git-coco 0.53.0 → 0.54.1

package/dist/index.esm.mjs

@@ -61,7 +61,7 @@ import { pathToFileURL } from 'url';
 /**
  * Current build version from package.json
  */
-const BUILD_VERSION = "0.53.0";
+const BUILD_VERSION = "0.54.1";
 
 const isInteractive = (config) => {
     return config?.mode === 'interactive' || !!config?.interactive;
@@ -308,6 +308,25 @@ class LangChainNetworkError extends LangChainError {
         this.provider = provider;
     }
 }
+/**
+ * User-initiated cancellation (#881 phase 3). Thrown by streaming
+ * helpers when an `AbortSignal` they were given fires. Distinct from
+ * `LangChainNetworkError` / `LangChainTimeoutError` so callers can
+ * pattern-match: a cancelled LLM call is the user's intent, not a
+ * failure to surface in the status line as an error.
+ *
+ * Carries the accumulated text up to the cancel point (when
+ * available) so the caller can decide whether to salvage a partial
+ * result or discard it. Today the workstation discards — the
+ * preview pane was the only consumer of the accumulated text and it
+ * gets cleared on cancel anyway.
+ */
+class LangChainCancelledError extends LangChainError {
+    constructor(message, accumulated, context) {
+        super(message, { ...context, accumulated });
+        this.accumulated = accumulated;
+    }
+}
 
 /**
  * Validates that a required parameter is not null or undefined
@@ -1302,6 +1321,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -1756,6 +1787,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -1950,6 +1993,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -7943,7 +7998,7 @@ async function enforcePromptBudget({ prompt, variables, tokenizer, maxTokens, su
 /**
  * Extracts provider and endpoint info from LLM instance if available
  */
-function extractLlmInfo(llm) {
+function extractLlmInfo$1(llm) {
     const info = {};
     // Try to extract provider from class name
     const className = llm?.constructor?.name || '';
@@ -7986,7 +8041,7 @@ const executeChain = async ({ llm, prompt, variables, parser, provider, endpoint
         });
     }
     // Extract LLM info for error reporting if not provided
-    const llmInfo = extractLlmInfo(llm);
+    const llmInfo = extractLlmInfo$1(llm);
     const effectiveProvider = provider || llmInfo.provider;
     const effectiveEndpoint = endpoint || llmInfo.endpoint;
     try {
@@ -14571,6 +14626,11 @@ const options$8 = {
         type: 'boolean',
         default: false,
     },
+    strictSplit: {
+        description: 'Fail loudly if the split planner exhausts its retry budget with an invalid plan (otherwise falls back to a single combined commit).',
+        type: 'boolean',
+        default: false,
+    },
 };
 const builder$8 = (yargs) => {
     return yargs.options(options$8).usage(getCommandUsageHeader(command$8));
@@ -15459,6 +15519,53 @@ function dropEmptyGroups(plan) {
     }
     return { ...plan, groups: surviving };
 }
+/**
+ * Construct a trivially-valid single-group plan covering every staged
+ * file. Used as the fallback when the LLM exhausts its retry budget
+ * with an invalid plan — turning a hard failure into a usable
+ * (if degraded) outcome.
+ *
+ * Properties of the returned plan:
+ *
+ *   - Exactly one group.
+ *   - Every staged file appears in that group's `files[]`. No hunks
+ *     are claimed, so any hunk inventory is irrelevant to the plan's
+ *     validity.
+ *   - By construction: no duplicates, no missing files, no mixed
+ *     mode, no phantom hunks. `getPlanValidationIssues` returns an
+ *     empty issue set.
+ *
+ * The group's `rationale` carries the reason text the caller wants
+ * to expose to the UI (typically "model exhausted N attempts; last
+ * issues were …"). The `body` carries a short note that survives
+ * into the commit message body so a user who applies without editing
+ * has the context recorded in git history.
+ *
+ * `title` defaults to a generic conventional-commits-compatible
+ * `chore: combined commit` — bland on purpose. Real commit messaging
+ * is the user's job at the compose / apply step.
+ *
+ * The plan is NOT linked to the LLM by construction. If the model
+ * can't produce a valid split, the user still gets one apply-able
+ * commit instead of a thrown error and a still-staged worktree.
+ */
+function buildSplitPlanFallback(staged, options = {}) {
+    const files = staged.map((change) => change.filePath);
+    const reasonLine = options.reason
+        ? ` Reason: ${options.reason}`
+        : '';
+    return {
+        groups: [
+            {
+                title: 'chore: combined commit',
+                body: 'Auto-generated single-commit fallback after the split planner could not produce a valid multi-group plan. Edit before applying if you want a more specific message; press `r` to re-roll the planner if a different model might do better.',
+                rationale: `Fallback plan — every staged file in one commit because the LLM could not produce a valid multi-group split.${reasonLine}`,
+                files,
+                hunks: [],
+            },
+        ],
+    };
+}
 function formatPlanValidationFeedback(issues) {
     const sections = [];
     if (issues.unknownFiles.length) {
@@ -15495,7 +15602,7 @@ const DEFAULT_MAX_PLAN_ATTEMPTS = 3;
  * into the same prompt template (`previous_attempt_feedback` slot) so the model can
  * fix its own mistakes without re-running pre-processing.
  */
-async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged, hunkInventory, logger, tokenizer, metadata = {}, maxAttempts = DEFAULT_MAX_PLAN_ATTEMPTS, }) {
+async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged, hunkInventory, logger, tokenizer, metadata = {}, maxAttempts = DEFAULT_MAX_PLAN_ATTEMPTS, strict = false, }) {
     let lastIssues = null;
     let attempt = 0;
     while (attempt < maxAttempts) {
@@ -15565,9 +15672,42 @@ async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged
             logger.verbose(`Plan attempt ${attempt}/${maxAttempts} failed validation: ${formatPlanValidationIssuesError(issues)}`, { color: 'yellow' });
         }
     }
-    throw new Error(lastIssues
-        ? `Failed to produce a valid commit-split plan after ${maxAttempts} attempts. Final validator issues: ${formatPlanValidationIssuesError(lastIssues)}`
-        : `Failed to produce a valid commit-split plan after ${maxAttempts} attempts.`);
+    const issuesSummary = lastIssues
+        ? formatPlanValidationIssuesError(lastIssues)
+        : 'no captured validator issues';
+    // Strict mode: restore the pre-#1005 behaviour. Callers that pass
+    // `strict: true` (and CLI users via `--strict-split`) want explicit
+    // failure rather than the degraded fallback.
+    if (strict) {
+        throw new Error(lastIssues
+            ? `Failed to produce a valid commit-split plan after ${maxAttempts} attempts. Final validator issues: ${issuesSummary}`
+            : `Failed to produce a valid commit-split plan after ${maxAttempts} attempts.`);
+    }
+    // Default: hand back a trivially-valid single-group fallback. The
+    // caller's apply / preview surface should treat the `fallback` flag
+    // as a signal to nudge the user (it's strictly better than a hard
+    // failure with the staged set still on disk, but it's still a
+    // degraded outcome compared to a real multi-group split).
+    const reason = `LLM exhausted ${maxAttempts} planning attempts; final validator issues: ${issuesSummary}`;
+    if (logger) {
+        logger.verbose(`Plan attempts exhausted — falling back to a single-group plan. ${reason}`, { color: 'yellow' });
+    }
+    return {
+        plan: buildSplitPlanFallback(staged, { reason: issuesSummary }),
+        attempts: maxAttempts,
+        fallback: {
+            reason,
+            lastIssues: lastIssues ?? {
+                unknownFiles: [],
+                duplicateFiles: [],
+                unknownHunks: [],
+                duplicateHunks: [],
+                mixedFiles: [],
+                partiallyCoveredFiles: [],
+                missingFiles: [],
+            },
+        },
+    };
 }
 
 /**
@@ -15769,7 +15909,7 @@ async function applyPatchToIndex$1(patch, git) {
         child.stdin.end();
     });
 }
-async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger, noVerify, }) {
+async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger, noVerify, fallback, }) {
     validatePlanForStagedFiles(plan, changes.staged, hunkInventory);
     assertNoUnstagedOverlap(plan, changes, hunkInventory);
     // Defensive: drop any group with empty files[] AND empty hunks[].
@@ -15872,11 +16012,13 @@ async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger,
         return {
             commitHashes,
             message: `Created ${commitHashes.length} of ${applicableGroups.length} planned commit(s). Failed: ${partial}`,
+            fallback,
         };
     }
     return {
         commitHashes,
         message: `Created ${commitHashes.length} split commit(s).`,
+        fallback,
     };
 }
 /**
@@ -15974,7 +16116,7 @@ async function prepareCommitSplitPlan({ argv, config, git, logger, tokenizer, ll
     }
     const resolvedPlanLlm = planLlm ?? llm;
     const resolvedPlanModel = planService?.model ?? config.service.model;
-    const { plan } = await generateValidatedCommitSplitPlan({
+    const { plan, fallback } = await generateValidatedCommitSplitPlan({
         llm: resolvedPlanLlm,
         prompt: COMMIT_SPLIT_PROMPT,
         variables: {
@@ -15997,8 +16139,12 @@ async function prepareCommitSplitPlan({ argv, config, git, logger, tokenizer, ll
             conventional: useConventional,
         },
         maxAttempts: DEFAULT_MAX_PLAN_ATTEMPTS,
+        // Honour `--strict-split` (CLI) or `strictSplit` (config). When set,
+        // the planner reverts to the pre-#1005 behaviour of throwing on
+        // exhaustion instead of returning the single-group fallback.
