue: openMobileQueue" in html
+    assert '<script src="static/mobile-queue-launcher.js"></script>' in html
+    assert "const mobileQueueLauncher = createMobileQueueLauncher({" in html
+    assert "firstAction: name => qs('#my-work-list .my-work-card-main, #my-work-list .draft-resume, #my-work-list .draft-continue, #my-work-list .draft-edit')" in html
+    assert "onSelectQueue: name => mobileQueueLauncher.open(name)" in html
     assert '.mobile-queue-sheet' in html
     assert 'padding-bottom:calc(16px + env(safe-area-inset-bottom))' in html
     assert '.mobile-task-dock[data-attention="true"]' not in html
@@ -389,7 +426,7 @@ async def test_dashboard_renders_and_wires_phone_safe_task_dock():
     assert '<script src="static/mobile-task-dock.js"></script>' in html
     assert "createMobileTaskDock({" in html
     assert "work: () => mobileWorkEntry.open()" in html
-    assert "onSelectQueue: openMobileQueue" in html
+    assert "onSelectQueue: name => mobileQueueLauncher.open(name)" in html
     assert "qs('[data-work-filter=\"' + name + '\"]').click()" in html
     assert "find: () => qs('#find-work').click()" in html
     assert "new: () => qs('#new-issue').click()" in html

tests/test_passkey_store.py

@@ -104,3 +104,44 @@ def test_existing_challenge_registry_is_migrated_without_losing_live_challenges(
         ).fetchall()
     assert "source_hash" in columns
     assert sorted(rows) == sorted([("existing",), (store._digest(b"new"),)])
+
+
+def test_passkey_counter_advancement_is_atomic_across_store_instances(tmp_path):
+    database = tmp_path / "passkeys.sqlite3"
+    first = PasskeyStore(database, clock=lambda: 1_000.0)
+    second = PasskeyStore(database, clock=lambda: 1_000.0)
+    first.register(
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+
+    assert first.advance_counter(b"phone-credential", expected=4, new=5) is True
+    assert second.advance_counter(b"phone-credential", expected=4, new=5) is False
+    assert first.get(b"phone-credential").sign_count == 5
+
+
+def test_passkey_counter_rejects_non_advancing_values_but_supports_counterless_devices(
+    tmp_path,
+):
+    store = PasskeyStore(tmp_path / "passkeys.sqlite3", clock=lambda: 1_000.0)
+    store.register(
+        credential_id=b"phone-credential",
+        public_key=b"phone-public-key",
+        sign_count=4,
+        device_label="Phone",
+        management_id="phone-management-id",
+    )
+    store.register(
+        credential_id=b"counterless-credential",
+        public_key=b"counterless-public-key",
+        sign_count=0,
+        device_label="Security key",
+        management_id="counterless-management-id",
+    )
+
+    assert store.advance_counter(b"phone-credential", expected=4, new=4) is False
+    assert store.advance_counter(b"phone-credential", expected=4, new=3) is False
+    assert store.advance_counter(b"counterless-credential", expected=0, new=0) is True

tests/test_plan_today.py

@@ -164,6 +164,77 @@ process.stdout.write(JSON.stringify({{before,ignored,applied,after,result,saved}
     }
 
