git-coco 0.54.0 → 0.55.0

package/dist/index.js

@@ -78,7 +78,7 @@ var readline__namespace = /*#__PURE__*/_interopNamespaceDefault(readline);
 /**
  * Current build version from package.json
  */
-const BUILD_VERSION = "0.54.0";
+const BUILD_VERSION = "0.55.0";
 
 const isInteractive = (config) => {
     return config?.mode === 'interactive' || !!config?.interactive;
@@ -18368,7 +18368,15 @@ const FIELD_SEPARATOR$3 = '\x1f';
 const LOG_FORMAT = `%x1f%h%x1f%H%x1f%P%x1f%ad%x1f%an%x1f%d%x1f%s`;
 const DETAIL_FORMAT = `%H%x1f%h%x1f%P%x1f%ad%x1f%an%x1f%d%x1f%s%x1f%b`;
 const LOG_DEFAULT_LIMIT = 30;
-const LOG_INTERACTIVE_DEFAULT_LIMIT = 300;
+// Bumped from 300 → 1000 in 0.54.2. With the full-graph default
+// (#1034) the workstation surfaces many more refs (all branches, all
+// tags, plus stash commits added via `extraRefs`), and on active repos
+// the 300-commit cap was cutting off year+-old stash bases and old
+// tag commits — making the cursor-syncs-history effect report "tip
+// not in loaded window" instead of moving the graph cursor. 1000
+// fits a year of activity for most repos, git log is still sub-200ms,
+// and Ink virtualises scroll so render cost stays flat.
+const LOG_INTERACTIVE_DEFAULT_LIMIT = 1000;
 function toArray(value) {
     if (!value) {
         return [];
@@ -18548,12 +18556,77 @@ function buildLogArgs(argv, options = {}) {
     else if (argv.branch) {
         args.push(argv.branch);
     }
+    // Extra refs (stash commits etc.) — append after the --all / branch
+    // selector but BEFORE the path separator. Git treats them as
+    // additional graph roots, so the traversal includes them alongside
+    // whatever --all / --branch already covers.
+    if (options.extraRefs && options.extraRefs.length > 0) {
+        args.push(...options.extraRefs);
+    }
     const paths = toArray(argv.path);
     if (paths.length > 0) {
         args.push('--', ...paths);
     }
     return args;
 }
+/**
+ * Default size of a targeted-context window. Sized to comfortably
+ * cover a year of activity on most repos so the cursor-sync's
+ * "jump to commit anchored on a ref I just selected" can succeed
+ * without paginating through the whole history.
+ */
+const COMMIT_CONTEXT_DEFAULT_LIMIT = 5000;
+/**
+ * Load a window of commits anchored on a specific hash. Used by the
+ * cursor-sync effect when the user selects a ref (branch / tag /
+ * stash) whose target commit isn't in the loaded graph window.
+ *
+ * Critical detail: this walks **only from the target** (and its
+ * ancestors), NOT from `--all`. Why: when you combine `--all` with
+ * `<targetHash>` AND `--max-count=N`, git unions the walks, sorts
+ * the result by date, and slices the newest N rows. If the target
+ * is older than the Nth newest commit across all refs (very common
+ * for year-old tags / branches on active repos), it falls off the
+ * slice even though it was passed as a root. Walking from the
+ * target alone guarantees the target IS the first row of the
+ * output and its ancestors fill the rest.
+ *
+ * The caller merges the result via the `appendRows` reducer action
+ * which deduplicates by hash, so the target's ancestry slots into
+ * the existing `--all` graph cleanly. The user's loaded view ends
+ * up as the union of: the original `--all` window + target's
+ * ancestry — exactly what's needed for the cursor to land.
+ *
+ * Capped at `options.limit` (default 5000) to keep one targeted
+ * fetch bounded. For most refs, even a 100-commit limit would be
+ * enough to surface the target; we go higher to also pull in the
+ * surrounding context so the user can scroll around the landed
+ * cursor.
+ */
+async function getLogRowsAnchoredOn(git, argv, targetHash, options = {}) {
+    // Strip every "walk many refs" toggle so buildLogArgs produces a
+    // clean `git log <flags> <targetHash>` — exactly the walk that
+    // guarantees the target's inclusion.
+    const merged = {
+        ...argv,
+        all: false,
+        view: 'compact', // suppresses 'full' → '--all' mapping
+        branch: undefined,
+        path: undefined,
+    };
+    // Also drop --first-parent / --no-merges so the target's ancestry
+    // renders with full topology (matters for stash commits which are
+    // merges by construction).
+    const baseArgs = buildLogArgs(merged, {
+        limit: options.limit ?? COMMIT_CONTEXT_DEFAULT_LIMIT,
+    }).filter((arg) => arg !== '--first-parent' && arg !== '--no-merges');
+    // Splice the target as the positional ref. `buildLogArgs` already
+    // appended any `--all`/`--branch`/`<extraRefs>` it considered;
+    // since we cleared all those above, the only positional ref we
+    // add is the target.
+    baseArgs.push(targetHash);
+    return parseLogOutput(await git.raw(baseArgs));
+}
 /**
  * Build merged `LogArgv` for the interactive TUI's `g` graph toggle.
  *
@@ -18661,6 +18734,178 @@ async function getCommitFilePreview(git, commit, file, limit = 40) {
     };
 }
 
+function parseStashSubject(subject) {
+    const match = subject.match(/^(?:WIP on|On) ([^:]+):\s*(.*)$/);
+    if (!match) {
+        return {
+            branch: '<unknown>',
+            message: subject,
+        };
+    }
+    return {
+        branch: match[1],
+        message: match[2] || subject,
+    };
+}
+function parseStashList(output) {
+    return output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => {
+        const [ref, hash, parents, date, subject] = line.split('\x1f');
+        const parsedSubject = parseStashSubject(subject || '');
+        // `%P` returns space-separated parent hashes. Stash commits are
+        // merges with 2-3 parents; the FIRST is the base (HEAD at stash
+        // time). Empty parents string (legacy / corrupted entries) maps
+        // to an empty baseHash; the cursor-sync caller treats that as
+        // "no base available, fall back to stash hash."
+        const baseHash = parents ? (parents.split(' ')[0] || '') : '';
+        return {
+            ref,
+            hash,
+            baseHash,
+            date,
+            branch: parsedSubject.branch,
+            message: parsedSubject.message,
+        };
+    });
+}
+function parseStashFiles(output) {
+    return output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+/**
+ * Resolve the commit hashes for every stash, in `stash@{N}` order.
+ *
+ * Used by the workstation's history loader to include older stashes
+ * as graph roots — `git log --all` only walks `refs/stash` (the
+ * latest stash) by default, so stash@{1+} commits live off-graph
+ * unless explicitly referenced. Passing this list as positional refs
+ * to `git log` makes every stash appear as a graph node, which lets
+ * the cursor-syncs-history effect actually land on them when the
+ * user navigates the stashes sidebar.
+ *
+ * Cheap: one `git stash list` call, no per-stash fan-out. Returns
+ * an empty array when there are no stashes — callers can pass the
+ * result through unconditionally.
+ */
+async function getStashCommitHashes(git) {
+    const raw = await git.raw(['stash', 'list', '--format=%H']).catch(() => '');
+    return raw
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+async function getStashOverview(git) {
+    // Format fields (separated by 0x1f / unit separator):
+    //   %gd  — stash reflog selector (stash@{N})
+    //   %H   — stash commit hash
+    //   %P   — space-separated parent hashes (first = base, see StashEntry.baseHash)
+    //   %ci  — committer date, ISO format
+    //   %gs  — reflog subject ("WIP on main: <subject>")
+    const stashes = parseStashList(await git.raw(['stash', 'list', '--date=iso', '--format=%gd%x1f%H%x1f%P%x1f%ci%x1f%gs']));
+    return {
+        stashes: await Promise.all(stashes.map(async (stash) => ({
+            ...stash,
+            files: parseStashFiles(await git.raw(['stash', 'show', '--name-only', stash.ref])),
+        }))),
+    };
+}
+/**
+ * Full unified-patch diff for a stash. Used by the diff surface when
+ * `state.diffSource === 'stash'` to render the stash's changes inline.
+ *
+ * Empty stashes (e.g. created by `git stash --keep-index` against an
+ * already-clean tree) return [] rather than throwing — surfaces fall
+ * back to a "no diff to display" message.
+ */
+async function getStashDiff(git, stashRef) {
+    return (await git.raw(['stash', 'show', '-p', stashRef]))
+        .split('\n')
+        .map((line) => line.replace(/\r$/, ''));
+}
+/**
+ * Slice a unified-patch into per-file sections. Each entry records the
+ * file path and the offset of its `diff --git` header within `lines`.
+ * Used by the stash explorer to build a per-file cursor + cherry-pick
+ * the file at the cursor.
+ *
+ * Renames / moves return the destination path (the `b/` side); the
+ * action surface treats that as the path to materialize from the stash.
+ *
+ * Path quoting: git wraps paths containing spaces or special characters
+ * in double-quotes (`diff --git "a/path with spaces" "b/path with spaces"`).
+ * The parser handles both the unquoted and quoted forms; without that,
+ * stash-file navigation and cherry-pick silently broke for any file
+ * whose path contained a space.
+ */
+function parseStashDiffFiles(lines) {
+    const files = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        const parsed = parseDiffGitHeader(line);
+        if (parsed) {
+            files.push({ path: parsed.bPath || parsed.aPath, startLine: i });
+        }
+    }
+    return files;
+}
+/**
+ * Resolve which stash file *contains* a given line offset — the user's
+ * cursor scrolls through a concatenated multi-file patch, and this is
+ * what powers the "File N/M: <path>" panel header, the inline header
+ * highlighting (#791 follow-up), and the cherry-pick / open-in-editor
+ * dispatchers' "what file is the cursor on" lookup.
+ *
+ * Returns `undefined` when the file list is empty *or* the offset
+ * lands before the very first file's `diff --git` header (e.g. when
+ * `--stat` summary lines lead the patch). Callers fall through to a
+ * "no file selected" state in that case.
+ */
+function findStashFileForOffset(files, offset) {
+    if (files.length === 0)
+        return undefined;
+    let current;
+    for (const file of files) {
+        if (file.startLine <= offset) {
+            current = file;
+        }
+        else {
+            break;
+        }
+    }
+    // First file is the canonical fallback — even if the offset lands
+    // before its header (rare), we want the cursor to be "in" something
+    // so the user's actions have a target.
+    return current ?? files[0];
+}
+const DIFF_GIT_HEADER = /^diff --git (?:"a\/((?:\\.|[^"\\])+)"|a\/(\S+)) (?:"b\/((?:\\.|[^"\\])+)"|b\/(\S+))$/;
+function parseDiffGitHeader(line) {
+    const match = line.match(DIFF_GIT_HEADER);
+    if (!match)
+        return undefined;
+    const aPath = unescapeGitQuoted(match[1]) || match[2];
+    const bPath = unescapeGitQuoted(match[3]) || match[4];
+    if (!aPath || !bPath)
+        return undefined;
+    return { aPath, bPath };
+}
+function unescapeGitQuoted(value) {
+    if (value === undefined)
+        return undefined;
+    // Git's diff header quoting escapes `"`, `\`, and the usual
+    // C-style sequences. Reverse the most common ones so callers get the
+    // raw on-disk path.
+    return value
+        .replace(/\\\\/g, '\\')
+        .replace(/\\"/g, '"')
+        .replace(/\\t/g, '\t')
+        .replace(/\\n/g, '\n');
+}
+
 const FIELD_SEPARATOR$2 = '\x1f';
 function parseBranchRefs(output) {
     return output
@@ -18853,143 +19098,6 @@ async function getPullRequestOverview(git, runner = defaultGhRunner) {
     }
 }
 
-function parseStashSubject(subject) {
-    const match = subject.match(/^(?:WIP on|On) ([^:]+):\s*(.*)$/);
-    if (!match) {
-        return {
-            branch: '<unknown>',
-            message: subject,
-        };
-    }
-    return {
-        branch: match[1],
-        message: match[2] || subject,
-    };
-}
-function parseStashList(output) {
-    return output
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .map((line) => {
-        const [ref, hash, date, subject] = line.split('\x1f');
-        const parsedSubject = parseStashSubject(subject || '');
-        return {
-            ref,
-            hash,
-            date,
-            branch: parsedSubject.branch,
-            message: parsedSubject.message,
-        };
-    });
-}
-function parseStashFiles(output) {
-    return output
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean);
-}
-async function getStashOverview(git) {
-    const stashes = parseStashList(await git.raw(['stash', 'list', '--date=iso', '--format=%gd%x1f%H%x1f%ci%x1f%gs']));
-    return {
-        stashes: await Promise.all(stashes.map(async (stash) => ({
-            ...stash,
-            files: parseStashFiles(await git.raw(['stash', 'show', '--name-only', stash.ref])),
-        }))),
-    };
-}
-/**
- * Full unified-patch diff for a stash. Used by the diff surface when
- * `state.diffSource === 'stash'` to render the stash's changes inline.
- *
- * Empty stashes (e.g. created by `git stash --keep-index` against an
- * already-clean tree) return [] rather than throwing — surfaces fall
- * back to a "no diff to display" message.
- */
-async function getStashDiff(git, stashRef) {
-    return (await git.raw(['stash', 'show', '-p', stashRef]))
-        .split('\n')
-        .map((line) => line.replace(/\r$/, ''));
-}
-/**
- * Slice a unified-patch into per-file sections. Each entry records the
- * file path and the offset of its `diff --git` header within `lines`.
- * Used by the stash explorer to build a per-file cursor + cherry-pick
- * the file at the cursor.
- *
- * Renames / moves return the destination path (the `b/` side); the
- * action surface treats that as the path to materialize from the stash.
- *
- * Path quoting: git wraps paths containing spaces or special characters
- * in double-quotes (`diff --git "a/path with spaces" "b/path with spaces"`).
- * The parser handles both the unquoted and quoted forms; without that,
- * stash-file navigation and cherry-pick silently broke for any file
- * whose path contained a space.
- */
-function parseStashDiffFiles(lines) {
-    const files = [];
-    for (let i = 0; i < lines.length; i += 1) {
-        const line = lines[i];
-        const parsed = parseDiffGitHeader(line);
-        if (parsed) {
-            files.push({ path: parsed.bPath || parsed.aPath, startLine: i });
-        }
-    }
-    return files;
-}
-/**
- * Resolve which stash file *contains* a given line offset — the user's
- * cursor scrolls through a concatenated multi-file patch, and this is
- * what powers the "File N/M: <path>" panel header, the inline header
- * highlighting (#791 follow-up), and the cherry-pick / open-in-editor
- * dispatchers' "what file is the cursor on" lookup.
- *
- * Returns `undefined` when the file list is empty *or* the offset
- * lands before the very first file's `diff --git` header (e.g. when
- * `--stat` summary lines lead the patch). Callers fall through to a
- * "no file selected" state in that case.
- */
-function findStashFileForOffset(files, offset) {
-    if (files.length === 0)
-        return undefined;
-    let current;
-    for (const file of files) {
-        if (file.startLine <= offset) {
-            current = file;
-        }
-        else {
-            break;
-        }
-    }
-    // First file is the canonical fallback — even if the offset lands
-    // before its header (rare), we want the cursor to be "in" something
-    // so the user's actions have a target.