+        strict: Boolean(argv.strictSplit ?? config.strictSplit),
     });
-    return { plan, context: { changes, hunkInventory } };
+    return { plan, context: { changes, hunkInventory }, fallback };
 }
 async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, planLlm, planService, }) {
     const result = await prepareCommitSplitPlan({
@@ -16014,7 +16160,7 @@ async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, pl
     if ('empty' in result) {
         return 'No staged changes found.';
     }
-    const { plan, context } = result;
+    const { plan, context, fallback } = result;
     if (argv.apply) {
         const applied = await applyCommitSplitPlan({
             plan,
@@ -16023,9 +16169,24 @@ async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, pl
             git,
             logger,
             noVerify: argv.noVerify || config.noVerify || false,
+            fallback,
         });
+        if (applied.fallback) {
+            return [
+                `Note: applied the single-commit fallback (${applied.fallback.reason}).`,
+                applied.message,
+            ].join('\n');
+        }
         return applied.message;
     }
+    if (fallback) {
+        return [
+            `Note: showing the single-commit fallback plan (${fallback.reason}).`,
+            'Re-run with a stronger model or use --strict-split to surface the planner error.',
+            '',
+            formatCommitSplitPlan(plan),
+        ].join('\n');
+    }
     return formatCommitSplitPlan(plan);
 }
 
@@ -20059,16 +20220,43 @@ function applyCommitComposeAction(state, action) {
                 field: state.field === 'summary' ? 'body' : 'summary',
             };
         case 'setEditing':
+            // Audit finding #12: defensively clear `streamingPreview` when
+            // editing toggles off AND no draft is in flight. The current
+            // input pipeline never triggers this combination, but the
+            // reducer is the source of truth — if a future code path
+            // toggles editing off mid-stream, the preview shouldn't linger
+            // below an idle compose panel.
             return {
                 ...state,
                 editing: action.value,
+                streamingPreview: !action.value && !state.loading ? undefined : state.streamingPreview,
             };
         case 'setLoading':
+            // Clearing loading also clears any in-flight streaming preview;
+            // the preview's whole purpose is to fill the wait window. Once
+            // the wait ends (success OR failure), the preview is stale.
             return {
                 ...state,
                 loading: action.value,
+                streamingPreview: action.value ? state.streamingPreview : undefined,
             };
         case 'setDraft':
+            // Audit finding #7: if the user has typed content in summary or
+            // body, the AI draft would silently clobber their work with no
+            // undo. Route the result to `pendingAiDraft` instead and surface
+            // a confirmation message; the user accepts with `R` (replace)
+            // or dismisses with Esc. Empty fields = safe to replace as
+            // before, since there's nothing to lose.
+            if (state.summary.trim() || state.body.trim()) {
+                return {
+                    ...state,
+                    loading: false,
+                    streamingPreview: undefined,
+                    pendingAiDraft: action.value,
+                    message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                    details: undefined,
+                };
+            }
             // No `message` here — the loader → filled fields are the confirmation
             // that the AI generated something. A lingering "AI draft ready for
             // editing" line in the panel reads as stale state. The runtime still
@@ -20082,6 +20270,8 @@ function applyCommitComposeAction(state, action) {
                 loading: false,
                 message: undefined,
                 details: undefined,
+                streamingPreview: undefined,
+                pendingAiDraft: undefined,
             };
         case 'setResult':
             return {
@@ -20089,6 +20279,57 @@ function applyCommitComposeAction(state, action) {
                 loading: false,
                 message: action.message,
                 details: action.details,
+                streamingPreview: undefined,
+            };
+        case 'setStreamingPreview':
+            // Per-chunk live-preview update. Fires from the streaming
+            // workflow's onChunk callback; the renderer turns it into a
+            // last-N-lines panel below the loading line. Pass `undefined`
+            // to explicitly clear (the workflow does this on completion
+            // alongside the `setDraft` / `setResult` dispatch).
+            return {
+                ...state,
+                streamingPreview: action.value,
+            };
+        case 'setPendingAiDraft':
+            // Audit finding #7: route the AI draft here (instead of straight
+            // to summary/body via `setDraft`) when the user has unsaved
+            // typing the draft would clobber. The dispatcher does the
+            // user-content check; this reducer just stashes the draft and
+            // surfaces a message inviting the user to accept or dismiss.
+            return {
+                ...state,
+                loading: false,
+                streamingPreview: undefined,
+                pendingAiDraft: action.value,
+                message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                details: undefined,
+            };
+        case 'acceptPendingAiDraft':
+            // Swap the pending draft into the editable fields and clear it.
+            // Mirrors `setDraft`'s field positioning (focus on summary,
+            // editing on) so the user lands in the same place whether they
+            // accepted immediately or after deliberation.
+            if (!state.pendingAiDraft)
+                return state;
+            return {
+                ...state,
+                ...splitCommitDraft(state.pendingAiDraft),
+                field: 'summary',
+                editing: true,
+                loading: false,
+                message: undefined,
+                details: undefined,
+                streamingPreview: undefined,
+                pendingAiDraft: undefined,
+            };
+        case 'dismissPendingAiDraft':
+            // User chose to keep their typing; drop the AI draft.
+            return {
+                ...state,
+                pendingAiDraft: undefined,
+                message: undefined,
+                details: undefined,
             };
         case 'reset':
             // Drop message/details too — the post-commit "Created commit ..."
@@ -20162,6 +20403,233 @@ async function createManualCommit({ git, summary, body, noVerify = false, }) {
     }
 }
 
+/**
+ * Same provider / endpoint best-effort extraction `executeChain` uses,
+ * duplicated here rather than imported so the streaming module doesn't
+ * pull on `executeChain`'s implementation. If both helpers ever need to
+ * share more, factor this out to a shared `llmInfo.ts`.
+ */
+function extractLlmInfo(llm) {
+    const info = {};
+    const className = llm?.constructor?.name || '';
+    if (className.includes('Ollama')) {
+        info.provider = 'ollama';
+        if ('lc_kwargs' in llm && typeof llm.lc_kwargs === 'object' && llm.lc_kwargs !== null) {
+            const kwargs = llm.lc_kwargs;
+            if (typeof kwargs.baseUrl === 'string') {
+                info.endpoint = kwargs.baseUrl;
+            }
+        }
+    }
+    else if (className.includes('OpenAI')) {
+        info.provider = 'openai';
+    }
+    else if (className.includes('Anthropic')) {
+        info.provider = 'anthropic';
+    }
+    return info;
+}
+/**
+ * Coerce one streamed chunk into its text fragment. LangChain's
+ * `prompt.pipe(llm).stream(...)` yields `BaseMessageChunk` instances
+ * whose `.content` is sometimes a string and sometimes an array of
+ * content parts (multi-modal models, tool calls). We only care about
+ * the textual delta here; non-text parts are silently dropped because
+ * phase 1's surfaces (stdout + status-line copy) can't render them
+ * anyway.
+ */
+function coerceChunkText(messageChunk) {
+    if (typeof messageChunk === 'string')
+        return messageChunk;
+    if (messageChunk && typeof messageChunk === 'object' && 'content' in messageChunk) {
+        const content = messageChunk.content;
+        if (typeof content === 'string')
+            return content;
+        if (Array.isArray(content)) {
+            // Multi-part content array — concatenate the text parts only.
+            return content
+                .map((part) => {
+                if (typeof part === 'string')
+                    return part;
+                if (part && typeof part === 'object' && 'text' in part && typeof part.text === 'string') {
+                    return part.text;
+                }
+                return '';
+            })
+                .join('');
+        }
+    }
+    return '';
+}
+/**
+ * Streaming variant of `executeChain`. Pipes the prompt into the LLM,
+ * consumes the resulting async iterable, fires `onChunk` with each text
+ * fragment as it arrives, and runs the supplied parser against the
+ * fully-accumulated text on completion. Returns the parsed result.
+ *
+ * Why a separate function instead of an `onChunk?` flag on
+ * `executeChain`? Two reasons:
+ *
+ *   1. The two paths have meaningfully different failure modes — a
+ *      half-streamed result can be salvaged with a best-effort parse;
+ *      an `invoke()` failure can't. Separate functions let each handle
+ *      its own error shape cleanly.
+ *   2. Callers should make an explicit choice about whether they want
+ *      streaming. Adding it as an opt-in flag on `executeChain` makes
+ *      it tempting to plumb `onChunk` from random surfaces; a separate
+ *      helper makes the call site say "yes, this needs streaming."
+ *
+ * No automatic fallback to non-streaming `executeChain` when streaming
+ * fails — by design. Callers that want fallback should `catch` this
+ * function and call `executeChain` themselves. Keeps the helper focused
+ * on the streaming path and the fallback policy explicit at the call
+ * site (different commands may want different fallback strategies).
+ */
+async function executeChainStreaming({ llm, prompt, variables, parser, onChunk, signal, provider, endpoint, logger, tokenizer, metadata, }) {
+    validateRequired(llm, 'llm', 'executeChainStreaming');
+    validateRequired(prompt, 'prompt', 'executeChainStreaming');
+    validateRequired(variables, 'variables', 'executeChainStreaming');
+    validateRequired(parser, 'parser', 'executeChainStreaming');
+    validateRequired(onChunk, 'onChunk', 'executeChainStreaming');
+    if (typeof variables !== 'object' || Array.isArray(variables)) {
+        throw new LangChainExecutionError('executeChainStreaming: Variables must be a non-array object', { variables, type: typeof variables, isArray: Array.isArray(variables) });
+    }
+    // Pre-flight abort check (#881 phase 3). Callers that ran the cancel
+    // path before reaching here shouldn't pay for prompt rendering or
+    // request setup. Match the contract `chain.stream(..., { signal })`
+    // would have honoured — throw `LangChainCancelledError` rather than
+    // a bare `AbortError`.
+    if (signal?.aborted) {
+        throw new LangChainCancelledError('executeChainStreaming: Aborted before stream opened', '');
+    }
+    const llmInfo = extractLlmInfo(llm);
+    const effectiveProvider = provider || llmInfo.provider;
+    const effectiveEndpoint = endpoint || llmInfo.endpoint;
+    let accumulated = '';
+    try {
+        const renderedPrompt = await prompt.format(variables);
+        const promptTokens = estimatePromptTokens(tokenizer, renderedPrompt);
+        const chain = prompt.pipe(llm);
+        const startedAt = Date.now();
+        // Forward the signal into LangChain's RunnableConfig. The HTTP
+        // transport (openai / anthropic / ollama clients) honours it and
+        // tears down the connection rather than waiting for the model to
+        // finish. The async iterator throws an AbortError that we
+        // classify below.
+        const stream = await chain.stream(variables, signal ? { signal } : undefined);
+        let chunkCount = 0;
+        let callbackFailureCount = 0;
+        // Audit finding #13: cap consecutive callback failures so a
+        // genuinely broken render handler can't tie up the LLM call
+        // silently for the user's entire wait. Five strikes (out of an
+        // expected ~50-500 chunks for a normal commit message) is enough
+        // to ride out a transient blip but small enough to bail before
+        // the user finishes waiting on a useless stream.