 
+def test_plan_today_builds_ranked_ready_capacity_fit_without_saving():
+    script = f"""
+const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
+const item = (number, reason) => ({{kind:'issue', repository:'stackchain/dashboard', number, title:'Issue ' + number, reason}});
+const saved = [];
++const planner = createPlanToday({{
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  save: plan => saved.push(plan),
+}});
+const id = n => 'issue:stackchain/dashboard:' + n + ':';
+planner.open([], [item(1, 'Due today'), item(2, 'Unread update'), item(3, 'Assigned to you'), item(4, 'Needs your review')], {{
+  capacity_minutes:90, estimates:{{[id(1)]:60,[id(2)]:45,[id(3)]:30,[id(4)]:20}}
+}});
+const build = planner.buildRecommendation({{
+  [id(1)]:{{status:'ready'}},
+  [id(2)]:{{status:'blocked', reason:'Waiting on API'}},
+  [id(3)]:{{status:'ready'}},
+  [id(4)]:{{status:'unverified'}},
+}});
+process.stdout.write(JSON.stringify({{build, snapshot:planner.snapshot(), saved}}));
+""".replace("+const", "const")
+    result = run_node(script)
+    assert result["build"] == {
+        "selected": ["issue:stackchain/dashboard:1:", "issue:stackchain/dashboard:3:"],
+        "reasons": {
+            "issue:stackchain/dashboard:1:": "Due today",
+            "issue:stackchain/dashboard:3:": "Assigned to you",
+        },
+        "skipped": [
+            {"id": "issue:stackchain/dashboard:2:", "status": "blocked", "reason": "Waiting on API"},
+            {"id": "issue:stackchain/dashboard:4:", "status": "unverified", "reason": "Could not verify readiness"},
+        ],
+        "needs_estimate": [],
+    }
+    assert result["snapshot"]["ids"] == [
+        "issue:stackchain/dashboard:1:", "issue:stackchain/dashboard:3:"
+    ]
+    assert result["snapshot"]["planned_minutes"] == 90
+    assert result["snapshot"]["remaining_minutes"] == 0
+    assert result["snapshot"]["build"] == result["build"]
+    assert result["saved"] == []
+
+
+def test_plan_today_estimates_ready_omission_and_refits_without_another_readiness_check():
+    script = f"""
+const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
+const item = number => ({{kind:'issue', repository:'stackchain/dashboard', number, title:'Issue ' + number}});
+const planner = createPlanToday({{
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  save: () => true,
+}});
+const id = n => 'issue:stackchain/dashboard:' + n + ':';
+planner.open([], [item(1), item(2)], {{capacity_minutes:60, estimates:{{[id(1)]:30}}}});
+planner.buildRecommendation({{[id(1)]:{{status:'ready'}}, [id(2)]:{{status:'ready'}}}});
+const before = planner.snapshot();
+const estimated = planner.setEstimate(id(2), 30);
+const after = planner.snapshot();
+process.stdout.write(JSON.stringify({{before, estimated, after}}));
+"""
+    result = run_node(script)
+    assert result["before"]["ids"] == ["issue:stackchain/dashboard:1:"]
+    assert result["before"]["build"]["needs_estimate"] == ["issue:stackchain/dashboard:2:"]
+    assert result["estimated"] is True
+    assert result["after"]["ids"] == [
+        "issue:stackchain/dashboard:1:", "issue:stackchain/dashboard:2:"
+    ]
+    assert result["after"]["estimates"]["issue:stackchain/dashboard:2:"] == 30
+    assert result["after"]["remaining_minutes"] == 0
+    assert result["after"]["build"]["needs_estimate"] == []
+
+
 def test_plan_today_preview_preserves_draft_scroll_and_adds_item_once_on_return():
     script = f"""
 const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
@@ -278,6 +349,12 @@ async def test_mobile_dashboard_wires_focused_plan_today_sheet():
     assert 'id="plan-today-sheet" role="dialog"' in html
     assert 'id="plan-today-capacity"' in html
     assert 'id="plan-today-available"' in html
+    assert 'id="build-today-plan"' in html
+    assert 'id="plan-today-build-status" role="status" aria-live="polite"' in html
+    assert 'id="plan-today-estimates"' in html
+    assert 'Estimate to finish your plan' in html
+    assert 'data-plan-missing-estimate="' in html
+    assert '.plan-today-estimates input { min-height:44px;' in html
     assert 'inputmode="numeric" min="15" max="1440"' in html
     assert 'data-plan-estimate="' in html
     assert 'aria-label="Estimate for ' in html
@@ -333,6 +410,7 @@ async def test_plan_today_wires_cancel_back_and_success_through_overlay_history(
 def test_plan_today_controller_is_available_in_the_offline_shell():
     source = SERVICE_WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/plan-today.js'" in source
+    assert "BASE + 'static/plan-today-readiness.js'" in source
     assert "BASE + 'static/plan-today-preview.js'" in source