-    return current ?? files[0];
-}
-const DIFF_GIT_HEADER = /^diff --git (?:"a\/((?:\\.|[^"\\])+)"|a\/(\S+)) (?:"b\/((?:\\.|[^"\\])+)"|b\/(\S+))$/;
-function parseDiffGitHeader(line) {
-    const match = line.match(DIFF_GIT_HEADER);
-    if (!match)
-        return undefined;
-    const aPath = unescapeGitQuoted(match[1]) || match[2];
-    const bPath = unescapeGitQuoted(match[3]) || match[4];
-    if (!aPath || !bPath)
-        return undefined;
-    return { aPath, bPath };
-}
-function unescapeGitQuoted(value) {
-    if (value === undefined)
-        return undefined;
-    // Git's diff header quoting escapes `"`, `\`, and the usual
-    // C-style sequences. Reverse the most common ones so callers get the
-    // raw on-disk path.
-    return value
-        .replace(/\\\\/g, '\\')
-        .replace(/\\"/g, '"')
-        .replace(/\\t/g, '\t')
-        .replace(/\\n/g, '\n');
-}
-
 function fileState(indexStatus, worktreeStatus) {
     if (indexStatus === '?' && worktreeStatus === '?') {
         return 'untracked';
@@ -19056,7 +19164,18 @@ function parseTagRefs(output) {
         .map((line) => line.trimEnd())
         .filter(Boolean)
         .map((line) => {
-        const [name, hash, date, subject] = line.split(FIELD_SEPARATOR$1);
+        const [name, objectHash, derefedHash, date, subject] = line.split(FIELD_SEPARATOR$1);
+        // For annotated tags `%(objectname:short)` returns the TAG
+        // OBJECT's SHA, not the commit it points to — that's the SHA
+        // sitting in `refs/tags/<name>`'s blob. `%(*objectname:short)`
+        // dereferences the tag and yields the commit's SHA, but is
+        // EMPTY for lightweight tags (which are already direct
+        // pointers to commits). Prefer the dereferenced form when
+        // present, fall back to the object SHA otherwise. This is what
+        // lets cursor-sync find the tagged commit in the loaded log
+        // window — anchoring on the tag object's own SHA would never
+        // match a commit row.
+        const hash = derefedHash || objectHash;
         return {
             name,
             hash,
@@ -19068,7 +19187,7 @@ function parseTagRefs(output) {
 async function getTagOverview(git) {
     const output = await git.raw([
         'for-each-ref',
-        `--format=%(refname:short)${FIELD_SEPARATOR$1}%(objectname:short)${FIELD_SEPARATOR$1}%(creatordate:short)${FIELD_SEPARATOR$1}%(subject)`,
+        `--format=%(refname:short)${FIELD_SEPARATOR$1}%(objectname:short)${FIELD_SEPARATOR$1}%(*objectname:short)${FIELD_SEPARATOR$1}%(creatordate:short)${FIELD_SEPARATOR$1}%(subject)`,
         '--sort=-creatordate',
         'refs/tags',
     ]);
@@ -19950,6 +20069,92 @@ async function startInteractiveLog(git, rows, streams = {}) {
     output.write(`${renderInteractiveLog(state, await loadSelectedDetail(), branches, pullRequest, tags, undefined, worktree, {}, { appLabel }, { stashes, worktreeList }, {}, operationOverview, providerOverview)}\n`, 'utf8');
 }
 
+/**
+ * Shared hash-matching helpers for cross-command lookups.
+ *
+ * Git surfaces the same commit with different short-hash lengths
+ * depending on which command produced the row:
+ *
+ *   - `for-each-ref --format=%(objectname:short)` (branches, tags,
+ *     stashes) honors `core.abbrev`, typically 7 chars.
+ *   - `git log --pretty=format:%h` (history rows) honors the same
+ *     setting BUT git auto-extends abbreviations to keep them unique
+ *     within the walked set — so the same commit can come back as 7
+ *     chars from one command and 8 (or more) from another.
+ *
+ * Consequence: any exact-equality lookup that compares a hash from
+ * `for-each-ref` against a hash from `git log` will miss the match
+ * even when both refer to the same commit. This bit the workstation's
+ * cursor-sync effect twice during 0.54.2 — once in the resolver, once
+ * in the `selectCommitByHash` reducer — and shows up wherever a ref
+ * hash is checked against the loaded log window.
+ *
+ * The fix is bidirectional prefix matching: a hash matches another if
+ * one is a prefix of the other. Below a 4-char floor we refuse to
+ * match — three chars would collide with too many real commits.
+ *
+ * This module is the canonical place for that logic. Import it
+ * anywhere you compare a "hash from one git formatter" against a
+ * "hash from a different git formatter."
+ *
+ * Lives in `src/git/` because both `workstation/` and `commands/log/`
+ * depend on it — `commands/log/` must not depend on `workstation/`,
+ * so this can't live in `workstation/runtime/cursorSyncResolver.ts`.
+ */
+/**
+ * Minimum length below which we refuse to prefix-match. Three chars
+ * is too small to be a meaningful unique prefix for any real-world
+ * git history.
+ */
+const MIN_PREFIX_LENGTH = 4;
+/**
+ * True when `a` and `b` refer to the same commit, tolerating
+ * short-hash length differences from different git formatters.
+ *
+ * Symmetric: `hashesMatch(a, b) === hashesMatch(b, a)`. An exact
+ * string equality wins immediately (the common path); otherwise we
+ * test bidirectional `startsWith` and bail when either input is too
+ * short to be a meaningful prefix.
+ */
+function hashesMatch(a, b) {
+    if (!a || !b)
+        return false;
+    if (a === b)
+        return true;
+    if (a.length < MIN_PREFIX_LENGTH || b.length < MIN_PREFIX_LENGTH)
+        return false;
+    return a.startsWith(b) || b.startsWith(a);
+}
+/**
+ * True when `hash` matches any entry in `candidates`. Convenience
+ * wrapper for the common "is this ref's hash in any of the row's
+ * hash variants?" check.
+ */
+function hashesMatchAny(hash, candidates) {
+    if (!hash)
+        return false;
+    return candidates.some((candidate) => hashesMatch(hash, candidate));
+}
+/**
+ * True when `hash` is present in the loaded set — exact match first
+ * (the O(1) fast path), then bidirectional `startsWith` over the set
+ * to cover the formatter mismatch.
+ *
+ * The set is small in practice (1k–5k entries) so O(N) iteration on
+ * miss is fine.
+ */
+function hashLoaded(hash, loaded) {
+    if (loaded.has(hash))
+        return true;
+    if (hash.length < MIN_PREFIX_LENGTH)
+        return false;
+    for (const entry of loaded) {
+        if (entry.startsWith(hash) || hash.startsWith(entry))
+            return true;
+    }
+    return false;
+}
+
 const EMPTY_STATUS$1 = { enabled: false, patterns: [] };
 /**
  * Parse a single `.gitattributes` body into the LFS-tracked
@@ -20237,9 +20442,16 @@ function applyCommitComposeAction(state, action) {
                 field: state.field === 'summary' ? 'body' : 'summary',
             };
         case 'setEditing':
+            // Audit finding #12: defensively clear `streamingPreview` when
+            // editing toggles off AND no draft is in flight. The current
+            // input pipeline never triggers this combination, but the
+            // reducer is the source of truth — if a future code path
+            // toggles editing off mid-stream, the preview shouldn't linger
+            // below an idle compose panel.
             return {
                 ...state,
                 editing: action.value,
+                streamingPreview: !action.value && !state.loading ? undefined : state.streamingPreview,
             };
         case 'setLoading':
             // Clearing loading also clears any in-flight streaming preview;
@@ -20251,6 +20463,22 @@ function applyCommitComposeAction(state, action) {
                 streamingPreview: action.value ? state.streamingPreview : undefined,
             };
         case 'setDraft':
+            // Audit finding #7: if the user has typed content in summary or
+            // body, the AI draft would silently clobber their work with no
+            // undo. Route the result to `pendingAiDraft` instead and surface
+            // a confirmation message; the user accepts with `R` (replace)
+            // or dismisses with Esc. Empty fields = safe to replace as
+            // before, since there's nothing to lose.
+            if (state.summary.trim() || state.body.trim()) {
+                return {
+                    ...state,
+                    loading: false,
+                    streamingPreview: undefined,
+                    pendingAiDraft: action.value,
+                    message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                    details: undefined,
+                };
+            }
             // No `message` here — the loader → filled fields are the confirmation
             // that the AI generated something. A lingering "AI draft ready for
             // editing" line in the panel reads as stale state. The runtime still
@@ -20265,6 +20493,7 @@ function applyCommitComposeAction(state, action) {
                 message: undefined,
                 details: undefined,
                 streamingPreview: undefined,
+                pendingAiDraft: undefined,
             };
         case 'setResult':
             return {
@@ -20284,6 +20513,46 @@ function applyCommitComposeAction(state, action) {
                 ...state,
                 streamingPreview: action.value,
             };
+        case 'setPendingAiDraft':
+            // Audit finding #7: route the AI draft here (instead of straight
+            // to summary/body via `setDraft`) when the user has unsaved
+            // typing the draft would clobber. The dispatcher does the
+            // user-content check; this reducer just stashes the draft and
+            // surfaces a message inviting the user to accept or dismiss.
+            return {
+                ...state,
+                loading: false,
+                streamingPreview: undefined,
+                pendingAiDraft: action.value,
+                message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                details: undefined,
+            };
+        case 'acceptPendingAiDraft':
+            // Swap the pending draft into the editable fields and clear it.
+            // Mirrors `setDraft`'s field positioning (focus on summary,
+            // editing on) so the user lands in the same place whether they
+            // accepted immediately or after deliberation.
+            if (!state.pendingAiDraft)
+                return state;
+            return {
+                ...state,
+                ...splitCommitDraft(state.pendingAiDraft),
+                field: 'summary',
+                editing: true,
+                loading: false,
+                message: undefined,
+                details: undefined,
+                streamingPreview: undefined,
+                pendingAiDraft: undefined,
+            };
+        case 'dismissPendingAiDraft':
+            // User chose to keep their typing; drop the AI draft.
+            return {
+                ...state,
+                pendingAiDraft: undefined,
+                message: undefined,
+                details: undefined,
+            };
         case 'reset':
             // Drop message/details too — the post-commit "Created commit ..."
             // notification is already on the runtime status line (footer); a
@@ -20471,6 +20740,14 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
         // classify below.
         const stream = await chain.stream(variables, signal ? { signal } : undefined);
         let chunkCount = 0;
+        let callbackFailureCount = 0;
+        // Audit finding #13: cap consecutive callback failures so a
+        // genuinely broken render handler can't tie up the LLM call
+        // silently for the user's entire wait. Five strikes (out of an
+        // expected ~50-500 chunks for a normal commit message) is enough
+        // to ride out a transient blip but small enough to bail before
+        // the user finishes waiting on a useless stream.
+        const MAX_CALLBACK_FAILURES = 5;
         for await (const messageChunk of stream) {
             const text = coerceChunkText(messageChunk);
             if (!text)
@@ -20479,12 +20756,20 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
             chunkCount += 1;
             try {
                 onChunk({ text, accumulated });
+                // Successful callback resets the consecutive-failure counter —
+                // we only bail on a STREAK of failures, not on isolated ones.
+                callbackFailureCount = 0;
             }
             catch (callbackError) {
                 // Deliberately swallow callback errors so a bad render handler
                 // can't tank the entire LLM call. Log at verbose so users with
                 // verbose mode on can still see what happened.
-                logger?.verbose(`executeChainStreaming: onChunk handler threw: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                callbackFailureCount += 1;
+                logger?.verbose(`executeChainStreaming: onChunk handler threw (${callbackFailureCount}/${MAX_CALLBACK_FAILURES}): ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                if (callbackFailureCount >= MAX_CALLBACK_FAILURES) {
+                    logger?.verbose(`executeChainStreaming: bailing stream — ${MAX_CALLBACK_FAILURES} consecutive callback failures suggest a broken render handler.`, { color: 'red' });
+                    throw new LangChainExecutionError(`executeChainStreaming: render handler failed ${MAX_CALLBACK_FAILURES} times in a row; aborting stream so the failure surfaces to the caller.`, { accumulatedLength: accumulated.length, chunkCount });
+                }
             }
         }
         if (!accumulated) {
@@ -20518,15 +20803,22 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
     }
     catch (error) {
         // Cancellation classifier (#881 phase 3). Three signals: an
-        // explicitly aborted user signal (post-throw check), the
-        // standard DOM `AbortError`, or a Node `AbortSignal` with
-        // `signal.aborted === true` while a chain-internal error
-        // propagates. Any of these means "user wanted out," not "the
-        // call failed." Wrap the raw error so callers can pattern-match
-        // on `LangChainCancelledError` and carry the partial accumulated
-        // text in case the caller wants to salvage anything.
+        // explicitly aborted user signal (post-throw check) or a thrown
+        // `AbortError` from the standard DOM API. Either means "user
+        // wanted out," not "the call failed." Wrap the raw error so
+        // callers can pattern-match on `LangChainCancelledError` and
+        // carry the partial accumulated text in case the caller wants
+        // to salvage anything.
+        //
+        // Audit finding #8: an earlier implementation also fell back to
+        // `error.message.includes('aborted')` as a third signal. That
+        // substring heuristic is footgun-shaped — legitimate provider
+        // errors ("model not aborted properly", future API copy) would
+        // misclassify as user cancels. Dropped; rely on the structured
+        // signal (`signal.aborted`) and the standard error class
+        // (`name === 'AbortError'`).
         const aborted = signal?.aborted ||
-            (error instanceof Error && (error.name === 'AbortError' || error.message?.includes('aborted')));
+            (error instanceof Error && error.name === 'AbortError');
         if (aborted) {
             throw new LangChainCancelledError(error instanceof Error ? error.message : 'Streaming aborted by user', accumulated, {
                 provider: effectiveProvider,
@@ -20785,6 +21077,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
             // schema-validated retry — paying for a second LLM call only
             // on the edge case where the streamed output is unsalvageable.
             const streamingParser = createSchemaParser(schema, llm);
+            // Capture the final accumulated text out-of-band so we can
+            // attempt salvage if the parser throws on completion (audit
+            // finding #1). Updated on every chunk; the last value is
+            // whatever the stream produced before the parser ran. Empty
+            // string when streaming throws before any chunks arrived.
+            let streamedAccumulated = '';
             let salvaged;
             try {
                 // `executeChainStreaming` runs the parser on the accumulated
@@ -20798,6 +21096,7 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                     variables: budgetedPrompt.variables,
                     parser: streamingParser,
                     onChunk: ({ text, accumulated }) => {
+                        streamedAccumulated = accumulated;
                         onStreamChunk(text, accumulated);
                     },
                     signal,
@@ -20827,13 +21126,24 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                         cancelled: true,
                     };
                 }
-                // Streamed accumulated text didn't parse cleanly. Try the
-                // lossy salvager on whatever we have; if that produces a
-                // non-placeholder title, accept it. Otherwise fall through
-                // to the non-streaming path which can retry with a fresh
-                // LLM call.
-                logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
-                salvaged = undefined;
+                // Audit finding #1: try the lossy salvager on the accumulated
+                // text before paying for a second LLM call. The salvager
+                // strips code fences, attempts strict JSON parse, and falls
+                // back to "first line is title, rest is body." We only accept
+                // its output when it produced a real title — the placeholder
+                // title ("Auto-generated commit") means the salvager
+                // couldn't extract anything meaningful and the non-streaming
+                // retry is the better choice.
+                if (streamedAccumulated) {
+                    const candidate = salvageCommitMessageFromText(streamedAccumulated);
+                    if (candidate.title && candidate.title !== 'Auto-generated commit') {
+                        salvaged = candidate;
+                        logger.verbose(`Streaming parser failed but salvager recovered a draft from ${streamedAccumulated.length} accumulated chars; skipping non-streaming retry.`, { color: 'green' });
+                    }
+                }
+                if (!salvaged) {
+                    logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
+                }
             }
             // Type-narrow: commitMsg is set inside try{}, but TS doesn't
             // see that across the catch. Re-init through the salvage path
@@ -20842,10 +21152,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                 commitMsg = salvaged;
             }
             else if (!(commitMsg)) {
-                // Streaming threw; do the standard non-streaming flow to
-                // recover. This is the trade-off documented in the issue —
-                // streaming gives us a preview but the validated result still
-                // comes from the schema-aware retry path when streaming fails.