+        const MAX_CALLBACK_FAILURES = 5;
+        for await (const messageChunk of stream) {
+            const text = coerceChunkText(messageChunk);
+            if (!text)
+                continue;
+            accumulated += text;
+            chunkCount += 1;
+            try {
+                onChunk({ text, accumulated });
+                // Successful callback resets the consecutive-failure counter —
+                // we only bail on a STREAK of failures, not on isolated ones.
+                callbackFailureCount = 0;
+            }
+            catch (callbackError) {
+                // Deliberately swallow callback errors so a bad render handler
+                // can't tank the entire LLM call. Log at verbose so users with
+                // verbose mode on can still see what happened.
+                callbackFailureCount += 1;
+                logger?.verbose(`executeChainStreaming: onChunk handler threw (${callbackFailureCount}/${MAX_CALLBACK_FAILURES}): ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                if (callbackFailureCount >= MAX_CALLBACK_FAILURES) {
+                    logger?.verbose(`executeChainStreaming: bailing stream — ${MAX_CALLBACK_FAILURES} consecutive callback failures suggest a broken render handler.`, { color: 'red' });
+                    throw new LangChainExecutionError(`executeChainStreaming: render handler failed ${MAX_CALLBACK_FAILURES} times in a row; aborting stream so the failure surfaces to the caller.`, { accumulatedLength: accumulated.length, chunkCount });
+                }
+            }
+        }
+        if (!accumulated) {
+            throw new LangChainExecutionError('executeChainStreaming: Stream completed with no text chunks', { variables, promptInputVariables: prompt.inputVariables });
+        }
+        const result = (await parser.invoke(accumulated));
+        const elapsedMs = Date.now() - startedAt;
+        logLlmCall(logger, {
+            task: metadata?.task || 'chain-streaming',
+            provider: effectiveProvider,
+            parserType: parser.constructor.name,
+            variableKeys: Object.keys(variables),
+            promptTokens,
+            elapsedMs,
+            // Surfaced in observability so consumers can spot the streaming
+            // path in their logs without correlating across tools. `chunks`
+            // doubles as a sanity check (a streaming call that delivered 1
+            // chunk is functionally identical to a non-streaming one).
+            streamed: true,
+            streamChunks: chunkCount,
+            ...metadata,
+        });
+        if (result === null || result === undefined) {
+            throw new LangChainExecutionError('executeChainStreaming: Parser returned null or undefined from streamed text', {
+                variables,
+                promptInputVariables: prompt.inputVariables,
+                accumulatedLength: accumulated.length,
+            });
+        }
+        return result;
+    }
+    catch (error) {
+        // Cancellation classifier (#881 phase 3). Three signals: an
+        // explicitly aborted user signal (post-throw check) or a thrown
+        // `AbortError` from the standard DOM API. Either means "user
+        // wanted out," not "the call failed." Wrap the raw error so
+        // callers can pattern-match on `LangChainCancelledError` and
+        // carry the partial accumulated text in case the caller wants
+        // to salvage anything.
+        //
+        // Audit finding #8: an earlier implementation also fell back to
+        // `error.message.includes('aborted')` as a third signal. That
+        // substring heuristic is footgun-shaped — legitimate provider
+        // errors ("model not aborted properly", future API copy) would
+        // misclassify as user cancels. Dropped; rely on the structured
+        // signal (`signal.aborted`) and the standard error class
+        // (`name === 'AbortError'`).
+        const aborted = signal?.aborted ||
+            (error instanceof Error && error.name === 'AbortError');
+        if (aborted) {
+            throw new LangChainCancelledError(error instanceof Error ? error.message : 'Streaming aborted by user', accumulated, {
+                provider: effectiveProvider,
+                endpoint: effectiveEndpoint,
+            });
+        }
+        if (error instanceof LangChainExecutionError ||
+            error instanceof LangChainNetworkError ||
+            error instanceof LangChainCancelledError) {
+            throw error;
+        }
+        if (error instanceof Error && isNetworkError(error)) {
+            throw new LangChainNetworkError(error.message, effectiveEndpoint, effectiveProvider, {
+                originalError: error.name,
+                originalMessage: error.message,
+                stack: error.stack,
+                promptInputVariables: prompt.inputVariables,
+                variableKeys: Object.keys(variables),
+                parserType: parser.constructor.name,
+                streamed: true,
+            });
+        }
+        handleLangChainError(error, 'executeChainStreaming: Stream execution failed', {
+            promptInputVariables: prompt.inputVariables,
+            variableKeys: Object.keys(variables),
+            parserType: parser.constructor.name,
+            provider: effectiveProvider,
+            endpoint: effectiveEndpoint,
+            streamed: true,
+        });
+    }
+}
+
 const FORMAT_INSTRUCTIONS_TEMPLATE = (schemaDescription) => (`CRITICAL: You must return ONLY a valid JSON object with no additional text, explanations, or markdown formatting.
 
 REQUIRED JSON FORMAT:
@@ -20186,7 +20654,45 @@ IMPORTANT RULES:
  * are surfaced as `validationErrors`/`warnings` rather than driving an
  * interactive retry flow — the TUI can re-invoke or let the user edit.
  */
-async function generateCommitDraft({ git, argv, logger = new Logger({ silent: true }), }) {
+/**
+ * Fallback parser shared between the non-streaming
+ * `executeChainWithSchema` call and the streaming path (#881 phase 2).
+ *
+ * Extracted from the inline `fallbackParser` option so the streaming
+ * path can use the same lossy-but-permissive recovery for accumulated
+ * text. Strips markdown code fences, attempts strict JSON parse, and
+ * falls back to "first line is title, rest is body" when JSON parsing
+ * fails entirely.
+ *
+ * Returned shape always satisfies the schema's structural requirements
+ * (`title` + `body` strings) but the *content* may be the last-ditch
+ * "Auto-generated commit" placeholder. Callers should treat this as a
+ * best-effort salvage, not a parse confirmation.
+ */
+function salvageCommitMessageFromText(text) {
+    try {
+        let cleanText = text.trim();
+        const codeBlockMatch = cleanText.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
+        if (codeBlockMatch && codeBlockMatch[1]) {
+            cleanText = codeBlockMatch[1].trim();
+        }
+        const parsed = JSON.parse(cleanText);
+        if (parsed && typeof parsed === 'object' &&
+            typeof parsed.title === 'string' &&
+            typeof parsed.body === 'string' &&
+            parsed.title.length > 0) {
+            return parsed;
+        }
+    }
+    catch {
+        // fall through to line-split salvage
+    }
+    return {
+        title: text.split('\n')[0] || 'Auto-generated commit',
+        body: text.split('\n').slice(1).join('\n') || 'Generated commit message',
+    };
+}
+async function generateCommitDraft({ git, argv, logger = new Logger({ silent: true }), onStreamChunk, signal, }) {
     const config = loadConfig(argv);
     const key = getApiKeyForModel(config);
     const { provider } = getModelAndProviderFromConfig(config);
@@ -20329,42 +20835,137 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
             tokenizer,
             maxTokens: config.service.tokenLimit || 2048,
         });
-        const commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
-            logger,
-            tokenizer,
-            metadata: {
-                task: useConventional ? 'commit-message-conventional' : 'commit-message',
-                command: 'commit-draft',
-                provider,
-                model: String(model),
-            },
-            retryOptions: {
-                maxAttempts: maxParsingAttempts,
-            },
-            fallbackParser: (text) => {
-                try {
-                    let cleanText = text.trim();
-                    const codeBlockMatch = cleanText.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
-                    if (codeBlockMatch && codeBlockMatch[1]) {
-                        cleanText = codeBlockMatch[1].trim();
-                    }
-                    const parsed = JSON.parse(cleanText);
-                    if (parsed && typeof parsed === 'object' &&
-                        typeof parsed.title === 'string' &&
-                        typeof parsed.body === 'string' &&
-                        parsed.title.length > 0) {
-                        return parsed;
+        // Streaming path (#881 phase 2). Active when the caller supplied
+        // an `onStreamChunk` AND the config opted in. Only the FIRST
+        // attempt streams; the commitlint-retry attempt (attempt === 2)
+        // and the existing executeChainWithSchema retry loop run
+        // non-streaming so we keep the schema-validated retry as the
+        // backstop when the streamed text can't be salvaged.
+        const streamingEnabled = Boolean(onStreamChunk && config.service.streaming?.enabled);
+        const shouldStreamThisAttempt = streamingEnabled && attempt === 1;
+        let commitMsg;
+        if (shouldStreamThisAttempt && onStreamChunk) {
+            // The streaming chain bypasses the schema parser during the
+            // stream itself (no streaming-aware JSON parser today) and
+            // delivers the raw accumulated text to a no-op `parser.invoke`.
+            // We then salvage the structured result via the same lossy
+            // recovery the non-streaming fallbackParser uses. If the
+            // salvager produces a plausible draft, we use it. Otherwise we
+            // fall through to executeChainWithSchema below for a real
+            // schema-validated retry — paying for a second LLM call only
+            // on the edge case where the streamed output is unsalvageable.
+            const streamingParser = createSchemaParser(schema, llm);
+            // Capture the final accumulated text out-of-band so we can
+            // attempt salvage if the parser throws on completion (audit
+            // finding #1). Updated on every chunk; the last value is
+            // whatever the stream produced before the parser ran. Empty
+            // string when streaming throws before any chunks arrived.
+            let streamedAccumulated = '';
+            let salvaged;
+            try {
+                // `executeChainStreaming` runs the parser on the accumulated
+                // text at completion. StructuredOutputParser will throw when
+                // the model produced unparseable JSON — we catch that below
+                // and salvage manually. The happy-path zod-validated object
+                // becomes our commitMsg.