tests/test_plan_today_readiness.py

@@ -0,0 +1,94 @@
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from tests.dashboard_bundle import dashboard
+
+
+READINESS = Path(__file__).parents[1] / "frontend" / "plan-today-readiness.js"
+
+
+def run_node(script: str) -> dict:
+    result = subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True)
+    return json.loads(result.stdout)
+
+
+def test_plan_readiness_bounds_concurrency_and_preserves_ranked_order():
+    script = f"""
+const createReadiness = require({json.dumps(str(READINESS))});
+let active = 0;
+let peak = 0;
+const completed = [];
+const delays = {{1:40, 2:5, 3:20, 4:1, 5:10, 6:2}};
+const readiness = createReadiness({{
+  concurrency:3,
+  identity:item => 'issue:' + item.number,
+  inspect:async item => {{
+    active += 1;
+    peak = Math.max(peak, active);
+    await new Promise(resolve => setTimeout(resolve, delays[item.number]));
+    completed.push(item.number);
+    active -= 1;
+    return item.number === 4 ? {{status:'blocked', reason:'Waiting'}} : {{status:'ready'}};
+  }},
+}});
+readiness.run([1,2,3,4,5,6].map(number => ({{kind:'issue', number}}))).then(result => {{
+  process.stdout.write(JSON.stringify({{peak, completed, entries:Object.entries(result)}}));
+}});
+"""
+    result = run_node(script)
+    assert result["peak"] == 3
+    assert result["completed"] != [1, 2, 3, 4, 5, 6]
+    assert result["entries"] == [
+        ["issue:1", {"status": "ready"}],
+        ["issue:2", {"status": "ready"}],
+        ["issue:3", {"status": "ready"}],
+        ["issue:4", {"status": "blocked", "reason": "Waiting"}],
+        ["issue:5", {"status": "ready"}],
+        ["issue:6", {"status": "ready"}],
+    ]
+
+
+def test_plan_readiness_supersedes_stale_builds_and_normalizes_real_failures():
+    script = f"""
+const createReadiness = require({json.dumps(str(READINESS))});
+let releaseFirst;
+const firstGate = new Promise(resolve => {{ releaseFirst = resolve; }});
+const readiness = createReadiness({{
+  concurrency:2,
+  identity:item => 'issue:' + item.number,
+  inspect:async item => {{
+    if (item.number === 1) await firstGate;
+    if (item.number === 3) throw new Error('upstream details');
+    return {{status:'ready'}};
+  }},
+}});
+const stale = readiness.run([{{number:1}}, {{number:2}}]);
+const current = readiness.run([{{number:3}}, {{number:4}}]);
+current.then(currentResult => {{
+  releaseFirst();
+  stale.then(staleResult => process.stdout.write(JSON.stringify({{staleResult, currentResult}})));
+}});
+"""
+    assert run_node(script) == {
+        "staleResult": None,
+        "currentResult": {
+            "issue:3": {"status": "unverified"},
+            "issue:4": {"status": "ready"},
+        },
+    }
+
+
+@pytest.mark.anyio
+async def test_dashboard_uses_bounded_supersedable_readiness_for_build_my_today():
+    html = await dashboard()
+
+    assert '<script src="static/plan-today-readiness.js"></script>' in html
+    assert "const planTodayReadiness = createPlanTodayReadiness({" in html
+    assert "concurrency:3" in html
+    assert "const checks = await planTodayReadiness.run(candidates);" in html
+    assert "if (!checks) return;" in html
+    assert "planTodayReadiness.cancel();" in html
+    assert "Promise.all(candidates.map" not in html

tests/test_security_center.py

@@ -47,3 +47,42 @@ const boundary={{
         "hidden": False,
         "focused": True,
     }
+
+
+def test_counter_anomaly_activity_gives_passkey_remediation_guidance():
+    harness = f"""
+const attachSecurityCenter=require({json.dumps(str(SECURITY_CENTER))});
+const element=()=>({{
+  hidden:true, disabled:false, textContent:'', children:[], className:'',
+  addEventListener(){{}}, focus(){{}}, replaceChildren(){{this.children=[];}},
+  append(...values){{this.children.push(...values);}},
+}});
+const ids={{
+  'active-devices':element(), 'active-devices-sheet':element(),
+  'active-devices-list':element(), 'active-devices-status':element(),
+  'enrolled-passkeys-list':element(), 'enrolled-passkeys-status':element(),
+  'enroll-passkey':element(), 'security-activity-list':element(),
+  'security-activity-status':element(), 'load-more-security-activity':element(),
+  'close-active-devices':element(),
+}};
+const root={{document:{{getElementById:id=>ids[id]||null,createElement:()=>element()}}}};
+const boundary={{
+  listActiveDevices:async()=>[], listPasskeys:async()=>[],
+  listSecurityEvents:async()=>({{events:[{{
+    kind:'passkey_counter_anomaly', device_label:'Phone', method:'passkey',
+    target:'sign_in:dashboard', status:'completed', created_at:1,
+  }}],authentication_alerts:[],next_cursor:null}}),
+}};
+(async()=>{{
+  await attachSecurityCenter({{root,boundary}}).open();
+  const row=ids['security-activity-list'].children[0];
+  console.log(JSON.stringify(row.children.map(child=>child.textContent)));
+}})().catch(error=>{{console.error(error);process.exit(1);}});
+"""
+    completed = subprocess.run(
+        ["node", "-e", harness], check=True, capture_output=True, text=True
+    )
+
+    title, detail = json.loads(completed.stdout)
+    assert title == "Passkey counter anomaly"
+    assert "Remove and re-enroll this passkey" in detail

