feat(ios): P1-B — W7 UI wave: deep links, timeline, quick-reply, diff, projects, session switcher, thumbnails, lock-screen push

T-iOS-22: DeepLinkRouter (full-field whitelist, cold-start stash, route(from:) for push-tap reuse), 21 tests
T-iOS-24: TimelineSheet mirroring web render() order; disabled→empty-state; reuses AwayDigest onExpand
T-iOS-25: QuickReply chips (built-ins mirror quick-reply.ts via KeyByteMap; visible iff live gate && !readOnly)
T-iOS-27: read-only DiffScreen + App-layer DiffFetcher (RO no-Origin; APIClient fold-in noted for T-iOS-38 owner)
T-iOS-26: Projects list/detail — grouping byte-identical to web group keys (prefs-shared collapse state),
prefs-clobber defenses (no blind PUT on empty base; adopt server echo), claude\r bootstrap
T-iOS-23: UnreadLedger + TitleSanitizer (SessionCore, +15 tests), lastOutputAt decode, list-boundary re-sanitize
T-iOS-29: new-in-cwd (untrusted cwd, no bootstrap re-injection) + exited-session reopen; fixes stale-controller
SwiftTerm view bug via .id(controller.id)
T-iOS-28: offscreen SwiftTerm thumbnail pipeline (LRU 32, concurrency gate 2, 256KiB cap, grid clamp)
T-iOS-21: PushRegistrar (WEBTERM_GATE category: Allow=.authenticationRequired, no .foreground) +
NotificationActionHandler (whitelisted payload, token never persisted, bg-task-wrapped POST, 403 fallback)
CRITICAL fix (verify-found boot crash): @Sendable literals on UN completion closures — MainActor-inherited
closures trapped Swift 6 executor check on UN's background queue; boot re-verified (no new crash reports,
permission prompt reached, privacy shade correctly covering during system alert)
Verified: 261 pkg + 247 app + 10 integration tests green; 7/7 semantics checks; Owns audit clean

ios/App/WebTerm/Screens/SessionListScreen.swift

@@ -16,6 +16,11 @@ struct SessionListScreen: View {
     var onOpen: (SessionListViewModel.OpenRequest) -> Void = { _ in }
     /// Host-switch header hook: "添加主机" entry (pairing sheet, T-iOS-15).
     var onAddHost: () -> Void = {}
+    /// T-iOS-28 (additive slot) · shared thumbnail pipeline: one cache + one
+    /// render-concurrency gate across ALL rows (scrolling must never spawn
+    /// unbounded offscreen terminals). `@State` keeps it stable across body
+    /// rebuilds; `live()` is cheap (the URLSession is a static shared).
+    @State private var thumbnails = SessionThumbnailPipeline.live()
 
     var body: some View {
         content
@@ -60,7 +65,7 @@ struct SessionListScreen: View {
                 Button {
                     viewModel.openSession(id: row.id)
                 } label: {
-                    SessionRowView(row: row)
+                    SessionRowView(row: row, thumbnail: thumbnailSlot(for: row))
                 }
                 .swipeActions(edge: .trailing, allowsFullSwipe: true) {
                     Button(role: .destructive) {
@@ -74,6 +79,23 @@ struct SessionListScreen: View {
         .refreshable { await viewModel.refresh() }
     }
 
+    /// T-iOS-28 · build one row's thumbnail slot. No paired host (defensive —
+    /// rows imply a host) → no slot; the request key carries `lastOutputAt`
+    /// so unchanged sessions render exactly once (pipeline cache).
+    private func thumbnailSlot(
+        for row: SessionListViewModel.SessionRow
+    ) -> SessionThumbnailView? {
+        guard let endpoint = viewModel.activeHost?.endpoint else { return nil }
+        return SessionThumbnailView(
+            request: SessionThumbnailRequest(
+                endpoint: endpoint,
+                sessionId: row.id,
+                lastOutputAt: row.info.lastOutputAt
+            ),
+            pipeline: thumbnails
+        )
+    }
+
     private func errorRow(_ message: String) -> some View {
         Label(message, systemImage: "exclamationmark.triangle")
             .font(.footnote)
@@ -142,15 +164,26 @@ struct SessionListScreen: View {
 
 private struct SessionRowView: View {
     let row: SessionListViewModel.SessionRow
+    /// T-iOS-28 (additive) · trailing live-preview thumbnail; nil = no slot
+    /// (no host / preview-less contexts) and the row lays out as before.
+    var thumbnail: SessionThumbnailView?
 
     var body: some View {
         HStack(alignment: .top, spacing: Metrics.rowSpacing) {
             indicator
                 .frame(width: Metrics.indicatorWidth)
             VStack(alignment: .leading, spacing: Metrics.rowInnerSpacing) {
-                Text(title)
-                    .font(.body)
-                    .lineLimit(1)
+                HStack(spacing: Metrics.titleSpacing) {
+                    // T-iOS-23: OSC titles are attacker-controlled — already
+                    // sanitized in the VM, rendered verbatim (no Markdown /
+                    // LocalizedStringKey interpretation), one line only.
+                    Text(verbatim: title)
+                        .font(.body)
+                        .lineLimit(1)
+                    if row.isUnread {
+                        unreadDot
+                    }
+                }
                 Text(meta)
                     .font(.caption)
                     .foregroundStyle(.secondary)
@@ -158,6 +191,10 @@ private struct SessionRowView: View {
                     TelemetryChips(model: telemetry)
                 }
             }
+            if let thumbnail {
+                Spacer(minLength: Metrics.titleSpacing)
+                thumbnail
+            }
         }
         .opacity(row.info.exited ? Metrics.exitedOpacity : 1)
         .accessibilityElement(children: .combine)
@@ -179,8 +216,19 @@ private struct SessionRowView: View {
         }
     }
 
-    /// `cwd` is server-supplied display text (untrusted → plain Text only).
+    /// Unread dot (T-iOS-23): output newer than the local last-seen watermark.
+    private var unreadDot: some View {
+        Circle()
+            .fill(.blue)
+            .frame(width: Metrics.unreadDotSize, height: Metrics.unreadDotSize)
+            .accessibilityLabel(ScreenCopy.unreadLabel)
+    }
+
+    /// Sanitized OSC title first (T-iOS-23, mirrors web autoTitle precedence,
+    /// public/tabs.ts:570), else the cwd-derived name. Both are server-supplied
+    /// display text (untrusted → verbatim Text only).
     private var title: String {
+        if let osc = row.title, !osc.isEmpty { return osc }
         guard let cwd = row.info.cwd, !cwd.isEmpty else { return ScreenCopy.unknownDirectory }
         return URL(fileURLWithPath: cwd).lastPathComponent
     }
@@ -213,6 +261,8 @@ private struct SessionRowView: View {
         static let dotSize: CGFloat = 10
         static let dotTopPadding: CGFloat = 5
         static let exitedOpacity = 0.55
+        static let titleSpacing: CGFloat = 6
+        static let unreadDotSize: CGFloat = 8
     }
 }
 
@@ -231,6 +281,7 @@ private enum ScreenCopy {
     static let unknownDirectory = "未知目录"
     static let exitedTag = "已退出"
     static let pendingBadgeLabel = "等待审批"
+    static let unreadLabel = "有新输出"
 
     static func clientCount(_ count: Int) -> String {
         "\(count) 台设备在看"