+                commitMsg = await executeChainStreaming({
+                    llm,
+                    prompt,
+                    variables: budgetedPrompt.variables,
+                    parser: streamingParser,
+                    onChunk: ({ text, accumulated }) => {
+                        streamedAccumulated = accumulated;
+                        onStreamChunk(text, accumulated);
+                    },
+                    signal,
+                    logger,
+                    tokenizer,
+                    metadata: {
+                        task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                        command: 'commit-draft',
+                        provider,
+                        model: String(model),
+                    },
+                });
+            }
+            catch (streamErr) {
+                // User-initiated cancel (#881 phase 3). Bail out of the
+                // entire attempt loop and let the caller distinguish
+                // "cancelled" from "failed" in the status line. We do NOT
+                // fall through to the non-streaming retry on cancel — the
+                // user explicitly asked to stop, kicking off a fresh
+                // unstreamable LLM call would defy that intent.
+                if (streamErr instanceof LangChainCancelledError) {
+                    return {
+                        ok: false,
+                        draft: streamErr.accumulated || '',
+                        warnings,
+                        validationErrors: [],
+                        cancelled: true,
+                    };
+                }
+                // Audit finding #1: try the lossy salvager on the accumulated
+                // text before paying for a second LLM call. The salvager
+                // strips code fences, attempts strict JSON parse, and falls
+                // back to "first line is title, rest is body." We only accept
+                // its output when it produced a real title — the placeholder
+                // title ("Auto-generated commit") means the salvager
+                // couldn't extract anything meaningful and the non-streaming
+                // retry is the better choice.
+                if (streamedAccumulated) {
+                    const candidate = salvageCommitMessageFromText(streamedAccumulated);
+                    if (candidate.title && candidate.title !== 'Auto-generated commit') {
+                        salvaged = candidate;
+                        logger.verbose(`Streaming parser failed but salvager recovered a draft from ${streamedAccumulated.length} accumulated chars; skipping non-streaming retry.`, { color: 'green' });
                     }
                 }
-                catch {
-                    // fall through
+                if (!salvaged) {
+                    logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
                 }
-                return {
-                    title: text.split('\n')[0] || 'Auto-generated commit',
-                    body: text.split('\n').slice(1).join('\n') || 'Generated commit message',
-                };
-            },
-        });
+            }
+            // Type-narrow: commitMsg is set inside try{}, but TS doesn't
+            // see that across the catch. Re-init through the salvage path
+            // if streaming threw.
+            if (salvaged) {
+                commitMsg = salvaged;
+            }
+            else if (!(commitMsg)) {
+                // Streaming threw AND the salvager couldn't recover anything
+                // useful; fall back to the standard non-streaming flow.
+                // Documented trade-off from the issue: streaming gives us a
+                // preview but the validated result still comes from the
+                // schema-aware retry path when both streaming AND salvage
+                // fail.
+                commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
+                    logger,
+                    tokenizer,
+                    metadata: {
+                        task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                        command: 'commit-draft',
+                        provider,
+                        model: String(model),
+                    },
+                    retryOptions: { maxAttempts: maxParsingAttempts },
+                    fallbackParser: salvageCommitMessageFromText,
+                });
+            }
+        }
+        else {
+            commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
+                logger,
+                tokenizer,
+                metadata: {
+                    task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                    command: 'commit-draft',
+                    provider,
+                    model: String(model),
+                },
+                retryOptions: {
+                    maxAttempts: maxParsingAttempts,
+                },
+                fallbackParser: salvageCommitMessageFromText,
+            });
+        }
         const ticketId = extractTicketIdFromBranchName(branchName);
         const fullMessage = formatCommitMessage(commitMsg, {
             append: argv.append,
@@ -20462,8 +21063,26 @@ async function runCommitDraftWorkflow(input = {}) {
     const argv = createCommitWorkflowArgv('commit');
     const logger = new Logger({ silent: true });
     try {
-        const result = await generateCommitDraft({ git, argv, logger });
+        const result = await generateCommitDraft({
+            git,
+            argv,
+            logger,
+            onStreamChunk: input.onStreamChunk,
+            signal: input.signal,
+        });
         const draft = result.draft.trim();
+        // Cancel path (#881 phase 3). Reported separately from success
+        // / failure so the runtime can render a neutral "cancelled"
+        // status line instead of an error.
+        if (result.cancelled) {
+            return {
+                ok: false,
+                message: 'AI draft cancelled.',
+                details: [],
+                draft: '',
+                cancelled: true,
+            };
+        }
         if (result.ok && draft) {
             return {
                 ok: true,
@@ -20552,6 +21171,7 @@ async function runCommitSplitPlanWorkflow(input = {}) {
             ok: true,
             plan: result.plan,
             planContext: result.context,
+            fallback: result.fallback,
         };
     }
     catch (error) {
@@ -20596,6 +21216,7 @@ async function runCommitSplitApplyWorkflow(input) {
             git,
             logger,
             noVerify: input.noVerify || false,
+            fallback: input.fallback,
         });
         return {
             ok: true,
@@ -20606,6 +21227,7 @@ async function runCommitSplitApplyWorkflow(input) {
             // I/O AND inaccurate when partial-apply landed fewer commits
             // than the plan had groups.
             commitHashes: applied.commitHashes,
+            fallback: applied.fallback,
         };
     }
     catch (error) {
@@ -22750,10 +23372,17 @@ function withPoppedView(state) {
  * in a clean slate — the mental equivalent of a fresh `coco ui`
  * launched against the submodule's working dir.
  *
- * Carry-over preferences (sidebar tab, branch / tag sort, palette
- * recents, inspector tab, diff view mode) are intentionally left
- * untouched. They're user-level choices that should persist across
- * frames, the same way they persist across view pushes today.
+ * Sidebar tab + branch / tag sort are also captured into the return
+ * snapshot (#995) so popping back restores the parent's choices
+ * instead of letting the submodule's tab/sort bleed across the
+ * boundary. The values on the *new* frame are left as-is (carried
+ * over from the parent) — the load effect in app.ts re-reads
+ * persistence keyed on the submodule's workdir and dispatches a
+ * restore if the user has a submodule-specific saved preference.
+ *
+ * Other preferences (palette recents, inspector tab, diff view mode)
+ * stay global by design — the user's preference shouldn't reset when
+ * they cross a submodule boundary.
  *
  * Live runtime objects (`SimpleGit`, loaded `LogInkContext`) live
  * outside the reducer in `app.ts`'s parallel ref structure — this
@@ -22770,6 +23399,10 @@ function withPushedRepoFrame(state, payload) {
             selectedFileIndex: state.selectedFileIndex,
             selectedSubmoduleIndex: state.selectedSubmoduleIndex,
             filter: state.filter,
+            sidebarTab: state.sidebarTab,
+            userSidebarTab: state.userSidebarTab,
+            branchSort: state.branchSort,
+            tagSort: state.tagSort,
         },
     };
     return {
@@ -22822,6 +23455,15 @@ function withPoppedRepoFrame(state) {
         filter: ret.filter,
         filterMode: false,
         pendingCommitFocused: false,
+        // #995 — restore sidebar tab + sort preferences from the captured
+        // parentReturn. Without this, the submodule's tab / sort choice
+        // bleeds back into the parent after pop: the user picks 'tags' in
+        // a vendored submodule, pops back to the parent, and finds the
+        // parent's previously-selected 'branches' tab quietly replaced.
+        sidebarTab: ret.sidebarTab,
+        userSidebarTab: ret.userSidebarTab,
+        branchSort: ret.branchSort,
+        tagSort: ret.tagSort,
         pendingKey: undefined,
         pendingConfirmationId: undefined,
         pendingConfirmationPayload: undefined,
@@ -23597,6 +24239,17 @@ function applyLogInkAction(state, action) {
                 statusLoading: !action.value ? undefined : (action.loading ? true : undefined),
                 pendingKey: undefined,
             };
+        case 'setPendingPullRequestBodyDraft':
+            // PR-body draft tracker (#881 phase 4). Set true while
+            // `startCreatePullRequest` is awaiting the changelog-based
+            // body generation; gates the Esc cancel binding in the input
+            // handler so pressing Esc during the wait skips opening the
+            // follow-up prompt instead of falling through to global Esc.
+            return {
+                ...state,
+                pendingPullRequestBodyDraft: action.value || undefined,
+                pendingKey: undefined,
+            };
         case 'setWorkflowAction':
             return {
                 ...state,
@@ -23725,10 +24378,14 @@ function applyLogInkAction(state, action) {
             // Cache the result so re-entry (or `c` to PR) reuses it instead of
             // re-running the LLM. Keyed by branch so a checkout naturally
             // produces a fresh generation.
+            // Audit finding #9: `generatedAt` arrives on the action payload
+            // instead of being read from `Date.now()` here, so the reducer
+            // stays pure. Dispatchers (currently `runChangelogView` in
+            // app.ts) call `Date.now()` at dispatch time.
             const cached = {
                 text: action.text,
                 baseLabel: action.baseLabel,
-                generatedAt: Date.now(),
+                generatedAt: action.generatedAt,
             };
             return {
                 ...state,
@@ -23782,7 +24439,8 @@ function applyLogInkAction(state, action) {
                         // Updated-at timestamp reflects the edit. Not the original
                         // generation time — `r` (regenerate) is the explicit knob
                         // for "I want fresh LLM output, not my edits".
-                        generatedAt: Date.now(),
+                        // Audit finding #9: timestamp arrives on the action.
+                        generatedAt: action.generatedAt,
                     },
                 },
                 pendingKey: undefined,
@@ -23818,7 +24476,9 @@ function applyLogInkAction(state, action) {
             }
             return {
                 ...state,
-                recentCommitHashes: { hashes: action.hashes, markedAt: Date.now() },
+                // Audit finding #9: timestamp arrives on the action payload
+                // instead of being read from `Date.now()` here.
+                recentCommitHashes: { hashes: action.hashes, markedAt: action.markedAt },
                 pendingKey: undefined,
             };
         case 'clearRecentCommits':
@@ -23840,6 +24500,7 @@ function applyLogInkAction(state, action) {
                     plan: action.plan,
                     planContext: action.planContext,
                     scrollOffset: 0,
+                    fallback: action.fallback,
                 },
                 pendingKey: undefined,
             };
@@ -24616,6 +25277,65 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         }
         return [];
     }
+    // Cancel in-flight AI commit draft (#881 phase 3). When the compose
+    // state has a draft in flight (loading === true), Esc aborts the
+    // LLM call and the runtime handler cleans up (clear loading, clear
+    // preview, status line shows "AI draft cancelled.").