tests/test_service_worker.py

@@ -145,7 +145,7 @@ async function dispatchPush(payload) {{
 def test_resumable_today_session_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/my-work.js'" in source
     assert "BASE + 'static/dashboard.js'" in source
     assert "BASE + 'static/dashboard.css'" in source
@@ -154,14 +154,14 @@ def test_resumable_today_session_ships_in_a_new_offline_shell():
 def test_ownership_exit_runtime_rolls_the_offline_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/dashboard.js'" in source
 
 
 def test_offline_review_next_ships_today_completion_atomically():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/today-completion.js'" in source
     assert "BASE + 'static/dashboard.js'" in source
 
@@ -169,7 +169,7 @@ def test_offline_review_next_ships_today_completion_atomically():
 def test_duplicate_aware_capture_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/create-issue-sheet.js'" in source
     assert "BASE + 'static/dashboard.js'" in source
 
@@ -177,14 +177,14 @@ def test_duplicate_aware_capture_ships_in_a_new_offline_shell():
 def test_exact_later_picker_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/later-picker.js'" in source
 
 
 def test_navigation_deadline_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/dashboard.css'" in source
     assert "BASE + 'static/dashboard.js'" in source
     assert "BASE + 'static/install-app.js'" in source
@@ -193,21 +193,21 @@ def test_navigation_deadline_ships_in_a_new_shell_cache():
 def test_today_convergence_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/today-sync.js'" in source
 
 
 def test_mobile_search_viewport_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/mobile-search-viewport.js'" in source
 
 
 def test_update_ownership_flow_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/update-ownership.js'" in source
 
 
@@ -654,7 +654,7 @@ def test_one_session_bound_csrf_proof_is_reused_for_a_background_drain():
 def test_queue_today_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/queue-today.js'" in source
 
 
@@ -684,6 +684,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/widgets.js",
         "/dashboard/static/drafts.js",
         "/dashboard/static/unfiled-captures.js",
+        "/dashboard/static/draft-filing-session.js",
         "/dashboard/static/draft-capacity-dialog.js",
         "/dashboard/static/outbox-coordinator.js",
         "/dashboard/static/issue-outbox.js",
@@ -703,6 +704,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/comment-next.js",
         "/dashboard/static/update-reply-read-next.js",
         "/dashboard/static/plan-today.js",
+        "/dashboard/static/plan-today-readiness.js",
         "/dashboard/static/plan-today-preview.js",
         "/dashboard/static/today-sync.js",
         "/dashboard/static/today-rollover.js",
@@ -728,6 +730,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/context-poller.js",
         "/dashboard/static/mobile-task-dock.js",
         "/dashboard/static/mobile-work-entry.js",
+        "/dashboard/static/mobile-queue-launcher.js",
         "/dashboard/static/mobile-launch.js",
         "/dashboard/static/install-app.js",
         "/dashboard/static/mobile-device-setup.js",

tests/test_today_readiness.py

@@ -221,7 +221,7 @@ async def test_today_blocker_opens_existing_preview_and_preserves_readiness_gate
 def test_readiness_runtime_is_available_in_offline_shell():
     service_worker = SERVICE_WORKER.read_text()
 
-    assert "const CACHE = 'stackchain-dashboard-shell-v93';" in service_worker
+    assert "const CACHE = 'stackchain-dashboard-shell-v96';" in service_worker
     assert "BASE + 'static/today-readiness.js'" in service_worker
 
 

tests/test_today_sync.py

@@ -127,7 +127,7 @@ sync.enqueueConfiguration(120, {{'issue:r:1:':60}});
 def test_inflight_today_drain_ships_in_a_new_offline_shell():
     source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
 
-    assert "stackchain-dashboard-shell-v93" in source
+    assert "stackchain-dashboard-shell-v96" in source
     assert "BASE + 'static/today-sync.js'" in source
 