+                // Streaming threw AND the salvager couldn't recover anything
+                // useful; fall back to the standard non-streaming flow.
+                // Documented trade-off from the issue: streaming gives us a
+                // preview but the validated result still comes from the
+                // schema-aware retry path when both streaming AND salvage
+                // fail.
                 commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
                     logger,
                     tokenizer,
@@ -23535,7 +23847,16 @@ function createLogInkState(rows, options = {}) {
         worktreeDiffOffset: 0,
         filter: '',
         filterMode: false,
-        fullGraph: false,
+        // Default to the full multi-ref graph (`git log --all`) so users
+        // see how branches, tags, and stashes weave through the history
+        // out of the box. Pre-0.54.x this defaulted to false (current
+        // branch only); user feedback consistently asked for the
+        // GitKraken-style "see everything" view as the starting state.
+        // The `\` toggle still flips back to compact / current-branch
+        // mode for users who want the cleaner single-line graph. Tests
+        // override via `options.fullGraph` when they need the compact
+        // case explicitly.
+        fullGraph: options.fullGraph ?? true,
         showHelp: false,
         helpScrollOffset: 0,
         showCommandPalette: false,
@@ -23644,8 +23965,17 @@ function applyLogInkAction(state, action) {
             // branch's tip without the user manually scrolling. No-op when
             // the hash isn't in the loaded list (the runtime surfaces a
             // status hint in that case).
+            //
+            // Uses the shared `hashesMatchAny` helper to cover the
+            // short-hash auto-extension mismatch between
+            // `for-each-ref --format=%(objectname:short)` (cursored ref)
+            // and `git log --pretty=format:%h` (history row). Without that
+            // tolerance the resolver could decide "jump" but this reducer
+            // would silently no-op — the status updates but the cursor
+            // doesn't move, exactly the branch-cursor bug surfaced in 0.54.1
+            // testing. See `src/git/hashes.ts` for the matching rules.
             const target = action.hash;
-            const index = state.filteredCommits.findIndex((commit) => commit.hash === target || commit.shortHash === target);
+            const index = state.filteredCommits.findIndex((commit) => hashesMatchAny(target, [commit.hash, commit.shortHash]));
             if (index < 0) {
                 return state;
             }
@@ -24288,10 +24618,14 @@ function applyLogInkAction(state, action) {
             // Cache the result so re-entry (or `c` to PR) reuses it instead of
             // re-running the LLM. Keyed by branch so a checkout naturally
             // produces a fresh generation.
+            // Audit finding #9: `generatedAt` arrives on the action payload
+            // instead of being read from `Date.now()` here, so the reducer
+            // stays pure. Dispatchers (currently `runChangelogView` in
+            // app.ts) call `Date.now()` at dispatch time.
             const cached = {
                 text: action.text,
                 baseLabel: action.baseLabel,
-                generatedAt: Date.now(),
+                generatedAt: action.generatedAt,
             };
             return {
                 ...state,
@@ -24345,7 +24679,8 @@ function applyLogInkAction(state, action) {
                         // Updated-at timestamp reflects the edit. Not the original
                         // generation time — `r` (regenerate) is the explicit knob
                         // for "I want fresh LLM output, not my edits".
-                        generatedAt: Date.now(),
+                        // Audit finding #9: timestamp arrives on the action.
+                        generatedAt: action.generatedAt,
                     },
                 },
                 pendingKey: undefined,
@@ -24381,7 +24716,9 @@ function applyLogInkAction(state, action) {
             }
             return {
                 ...state,
-                recentCommitHashes: { hashes: action.hashes, markedAt: Date.now() },
+                // Audit finding #9: timestamp arrives on the action payload
+                // instead of being read from `Date.now()` here.
+                recentCommitHashes: { hashes: action.hashes, markedAt: action.markedAt },
                 pendingKey: undefined,
             };
         case 'clearRecentCommits':
@@ -24575,7 +24912,7 @@ function getInspectorActionExecuteEvents(inspectorAction, state) {
     const commit = state.filteredCommits[state.selectedIndex];
     const requireCommit = (fn) => {
         if (!commit) {
-            return [action({ type: 'setStatus', value: 'No commit selected' })];
+            return [action({ type: 'setStatus', value: 'No commit selected', kind: 'warning' })];
         }
         return fn(commit.hash, state.selectedIndex);
     };
@@ -24614,6 +24951,7 @@ function getInspectorActionExecuteEvents(inspectorAction, state) {
             return [action({
                     type: 'setStatus',
                     value: `Action ${inspectorAction.key} not yet wired`,
+                    kind: 'warning',
                 })];
     }
 }
@@ -24828,6 +25166,7 @@ function getLogInkPaletteExecuteEvents(command, state) {
             return [action({
                     type: 'setStatus',
                     value: 'open the diff view and press [ or ] to jump hunks',
+                    kind: 'warning',
                 })];
         case 'focusNext':
             return [action({ type: 'focusNext' })];
@@ -24876,6 +25215,7 @@ function getLogInkPaletteExecuteEvents(command, state) {
             return [action({
                     type: 'setStatus',
                     value: 'open branches / tags / history and press m on the cursored ref',
+                    kind: 'warning',
                 })];
         case 'navigateBack':
             // Mirror the Esc / `<` semantics (#931): drain the frame's view
@@ -24951,6 +25291,7 @@ function getLogInkPaletteExecuteEvents(command, state) {
             return [action({
                     type: 'setStatus',
                     value: 'Sort cycle is available in the branches and tags views',
+                    kind: 'warning',
                 })];
         case 'yankClipboard':
             // The runtime resolves the value/label against the live filtered
@@ -25007,7 +25348,7 @@ function submitInputPrompt(state) {
         return [];
     const value = state.inputPrompt.value.trim();
     if (!value) {
-        return [action({ type: 'setStatus', value: 'enter a value or press esc to cancel' })];
+        return [action({ type: 'setStatus', value: 'enter a value or press esc to cancel', kind: 'warning' })];
     }
     if (state.inputPrompt.kind === 'reset-mode') {
         const mode = value.toLowerCase();
@@ -25015,6 +25356,7 @@ function submitInputPrompt(state) {
             return [action({
                     type: 'setStatus',
                     value: `Unknown reset mode: ${value}. Use soft, mixed, or hard.`,
+                    kind: 'warning',
                 })];
         }
         return [
@@ -25028,6 +25370,7 @@ function submitInputPrompt(state) {
             return [action({
                     type: 'setStatus',
                     value: `Unknown merge strategy: ${value}. Use merge, squash, or rebase.`,
+                    kind: 'warning',
                 })];
         }
         return [
@@ -25091,6 +25434,7 @@ function submitInputPrompt(state) {
             return [action({
                     type: 'setStatus',
                     value: `Unknown merge strategy: ${value}. Use merge, squash, or rebase.`,
+                    kind: 'warning',
                 })];
         }
         return [
@@ -25181,16 +25525,24 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         return [];
     }
     // Cancel in-flight AI commit draft (#881 phase 3). When the compose
-    // surface is mid-stream (loading === true), Esc aborts the LLM call
-    // and the runtime handler cleans up (clear loading, clear preview,
-    // status line shows "AI draft cancelled."). Sits above the editing
-    // / view handlers so the cancel keystroke can't fall through to
-    // "leave compose" or anything else.
+    // state has a draft in flight (loading === true), Esc aborts the
+    // LLM call and the runtime handler cleans up (clear loading, clear
+    // preview, status line shows "AI draft cancelled.").
     //
-    // Loading and editing are mutually exclusive in practice (the user
-    // can't type while the AI is generating), but the order here makes
-    // the precedence explicit if that ever changes.
-    if (state.activeView === 'compose' && state.commitCompose.loading && key.escape) {
+    // Audit finding #5: the `activeView === 'compose'` gate from the
+    // original phase 3 implementation made the cancel keystroke
+    // unreachable after the user chord-navigated away from compose
+    // mid-stream (Esc would fall through to popView etc., consuming
+    // the navigation intent while the LLM call silently ran to
+    // completion). Cancel should work wherever the user is — they
+    // can always navigate back to compose afterwards.
+    //
+    // Sits above the editing / view handlers so the cancel keystroke
+    // can't fall through to "leave compose" or anything else. Loading
+    // and editing are mutually exclusive in practice (the user can't
+    // type while the AI is generating), but the order here makes the
+    // precedence explicit if that ever changes.
+    if (state.commitCompose.loading && key.escape) {
         return [{ type: 'cancelAiCommitDraft' }];
     }
     // Cancel in-flight PR body draft (#881 phase 4). The `C` keystroke
@@ -25210,6 +25562,27 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     if (state.pendingPullRequestBodyDraft && key.escape) {
         return [{ type: 'cancelPullRequestBodyDraft' }];
     }
+    // Pending AI draft confirmation (audit finding #7). When the AI
+    // draft completes against a non-empty compose surface, it lands in
+    // `pendingAiDraft` instead of overwriting the user's typing. `R`
+    // accepts the swap (user's typing is lost, AI draft becomes the
+    // new content). `Esc` dismisses the AI draft (typing is preserved,
+    // AI draft is lost — the user paid for the tokens but explicitly
+    // chose not to use them).
+    //
+    // Gated on `activeView === 'compose'` because the pending draft is
+    // only meaningful on the compose surface (where the message line
+    // surfaces the prompt). A user who chord-navigated away while the
+    // draft was pending should see the original `R` / Esc semantics of
+    // wherever they are now.
+    if (state.activeView === 'compose' && state.commitCompose.pendingAiDraft) {
+        if (inputValue === 'R' && !key.ctrl && !key.meta) {
+            return [action({ type: 'commitCompose', action: { type: 'acceptPendingAiDraft' } })];
+        }
+        if (key.escape) {
+            return [action({ type: 'commitCompose', action: { type: 'dismissPendingAiDraft' } })];
+        }
+    }
     if (state.commitCompose.editing) {
         if (key.escape) {
             return [action({ type: 'commitCompose', action: { type: 'setEditing', value: false } })];
@@ -25659,7 +26032,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         }
         return [
             action({ type: 'setPendingKey', value: undefined }),
-            action({ type: 'setStatus', value: 'gH applies a hunk in commit-diff or stash-diff view' }),
+            action({ type: 'setStatus', value: 'gH applies a hunk in commit-diff or stash-diff view', kind: 'warning' }),
         ];
     }
     // `gT` chord: create a lightweight tag at the cursored commit on the
@@ -25683,7 +26056,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         }
         return [
             action({ type: 'setPendingKey', value: undefined }),
-            action({ type: 'setStatus', value: 'gT creates a tag at the cursored commit on the history view' }),
+            action({ type: 'setStatus', value: 'gT creates a tag at the cursored commit on the history view', kind: 'warning' }),
         ];
     }
     // #784 — bisect view action keys. Scoped to `state.activeView ===
@@ -25798,6 +26171,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
                 value: next === 'split'
                     ? 'Switched to side-by-side diff'
                     : 'Switched to unified diff',
+                kind: 'success',
             }),
         ];
     }
@@ -26248,10 +26622,10 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     if (key.return && state.compareBase && isCompareFlowTarget(state)) {
         const head = getCursoredCompareRef(state, context);
         if (!head) {
-            return [action({ type: 'setStatus', value: 'No ref under cursor — move to a branch / tag / commit row first' })];
+            return [action({ type: 'setStatus', value: 'No ref under cursor — move to a branch / tag / commit row first', kind: 'warning' })];
         }
         if (head.ref === state.compareBase.ref && head.kind === state.compareBase.kind) {
-            return [action({ type: 'setStatus', value: 'Compare base and head are the same ref — pick a different one' })];
+            return [action({ type: 'setStatus', value: 'Compare base and head are the same ref — pick a different one', kind: 'warning' })];
         }
         return [
             action({
@@ -26454,7 +26828,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
                     action({ type: 'setFocus', value: 'commits' }),
                 ];
             }
-            return [action({ type: 'setStatus', value: 'no detail view for this tab' })];
+            return [action({ type: 'setStatus', value: 'no detail view for this tab', kind: 'warning' })];
         }
         // Fall through — per-entity Enter handler below claims the keystroke.
     }
@@ -26565,7 +26939,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     if (inputValue === 'm' && isCompareFlowTarget(state)) {
         const ref = getCursoredCompareRef(state, context);
         if (!ref) {
-            return [action({ type: 'setStatus', value: 'No ref under cursor — move to a branch / tag / commit row first' })];
+            return [action({ type: 'setStatus', value: 'No ref under cursor — move to a branch / tag / commit row first', kind: 'warning' })];
         }
         if (state.compareBase && state.compareBase.ref === ref.ref && state.compareBase.kind === ref.kind) {
             return [
@@ -26796,7 +27170,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     // Always intercept `C` on the conflicts view to prevent fallthrough to
     // the global `C` (Create PR) binding when conflicts remain.
     if (inputValue === 'C' && state.activeView === 'conflicts') {
-        return [action({ type: 'setStatus', value: 'Resolve all conflicts before continuing' })];
+        return [action({ type: 'setStatus', value: 'Resolve all conflicts before continuing', kind: 'warning' })];
     }
     // Global `C` — create a pull request from the current branch. The
     // runtime callback handles pre-flight (current branch resolution,
@@ -26812,6 +27186,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         return [action({
                 type: 'setStatus',
                 value: 'Finish or cancel the commit draft before creating a PR.',
+                kind: 'warning',
             })];
     }
     if (inputValue === 'C' && state.activeView !== 'conflicts') {
@@ -26871,7 +27246,7 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
             return events;
         }
         if (state.activeView === 'diff' && (state.diffSource === 'commit' || state.diffSource === 'stash')) {
-            return [action({ type: 'setStatus', value: 'no hunk under cursor — j/k to a + or - line first' })];
+            return [action({ type: 'setStatus', value: 'no hunk under cursor — j/k to a + or - line first', kind: 'warning' })];
         }
     }
     // `c` on the history view cherry-picks the full selected commit on
@@ -27756,7 +28131,7 @@ const SIDEBAR_AT_REST_BY_TIER = {
     rail: { min: 22, max: 28, fraction: 0.24 }, // unused — rail collapses to LAYOUT_RAIL_PANEL_WIDTH
     tight: { min: 22, max: 28, fraction: 0.24 },
     normal: { min: 22, max: 30, fraction: 0.22 },
-    wide: { min: 28, max: 48, fraction: 0.24 },
+    wide: { min: 28, max: 32, fraction: 0.20 },
 };
 function calcSidebarAtRestWidth(columns, density) {
     const config = SIDEBAR_AT_REST_BY_TIER[density];
@@ -29709,18 +30084,105 @@ function renderPromotedFilterAffordance(h, Text, state, theme) {
     ];
 }
 
+function resolveCursorSyncDecision(input) {
+    if (!input.target) {
+        return { type: 'noop', reason: 'no-target' };
+    }
+    if (input.target.hash === input.lastSyncedHash) {
+        return { type: 'noop', reason: 'duplicate-of-last' };
+    }
+    if (isHashLoaded(input.target.hash, input.loadedHashes)) {
+        return {
+            type: 'jump',
+            hash: input.target.hash,
+            label: input.target.label,
+        };
+    }
+    if (input.attemptedContextHashes.has(input.target.hash)) {
+        return { type: 'unreachable', target: input.target };
+    }
+    return { type: 'load-context', target: input.target };
+}
+/**
+ * Re-export of the shared `hashLoaded` helper under the resolver's
+ * historical name. Kept exported so existing tests (and any external
+ * importers) keep working unchanged — see `src/git/hashes.ts` for the
+ * canonical implementation and the rationale behind bidirectional
+ * prefix matching.