+    //
+    // Audit finding #5: the `activeView === 'compose'` gate from the
+    // original phase 3 implementation made the cancel keystroke
+    // unreachable after the user chord-navigated away from compose
+    // mid-stream (Esc would fall through to popView etc., consuming
+    // the navigation intent while the LLM call silently ran to
+    // completion). Cancel should work wherever the user is — they
+    // can always navigate back to compose afterwards.
+    //
+    // Sits above the editing / view handlers so the cancel keystroke
+    // can't fall through to "leave compose" or anything else. Loading
+    // and editing are mutually exclusive in practice (the user can't
+    // type while the AI is generating), but the order here makes the
+    // precedence explicit if that ever changes.
+    if (state.commitCompose.loading && key.escape) {
+        return [{ type: 'cancelAiCommitDraft' }];
+    }
+    // Cancel in-flight PR body draft (#881 phase 4). The `C` keystroke
+    // kicks off a changelog-based draft that runs for 5-15 seconds
+    // before the input prompt opens. While the draft is pending, Esc
+    // tells the runtime to skip the prompt and surface a "cancelled"
+    // status. Unlike the compose cancel above, this is a *soft* cancel
+    // — the background LLM call still completes, but its result is
+    // discarded. Acceptable trade-off for now; deeper signal threading
+    // through `changelogHandler` lands in a follow-up if real cancel
+    // becomes a request.
+    //
+    // Sits unconditionally on the global Esc check (no `activeView`
+    // gate) because the draft can be initiated from any view via the
+    // palette `C` binding; Esc must work wherever the user is when
+    // they decide to bail.
+    if (state.pendingPullRequestBodyDraft && key.escape) {
+        return [{ type: 'cancelPullRequestBodyDraft' }];
+    }
+    // Pending AI draft confirmation (audit finding #7). When the AI
+    // draft completes against a non-empty compose surface, it lands in
+    // `pendingAiDraft` instead of overwriting the user's typing. `R`
+    // accepts the swap (user's typing is lost, AI draft becomes the
+    // new content). `Esc` dismisses the AI draft (typing is preserved,
+    // AI draft is lost — the user paid for the tokens but explicitly
+    // chose not to use them).
+    //
+    // Gated on `activeView === 'compose'` because the pending draft is
+    // only meaningful on the compose surface (where the message line
+    // surfaces the prompt). A user who chord-navigated away while the
+    // draft was pending should see the original `R` / Esc semantics of
+    // wherever they are now.
+    if (state.activeView === 'compose' && state.commitCompose.pendingAiDraft) {
+        if (inputValue === 'R' && !key.ctrl && !key.meta) {
+            return [action({ type: 'commitCompose', action: { type: 'acceptPendingAiDraft' } })];
+        }
+        if (key.escape) {
+            return [action({ type: 'commitCompose', action: { type: 'dismissPendingAiDraft' } })];
+        }
+    }
     if (state.commitCompose.editing) {
         if (key.escape) {
             return [action({ type: 'commitCompose', action: { type: 'setEditing', value: false } })];
@@ -26632,17 +27352,24 @@ function formatRemainingWorktreeHint(unstaged, untracked) {
  *
  * When the worktree is clean post-apply:
  *   "Created N commits — press gh to view them in history. Worktree is clean."
+ *
+ * When `fallback` is set, the planner exhausted its retry budget and
+ * the apply landed the single-group fallback plan instead of a real
+ * multi-group split. Prefix the message so the user knows the result
+ * isn't a true LLM split — they may want to re-roll with a different
+ * model, or accept the combined commit as-is.
  */
-function formatSplitApplySuccess(commitCount, unstaged, untracked) {
+function formatSplitApplySuccess(commitCount, unstaged, untracked, fallback) {
     const created = commitCount === 1
         ? 'Created 1 commit'
         : `Created ${commitCount} commits`;
     const navCue = `${created} — press gh to view them in history.`;
     const remainingHint = formatRemainingWorktreeHint(unstaged, untracked);
-    if (!remainingHint) {
-        return `${navCue} Worktree is clean.`;
+    const tail = remainingHint ? ` ${remainingHint}` : ' Worktree is clean.';
+    if (fallback) {
+        return `Split planner fallback applied (combined commit) — ${fallback.reason}. ${navCue}${tail}`;
     }
-    return `${navCue} ${remainingHint}`;
+    return `${navCue}${tail}`;
 }
 
 /**
@@ -30540,6 +31267,97 @@ function renderChangelogSurface(h, components, state, _context, _contextStatus,
     }, h(Box, { justifyContent: 'space-between' }, h(Text, { bold: true }, panelTitle(headerLeft, focused)), h(Text, { dimColor: true }, headerRight)), ...lines);
 }
 
+/**
+ * Streaming-preview helper (#881 phase 2). Turns the raw accumulated
+ * text from an in-flight LLM stream into the last N visual lines that
+ * fit a given panel width, plus a flag telling the renderer whether
+ * earlier content was elided.
+ *
+ * Why a chrome helper instead of inlining the math in the compose
+ * surface: the same shape is going to be reused by PR-body and review
+ * streaming once those surfaces opt in. The visual line math (wrap to
+ * width, count from the bottom, mark truncation) doesn't belong on the
+ * surface itself.
+ *
+ * No JSX / no Ink here — chrome modules stay framework-agnostic and
+ * return data the surface can hand to its own `h(Text, ...)` calls.
+ */
+/**
+ * Default last-N visible visual lines. Tuned for compose where the
+ * panel already shows summary + body + loading line, so the preview
+ * can't take more vertical space without pushing the state-line off
+ * the bottom of short terminals. 6 lines is roughly two short
+ * commit-body paragraphs — enough to feel like content is flowing,
+ * not so much that the user loses sight of the surrounding chrome.
+ */
+const DEFAULT_STREAMING_PREVIEW_LINES = 6;
+/**
+ * Marker prefixed to the first visible line when earlier content was
+ * elided. Chrome theme picks ASCII vs Unicode at render time; this
+ * module returns both so surfaces don't need to import the theme.
+ */
+const STREAMING_PREVIEW_TRUNCATE_GLYPH = '…';
+const STREAMING_PREVIEW_TRUNCATE_ASCII = '...';
+/**
+ * Compute the visible preview window for a streaming buffer.
+ *
+ * The buffer is split on newlines (preserving blank lines so paragraph
+ * spacing stays visible), each source line is hard-wrapped to `width`,
+ * and the trailing `maxLines` wrapped lines are returned. When the
+ * total wrapped line count exceeds `maxLines`, `truncated` is true so
+ * the renderer can prefix the first line with an ellipsis marker.
+ *
+ * Whitespace-only / empty input returns `{ lines: [], truncated: false }`
+ * so renderers can branch on `lines.length === 0` to skip rendering
+ * entirely during the brief window between dispatching `setLoading`
+ * and the first chunk arriving.
+ *
+ * Width math mirrors the compose surface's body wrap (`width - 6` for
+ * border + paddingX + 2-space indent budget); callers pass the width
+ * they intend to use and this helper assumes it's the wrap budget,
+ * not the panel width.
+ */
+function formatStreamingPreview(accumulated, width, maxLines = DEFAULT_STREAMING_PREVIEW_LINES) {
+    if (!accumulated) {
+        return { lines: [], truncated: false };
+    }
+    const trimmed = accumulated.replace(/\s+$/u, '');
+    if (!trimmed) {
+        return { lines: [], truncated: false };
+    }
+    // Wrap each source line. Empty source lines must survive the wrap so
+    // a stream like "A\n\nB" reads as two paragraphs separated by a blank
+    // row rather than collapsing into "A B".
+    const wrapWidth = Math.max(8, width);
+    const wrapped = [];
+    for (const line of trimmed.split('\n')) {
+        if (line === '') {
+            wrapped.push('');
+            continue;
+        }
+        for (const segment of wrapCells(line, wrapWidth)) {
+            wrapped.push(segment);
+        }
+    }
+    const budget = Math.max(1, maxLines);
+    if (wrapped.length <= budget) {
+        return { lines: wrapped, truncated: false };
+    }
+    return {
+        lines: wrapped.slice(wrapped.length - budget),
+        truncated: true,
+    };
+}
+/**
+ * Resolve the truncation marker for the current theme. Pure helper so
+ * the surface can render a single-character glyph in colour terminals
+ * and the ASCII fallback when `theme.ascii` is on. Centralised here so
+ * future surfaces opting into streaming use the same glyph.
+ */
+function streamingPreviewTruncateMarker(ascii) {
+    return ascii ? STREAMING_PREVIEW_TRUNCATE_ASCII : STREAMING_PREVIEW_TRUNCATE_GLYPH;
+}
+
 /**
  * Compose surface — the in-TUI commit-message composer. Combines a
  * summary line, a body field, and a state-line footer; an inline
@@ -30549,6 +31367,33 @@ function renderChangelogSurface(h, components, state, _context, _contextStatus,
  * Extracted from `src/commands/log/inkRuntime.ts` as part of phase 5a.2
  * of #890. No behavior change.
  */
+/**
+ * Render the streaming-preview block — the trailing lines of the
+ * in-flight LLM stream that sit below the loading spinner. Pure
+ * formatting; the wrap math + truncation flag live in the
+ * `streamingPreview` chrome helper so other surfaces (PR body,
+ * review) can reuse them later.
+ *
+ * Returns an empty array when no preview text is present (the loader
+ * just shows the spinner) so the caller's spread doesn't insert blank
+ * rows that would shift the state-line.
+ */
+function renderStreamingPreviewLines(h, components, preview, width, theme) {
+    const { Text } = components;
+    const view = formatStreamingPreview(preview, width);
+    if (view.lines.length === 0)
+        return [];
+    const marker = view.truncated ? streamingPreviewTruncateMarker(theme.ascii) : '';
+    return view.lines.map((line, index) => {
+        // Prefix the first line with the truncation marker when earlier
+        // content was elided. Subsequent lines render unprefixed.