 

tests/test_unfiled_captures.py

@@ -8,6 +8,7 @@ from tests.dashboard_bundle import dashboard
 
 
 UNFILED = Path(__file__).parents[1] / "frontend" / "unfiled-captures.js"
+DRAFT_SESSION = Path(__file__).parents[1] / "frontend" / "draft-filing-session.js"
 
 
 def run_node(script: str):
@@ -15,6 +16,28 @@ def run_node(script: str):
     return json.loads(result.stdout)
 
 
+def test_draft_filing_session_navigates_stable_capture_ids_and_reconciles_removed_items():
+    script = f"""
+const createDraftFilingSession = require({json.dumps(str(DRAFT_SESSION))});
+let captures = [{{id:'newest'}}, {{id:'middle'}}, {{id:'oldest'}}];
+const session = createDraftFilingSession({{list:()=>captures}});
+const opened = session.start('middle');
+const skipped = session.next();
+captures = [{{id:'newest'}}];
+const afterFiled = session.removeCurrentAndNext('oldest');
+const previous = session.previous();
+process.stdout.write(JSON.stringify({{opened,skipped,afterFiled,previous}}));
+"""
+    output = run_node(script)
+
+    assert output == {
+        "opened": {"id": "middle", "position": 2, "total": 3, "remaining": 1},
+        "skipped": {"id": "oldest", "position": 3, "total": 3, "remaining": 0},
+        "afterFiled": {"id": "newest", "position": 1, "total": 1, "remaining": 0},
+        "previous": {"id": "newest", "position": 1, "total": 1, "remaining": 0},
+    }
+
+
 def test_unfiled_captures_block_at_capacity_until_oldest_is_explicitly_replaced():
     script = f"""
 const createUnfiledCaptures = require({json.dumps(str(UNFILED))});
@@ -335,13 +358,14 @@ async def test_mobile_composer_exposes_cold_offline_save_and_account_safe_resume
     assert "requestAnimationFrame(() =>" in html
     assert "savedCard?.scrollIntoView({block:'nearest'})" in html
     assert "Saved to Drafts. Choose a repository when you’re ready to file it." in html
-    assert "await unfiledCaptures.resume(item.capture_id, activeFlushLogin)" in html
+    assert "await dependencies.captures.resume(captureId, dependencies.getLogin())" in DRAFT_SESSION.read_text()
     assert "await createIssueAttachmentController.serialize()" in html
     assert "createUnfiledAttachmentStore()" in html
-    assert "createIssueAttachmentController.restore(resumed.attachment)" in html
-    assert "await unfiledCaptures.completeResume(resumedUnfiledCaptureId)" in html
+    assert "dependencies.attachment[resumed.attachment ? 'restore' : 'clear'](resumed.attachment)" in DRAFT_SESSION.read_text()
+    assert "await unfiledCaptures.completeResume(rUC)" in html
+    assert "...(rUC ? { sourceCaptureId: rUC } : {})" in html
     assert "item.hasAttachment ? ' · Screenshot attached' : ''" in html
-    assert "issueCapture.saveDraft(resumed)" in html
+    assert "dependencies.issueCapture.saveDraft(resumed)" in DRAFT_SESSION.read_text()
     assert "item.kind === 'unfiled-issue'" in html
     assert '.create-issue-actions button { min-height:44px;' in html
     assert '.draft-card:focus-visible' in html
@@ -349,6 +373,25 @@ async def test_mobile_composer_exposes_cold_offline_save_and_account_safe_resume
     assert '@media(max-width:320px)' in html
 
 
+@pytest.mark.anyio
+async def test_mobile_drafts_expose_a_safe_sequential_filing_session():
+    html = await dashboard()
+
+    assert '<script src="static/draft-filing-session.js"></script>' in html
+    assert 'id="draft-filing-session"' in html
+    assert 'id="draft-filing-progress"' in html
+    assert 'id="previous-draft"' in html
+    assert 'id="skip-draft"' in html
+    assert "dFS.start(item.capture_id)" in html
+    assert "await dFS.nextCapture()" in html
+    assert "await dFS.advance(fS.id)" in html
+    feature = DRAFT_SESSION.read_text()
+    assert "Draft ${state.position} of ${state.total}" in feature
+    assert "qs('#submit-new-issue').textContent = state.remaining ? 'File & next' : 'File final Draft'" in feature
+    assert '.draft-filing-session-actions button { min-height:44px;' in html
+    assert 'padding-bottom:calc(10px + env(safe-area-inset-bottom))' in html
+
+
 @pytest.mark.anyio
 async def test_mobile_capture_capacity_requires_an_explicit_preserving_decision():
     html = await dashboard()