+ */
+function isHashLoaded(hash, loadedHashes) {
+    return hashLoaded(hash, loadedHashes);
+}
+/**
+ * Build the membership set the resolver expects. Includes BOTH the
+ * full hash and the short hash for every commit so the caller can
+ * match either form (refs sometimes carry only the short hash and
+ * `state.filteredCommits` items always have both).
+ *
+ * Exported so the cursor-sync effect can build the set once per
+ * re-render and pass it down without leaking the implementation
+ * detail. Tests use it to construct realistic inputs without
+ * hand-rolling the dual-hash logic.
+ */
+function buildLoadedHashSet(commits) {
+    const set = new Set();
+    for (const commit of commits) {
+        if (commit.hash)
+            set.add(commit.hash);
+        if (commit.shortHash)
+            set.add(commit.shortHash);
+    }
+    return set;
+}
+
 /**
- * Status-bar / footer renderer. Two-column layout:
- *   - Left: contextual hints for the active view (built by inkKeymap's
- *     `getLogInkFooterHints`), with the optional status message / idle
- *     tip appended.
- *   - Right: global key hints (`?` help, `:` palette, `q` quit, …).
+ * Status-bar / footer renderer. Two-row layout, using the full
+ * `height: 2` the footer already reserves:
+ *
+ *   Row 1 — keyboard hint band:
+ *     ┌──── contextual hints ────┐                ┌──── globals ────┐
+ *     ↑/↓ branches  ←/→ tab  …                    ? help · : cmds · q
+ *
+ *   Row 2 — status / feedback band:
+ *     ⠋ main has no upstream — nothing to fetch.
+ *
+ * Row 2 is empty when there's no status message, idle tip, or error.
+ * This is a behaviour change from the pre-0.54.2 single-row layout
+ * where the status message sat awkwardly between the contextual and
+ * global hints, getting visually crushed.
  *
- * Idle tips only fill the slot when no real status message is set so the
+ * The separation matters because:
+ *   - status text and key hints serve different cognitive purposes
+ *     (read vs. scan) and competing for the same row makes both
+ *     harder to use,
+ *   - long status messages (especially errors / multi-clause loading
+ *     copy) no longer push global hints off screen or wrap into the
+ *     hint cluster,
+ *   - errors now keep the global hints visible — the user often
+ *     needs `?` / `:` / `q` to *recover* from the error.
+ *
+ * Idle tips fill row 2 only when no real status message is set so the
  * tip cycle never overwrites genuine workflow feedback.
  *
- * Extracted from `src/commands/log/inkRuntime.ts` as part of phase 5a.7
- * of #890. No behavior change.
+ * Row 2 styling is kind-aware. Each statusKind gets its own theme
+ * color and glyph prefix so the message is identifiable at a glance
+ * — even with NO_COLOR set, the glyph alone communicates kind:
+ *
+ *   loading  →  spinner + accent  + bold
+ *   error    →  ✗ / !  + danger   + bold
+ *   warning  →  ⚠ / !  + warning  + bold
+ *   success  →  ✓ / +  + success  + bold
+ *   info     →  ℹ / i  + info     + bold
+ *   idle tip →  no glyph + dim muted (passive)
+ *
+ * Pre-redesign success and loading both used `accent` (cyan), so the
+ * user couldn't tell "done" from "in progress" by color alone. Each
+ * kind now uses its dedicated theme color and ships an ASCII glyph
+ * fallback for `theme.ascii` mode (TERM=dumb / vt100).
+ *
+ * Extracted from `src/commands/log/inkRuntime.ts` as part of phase
+ * 5a.7 of #890. Two-row layout introduced post-0.54.2; per-kind
+ * colors + glyphs added in the same pass.
  */
 function renderFooter(h, components, state, context, theme, idleTip, spinnerFrame = 0) {
     const { Box, Text } = components;
@@ -29752,50 +30214,268 @@ function renderFooter(h, components, state, context, theme, idleTip, spinnerFram
     });
     // Real status messages always win; idle tips only fill the slot when it
     // would otherwise be empty.
-    const isLoading = Boolean(state.statusLoading && state.statusMessage);
-    const trailing = state.statusMessage || idleTip || '';
-    // Loading status gets a spinner prefix in front of the message —
-    // motion makes transient LLM calls (create-PR body, PR fetches,
-    // etc.) feel less frozen even when they're sub-second.
-    const spinnerPrefix = isLoading ? `${pickSpinnerFrame(spinnerFrame)} ` : '';
-    const trailingWithSpinner = trailing ? `${spinnerPrefix}${trailing}` : '';
-    const status = trailingWithSpinner ? `  ${trailingWithSpinner}` : '';
+    const hasStatusMessage = Boolean(state.statusMessage);
+    const isLoading = Boolean(state.statusLoading && hasStatusMessage);
     const isError = state.statusKind === 'error';
+    const isWarning = state.statusKind === 'warning';
     const isSuccess = state.statusKind === 'success';
-    const contextualText = isError
-        // Errors get the full footer width and a `✗` prefix so they read
-        // as alarming. We drop the contextual hints when an error is
-        // active — they'd compete for attention with the message and
-        // long validator outputs (#907 polish: split-plan validator
-        // errors are often 100+ chars and got truncated against the hints).
-        ? `✗ ${state.statusMessage || ''}`
-        : `${hints.contextual.join('   ')}${status}`;
+    // 'info' is the implicit kind when statusKind is undefined but
+    // statusMessage is set — it's a deliberate status update, not an
+    // idle tip, so it gets info treatment rather than the dim fallback.
+    const isInfo = hasStatusMessage && !isError && !isWarning && !isSuccess && !isLoading;
+    const rawTrailing = state.statusMessage || idleTip || '';
+    // Glyphs per kind so the message is identifiable even before reading
+    // the color — improves scan-ability and degrades gracefully when the
+    // terminal lacks color. ASCII fallback for `theme.ascii` mode (TERM
+    // = dumb / vt100) where unicode glyphs render as garbage.
+    //   loading  →  spinner (animated)
+    //   error    →  ✗  / !
+    //   warning  →  ⚠  / !
+    //   success  →  ✓  / +
+    //   info     →  ℹ  / i
+    //   idle tip →  no glyph (passive)
+    const glyph = (() => {
+        if (isLoading)
+            return pickSpinnerFrame(spinnerFrame);
+        if (isError)
+            return theme.ascii ? '!' : '✗';
+        if (isWarning)
+            return theme.ascii ? '!' : '⚠';
+        if (isSuccess)
+            return theme.ascii ? '+' : '✓';
+        if (isInfo)
+            return theme.ascii ? 'i' : 'ℹ';
+        return '';
+    })();
+    const statusBody = rawTrailing
+        ? glyph
+            ? `${glyph} ${rawTrailing}`
+            : rawTrailing
+        : '';
+    // Row 2 color picks. Each kind gets its own theme color so success
+    // and loading are visually distinct (was conflated under `accent`
+    // pre-redesign — users couldn't tell "done" from "in progress").
+    //   loading → accent  (cyan / preset blue)
+    //   error   → danger  (red / preset red)
+    //   warning → warning (yellow)
+    //   success → success (green)
+    //   info    → info    (blue / preset accent in light themes)
+    //   idle    → undefined + dim (passive, blends with chrome)
+    const statusColor = isError
+        ? theme.colors.danger
+        : isWarning
+            ? theme.colors.warning
+            : isSuccess
+                ? theme.colors.success
+                : isLoading
+                    ? theme.colors.accent
+                    : isInfo
+                        ? theme.colors.info
+                        : undefined;
+    const statusBold = isError || isWarning || isSuccess || isLoading || isInfo;
+    const statusDim = !statusBold;
+    const hintsText = hints.contextual.join('   ');
     const globalText = hints.global.join(' · ');
-    // Error rendering: hide the global hints on the right so the
-    // message can wrap into that space. Success rendering: accent
-    // color on the message, hints stay visible. Default: existing
-    // muted styling.
-    const contextualColor = isError
-        ? 'red'
-        : isSuccess
-            ? theme.colors.accent
-            : theme.colors.muted;
-    return h(Box, {
-        flexDirection: 'row',
-        height: 2,
-        justifyContent: 'space-between',
-        paddingX: 1,
-    }, h(Text, {
-        color: contextualColor,
-        dimColor: !isError && !isSuccess,
-        bold: isError,
-    }, contextualText), 
-    // Globals are dropped entirely when an error is on screen — that
-    // space is what the long message needs to render. They come back
-    // the moment the status flips to info / success / cleared.
-    isError
-        ? h(Text, undefined, '')
-        : h(Text, { color: theme.colors.muted, dimColor: true }, globalText));
+    return h(Box, { flexDirection: 'column', height: 2, paddingX: 1 }, 
+    // Row 1: contextual ↔ global hints. justifyContent pushes them
+    // to opposite edges so the eye can scan each cluster as one
+    // block instead of hunting through a single concatenated line.
+    h(Box, { flexDirection: 'row', justifyContent: 'space-between' }, h(Text, { color: theme.colors.muted, dimColor: true }, hintsText), h(Text, { color: theme.colors.muted, dimColor: true }, globalText)), 
+    // Row 2: status / loading / idle tip / error. Empty Text keeps
+    // the row reserved when nothing's set so the surrounding layout
+    // doesn't shift as status flips on/off.
+    h(Text, {
+        color: statusColor,
+        dimColor: statusDim,
+        bold: statusBold,
+    }, statusBody));
+}
+
+const COMBINING_MARK_RANGES = [
+    [0x0300, 0x036f],
+    [0x1ab0, 0x1aff],
+    [0x1dc0, 0x1dff],
+    [0x20d0, 0x20ff],
+    [0xfe20, 0xfe2f],
+];
+const WIDE_CHARACTER_RANGES = [
+    [0x1100, 0x115f],
+    [0x2329, 0x232a],
+    [0x2e80, 0xa4cf],
+    [0xac00, 0xd7a3],
+    [0xf900, 0xfaff],
+    [0xfe10, 0xfe19],
+    [0xfe30, 0xfe6f],
+    [0xff00, 0xff60],
+    [0xffe0, 0xffe6],
+    [0x2600, 0x27bf],
+    [0x1f000, 0x1f9ff],
+    [0x20000, 0x3fffd],
+];
+function isInRange(codePoint, ranges) {
+    return ranges.some(([start, end]) => codePoint >= start && codePoint <= end);
+}
+function characterWidth(character) {
+    const codePoint = character.codePointAt(0) || 0;
+    if (codePoint === 0 || codePoint < 32 || (codePoint >= 0x7f && codePoint < 0xa0)) {
+        return 0;
+    }
+    if (codePoint === 0x200d ||
+        (codePoint >= 0xfe00 && codePoint <= 0xfe0f) ||
+        isInRange(codePoint, COMBINING_MARK_RANGES)) {
+        return 0;
+    }
+    return isInRange(codePoint, WIDE_CHARACTER_RANGES) ? 2 : 1;
+}
+function cellWidth(value) {
+    return Array.from(value).reduce((width, character) => width + characterWidth(character), 0);
+}
+/**
+ * Word-wrap `value` into lines that each fit within `width` cells. Breaks
+ * on whitespace where possible; falls back to mid-word splits when a single
+ * word is wider than the budget. Preserves blank input as a single empty
+ * line so `value.split('\n').flatMap(wrapCells)` round-trips cleanly.
+ */
+function wrapCells(value, width) {
+    if (width < 1) {
+        return [value];
+    }
+    if (cellWidth(value) <= width) {
+        return [value];
+    }
+    const lines = [];
+    let current = '';
+    let currentWidth = 0;
+    const flush = () => {
+        if (current.length > 0) {
+            lines.push(current);
+            current = '';
+            currentWidth = 0;
+        }
+    };
+    // Tokenize into runs of whitespace + non-whitespace so we can keep word
+    // boundaries when possible.
+    const tokens = value.match(/\s+|\S+/g) || [];
+    for (const token of tokens) {
+        const tokenWidth = cellWidth(token);
+        if (currentWidth + tokenWidth <= width) {
+            current += token;
+            currentWidth += tokenWidth;
+            continue;
+        }
+        if (/^\s+$/.test(token)) {
+            // Drop boundary whitespace at line breaks.
+            flush();
+            continue;
+        }
+        flush();
+        if (tokenWidth <= width) {
+            current = token;
+            currentWidth = tokenWidth;
+            continue;
+        }
+        // Word longer than budget — hard-split into chunks.
+        let remaining = token;
+        while (cellWidth(remaining) > width) {
+            let chunk = '';
+            let chunkWidth = 0;
+            for (const character of Array.from(remaining)) {
+                const charW = characterWidth(character);
+                if (chunkWidth + charW > width)
+                    break;
+                chunk += character;
+                chunkWidth += charW;
+            }
+            lines.push(chunk);
+            remaining = remaining.slice(chunk.length);
+        }
+        if (remaining.length > 0) {
+            current = remaining;
+            currentWidth = cellWidth(remaining);
+        }
+    }
+    flush();
+    return lines.length > 0 ? lines : [value];
+}
+function truncateCells(value, width) {
+    if (width < 1) {
+        return '';
+    }
+    if (cellWidth(value) <= width) {
+        return value;
+    }
+    const suffix = width > 3 ? '...' : '';
+    const available = width - cellWidth(suffix);
+    let used = 0;
+    let output = '';
+    for (const character of Array.from(value)) {
+        const nextWidth = characterWidth(character);
+        if (used + nextWidth > available) {
+            break;
+        }
+        output += character;
+        used += nextWidth;
+    }
+    return `${output}${suffix}`;
+}
+/**
+ * Truncate a file path so the filename (last segment) is preserved,
+ * eliding middle directory segments with `…/` instead of dropping
+ * end-of-string characters.
+ *
+ * `truncateCells` is the wrong tool for paths because it preserves the
+ * START of the string and drops the END — losing the filename, which
+ * is the most useful part. Example with `truncateCells`:
+ *
+ *   "src/commands/log/data.ts" (24) at width 18 → "src/commands/lo..."
+ *
+ * `truncatePathCells` preserves the filename and elides middle:
+ *
+ *   "src/commands/log/data.ts" (24) at width 18 → "src/…/log/data.ts"
+ *
+ * The algorithm tries successively-smaller prefixes (keeping the start
+ * of the path, the filename, and replacing the dropped middle segments
+ * with `…`) and returns the largest variant that fits. When even
+ * `…/<filename>` doesn't fit, falls back to plain `truncateCells` on
+ * the abbreviated form — better to show end-of-name than start-of-path.
+ *
+ * For inputs without `/` separators, behaves identically to
+ * `truncateCells`. Empty / width-0 cases match `truncateCells` too.
+ *
+ * @example
+ *   truncatePathCells('src/commands/log/data.ts', 18) // 'src/…/log/data.ts'
+ *   truncatePathCells('src/commands/log/data.ts', 12) // '…/data.ts'
+ *   truncatePathCells('a/b/c.ts', 100)                // 'a/b/c.ts'  (fits)
+ *   truncatePathCells('plainname.ts', 8)              // 'plain...'
+ */
+function truncatePathCells(value, width) {
+    if (width < 1)
+        return '';
+    if (cellWidth(value) <= width)
+        return value;
+    // No path structure to exploit — fall through to plain truncation.
+    if (!value.includes('/'))
+        return truncateCells(value, width);
+    const segments = value.split('/');
+    const filename = segments[segments.length - 1] ?? '';
+    const prefix = segments.slice(0, -1);
+    // Path is just '/filename' or has only the filename — no middle to
+    // elide. Defer to plain truncation.