+        const prefix = index === 0 && marker ? `${marker} ` : '  ';
+        return h(Text, {
+            key: `compose-stream-${index}`,
+            dimColor: true,
+        }, `${prefix}${line}`);
+    });
+}
 function renderComposeSurface(h, components, state, context, contextStatus, bodyRows, width, theme, spinnerFrame = 0) {
     const { Box, Text } = components;
     const compose = state.commitCompose;
@@ -30572,9 +31417,16 @@ function renderComposeSurface(h, components, state, context, contextStatus, body
         : ['<empty>'];
     const summaryVisualLines = wrapCells(`${compose.summary || '<empty>'}${summaryCursor}`, Math.max(8, width - 11) // "Summary  " (9) + 2 chrome = 11
     );
+    // State-line cycles through three modes (#881 phase 3 added the
+    // loading variant): editing copy when the user is typing, cancel
+    // hint when an AI draft is generating, default guidance otherwise.
+    // The cancel hint also covers the streaming preview window — same
+    // keystroke (Esc) aborts whether or not the preview is visible.
     const stateLine = compose.editing
         ? 'Editing — Enter switches summary↔body, Esc exits edit mode.'
-        : 'Press e to edit, c to commit, I for AI draft, esc to leave.';
+        : compose.loading
+            ? 'Generating AI draft — press Esc to cancel.'
+            : 'Press e to edit, c to commit, I for AI draft, esc to leave.';
     const hasStagedFiles = (worktree?.files || [])
         .some((file) => file.indexStatus !== ' ' && file.indexStatus !== '?');
     // Staged file list is rendered in the right Worktree panel
@@ -30621,6 +31473,13 @@ function renderComposeSurface(h, components, state, context, contextStatus, body
             }, theme.ascii
                 ? `[${pickSpinnerFrame(spinnerFrame).replace(/[^a-zA-Z0-9 ]/g, '.')}] Generating AI commit draft (this can take a moment)`
                 : `${pickSpinnerFrame(spinnerFrame)}  Generating AI commit draft… (this can take a moment)`),
+            // Streaming preview (#881 phase 2). Renders the trailing visual
+            // lines of the in-flight LLM stream below the loader so the user
+            // sees content building up instead of an opaque spinner. Empty
+            // before the first chunk arrives; the preview helper returns an
+            // empty `lines` array in that window so we skip the block
+            // entirely.
+            ...renderStreamingPreviewLines(h, components, compose.streamingPreview, bodyTextWidth, theme),
         ]
         : []), ...(compose.message ? [h(Text, undefined, ''), h(Text, { key: 'compose-msg' }, truncateCells(compose.message, 140))] : []), ...(compose.details || []).map((line, index) => h(Text, {
         key: `compose-detail-${index}`,
@@ -35494,9 +36353,18 @@ function LogInkApp(deps) {
     // Wrappers that delegate to the active frame's runtime entry so the
     // existing call sites stay byte-identical. Support both function-
     // updater and value-updater forms (the codebase uses both).
-    const setContext = React.useCallback((arg) => {
+    //
+    // `targetDepth` (#994) routes the write to a specific frame instead
+    // of the currently-active one. Loaders that capture the depth at
+    // issue-time and pass it here are robust against frame-stack
+    // mutations (push / pop) that happen while the load is in flight —
+    // the write lands on the frame that issued it, or silently drops
+    // if that frame has been popped (`updateRepoFrameRuntime` no-ops on
+    // out-of-range indices). Without the tag, an in-flight refresh on
+    // the parent would clobber a freshly-pushed submodule frame.
+    const setContext = React.useCallback((arg, targetDepth) => {
         setRuntimes((prev) => {
-            const depth = prev.length - 1;
+            const depth = targetDepth ?? prev.length - 1;
             if (depth < 0)
                 return prev;
             return updateRepoFrameRuntime(prev, depth, (frame) => ({
@@ -35507,9 +36375,9 @@ function LogInkApp(deps) {
             }));
         });
     }, []);
-    const setContextStatus = React.useCallback((arg) => {
+    const setContextStatus = React.useCallback((arg, targetDepth) => {
         setRuntimes((prev) => {
-            const depth = prev.length - 1;
+            const depth = targetDepth ?? prev.length - 1;
             if (depth < 0)
                 return prev;
             return updateRepoFrameRuntime(prev, depth, (frame) => ({
@@ -35526,6 +36394,14 @@ function LogInkApp(deps) {
     // workdirs for submodule paths recorded in `.gitmodules` (which
     // are repo-relative). Undefined during the brief moment between
     // git swap and the revparse callback resolving.
+    //
+    // Audit finding #10: rapid frame push/pop races are prevented by
+    // the per-effect `cancelled` flag — React fires the cleanup
+    // synchronously BEFORE running the next effect body, so any
+    // pending revparse from the old `git` sees `cancelled === true`
+    // and skips its write. The `git` reference itself is captured by
+    // closure, so each effect run resolves against the right binding.
+    // No additional depth tagging is needed.
     const [activeRepoRoot, setActiveRepoRoot] = React.useState(undefined);
     React.useEffect(() => {
         let cancelled = false;
@@ -35835,28 +36711,39 @@ function LogInkApp(deps) {
         // (stale-while-revalidate) and quietly swap it in once the new fetch
         // resolves — avoids the every-second flicker the watcher would
         // otherwise produce on busy repos.
+        //
+        // #994 — capture the depth this refresh was issued from BEFORE
+        // the await. The callback closure also captured `git` from the
+        // same render, so they're consistent: when the user drills into
+        // a submodule mid-await, the resolved data still lands on the
+        // parent frame (the one whose `git` was used for the fetch),
+        // not on the freshly-pushed submodule frame.
+        const issuedAtDepth = runtimes.length - 1;
         if (!options.silent) {
             dispatch({ type: 'setStatus', value: 'refreshing repository context' });
-            setContextStatus(createLogInkContextStatus('loading'));
+            setContextStatus(createLogInkContextStatus('loading'), issuedAtDepth);
         }
         const next = await loadLogInkContext(git);
-        setContext(next);
-        setContextStatus(createLogInkContextStatus('ready'));
+        setContext(next, issuedAtDepth);
+        setContextStatus(createLogInkContextStatus('ready'), issuedAtDepth);
         if (!options.silent) {
             dispatch({ type: 'setStatus', value: 'repository context refreshed' });
         }
-    }, [dispatch, git]);
+    }, [dispatch, git, runtimes.length, setContext, setContextStatus]);
     const refreshWorktreeContext = React.useCallback(async (options = {}) => {
+        // #994 — same frame-tagging as refreshContext above. Worktree
+        // loads are usually fast but still race-prone on slow disks.
+        const issuedAtDepth = runtimes.length - 1;
         if (!options.silent) {
-            setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'loading'));
+            setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'loading'), issuedAtDepth);
         }
         const worktree = await safe(getWorktreeOverview(git));
         setContext((current) => ({
             ...current,
             worktree,
-        }));
-        setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'ready'));
-    }, [git]);
+        }), issuedAtDepth);
+        setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'ready'), issuedAtDepth);
+    }, [git, runtimes.length, setContext, setContextStatus]);
     // Live refresh: watch .git metadata + the working tree root and reload
     // context when something changes outside the TUI (editor save, external
     // git commands, branch switch in another terminal). Best-effort — the
@@ -35945,18 +36832,50 @@ function LogInkApp(deps) {
         })();
         return () => { cancelled = true; };
     }, [git, dispatch]);
+    // Audit finding #2: re-resolve the repo root inline on every save
+    // and key the deps off `git` + the saved value. The original
+    // implementation read from `repoRootRef.current`, which is async-
+    // populated by the resolver effect above and can lag behind a git
+    // swap. After #995's synchronous pop-restore, the parent's freshly
+    // restored sidebar tab was being written into the submodule's
+    // cache because the ref still held the submodule root during the
+    // brief window before the resolver settled.
+    //
+    // The extra `revparse` cost per save is negligible (saves fire
+    // once per user-initiated tab change, not per render) and the
+    // cancellation flag prevents a stale resolution from racing a
+    // newer one in flight.
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveSidebarTab(repoRoot, state.userSidebarTab);
-    }, [state.userSidebarTab]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveSidebarTab(root, state.userSidebarTab);
+            }
+            catch {
+                // Not in a worktree, or revparse failed — silently skip.
+                // The next save attempt will retry.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.userSidebarTab, git]);
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveDiffViewMode(repoRoot, state.diffViewMode);
-    }, [state.diffViewMode]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveDiffViewMode(root, state.diffViewMode);
+            }
+            catch {
+                // Same as above.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.diffViewMode, git]);
     // P-stash-explorer: load `git stash show -p <ref>` once the diff view
     // becomes active with diffSource='stash'. Best-effort — empty stashes
     // or read errors fall through to a "no diff" hint at the render site.
@@ -36081,6 +37000,11 @@ function LogInkApp(deps) {
     const contextStatusRef = React.useRef(contextStatus);
     contextStatusRef.current = contextStatus;
     React.useEffect(() => {
+        // #994 — capture the depth this boot load is being issued for.
+        // The git instance in the closure is bound to this frame; tagged
+        // writes ensure resolved values land on the correct runtime entry
+        // even if a subsequent push/pop changes the active frame mid-load.