+    if (prefix.length === 0)
+        return truncateCells(value, width);
+    // Walk from "keep all prefix segments except the deepest" down to
+    // "keep no prefix segments." First variant that fits wins.
+    for (let keep = prefix.length - 1; keep >= 0; keep--) {
+        const candidate = keep === 0
+            ? `…/${filename}`
+            : `${prefix.slice(0, keep).join('/')}/…/${filename}`;
+        if (cellWidth(candidate) <= width)
+            return candidate;
+    }
+    // Even `…/<filename>` doesn't fit. Use plain truncation on that
+    // form — preserves the leading `…/` so the user knows a path was
+    // elided, then ellipsis-truncates the filename.
+    return truncateCells(`…/${filename}`, width);
 }
 
 /**
@@ -30022,218 +30702,318 @@ function sidebarTabCount(tab, context) {
     }
 }
 
-const COMBINING_MARK_RANGES = [
-    [0x0300, 0x036f],
-    [0x1ab0, 0x1aff],
-    [0x1dc0, 0x1dff],
-    [0x20d0, 0x20ff],
-    [0xfe20, 0xfe2f],
-];
-const WIDE_CHARACTER_RANGES = [
-    [0x1100, 0x115f],
-    [0x2329, 0x232a],
-    [0x2e80, 0xa4cf],
-    [0xac00, 0xd7a3],
-    [0xf900, 0xfaff],
-    [0xfe10, 0xfe19],
-    [0xfe30, 0xfe6f],
-    [0xff00, 0xff60],
-    [0xffe0, 0xffe6],
-    [0x2600, 0x27bf],
-    [0x1f000, 0x1f9ff],
-    [0x20000, 0x3fffd],
-];
-function isInRange(codePoint, ranges) {
-    return ranges.some(([start, end]) => codePoint >= start && codePoint <= end);
-}
-function characterWidth(character) {
-    const codePoint = character.codePointAt(0) || 0;
-    if (codePoint === 0 || codePoint < 32 || (codePoint >= 0x7f && codePoint < 0xa0)) {
-        return 0;
-    }
-    if (codePoint === 0x200d ||
-        (codePoint >= 0xfe00 && codePoint <= 0xfe0f) ||
-        isInRange(codePoint, COMBINING_MARK_RANGES)) {
-        return 0;
-    }
-    return isInRange(codePoint, WIDE_CHARACTER_RANGES) ? 2 : 1;
-}
-function cellWidth(value) {
-    return Array.from(value).reduce((width, character) => width + characterWidth(character), 0);
-}
 /**
- * Word-wrap `value` into lines that each fit within `width` cells. Breaks
- * on whitespace where possible; falls back to mid-word splits when a single
- * word is wider than the budget. Preserves blank input as a single empty
- * line so `value.split('\n').flatMap(wrapCells)` round-trips cleanly.
+ * Header chip builder. Turns the workstation's title-bar state into an
+ * ordered list of small visually-distinct chips:
+ *
+ *   coco · gfargo/coco · ⎇ main · ✓ clean · ⊘ no PR · [NORMAL]
+ *
+ * Pre-refactor the title bar concatenated every segment into a single
+ * Text span, which made the eye read the whole thing as one run of
+ * words (the same problem the footer had). Splitting into chips with a
+ * fixed separator lets each segment carry its own color and lets the
+ * user scan the bar in chunks — "what app, what repo, what branch,
+ * how clean, what PR state, what mode" — instead of parsing left-to-
+ * right.
+ *
+ * Why a separate module: the header runtime renders chips and handles
+ * truncation; chip construction is pure transformation of state +
+ * context + theme. Splitting them keeps the chips testable in
+ * isolation and keeps the runtime small.
+ *
+ * Truncation strategy lives in the consumer, not here — when the total
+ * width exceeds the column budget, the header falls back to the
+ * pre-redesign single-fragment truncated string so the ellipsis can't
+ * land mid-glyph. We always return the FULL chip list; the consumer
+ * decides whether to drop chips, fall back, or render all of them.
  */
-function wrapCells(value, width) {
-    if (width < 1) {
-        return [value];
+/**
+ * Default separator inserted between chips by the consumer. Exported as
+ * a constant so tests and width math agree on what they're measuring.
+ * The trailing/leading spaces are part of the separator — `·` alone
+ * would butt against adjacent chip labels.
+ */
+const HEADER_CHIP_SEPARATOR = ' · ';
+/**
+ * Build the ordered chip list for the header. Chips not relevant to the
+ * current state (no PR loaded, no breadcrumb, no search input, …) are
+ * omitted entirely rather than rendered as empty placeholders, so the
+ * consumer can just `chips.map(render)` without checking for empties.
+ */
+function buildHeaderChips(input) {
+    const { theme } = input;
+    const chips = [];
+    // App label — the constant identity. Accent + bold so it anchors the
+    // left edge of the bar.
+    chips.push({
+        id: 'app',
+        label: input.appLabel,
+        color: theme.colors.accent,
+        dim: false,
+        bold: true,
+    });
+    // Repo. Default color — it's contextual but not the headline.
+    chips.push({
+        id: 'repo',
+        label: input.repo,
+        color: undefined,
+        dim: false,
+        bold: false,
+    });
+    // Branch. Carries the branch glyph (⎇ / ASCII fallback) so the chip
+    // is identifiable even when the branch name is generic ("main" /
+    // "master").
+    const branchGlyph = theme.ascii ? 'git:' : '⎇';
+    chips.push({
+        id: 'branch',
+        label: `${branchGlyph} ${input.branch}`,
+        color: theme.colors.accent,
+        dim: false,
+        bold: true,
+    });
+    // Dirty/clean. Positive framing on clean (success color + ✓), warning
+    // on dirty (warning color + ●). ASCII fallbacks keep the chip
+    // identifiable on dumb terminals.
+    const dirtyChip = input.dirty
+        ? {
+            id: 'dirty',
+            label: theme.ascii ? '* dirty' : '● dirty',
+            color: theme.colors.warning,
+            dim: false,
+            bold: false,
+        }
+        : {
+            id: 'dirty',
+            label: theme.ascii ? '+ clean' : '✓ clean',
+            color: theme.colors.success,
+            dim: false,
+            bold: false,
+        };
+    chips.push(dirtyChip);
+    // Bisect — only when active. Distinct chip so users entering the TUI
+    // mid-bisect see it immediately (#784). Warning color because bisect
+    // is an "in progress, requires user action" state.
+    if (input.bisecting) {
+        chips.push({
+            id: 'bisecting',
+            label: theme.ascii ? '! BISECTING' : '⚠ BISECTING',
+            color: theme.colors.warning,
+            dim: false,
+            bold: true,
+        });
     }
-    if (cellWidth(value) <= width) {
-        return [value];
+    // PR state. When present, the chip uses the PR-state glyph + a short
+    // label ("PR #1234 OPEN" / "PR #1234 DRAFT"). When absent, a muted
+    // "no PR" chip so users know the system DID look (vs. the bar just
+    // being blank).
+    if (input.pullRequest) {
+        const prGlyph = getPullRequestStateGlyph({ ...input.pullRequest, isDraft: Boolean(input.pullRequest.isDraft) }, theme);
+        const stateLabel = input.pullRequest.isDraft
+            ? 'DRAFT'
+            : input.pullRequest.state.toUpperCase();
+        const label = prGlyph.glyph
+            ? `${prGlyph.glyph} PR #${input.pullRequest.number} ${stateLabel}`
+            : `PR #${input.pullRequest.number} ${stateLabel}`;
+        chips.push({
+            id: 'pr',
+            label,
+            color: prGlyph.color,
+            dim: prGlyph.dim,
+            bold: false,
+        });
     }
-    const lines = [];
-    let current = '';
-    let currentWidth = 0;
-    const flush = () => {
-        if (current.length > 0) {
-            lines.push(current);
-            current = '';
-            currentWidth = 0;
-        }
-    };
-    // Tokenize into runs of whitespace + non-whitespace so we can keep word
-    // boundaries when possible.
-    const tokens = value.match(/\s+|\S+/g) || [];
-    for (const token of tokens) {
-        const tokenWidth = cellWidth(token);
-        if (currentWidth + tokenWidth <= width) {
-            current += token;
-            currentWidth += tokenWidth;
-            continue;
-        }
-        if (/^\s+$/.test(token)) {
-            // Drop boundary whitespace at line breaks.
-            flush();
-            continue;
-        }
-        flush();
-        if (tokenWidth <= width) {
-            current = token;
-            currentWidth = tokenWidth;
-            continue;
-        }
-        // Word longer than budget — hard-split into chunks.
-        let remaining = token;
-        while (cellWidth(remaining) > width) {
-            let chunk = '';
-            let chunkWidth = 0;
-            for (const character of Array.from(remaining)) {
-                const charW = characterWidth(character);
-                if (chunkWidth + charW > width)
-                    break;
-                chunk += character;
-                chunkWidth += charW;
-            }
-            lines.push(chunk);
-            remaining = remaining.slice(chunk.length);
-        }
-        if (remaining.length > 0) {
-            current = remaining;
-            currentWidth = cellWidth(remaining);
-        }
+    else {
+        chips.push({
+            id: 'pr',
+            label: theme.ascii ? '- no PR' : '⊘ no PR',
+            color: theme.colors.muted,
+            dim: true,
+            bold: false,
+        });
     }
-    flush();
-    return lines.length > 0 ? lines : [value];
-}
-function truncateCells(value, width) {
-    if (width < 1) {
-        return '';
+    // View breadcrumb. Rendered only when there's content (`coco ui`
+    // root view → no breadcrumb chip; pushed into a sub-view → chip
+    // appears). Comes AFTER PR so the "state" group (app/repo/branch/
+    // dirty/PR) reads as one cluster and the "navigation" group (view
+    // breadcrumb / loading) reads as a separate cluster.
+    if (input.breadcrumb) {
+        chips.push({
+            id: 'view',
+            label: input.breadcrumb,
+            color: theme.colors.muted,
+            dim: true,
+            bold: false,
+        });
     }
-    if (cellWidth(value) <= width) {
-        return value;
+    if (input.loading) {
+        chips.push({
+            id: 'loading',
+            label: input.loading.trim(),
+            color: theme.colors.muted,
+            dim: true,
+            bold: false,
+        });
     }
-    const suffix = width > 3 ? '...' : '';
-    const available = width - cellWidth(suffix);
-    let used = 0;
-    let output = '';
-    for (const character of Array.from(value)) {
-        const nextWidth = characterWidth(character);
-        if (used + nextWidth > available) {
-            break;
-        }
-        output += character;
-        used += nextWidth;
+    // Mode — the explicit input-mode indicator (#P2.2). Always present
+    // so users never wonder why `q` doesn't quit while they're editing.
+    // EDIT / FILTER use the warning color to signal "your keystrokes
+    // mean something different right now"; NORMAL uses accent (matches
+    // the app chip's home base).
+    const modeColor = input.mode === 'NORMAL'
+        ? theme.colors.accent
+        : theme.colors.warning;
+    chips.push({
+        id: 'mode',
+        label: `[${input.mode}]`,
+        color: modeColor,
+        dim: false,
+        bold: true,
+    });
+    // Search — only when active. Dim so it doesn't compete with the
+    // identity chips for attention; the user knows it's there because
+    // they're typing into it.
+    if (input.search) {
+        chips.push({
+            id: 'search',
+            label: input.search,
+            color: theme.colors.muted,
+            dim: true,
+            bold: false,
+        });
     }
-    return `${output}${suffix}`;
+    return chips;
+}
+/**
+ * Total rendered width of a chip list assuming `HEADER_CHIP_SEPARATOR`
+ * between every pair. Used by the consumer to decide whether the
+ * chip layout fits the column budget or whether to fall back to the
+ * single-fragment truncated path.
+ */
+function measureHeaderChipsWidth(chips) {
+    if (chips.length === 0)
+        return 0;
+    const labels = chips.map((chip) => cellWidth(chip.label));
+    const separators = (chips.length - 1) * cellWidth(HEADER_CHIP_SEPARATOR);
+    return labels.reduce((sum, w) => sum + w, 0) + separators;
 }
 
 /**
- * Title-bar renderer. Surfaces:
- *   - the app label (e.g. "coco ui")
- *   - current repo owner/name (or "local repository")
- *   - current branch + dirty / BISECTING flag
- *   - PR glyph + label when one is detected
- *   - breadcrumb of the view stack
- *   - loading hint for boot / context fetches
- *   - mode indicator: [NORMAL] / [EDIT] / [FILTER]
- *   - active filter / search input
+ * Title-bar renderer. Surfaces the workstation's identity + navigation
+ * state as a row of small visually-distinct chips:
  *
- * Truncation: when the assembled title overruns the available columns we
- * fall back to a single-fragment Text (truncating the joined string) so
- * the ellipsis can't land mid-glyph. The split-fragment path keeps the PR
- * glyph in its own colored span when there's headroom.
+ *   coco · gfargo/coco · ⎇ main · ✓ clean · ⊘ no PR · [NORMAL]
  *
- * Extracted from `src/commands/log/inkRuntime.ts` as part of phase 5a.7
- * of #890. No behavior change.
+ * Per-chip color/glyph treatment lets the user scan in chunks ("what
+ * app, what repo, what branch, how clean, what PR state, what mode")
+ * instead of parsing one long sentence. Chip construction is in
+ * `chrome/headerChips.ts`; this runtime just renders.
+ *
+ * Truncation: when the assembled chip row overruns the available
+ * columns we fall back to a single Text fragment (truncating the
+ * joined chip labels) so the ellipsis can't land mid-glyph. This is
+ * the same defensive pattern the pre-redesign single-fragment code
+ * used, applied at the chip-list level instead of the inline glyph
+ * split.
+ *
+ * Extracted from `src/commands/log/inkRuntime.ts` as part of phase
+ * 5a.7 of #890. Chip restructuring introduced post-0.54.2.
  */
 function renderHeader(h, components, state, context, contextStatus, columns, theme, appLabel) {
     const { Box, Text } = components;
+    // Pull the source state into the small "describe what to render"
+    // shape the chip builder expects. Keeps the runtime decoupled from
+    // the chip layout — the builder doesn't know about LogInkState /
+    // LogInkContext, just plain values.
     const branch = context.branches?.currentBranch || context.provider?.currentBranch || '<detached>';
-    // #784 — surface bisect-in-progress in the title bar so users entering
-    // the TUI mid-bisect see it immediately, before they navigate to gB.
-    const dirtyBase = context.branches?.dirty ? 'dirty' : 'clean';
-    const dirty = context.bisect?.active ? `${dirtyBase} · BISECTING` : dirtyBase;
+    const dirty = Boolean(context.branches?.dirty);
+    const bisecting = Boolean(context.bisect?.active);
     const repo = context.provider?.repository.owner && context.provider.repository.name
         ? `${context.provider.repository.owner}/${context.provider.repository.name}`
         : 'local repository';
     const prInfo = context.provider?.currentPullRequest || context.pullRequest?.currentPullRequest;
-    const prGlyph = prInfo ? getPullRequestStateGlyph(prInfo, theme) : null;
-    const prLabel = prInfo
-        ? `PR #${prInfo.number} ${prInfo.isDraft ? 'DRAFT' : prInfo.state}`
-        : 'no PR';
-    const search = state.filterMode ? `search: ${state.filter}_` : state.filter ? `filter: ${state.filter}` : '';
-    // Boot loading wins over the per-context loading hint because it
-    // tells the user the headline thing they care about (commits aren't
-    // ready yet) — the context fetches finish independently and surface
-    // their own per-section loading copy in the sidebars.
+    // Boot loading wins over the per-context loading hint — same
+    // priority as pre-redesign. Context fetches still surface their own
+    // copy in the sidebars.
     const loading = state.bootLoading
-        ? '  loading commits'
-        : isLogInkContextLoading(contextStatus) ? '  loading context' : '';
+        ? 'loading commits'
+        : isLogInkContextLoading(contextStatus) ? 'loading context' : '';
     const breadcrumb = formatLogInkBreadcrumb(state.viewStack);
     const repoCrumb = formatLogInkRepoBreadcrumb(state.repoStack);
-    // Repo breadcrumb (when nested) comes first so the user sees which
-    // submodule they're in at a glance, then the view breadcrumb (when
-    // pushed deeper than the root view). The truncate fallback in the
-    // title row still applies — when both fight for space, the ellipsis
-    // lands at the end of whichever segment overflows.
     const view = combineLogInkBreadcrumbSegments(repoCrumb, breadcrumb);
-    // Mode indicator (P2.2) — surfaces the current input mode so users
-    // never wonder why `q` doesn't quit while they're editing or filtering.
     const mode = state.commitCompose.editing
-        ? '[EDIT]'
+        ? 'EDIT'
         : state.filterMode
-            ? '[FILTER]'
-            : '[NORMAL]';
-    const titlePrefix = `${appLabel}  ${repo}  ${branch}  ${dirty}  `;
-    const glyphPart = prGlyph?.glyph ? `${prGlyph.glyph} ` : '';
-    const titleSuffix = `${view}${loading}`;
-    const fullTitle = `${titlePrefix}${glyphPart}${prLabel}${titleSuffix}`;
-    const titleBudget = columns - mode.length - 4;
-    const truncatedTitle = truncateCells(fullTitle, titleBudget);
-    // Only split into colored fragments when the prefix + glyph + label all
-    // fit unmodified — otherwise the truncate ellipsis can land mid-fragment
-    // and we'd render half a glyph in the wrong color.
-    const splitFragments = truncatedTitle === fullTitle && glyphPart.length > 0;
-    const modeColor = theme.noColor
-        ? undefined
-        : state.filterMode || state.commitCompose.editing
-            ? theme.colors.warning
-            : theme.colors.accent;
+            ? 'FILTER'
+            : 'NORMAL';
+    const search = state.filterMode
+        ? `search: ${state.filter}_`
+        : state.filter
+            ? `filter: ${state.filter}`
+            : '';
+    const chips = buildHeaderChips({
+        appLabel,
+        repo,
+        branch,
+        dirty,
+        bisecting,
+        pullRequest: prInfo ? {
+            number: prInfo.number,
+            state: prInfo.state,
+            isDraft: prInfo.isDraft,
+        } : undefined,
+        breadcrumb: view,
+        loading,
+        mode,
+        search: search ? truncateCells(search, 36) : '',
+        theme,
+    });
+    // Truncation budget. Header line gets the full terminal width minus
+    // the box's horizontal padding (2 cells) and a small safety margin.
+    const budget = Math.max(0, columns - 4);
+    const chipsWidth = measureHeaderChipsWidth(chips);
     return h(Box, {
         borderColor: theme.colors.border,
         borderStyle: theme.borderStyle,
         height: 3,
         paddingX: 1,
-    }, splitFragments
-        ? h(Text, { bold: true, color: theme.colors.accent }, titlePrefix)
-        : h(Text, { bold: true, color: theme.colors.accent }, truncatedTitle), splitFragments
-        ? h(Text, { bold: true, color: prGlyph?.color, dimColor: prGlyph?.dim }, glyphPart)
-        : undefined, splitFragments
-        ? h(Text, { bold: true, color: theme.colors.accent }, `${prLabel}${titleSuffix}`)
-        : undefined, h(Text, { bold: true, color: modeColor }, `  ${mode}`), search ? h(Text, { dimColor: true }, `  ${truncateCells(search, 36)}`) : undefined);
+    }, chipsWidth <= budget
+        ? renderChipRow(h, Text, chips)
+        : renderFallback(h, Text, chips, theme, budget));
+}
+/**
+ * Render every chip as its own Text span with its own color/style,
+ * interleaved with dim separator spans. This is the path used when
+ * everything fits — the eye gets the full chip treatment.
+ */
+function renderChipRow(h, Text, chips) {
+    const nodes = [];
+    chips.forEach((chip, index) => {
+        if (index > 0) {
+            // Separator is intentionally dim so the eye can use it as a
+            // visual delimiter without it competing with chip labels for
+            // attention.
+            nodes.push(h(Text, { key: `sep-${index}`, dimColor: true }, HEADER_CHIP_SEPARATOR));
+        }
+        nodes.push(h(Text, {
+            key: chip.id,
+            color: chip.color,
+            dimColor: chip.dim,
+            bold: chip.bold,
+        }, chip.label));
+    });
+    return nodes;
+}
+/**
+ * Fallback path for narrow terminals. Concatenates every chip label
+ * with separators, then truncates the whole string with
+ * `truncateCells` so the ellipsis lands at a cell boundary. Loses the
+ * per-chip color treatment in exchange for guaranteed legibility on
+ * narrow displays — the same trade-off the pre-redesign single-
+ * fragment code made for its inline glyph color split.
+ */
+function renderFallback(h, Text, chips, theme, budget) {
+    const joined = chips.map((chip) => chip.label).join(HEADER_CHIP_SEPARATOR);
+    return h(Text, { bold: true, color: theme.colors.accent }, truncateCells(joined, budget));
 }
 
 /**
@@ -30456,10 +31236,21 @@ function renderActiveStatusTabContent(h, Text, context, contextStatus, width, th
     const summaryRow = (count, label, key, kind) => h(Text, { key }, '  ', h(Text, { color: colorOf(kind), bold: count > 0 }, `${count} ${label}`));
     const fileRows = worktree.files.slice(0, 12).map((file, index) => {
         const codes = `${file.indexStatus}${file.worktreeStatus}`;
+        // Smart path truncation: keep the leading status codes and elide
+        // middle directory segments to preserve the filename. Falls back
+        // to plain truncation when the codes + a meaningful filename
+        // don't both fit. Same shape as the detail surface so all the
+        // status-row renderings elide consistently.
+        const prefix = `  ${codes} `;
+        const totalBudget = width - 4;
+        const pathBudget = totalBudget - cellWidth(prefix);
+        const label = pathBudget >= 8
+            ? `${prefix}${truncatePathCells(file.path, pathBudget)}`
+            : truncateCells(`${prefix}${file.path}`, totalBudget);
         return h(Text, {
             key: `tab-status-file-${index}`,
             color: colorOf(file.state),
-        }, truncateCells(`  ${codes} ${file.path}`, width - 4));
+        }, label);
     });
     return [
         summaryRow(worktree.stagedCount, 'staged', 'tab-status-staged', 'staged'),
@@ -31802,7 +32593,17 @@ function renderDiffSurface(h, components, state, context, contextStatus, worktre
                             color: theme.noColor ? undefined : theme.colors.accent,
                             backgroundColor: isActive && focused && !theme.noColor ? theme.colors.selection : undefined,
                             inverse: isActive && focused,
-                        }, truncateCells(`${arrow}${headerFile.path}`, width - 4));
+                        }, (() => {
+                            // Smart path truncation for the diff file header: keep
+                            // the leading arrow glyph and elide middle path
+                            // segments so the filename is never lost. Falls back to
+                            // plain truncation when there isn't room for a
+                            // meaningful filename.
+                            const pathBudget = (width - 4) - cellWidth(arrow);
+                            return pathBudget >= 8
+                                ? `${arrow}${truncatePathCells(headerFile.path, pathBudget)}`
+                                : truncateCells(`${arrow}${headerFile.path}`, width - 4);
+                        })());
                     }
                     return h(Text, {
                         key: `stash-diff-line-${absoluteIndex}`,
@@ -35283,6 +36084,24 @@ function renderInspectorRefs(h, Text, refs, repository) {
     });
     return out;
 }
+/**
+ * Compose a `<prefix><path><suffix>` line where the path gets smart
+ * middle-elision truncation if needed, while the fixed prefix/suffix
+ * decorations stay intact. Falls back to plain whole-line truncation
+ * when the suffix decorations consume too much of the budget for the
+ * path-aware variant to leave a meaningful filename.
+ *
+ * Used by the changed-files list AND the compose-context staged /
+ * unstaged sections so all three places elide identically — same
+ * floor (8 cells), same fallback shape.
+ */
+function smartPathLabel(prefix, path, suffix, totalBudget) {
+    const pathBudget = totalBudget - cellWidth(prefix) - cellWidth(suffix);
+    if (pathBudget >= 8) {
+        return `${prefix}${truncatePathCells(path, pathBudget)}${suffix}`;
+    }
+    return truncateCells(`${prefix}${path}${suffix}`, totalBudget);
+}
 /**
  * Render a list of changed files with status-code colors and stats. Used
  * by both the history inspector and the commit-diff detail panel so the
@@ -35310,13 +36129,21 @@ function renderCommitFileList(h, Text, files, selectedIndex, focused, maxRows, w
         // in `lfsPointer.ts` so even rename / mode-only rows are
         // flagged.
         const lfsBadge = lfsStatus && isPathLfsTracked(lfsStatus, file.path) ? ' [LFS]' : '';
-        const label = `${cursor} ${statusCode} ${file.path}${renamed}${lfsBadge}${stats ? `  ${stats}` : ''}`;
+        // Smart path truncation via `smartPathLabel`: keeps the cursor +
+        // status-code prefix and the stats/badge suffix intact, gives
+        // the path's remaining width budget to middle-elision so the
+        // filename survives instead of getting blunt-truncated off the
+        // end (the issue users hit when inspector paths read like
+        // `src/commands/log/da...`).
+        const labelPrefix = `${cursor} ${statusCode} `;
+        const labelSuffix = `${renamed}${lfsBadge}${stats ? `  ${stats}` : ''}`;
+        const label = smartPathLabel(labelPrefix, file.path, labelSuffix, width - 4);
         return h(Text, {
             key: `commit-file-${index}`,
             color: statusCodeColor(file.status, theme),
             inverse: isSelected && focused && !theme.noColor,
             bold: isSelected,
-        }, truncateCells(label, width - 4));
+        }, label);
     });
 }
 function renderPreviewPanel(h, components, title, lines, width, theme, focused) {
@@ -35592,7 +36419,7 @@ function renderComposeContextPanel(h, components, state, context, contextStatus,
             ...stagedFiles.map((file, index) => h(Text, {
                 key: `compose-context-staged-${index}`,
                 color: theme.noColor ? undefined : theme.colors.gitAdded,
-            }, truncateCells(`  ${file.indexStatus} ${file.path}`, width - 4))),
+            }, smartPathLabel(`  ${file.indexStatus} `, file.path, '', width - 4))),
             h(Text, { key: 'compose-context-staged-spacer' }, ''),
         ]
         : []), ...(unstagedFiles.length
@@ -35601,7 +36428,7 @@ function renderComposeContextPanel(h, components, state, context, contextStatus,
             ...unstagedFiles.map((file, index) => h(Text, {
                 key: `compose-context-unstaged-${index}`,
                 color: theme.noColor ? undefined : theme.colors.gitModified,
-            }, truncateCells(`  ${file.worktreeStatus} ${file.path}`, width - 4))),
+            }, smartPathLabel(`  ${file.worktreeStatus} `, file.path, '', width - 4))),
         ]
         : !stagedFiles.length && !loadingWorktree
             ? [h(Text, { dimColor: true }, 'No worktree changes detected.')]
@@ -36268,6 +37095,14 @@ function LogInkApp(deps) {
     // workdirs for submodule paths recorded in `.gitmodules` (which
     // are repo-relative). Undefined during the brief moment between
     // git swap and the revparse callback resolving.
+    //
+    // Audit finding #10: rapid frame push/pop races are prevented by
+    // the per-effect `cancelled` flag — React fires the cleanup
+    // synchronously BEFORE running the next effect body, so any
+    // pending revparse from the old `git` sees `cancelled === true`
+    // and skips its write. The `git` reference itself is captured by
+    // closure, so each effect run resolves against the right binding.
+    // No additional depth tagging is needed.
     const [activeRepoRoot, setActiveRepoRoot] = React.useState(undefined);
     React.useEffect(() => {
         let cancelled = false;
@@ -36493,7 +37328,7 @@ function LogInkApp(deps) {
             if (cancelled || !mountedRef.current)
                 return;
             const message = error instanceof Error ? error.message : String(error);
-            dispatch({ type: 'setStatus', value: `Failed to load commits: ${message}` });
+            dispatch({ type: 'setStatus', value: `Failed to load commits: ${message}`, kind: 'error' });
             dispatch({ type: 'setBootLoading', value: false });
         });
         return () => {
@@ -36561,8 +37396,15 @@ function LogInkApp(deps) {
                 ...(fetchArgs?.author ? { author: fetchArgs.author } : {}),
                 ...(fetchArgs?.path ? { path: fetchArgs.path } : {}),
             };
+            // Stash commits as graph roots so post-operation refreshes
+            // keep the same rich graph the boot loader assembled. Without
+            // this, every commit / split-apply / etc. would drop stash
+            // anchors and the cursor-syncs-history effect would degrade
+            // back to "tip not in loaded window" for older stashes.
+            const stashHashes = await getStashCommitHashes(git).catch(() => []);
             const fresh = await getLogRows(git, mergedArgv, {
                 limit: LOG_INTERACTIVE_DEFAULT_LIMIT,
+                extraRefs: stashHashes,
             });
             if (mountedRef.current && fresh) {
                 dispatch({ type: 'replaceRows', rows: fresh });
@@ -36698,18 +37540,50 @@ function LogInkApp(deps) {
         })();
         return () => { cancelled = true; };
     }, [git, dispatch]);
+    // Audit finding #2: re-resolve the repo root inline on every save
+    // and key the deps off `git` + the saved value. The original
+    // implementation read from `repoRootRef.current`, which is async-
+    // populated by the resolver effect above and can lag behind a git
+    // swap. After #995's synchronous pop-restore, the parent's freshly
+    // restored sidebar tab was being written into the submodule's
+    // cache because the ref still held the submodule root during the
+    // brief window before the resolver settled.
+    //
+    // The extra `revparse` cost per save is negligible (saves fire
+    // once per user-initiated tab change, not per render) and the
+    // cancellation flag prevents a stale resolution from racing a
+    // newer one in flight.
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveSidebarTab(repoRoot, state.userSidebarTab);
-    }, [state.userSidebarTab]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveSidebarTab(root, state.userSidebarTab);
+            }
+            catch {
+                // Not in a worktree, or revparse failed — silently skip.
+                // The next save attempt will retry.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.userSidebarTab, git]);
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveDiffViewMode(repoRoot, state.diffViewMode);
-    }, [state.diffViewMode]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveDiffViewMode(root, state.diffViewMode);
+            }
+            catch {
+                // Same as above.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.diffViewMode, git]);
     // P-stash-explorer: load `git stash show -p <ref>` once the diff view
     // becomes active with diffSource='stash'. Best-effort — empty stashes
     // or read errors fall through to a "no diff" hint at the render site.
@@ -37096,12 +37970,33 @@ function LogInkApp(deps) {
     // fetched yet); a status hint surfaces in that case so the user
     // knows to toggle full graph or load older commits.
     const lastSyncedHashRef = React.useRef(undefined);
+    // Tracks which target hashes we've already anchored a `git log`
+    // fetch on (#1034 follow-up). When the cursor-syncs-history effect
+    // sees a target whose hash isn't in the loaded window AND isn't in
+    // this set, it kicks off `getLogRowsAnchoredOn` and adds the hash
+    // here. After the fetch resolves and rows are appended, the effect
+    // re-fires; if the target STILL isn't loaded the resolver sees the
+    // hash in this set and returns `unreachable` instead of looping.