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         loadLogInkContextEntries(git).forEach(({ key, load }) => {
             if (contextStatusRef.current[key] === 'ready')
@@ -36092,14 +37016,14 @@ function LogInkApp(deps) {
                 setContext((current) => ({
                     ...current,
                     [key]: value,
-                }));
-                setContextStatus((current) => updateLogInkContextStatus(current, key, 'ready'));
+                }), issuedAtDepth);
+                setContextStatus((current) => updateLogInkContextStatus(current, key, 'ready'), issuedAtDepth);
             });
         });
         return () => {
             active = false;
         };
-    }, [git]);
+    }, [git, runtimes.length, setContext, setContextStatus]);
     // Lazy-load the full pullRequest overview (#808). Only fires when
     // the user actually navigates to the PR view, and only when we
     // don't already have data (so a workflow-triggered refresh that
@@ -36113,21 +37037,22 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequest)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'loading'), issuedAtDepth);
         void safe(getPullRequestOverview(git)).then((value) => {
             if (!active)
                 return;
             setContext((current) => ({
                 ...current,
                 pullRequest: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.pullRequest]);
+    }, [git, runtimes.length, state.activeView, context.pullRequest, setContext, setContextStatus]);
     // Lazy-load the issue triage list (#882 phase 3, filter-aware
     // since phase 6). Fires on entry to the view AND on filter
     // preset changes (`f` cycles the preset; the dep on
@@ -36139,8 +37064,9 @@ function LogInkApp(deps) {
             return;
         if (context.issueList)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'loading'), issuedAtDepth);
         const filter = issueFilterForPreset(state.selectedIssueFilter);
         void safe(getIssueList(git, filter)).then((value) => {
             if (!active)
@@ -36148,13 +37074,21 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 issueList: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.issueList, state.selectedIssueFilter]);
+    }, [
+        git,
+        runtimes.length,
+        state.activeView,
+        context.issueList,
+        state.selectedIssueFilter,
+        setContext,
+        setContextStatus,
+    ]);
     // Filter cycling: when the preset changes, drop the cached list
     // so the effect above re-fires with the new filter. Done as a
     // separate effect (rather than folded into the cycle reducer)
@@ -36178,8 +37112,9 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequestList)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'loading'), issuedAtDepth);
         const filter = pullRequestFilterForPreset(state.selectedPullRequestFilter);
         void safe(getPullRequestList(git, filter)).then((value) => {
             if (!active)
@@ -36187,13 +37122,21 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 pullRequestList: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.pullRequestList, state.selectedPullRequestFilter]);
+    }, [
+        git,
+        runtimes.length,
+        state.activeView,
+        context.pullRequestList,
+        state.selectedPullRequestFilter,
+        setContext,
+        setContextStatus,
+    ]);
     React.useEffect(() => {
         if (state.activeView !== 'pull-request-triage')
             return;
@@ -36223,6 +37166,7 @@ function LogInkApp(deps) {
             return;
         if (context.issueDetailByNumber?.has(cursored.number))
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         const timer = setTimeout(async () => {
             const result = await getIssueDetail(cursored.number);
@@ -36231,17 +37175,19 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 issueDetailByNumber: new Map(current.issueDetailByNumber || []).set(result.detail.number, result.detail),
-            }));
+            }), issuedAtDepth);
         }, DETAIL_HYDRATION_DELAY_MS);
         return () => {
             active = false;
             clearTimeout(timer);
         };
     }, [
+        runtimes.length,
         state.activeView,
         state.selectedIssueIndex,
         filteredIssueList,
         context.issueDetailByNumber,
+        setContext,
     ]);
     React.useEffect(() => {
         if (state.activeView !== 'pull-request-triage')
@@ -36251,6 +37197,7 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequestDetailByNumber?.has(cursored.number))
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         const timer = setTimeout(async () => {
             const result = await getPullRequestDetail(cursored.number);
@@ -36259,17 +37206,19 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 pullRequestDetailByNumber: new Map(current.pullRequestDetailByNumber || []).set(result.detail.number, result.detail),
-            }));
+            }), issuedAtDepth);
         }, DETAIL_HYDRATION_DELAY_MS);
         return () => {
             active = false;
             clearTimeout(timer);
         };
     }, [
+        runtimes.length,
         state.activeView,
         state.selectedPullRequestTriageIndex,
         filteredPullRequestTriageList,
         context.pullRequestDetailByNumber,
+        setContext,
     ]);
     React.useEffect(() => {
         let active = true;
@@ -36530,21 +37479,124 @@ function LogInkApp(deps) {
         state.commitCompose.body,
         state.commitCompose.summary,
     ]);
+    // AbortController for the in-flight AI draft (#881 phase 3). Kept in
+    // a ref rather than state because cancel is a side-effect: the input
+    // handler reads `controllerRef.current?.abort()` synchronously when
+    // Esc fires during a loading draft. Storing it in state would force
+    // a re-render on every set, and React doesn't need to know — only
+    // the imperative cancel path does. Cleared after each call settles
+    // so a stale controller can't cancel a future draft.
+    const aiDraftAbortRef = React.useRef(null);
     const runAiCommitDraft = React.useCallback(async () => {
+        // Tear down any controller from a previous draft (defensive — a
+        // settled call should have cleared it in the finally block, but
+        // double-running would otherwise leave the first orphaned).
+        aiDraftAbortRef.current?.abort();
+        const controller = new AbortController();
+        aiDraftAbortRef.current = controller;
         dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: true } });
         dispatch({ type: 'setStatus', value: 'generating AI commit draft', loading: true });
-        const result = await runCommitDraftWorkflow();
-        if (result.ok && result.draft) {
-            dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: result.draft } });
-            dispatch({ type: 'setStatus', value: 'AI draft ready for editing' });
-            return;
+        // Streaming preview (#881 phase 2). The workflow forwards this to
+        // `generateCommitDraft`, which only actually streams when the
+        // user opted in via `service.streaming.enabled`. The callback
+        // updates `commitCompose.streamingPreview` so the compose surface
+        // renders a live last-N-lines preview below the loader. The
+        // reducer clears `streamingPreview` whenever loading flips off
+        // (success or failure), so we don't need an explicit teardown
+        // dispatch here.
+        try {
+            const result = await runCommitDraftWorkflow({
+                git,
+                signal: controller.signal,
+                onStreamChunk: (_text, accumulated) => {
+                    // Audit finding #4: skip dispatching into a torn-down
+                    // tree. If the user quit (or otherwise unmounted the
+                    // workstation) mid-stream, React warns about updates on
+                    // an unmounted component. Drop the chunk silently.
+                    if (!mountedRef.current)
+                        return;
+                    // Dispatch the full accumulated text — the preview chrome
+                    // helper does the last-N-lines slicing at render time, so
+                    // re-doing the slice here would be wasted work. Per-chunk
+                    // dispatches are cheap; React batches them and Ink redraws
+                    // at its own frame cadence.
+                    dispatch({
+                        type: 'commitCompose',
+                        action: { type: 'setStreamingPreview', value: accumulated },
+                    });
+                },
+            });
+            // Audit finding #4 (unmount race): bail out before any
+            // post-await dispatch if the user quit while the LLM call was
+            // in flight. Same pattern as `refreshHistoryRows` upstream.
+            if (!mountedRef.current)
+                return;
+            // Cancel path (#881 phase 3). User pressed Esc during the
+            // stream; reducer drops loading + preview, status line shows
+            // a neutral "cancelled" message. Skip the result / failure
+            // dispatches because the user already knows what happened.
+            if (result.cancelled) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({ type: 'setStatus', value: 'AI draft cancelled.' });
+                return;
+            }
+            if (result.ok && result.draft) {
+                dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: result.draft } });
+                dispatch({ type: 'setStatus', value: 'AI draft ready for editing' });
+                return;
+            }
+            dispatch({
+                type: 'commitCompose',
+                action: { type: 'setResult', message: result.message, details: result.details },
+            });
+            dispatch({ type: 'setStatus', value: result.message });
         }
-        dispatch({
-            type: 'commitCompose',
-            action: { type: 'setResult', message: result.message, details: result.details },
-        });
-        dispatch({ type: 'setStatus', value: result.message });
-    }, [dispatch]);
+        catch (error) {
+            // Audit finding #3: defensive recovery for unexpected throws
+            // from the workflow. The workflow catches its own errors
+            // today, so this catch is latent — but any future refactor
+            // that lets an error escape would otherwise strand the
+            // spinner permanently with no user-facing recovery short of
+            // quitting. Surface a generic failure and clear the loading
+            // state so the user can re-try.
+            if (mountedRef.current) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({
+                    type: 'setStatus',
+                    value: `AI draft failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`,
+                    kind: 'error',
+                });
+            }
+        }
+        finally {
+            // Clear the ref only if it still points at OUR controller — a
+            // rapid second invocation could have already replaced it, in
+            // which case the new controller is the one that owns cancel
+            // duty now.
+            if (aiDraftAbortRef.current === controller) {
+                aiDraftAbortRef.current = null;
+            }
+        }
+    }, [dispatch, git]);
+    /**
+     * Cancel an in-flight AI draft (#881 phase 3). Called by the input
+     * handler when the user presses Esc while `commitCompose.loading`
+     * is true. Idempotent — calling without an active controller is a
+     * no-op rather than an error so the keystroke handler can fire
+     * unconditionally during the loading window.
+     *
+     * `controller.abort()` propagates through
+     * `executeChainStreaming`, which throws `LangChainCancelledError`,
+     * which becomes `cancelled: true` on the workflow result. The
+     * runAiCommitDraft promise's finally block clears the ref. The
+     * resulting cleanup dispatches (clearing loading + status) happen
+     * back in `runAiCommitDraft`, not here, so this function stays
+     * pure-imperative and the React state updates flow through a
+     * single code path.
+     */
+    const cancelAiCommitDraft = React.useCallback(() => {
+        aiDraftAbortRef.current?.abort();
+    }, []);
     // `C` keystroke handler — start the create-pull-request flow. Resolves
     // the head + base branches from the live context, runs
     // `coco changelog --branch <base>` (via `runPullRequestBodyWorkflow`)
@@ -36558,6 +37610,19 @@ function LogInkApp(deps) {
     // missing) we surface the failure on the status line and skip the
     // prompt entirely — better than opening a prompt the user can't
     // actually submit successfully.
+    // Soft-cancel handle for the PR body draft (#881 phase 4). A mutable
+    // ref rather than state because the cancel decision needs to be
+    // visible synchronously inside the async workflow without forcing
+    // re-renders. Owned by the in-flight invocation: the cancel callback
+    // mutates `.cancelled` on the live ref; the workflow checks it after
+    // `await` resolves and decides whether to open the follow-up prompt.
+    //
+    // The LLM call itself keeps running (no AbortSignal threaded through
+    // `changelogHandler` today). The user-visible outcome — "PR draft
+    // cancelled, no prompt opens" — is identical to a hard cancel, at
+    // the cost of paying for the in-flight tokens. Deeper threading
+    // lands in a follow-up if hard cancel becomes a request.
+    const pullRequestBodyCancelRef = React.useRef(null);
     const startCreatePullRequest = React.useCallback(async () => {
         const head = context.branches?.currentBranch || context.provider?.currentBranch;
         if (!head) {
@@ -36586,32 +37651,78 @@ function LogInkApp(deps) {
             });
             return;
         }
+        // Set up the cancel handle BEFORE flipping the pending flag so a
+        // race between the flag-set and a synchronous Esc keystroke can't
+        // leave the input handler dispatching cancel without a ref to
+        // mutate. The cancel callback no-ops cleanly when the ref is null
+        // (call already settled).