+    //
+    // Stored as a ref because (a) the resolver only ever reads it and
+    // (b) component re-renders on state.filteredCommits change are the
+    // re-fire trigger; storing here in state would add a redundant
+    // render per attempt.
+    const attemptedContextHashesRef = React.useRef(new Set());
+    const loadCommitContextRef = React.useRef(null);
     React.useEffect(() => {
         const onBranchTab = state.activeView === 'branches' ||
             (state.focus === 'sidebar' && state.sidebarTab === 'branches');
         const onTagTab = state.activeView === 'tags' ||
             (state.focus === 'sidebar' && state.sidebarTab === 'tags');
-        if (!onBranchTab && !onTagTab)
+        // User-reported gap: cursoring a stash didn't sync the history
+        // cursor the way cursoring a branch / tag did. Same auto-jump
+        // affordance now extends to stashes; the stash's commit hash IS
+        // the row to land on (stashes are commits living off the
+        // `refs/stash` tree, visible under `--all` / fullGraph).
+        const onStashTab = state.activeView === 'stash' ||
+            (state.focus === 'sidebar' && state.sidebarTab === 'stashes');
+        if (!onBranchTab && !onTagTab && !onStashTab)
             return;
         let targetHash;
         let targetLabel;
@@ -37127,51 +38022,117 @@ function LogInkApp(deps) {
                 targetLabel = `tag ${tag.name}`;
             }
         }
-        if (!targetHash)
-            return;
-        // Skip the dispatch + status churn when the cursor hasn't
-        // actually changed which commit it's targeting (the case for
-        // rapid navigation through a cluster of branches that all point
-        // at the same commit). Without this guard the user sees a stream
-        // of "Synced history to <branch> tip" status messages even
-        // though the history cursor never moved.
-        if (targetHash === lastSyncedHashRef.current)
-            return;
-        const loaded = state.filteredCommits.some((commit) => commit.hash === targetHash || commit.shortHash === targetHash);
-        if (loaded) {
-            lastSyncedHashRef.current = targetHash;
-            dispatch({ type: 'selectCommitByHash', hash: targetHash });
-            // Confirmation status message so the user gets feedback even
-            // when the dedicated branches / tags view is occupying the
-            // main panel and the history cursor moves invisibly behind it.
-            dispatch({
-                type: 'setStatus',
-                value: `Synced history to ${targetLabel} tip`,
-            });
+        else if (onStashTab) {
+            const all = context.stashes?.stashes || [];
+            const visible = state.filter
+                ? all.filter((s) => matchesPromotedFilter([s.ref, s.message], state.filter))
+                : all;
+            const stash = visible[Math.min(state.selectedStashIndex, Math.max(0, visible.length - 1))];
+            if (stash) {
+                // Two-step fallback chain for stash cursor sync:
+                //
+                //   1. Try `baseHash` (the branch tip the stash was created
+                //      from). This answers the user-visible question "where
+                //      in larger git history was this stash made?" — that's
+                //      the branch origin point, not the stash's own merge-
+                //      commit row off in `refs/stash`. Base commits live on
+                //      regular branches so they're almost always in the
+                //      loaded window.
+                //
+                //   2. If `baseHash` isn't in the loaded window (the stash's
+                //      base branch was deleted, or the base is older than
+                //      the 1000-commit cap), fall back to `stash.hash`
+                //      itself. The stash commit was added as an extraRef so
+                //      it's reachable from the graph if it fits the window.
+                //
+                // Only after BOTH miss does the effect report "tip not in
+                // loaded window." The label flips to mention "base" vs the
+                // stash commit so the user knows what they're looking at.
+                // hashesMatchAny handles the short-hash auto-extension
+                // mismatch between `git stash list --format=%h` (stash hash)
+                // and `git log --pretty=format:%h` (history row). Same
+                // hazard as the branch/tag cursor sync — see src/git/hashes.ts.
+                const baseLoaded = Boolean(stash.baseHash) && state.filteredCommits.some((c) => hashesMatchAny(stash.baseHash, [c.hash, c.shortHash]));
+                const hashLoaded = state.filteredCommits.some((c) => hashesMatchAny(stash.hash, [c.hash, c.shortHash]));
+                if (baseLoaded) {
+                    targetHash = stash.baseHash;
+                    targetLabel = `${stash.ref}'s base`;
+                }
+                else if (hashLoaded) {
+                    targetHash = stash.hash;
+                    targetLabel = stash.ref;
+                }
+                else {
+                    // Neither in window — set to baseHash so the standard
+                    // "not in loaded window" message fires with a meaningful
+                    // label (the base is what the user actually wants to see).
+                    targetHash = stash.baseHash || stash.hash;
+                    targetLabel = stash.ref;
+                }
+            }
         }
-        else {
-            dispatch({
-                type: 'setStatus',
-                value: `${targetLabel} tip not in loaded window — press \\ for full graph or Ctrl+L to load more`,
-            });
+        // Delegate the actual decision to the pure resolver so the
+        // logic is testable in isolation. The effect just performs the
+        // resolver's chosen action.
+        const decision = resolveCursorSyncDecision({
+            target: targetHash ? { hash: targetHash, label: targetLabel || targetHash } : undefined,
+            loadedHashes: buildLoadedHashSet(state.filteredCommits),
+            lastSyncedHash: lastSyncedHashRef.current,
+            attemptedContextHashes: attemptedContextHashesRef.current,
+        });
+        switch (decision.type) {
+            case 'noop':
+                return;
+            case 'jump':
+                lastSyncedHashRef.current = decision.hash;
+                dispatch({ type: 'selectCommitByHash', hash: decision.hash });
+                dispatch({
+                    type: 'setStatus',
+                    value: `Synced history to ${decision.label} tip`,
+                });
+                return;
+            case 'load-context':
+                // Mark the hash as attempted BEFORE firing the load so a
+                // re-fire of this effect (state.filteredCommits change while
+                // the load is in flight) doesn't kick off a duplicate
+                // request. The resolver sees the hash in the set and
+                // returns `noop` until the load completes; on completion the
+                // appendRows triggers a final re-fire that either jumps or
+                // returns `unreachable`.
+                attemptedContextHashesRef.current.add(decision.target.hash);
+                void loadCommitContextRef.current?.(decision.target);
+                return;
+            case 'unreachable':
+                dispatch({
+                    type: 'setStatus',
+                    value: `${decision.target.label} target commit is unreachable — not in any walked ref's history.`,
+                    kind: 'warning',
+                });
+                return;
         }
     }, [
-        dispatch, context.branches, context.tags,
+        dispatch, context.branches, context.tags, context.stashes,
         state.activeView, state.focus, state.sidebarTab,
-        state.selectedBranchIndex, state.selectedTagIndex,
+        state.selectedBranchIndex, state.selectedTagIndex, state.selectedStashIndex,
         state.branchSort, state.tagSort, state.filter,
         state.filteredCommits,
     ]);
     // Reset the dedup ref when the user moves focus away from the
-    // sidebar branches / tags tab so re-entering re-fires the sync
-    // even if the cursored branch is the same as before.
+    // sidebar branches / tags / stashes tab so re-entering re-fires the
+    // sync even if the cursored row is the same as before.
     React.useEffect(() => {
         const onBranchTab = state.activeView === 'branches' ||
             (state.focus === 'sidebar' && state.sidebarTab === 'branches');
         const onTagTab = state.activeView === 'tags' ||
             (state.focus === 'sidebar' && state.sidebarTab === 'tags');
-        if (!onBranchTab && !onTagTab) {
+        const onStashTab = state.activeView === 'stash' ||
+            (state.focus === 'sidebar' && state.sidebarTab === 'stashes');
+        if (!onBranchTab && !onTagTab && !onStashTab) {
             lastSyncedHashRef.current = undefined;
+            // Drop any context-load attempt tracking too. If the user
+            // navigates back later we want to retry rather than show
+            // "unreachable" based on a stale attempted-set.
+            attemptedContextHashesRef.current = new Set();
         }
     }, [state.activeView, state.focus, state.sidebarTab]);
     React.useEffect(() => {
@@ -37202,7 +38163,7 @@ function LogInkApp(deps) {
     ]);
     const toggleSelectedFileStage = React.useCallback(async () => {
         if (!selectedWorktreeFile) {
-            dispatch({ type: 'setStatus', value: 'no worktree file selected' });
+            dispatch({ type: 'setStatus', value: 'no worktree file selected', kind: 'warning' });
             return;
         }
         dispatch({ type: 'setStatus', value: 'updating file stage state' });
@@ -37217,7 +38178,7 @@ function LogInkApp(deps) {
     const toggleSelectedHunkStage = React.useCallback(async () => {
         const selectedHunk = worktreeHunks?.hunks[state.selectedWorktreeHunkIndex];
         if (!selectedHunk) {
-            dispatch({ type: 'setStatus', value: 'no hunk selected' });
+            dispatch({ type: 'setStatus', value: 'no hunk selected', kind: 'warning' });
             return;
         }
         dispatch({ type: 'setStatus', value: 'updating hunk stage state' });
@@ -37231,6 +38192,7 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: `${selectedHunk.state === 'staged' ? 'Unstaged' : 'Staged'} hunk`,
+                kind: 'success',
             });
             await refreshWorktreeContext();
             setWorktreeDiff(undefined);
@@ -37240,12 +38202,13 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: error.message || 'failed to update hunk stage state',
+                kind: 'error',
             });
         }
     }, [dispatch, git, refreshWorktreeContext, state.selectedWorktreeHunkIndex, worktreeHunks]);
     const revertSelectedFile = React.useCallback(async () => {
         if (!selectedWorktreeFile) {
-            dispatch({ type: 'setStatus', value: 'no worktree file selected' });
+            dispatch({ type: 'setStatus', value: 'no worktree file selected', kind: 'warning' });
             return;
         }
         dispatch({ type: 'setStatus', value: 'reverting selected file' });
@@ -37258,13 +38221,13 @@ function LogInkApp(deps) {
     const revertSelectedHunk = React.useCallback(async () => {
         const selectedHunk = worktreeHunks?.hunks[state.selectedWorktreeHunkIndex];
         if (!selectedHunk) {
-            dispatch({ type: 'setStatus', value: 'no hunk selected' });
+            dispatch({ type: 'setStatus', value: 'no hunk selected', kind: 'warning' });
             return;
         }
         dispatch({ type: 'setStatus', value: 'reverting selected hunk' });
         try {
             await revertHunk(git, selectedHunk);
-            dispatch({ type: 'setStatus', value: `Reverted hunk in ${selectedHunk.filePath}` });
+            dispatch({ type: 'setStatus', value: `Reverted hunk in ${selectedHunk.filePath}`, kind: 'success' });
             await refreshWorktreeContext();
             setWorktreeDiff(undefined);
             setWorktreeHunks(undefined);
@@ -37273,13 +38236,14 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: error.message || 'failed to revert hunk',
+                kind: 'error',
             });
         }
     }, [dispatch, git, refreshWorktreeContext, state.selectedWorktreeHunkIndex, worktreeHunks]);
     const createCommitFromCompose = React.useCallback(async () => {
         const stagedCount = context.worktree?.stagedCount || 0;
         if (!stagedCount) {
-            dispatch({ type: 'setStatus', value: 'stage changes before committing' });
+            dispatch({ type: 'setStatus', value: 'stage changes before committing', kind: 'warning' });
             return;
         }
         dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: true } });
@@ -37343,6 +38307,12 @@ function LogInkApp(deps) {
                 git,
                 signal: controller.signal,
                 onStreamChunk: (_text, accumulated) => {
+                    // Audit finding #4: skip dispatching into a torn-down
+                    // tree. If the user quit (or otherwise unmounted the
+                    // workstation) mid-stream, React warns about updates on
+                    // an unmounted component. Drop the chunk silently.
+                    if (!mountedRef.current)
+                        return;
                     // Dispatch the full accumulated text — the preview chrome
                     // helper does the last-N-lines slicing at render time, so
                     // re-doing the slice here would be wasted work. Per-chunk
@@ -37354,18 +38324,23 @@ function LogInkApp(deps) {
                     });
                 },
             });
+            // Audit finding #4 (unmount race): bail out before any
+            // post-await dispatch if the user quit while the LLM call was
+            // in flight. Same pattern as `refreshHistoryRows` upstream.
+            if (!mountedRef.current)
+                return;
             // Cancel path (#881 phase 3). User pressed Esc during the
             // stream; reducer drops loading + preview, status line shows
             // a neutral "cancelled" message. Skip the result / failure
             // dispatches because the user already knows what happened.
             if (result.cancelled) {
                 dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
-                dispatch({ type: 'setStatus', value: 'AI draft cancelled.' });
+                dispatch({ type: 'setStatus', value: 'AI draft cancelled.', kind: 'info' });
                 return;
             }
             if (result.ok && result.draft) {
                 dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: result.draft } });
-                dispatch({ type: 'setStatus', value: 'AI draft ready for editing' });
+                dispatch({ type: 'setStatus', value: 'AI draft ready for editing', kind: 'success' });
                 return;
             }
             dispatch({
@@ -37374,6 +38349,23 @@ function LogInkApp(deps) {
             });
             dispatch({ type: 'setStatus', value: result.message });
         }
+        catch (error) {
+            // Audit finding #3: defensive recovery for unexpected throws
+            // from the workflow. The workflow catches its own errors
+            // today, so this catch is latent — but any future refactor
+            // that lets an error escape would otherwise strand the
+            // spinner permanently with no user-facing recovery short of
+            // quitting. Surface a generic failure and clear the loading
+            // state so the user can re-try.
+            if (mountedRef.current) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({
+                    type: 'setStatus',
+                    value: `AI draft failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`,
+                    kind: 'error',
+                });
+            }
+        }
         finally {
             // Clear the ref only if it still points at OUR controller — a
             // rapid second invocation could have already replaced it, in
@@ -37432,7 +38424,7 @@ function LogInkApp(deps) {
     const startCreatePullRequest = React.useCallback(async () => {
         const head = context.branches?.currentBranch || context.provider?.currentBranch;
         if (!head) {
-            dispatch({ type: 'setStatus', value: 'No current branch to create a PR from.' });
+            dispatch({ type: 'setStatus', value: 'No current branch to create a PR from.', kind: 'warning' });
             return;
         }
         const defaultBranch = context.provider?.repository.defaultBranch;
@@ -37440,11 +38432,12 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: 'No default branch detected. Set origin/HEAD or ensure main/master exists locally.',
+                kind: 'warning',
             });
             return;
         }
         if (head === defaultBranch) {
-            dispatch({ type: 'setStatus', value: `Current branch is ${defaultBranch}; check out a feature branch first.` });
+            dispatch({ type: 'setStatus', value: `Current branch is ${defaultBranch}; check out a feature branch first.`, kind: 'warning' });
             return;
         }
         if (context.pullRequest?.currentPullRequest || context.provider?.currentPullRequest) {
@@ -37454,6 +38447,7 @@ function LogInkApp(deps) {
                 value: existing
                     ? `PR #${existing.number} already open for ${head}. Use the PR view to manage it.`
                     : `A pull request is already open for ${head}.`,
+                kind: 'warning',
             });
             return;
         }
@@ -37465,9 +38459,14 @@ function LogInkApp(deps) {
         const cancelHandle = { cancelled: false };
         pullRequestBodyCancelRef.current = cancelHandle;
         dispatch({ type: 'setPendingPullRequestBodyDraft', value: true });
+        // Audit finding #6: soft cancel today — Esc skips opening the
+        // follow-up prompt, but the LLM call itself keeps running to
+        // completion (no AbortSignal threaded through the changelog CLI
+        // chain). Status copy reflects that honestly so the user isn't
+        // misled into thinking they're saving tokens.
         dispatch({
             type: 'setStatus',
-            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to cancel`,
+            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to skip prompt`,
             loading: true,
         });
         try {
@@ -37489,11 +38488,20 @@ function LogInkApp(deps) {
             const initialBody = body.body || '';
             const initial = initialBody ? `${initialTitle}\n\n${initialBody}` : initialTitle;
             if (!body.ok) {
-                dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.` });
+                dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.`, kind: 'error' });
             }
             else {
-                dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
-            }
+                dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.', kind: 'success' });
+            }
+            // Audit finding #11: clear the pending flag BEFORE opening the
+            // prompt. If a future refactor adds an `await` between the flag
+            // clear (currently in `finally`) and the `openInputPrompt`
+            // dispatch, an Esc keystroke in the gap would dispatch
+            // `cancelPullRequestBodyDraft` AFTER the prompt opens, leaving
+            // the prompt visible with a stale "cancelled" message. Clearing
+            // here moves the flag teardown into the same React batch as the
+            // prompt open, eliminating the race.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             dispatch({
                 type: 'openInputPrompt',
                 kind: 'create-pr',
@@ -37503,11 +38511,14 @@ function LogInkApp(deps) {
             });
         }
         finally {
-            // Clear the flag + the ref so a subsequent draft starts clean.