+        const cancelHandle = { cancelled: false };
+        pullRequestBodyCancelRef.current = cancelHandle;
+        dispatch({ type: 'setPendingPullRequestBodyDraft', value: true });
+        // Audit finding #6: soft cancel today — Esc skips opening the
+        // follow-up prompt, but the LLM call itself keeps running to
+        // completion (no AbortSignal threaded through the changelog CLI
+        // chain). Status copy reflects that honestly so the user isn't
+        // misled into thinking they're saving tokens.
         dispatch({
             type: 'setStatus',
-            value: `generating PR body from changelog (vs ${defaultBranch})…`,
+            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to skip prompt`,
             loading: true,
         });
-        const body = await runPullRequestBodyWorkflow({ baseBranch: defaultBranch });
-        // Fallback shape when the changelog generation fails — open the
-        // prompt with empty title + body rather than aborting, so the user
-        // can still author the PR manually. The status line surfaces why
-        // we couldn't pre-fill.
-        const initialTitle = body.title || head.replace(/^(feat|fix|chore|docs|refactor|test)\//, '').replace(/[-_]/g, ' ');
-        const initialBody = body.body || '';
-        const initial = initialBody ? `${initialTitle}\n\n${initialBody}` : initialTitle;
-        if (!body.ok) {
-            dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.` });
+        try {
+            const body = await runPullRequestBodyWorkflow({ baseBranch: defaultBranch });
+            // Soft-cancel check (#881 phase 4). If the user pressed Esc
+            // while the workflow was awaiting, skip opening the prompt and
+            // surface a neutral status. The underlying LLM call has
+            // already settled — its result is discarded. Hard cancel
+            // (aborting the HTTP request mid-flight) is a follow-up.
+            if (cancelHandle.cancelled) {
+                dispatch({ type: 'setStatus', value: 'PR draft cancelled.' });
+                return;
+            }
+            // Fallback shape when the changelog generation fails — open the
+            // prompt with empty title + body rather than aborting, so the user
+            // can still author the PR manually. The status line surfaces why
+            // we couldn't pre-fill.
+            const initialTitle = body.title || head.replace(/^(feat|fix|chore|docs|refactor|test)\//, '').replace(/[-_]/g, ' ');
+            const initialBody = body.body || '';
+            const initial = initialBody ? `${initialTitle}\n\n${initialBody}` : initialTitle;
+            if (!body.ok) {
+                dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.` });
+            }
+            else {
+                dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
+            }
+            // Audit finding #11: clear the pending flag BEFORE opening the
+            // prompt. If a future refactor adds an `await` between the flag
+            // clear (currently in `finally`) and the `openInputPrompt`
+            // dispatch, an Esc keystroke in the gap would dispatch
+            // `cancelPullRequestBodyDraft` AFTER the prompt opens, leaving
+            // the prompt visible with a stale "cancelled" message. Clearing
+            // here moves the flag teardown into the same React batch as the
+            // prompt open, eliminating the race.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
+            dispatch({
+                type: 'openInputPrompt',
+                kind: 'create-pr',
+                label: `Create PR: ${head} → ${defaultBranch}  (line 1 title · rest body · Enter newline · Ctrl+D submit)`,
+                initial,
+                multiline: true,
+            });
         }
-        else {
-            dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
+        finally {
+            // Belt-and-suspenders: the `try` block clears the flag on the
+            // success path (audit finding #11). This duplicate clear handles
+            // the error / cancel paths where the early-returns skip the
+            // success-path dispatch. Safe to no-op when already false.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
+            // Only clear the ref if we still own it — a second invocation
+            // would have already taken ownership in which case the cancel
+            // duty has rolled over.
+            if (pullRequestBodyCancelRef.current === cancelHandle) {
+                pullRequestBodyCancelRef.current = null;
+            }
         }
-        dispatch({
-            type: 'openInputPrompt',
-            kind: 'create-pr',
-            label: `Create PR: ${head} → ${defaultBranch}  (line 1 title · rest body · Enter newline · Ctrl+D submit)`,
-            initial,
-            multiline: true,
-        });
     }, [
         context.branches?.currentBranch,
         context.provider?.currentBranch,
@@ -36620,6 +37731,24 @@ function LogInkApp(deps) {
         context.pullRequest?.currentPullRequest,
         dispatch,
     ]);
+    /**
+     * Soft-cancel the in-flight PR body draft (#881 phase 4). The
+     * cancel ref's `.cancelled` flag is checked after the workflow's
+     * await resolves; setting it true causes the workflow to skip the
+     * prompt-open and surface a neutral "cancelled" status. The LLM
+     * call itself isn't aborted (no signal threaded through the
+     * `changelogHandler` chain) so the user still pays for the in-flight
+     * tokens. Acceptable for a 5-15s draft; hard cancel lands in a
+     * follow-up if it becomes a real ask.
+     *
+     * Idempotent — calling without an active draft is a no-op.
+     */
+    const cancelPullRequestBodyDraft = React.useCallback(() => {
+        const handle = pullRequestBodyCancelRef.current;
+        if (!handle)
+            return;
+        handle.cancelled = true;
+    }, []);
     // Copy an arbitrary string to the system clipboard. Distinct from
     // `yankFromActiveView` which derives the value from the current view
     // — this one takes the value as an explicit event payload, used by
@@ -36690,6 +37819,11 @@ function LogInkApp(deps) {
                 branch: head,
                 baseLabel: cached.baseLabel,
                 text: cached.text,
+                // Audit finding #9: cache-hit path preserves the original
+                // generation timestamp rather than minting a fresh one — the
+                // "X ago" header should reflect when the LLM ran, not when
+                // the cached entry was re-displayed.
+                generatedAt: cached.generatedAt,
             });
             dispatch({
                 type: 'setStatus',
@@ -36718,6 +37852,9 @@ function LogInkApp(deps) {
             branch: head,
             baseLabel,
             text: result.text,
+            // Audit finding #9: timestamp captured at dispatch time, not
+            // inside the reducer.
+            generatedAt: Date.now(),
         });
         dispatch({
             type: 'setStatus',
@@ -36820,7 +37957,7 @@ function LogInkApp(deps) {
         if (editorOk) {
             try {
                 const content = readFileSync$1(file, 'utf8');
-                dispatch({ type: 'setChangelogText', text: content });
+                dispatch({ type: 'setChangelogText', text: content, generatedAt: Date.now() });
                 dispatch({ type: 'setStatus', value: 'Changelog updated from editor.' });
             }
             catch (error) {
@@ -37045,11 +38182,18 @@ function LogInkApp(deps) {
             type: 'setSplitPlanReady',
             plan: result.plan,
             planContext: result.planContext,
+            fallback: result.fallback,
         });
+        const readyMessage = result.fallback
+            ? `Split planner exhausted retries — showing single-commit fallback. y/Enter to apply as one commit, r to re-roll, Esc to cancel.`
+            : `Split plan ready: ${result.plan.groups.length} commit(s). y/Enter to apply, Esc to cancel.`;
+        // Use 'info' kind for the fallback path (still actionable, just
+        // not a clean win). The reducer's "warning" is the absence of
+        // `success` framing — the message text itself carries the cue.
         dispatch({
             type: 'setStatus',
-            value: `Split plan ready: ${result.plan.groups.length} commit(s). y/Enter to apply, Esc to cancel.`,
-            kind: 'success',
+            value: readyMessage,
+            kind: result.fallback ? 'info' : 'success',
         });
     }, [context.operation, context.worktree?.stagedCount, dispatch, git]);
     // `y`/Enter inside the overlay — apply the previewed plan. Uses the
@@ -37091,6 +38235,7 @@ function LogInkApp(deps) {
             plan: splitPlan.plan,
             planContext: splitPlan.planContext,
             git,
+            fallback: splitPlan.fallback,
         });
         dump.push(`workflow returned: ok=${result.ok} message="${result.message}" commitHashes=[${(result.commitHashes || []).join(', ')}]`);
         try {
@@ -37167,7 +38312,8 @@ function LogInkApp(deps) {
         // that could disagree with reality on partial-apply.
         const commitHashes = result.commitHashes || [];
         if (commitHashes.length > 0) {
-            dispatch({ type: 'markRecentCommits', hashes: commitHashes });
+            // Audit finding #9: timestamp captured at dispatch time.
+            dispatch({ type: 'markRecentCommits', hashes: commitHashes, markedAt: Date.now() });
             // DevSkim: ignore DS172411 — function literal, fixed delay,
             // no caller-supplied data flowing through.
             setTimeout(() => dispatch({ type: 'clearRecentCommits' }), 5000);
@@ -37185,8 +38331,15 @@ function LogInkApp(deps) {
             });
             return;
         }
-        const successMessage = formatSplitApplySuccess(commitHashes.length, unstaged, untracked);
-        dispatch({ type: 'setStatus', value: successMessage, kind: 'success' });
+        const successMessage = formatSplitApplySuccess(commitHashes.length, unstaged, untracked, result.fallback ? { reason: result.fallback.reason } : undefined);
+        // Fallback path uses 'info' kind — apply technically succeeded
+        // but the user should know it landed as a single combined commit
+        // rather than a real LLM-driven multi-group split.
+        dispatch({
+            type: 'setStatus',
+            value: successMessage,
+            kind: result.fallback ? 'info' : 'success',
+        });
     }, [dispatch, git, refreshContext, refreshHistoryRows, refreshWorktreeContext, state.splitPlan]);
     // Esc inside the overlay — close without applying. Status line gets
     // a confirmation so the user knows the operation was abandoned.
@@ -38646,9 +39799,15 @@ function LogInkApp(deps) {
             else if (event.type === 'runAiCommitDraft') {
                 void runAiCommitDraft();
             }
+            else if (event.type === 'cancelAiCommitDraft') {
+                cancelAiCommitDraft();
+            }
             else if (event.type === 'startCreatePullRequest') {
                 void startCreatePullRequest();
             }
+            else if (event.type === 'cancelPullRequestBodyDraft') {
+                cancelPullRequestBodyDraft();
+            }
             else if (event.type === 'startChangelogView') {
                 void startChangelogView();
             }