+            // Belt-and-suspenders: the `try` block clears the flag on the
+            // success path (audit finding #11). This duplicate clear handles
+            // the error / cancel paths where the early-returns skip the
+            // success-path dispatch. Safe to no-op when already false.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             // Only clear the ref if we still own it — a second invocation
             // would have already taken ownership in which case the cancel
             // duty has rolled over.
-            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             if (pullRequestBodyCancelRef.current === cancelHandle) {
                 pullRequestBodyCancelRef.current = null;
             }
@@ -37547,17 +38558,18 @@ function LogInkApp(deps) {
     const yankText = React.useCallback(async (value, label) => {
         const clipboard = clipboardRunner || defaultClipboardRunner;
         if (!value) {
-            dispatch({ type: 'setStatus', value: `Nothing to copy — ${label} is empty.` });
+            dispatch({ type: 'setStatus', value: `Nothing to copy — ${label} is empty.`, kind: 'warning' });
             return;
         }
         try {
             await clipboard(value);
-            dispatch({ type: 'setStatus', value: `Copied ${label} to clipboard.` });
+            dispatch({ type: 'setStatus', value: `Copied ${label} to clipboard.`, kind: 'success' });
         }
         catch (error) {
             dispatch({
                 type: 'setStatus',
                 value: `Copy failed (${label}): ${error.message}`,
+                kind: 'error',
             });
         }
     }, [clipboardRunner, dispatch]);
@@ -37581,7 +38593,7 @@ function LogInkApp(deps) {
     const startChangelogView = React.useCallback(async (options = {}) => {
         const head = context.branches?.currentBranch || context.provider?.currentBranch;
         if (!head) {
-            dispatch({ type: 'setStatus', value: 'No current branch — check out a branch first.' });
+            dispatch({ type: 'setStatus', value: 'No current branch — check out a branch first.', kind: 'warning' });
             return;
         }
         const defaultBranch = context.provider?.repository.defaultBranch;
@@ -37608,6 +38620,11 @@ function LogInkApp(deps) {
                 branch: head,
                 baseLabel: cached.baseLabel,
                 text: cached.text,
+                // Audit finding #9: cache-hit path preserves the original
+                // generation timestamp rather than minting a fresh one — the
+                // "X ago" header should reflect when the LLM ran, not when
+                // the cached entry was re-displayed.
+                generatedAt: cached.generatedAt,
             });
             dispatch({
                 type: 'setStatus',
@@ -37628,7 +38645,7 @@ function LogInkApp(deps) {
                 baseLabel,
                 error: result.message,
             });
-            dispatch({ type: 'setStatus', value: `Changelog failed: ${result.message}` });
+            dispatch({ type: 'setStatus', value: `Changelog failed: ${result.message}`, kind: 'error' });
             return;
         }
         dispatch({
@@ -37636,10 +38653,14 @@ function LogInkApp(deps) {
             branch: head,
             baseLabel,
             text: result.text,
+            // Audit finding #9: timestamp captured at dispatch time, not
+            // inside the reducer.
+            generatedAt: Date.now(),
         });
         dispatch({
             type: 'setStatus',
             value: 'Changelog ready — y yank · E $EDITOR · c PR · r regen · < back.',
+            kind: 'success',
         });
     }, [
         context.branches?.currentBranch,
@@ -37660,7 +38681,7 @@ function LogInkApp(deps) {
     const yankChangelog = React.useCallback(() => {
         const text = state.changelogView.text;
         if (!text) {
-            dispatch({ type: 'setStatus', value: 'No changelog text to copy.' });
+            dispatch({ type: 'setStatus', value: 'No changelog text to copy.', kind: 'warning' });
             return;
         }
         void yankText(text, 'changelog');
@@ -37673,7 +38694,7 @@ function LogInkApp(deps) {
     const openChangelogInEditor = React.useCallback(() => {
         const current = state.changelogView.text;
         if (current === undefined) {
-            dispatch({ type: 'setStatus', value: 'Changelog not loaded yet — wait for generation.' });
+            dispatch({ type: 'setStatus', value: 'Changelog not loaded yet — wait for generation.', kind: 'warning' });
             return;
         }
         let dir;
@@ -37684,6 +38705,7 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: `Failed to create temp file for editor: ${error.message}`,
+                kind: 'error',
             });
             return;
         }
@@ -37695,6 +38717,7 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: `Failed to seed temp file: ${error.message}`,
+                kind: 'error',
             });
             try {
                 fs$1.rmSync(dir, { recursive: true, force: true });
@@ -37718,13 +38741,13 @@ function LogInkApp(deps) {
             out.write(`${SHOW_CURSOR}${EXIT_ALT}`);
             const result = node_child_process.spawnSync(editor, [...editorPrefixArgs, file], { stdio: 'inherit' });
             if (result.error) {
-                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}` });
+                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}`, kind: 'error' });
             }
             else if (result.signal) {
-                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}` });
+                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}`, kind: 'warning' });
             }
             else if (typeof result.status === 'number' && result.status !== 0) {
-                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}` });
+                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}`, kind: 'warning' });
             }
             else {
                 editorOk = true;
@@ -37738,13 +38761,14 @@ function LogInkApp(deps) {
         if (editorOk) {
             try {
                 const content = fs$1.readFileSync(file, 'utf8');
-                dispatch({ type: 'setChangelogText', text: content });
-                dispatch({ type: 'setStatus', value: 'Changelog updated from editor.' });
+                dispatch({ type: 'setChangelogText', text: content, generatedAt: Date.now() });
+                dispatch({ type: 'setStatus', value: 'Changelog updated from editor.', kind: 'success' });
             }
             catch (error) {
                 dispatch({
                     type: 'setStatus',
                     value: `Failed to read back edited changelog: ${error.message}`,
+                    kind: 'error',
                 });
             }
         }
@@ -37785,19 +38809,19 @@ function LogInkApp(deps) {
             out.write(`${SHOW_CURSOR}${EXIT_ALT}`);
             const result = node_child_process.spawnSync(editor, [...editorPrefixArgs, path], { stdio: 'inherit' });
             if (result.error) {
-                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}` });
+                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}`, kind: 'error' });
             }
             else if (result.signal) {
                 // Editor was killed by a signal (e.g. ^C, SIGTERM). status is
                 // null in this case, so the old `status !== 0` check would
                 // mistakenly fall through to the success branch.
-                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}` });
+                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}`, kind: 'warning' });
             }
             else if (typeof result.status === 'number' && result.status !== 0) {
-                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}` });
+                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}`, kind: 'warning' });
             }
             else {
-                dispatch({ type: 'setStatus', value: `Edited ${path}` });
+                dispatch({ type: 'setStatus', value: `Edited ${path}`, kind: 'success' });
             }
         }
         finally {
@@ -37844,6 +38868,7 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: `Failed to create temp file for editor: ${error.message}`,
+                kind: 'error',
             });
             return;
         }
@@ -37855,6 +38880,7 @@ function LogInkApp(deps) {
             dispatch({
                 type: 'setStatus',
                 value: `Failed to seed temp file: ${error.message}`,
+                kind: 'error',
             });
             try {
                 fs$1.rmSync(dir, { recursive: true, force: true });
@@ -37878,13 +38904,13 @@ function LogInkApp(deps) {
             out.write(`${SHOW_CURSOR}${EXIT_ALT}`);
             const result = node_child_process.spawnSync(editor, [...editorPrefixArgs, file], { stdio: 'inherit' });
             if (result.error) {
-                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}` });
+                dispatch({ type: 'setStatus', value: `Failed to launch ${editor}: ${result.error.message}`, kind: 'error' });
             }
             else if (result.signal) {
-                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}` });
+                dispatch({ type: 'setStatus', value: `${editor} interrupted by ${result.signal}`, kind: 'warning' });
             }
             else if (typeof result.status === 'number' && result.status !== 0) {
-                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}` });
+                dispatch({ type: 'setStatus', value: `${editor} exited with status ${result.status}`, kind: 'warning' });
             }
             else {
                 editorOk = true;
@@ -37903,12 +38929,13 @@ function LogInkApp(deps) {
             try {
                 const content = fs$1.readFileSync(file, 'utf8');
                 dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: content } });
-                dispatch({ type: 'setStatus', value: 'Commit draft updated from editor.' });
+                dispatch({ type: 'setStatus', value: 'Commit draft updated from editor.', kind: 'success' });
             }
             catch (error) {
                 dispatch({
                     type: 'setStatus',
                     value: `Failed to read back edited draft: ${error.message}`,
+                    kind: 'error',
                 });
             }
         }
@@ -37984,7 +39011,7 @@ function LogInkApp(deps) {
     const applyCommitSplit = React.useCallback(async () => {
         const splitPlan = state.splitPlan;
         if (!splitPlan?.plan || !splitPlan.planContext) {
-            dispatch({ type: 'setStatus', value: 'No split plan loaded yet — wait for generation.' });
+            dispatch({ type: 'setStatus', value: 'No split plan loaded yet — wait for generation.', kind: 'warning' });
             return;
         }
         // Diagnostic dump for the silent-failure bug surfaced in #944
@@ -38093,7 +39120,8 @@ function LogInkApp(deps) {
         // that could disagree with reality on partial-apply.
         const commitHashes = result.commitHashes || [];
         if (commitHashes.length > 0) {
-            dispatch({ type: 'markRecentCommits', hashes: commitHashes });
+            // Audit finding #9: timestamp captured at dispatch time.
+            dispatch({ type: 'markRecentCommits', hashes: commitHashes, markedAt: Date.now() });
             // DevSkim: ignore DS172411 — function literal, fixed delay,
             // no caller-supplied data flowing through.
             setTimeout(() => dispatch({ type: 'clearRecentCommits' }), 5000);
@@ -38954,7 +39982,7 @@ function LogInkApp(deps) {
         };
         const handler = handlers[id];
         if (!handler) {
-            dispatch({ type: 'setStatus', value: `Workflow action ${id} not yet wired` });
+            dispatch({ type: 'setStatus', value: `Workflow action ${id} not yet wired`, kind: 'warning' });
             return;
         }
         const result = await handler();
@@ -38999,7 +40027,37 @@ function LogInkApp(deps) {
             // without flickering the surfaces through a 'loading' phase.
             await refreshContext({ silent: true });
         }
-    }, [context, dispatch, git, refreshContext, refreshHistoryRows, state.branchSort, state.filter, state.selectedBranchIndex,
+        // Stash workflow follow-up. Two distinct behaviours.
+        //
+        // **apply / pop**: the user brought stashed content back into the
+        // worktree, but the sidebar still has them on the stash view.
+        // Expected next move is "look at what landed in my worktree", so
+        // jump them to history view (where the worktree counts in the
+        // sidebar are visible) AND refresh worktree context explicitly so
+        // the staged / unstaged / untracked numbers reflect the changes.
+        //
+        // **drop**: the silent context refresh above already re-fetched
+        // the stash list, BUT users reported it feeling like nothing
+        // happened. Fix two things: refresh worktree alongside (drops can
+        // affect untracked files when the stash held `-u` state), and
+        // surface the new stash count on the status line so there's
+        // unambiguous feedback that the drop landed and the list shrank.
+        if (result?.ok && (id === 'apply-stash' || id === 'pop-stash')) {
+            dispatch({ type: 'pushView', value: 'history' });
+            await refreshWorktreeContext();
+        }
+        if (result?.ok && id === 'drop-stash') {
+            // Explicit worktree refresh in case the dropped stash carried
+            // untracked-file state that's now collected.
+            await refreshWorktreeContext();
+            // The silent context refresh already replaced `context.stashes`;
+            // reading the count back here would be stale because closures
+            // capture the pre-refresh value. Status message stays generic
+            // ("Dropped stash@{N}") — the visible list shrinking is the
+            // unambiguous signal that the operation landed.
+        }
+    }, [context, dispatch, git, refreshContext, refreshHistoryRows, refreshWorktreeContext,
+        state.branchSort, state.filter, state.selectedBranchIndex,
         state.selectedStashIndex, state.selectedTagIndex, state.selectedWorktreeListIndex, state.stashDiffRef,
         state.statusFilterMask, state.tagSort]);
     // Resolve the active view's "yank target" (commit hash / branch /
@@ -39161,15 +40219,15 @@ function LogInkApp(deps) {
             }
         }
         if (!value || !label) {
-            dispatch({ type: 'setStatus', value: 'Nothing to yank in this view' });
+            dispatch({ type: 'setStatus', value: 'Nothing to yank in this view', kind: 'warning' });
             return;
         }
         try {
             await clipboard(value);
-            dispatch({ type: 'setStatus', value: `Copied ${label}` });
+            dispatch({ type: 'setStatus', value: `Copied ${label}`, kind: 'success' });
         }
         catch (error) {
-            dispatch({ type: 'setStatus', value: `Copy failed: ${error.message}` });
+            dispatch({ type: 'setStatus', value: `Copy failed: ${error.message}`, kind: 'error' });
         }
     }, [
         clipboardRunner,
@@ -39229,63 +40287,175 @@ function LogInkApp(deps) {
     React.useEffect(() => {
         loadingMoreCommitsRef.current = loadingMoreCommits;
     }, [loadingMoreCommits]);
+    // STABLE useCallback (empty deps) for loadMoreCommits. The function
+    // reads the volatile state (commit counts, fetch args, hasMore) via
+    // refs that update on every render so the identity stays constant.
+    //
+    // Why stable matters: the cursor-syncs-history auto-load chain
+    // calls this through a forward-reference ref (loadMoreCommitsRef).
+    // If loadMoreCommits regenerated on every render — as the previous
+    // implementation did via state deps — there was a render-order
+    // race: the cursor sync effect would call the PREVIOUS render's
+    // callback (still in the ref because the ref-setter useEffect runs
+    // after the cursor-sync effect in declaration order), which had
+    // captured a stale `state.commits.length` and re-fetched the same
+    // window. The auto-load chain appeared to fire but never advanced
+    // through history.
+    //
+    // Stable identity + refs sidesteps the race entirely: the function
+    // never changes, and every call reads the latest state.
+    const loadMoreStateRef = React.useRef({
+        commitsLength: state.commits.length,
+        filteredCommitsLength: state.filteredCommits.length,
+        historyFetchArgs: state.historyFetchArgs,
+        hasMoreCommits,
+        logArgv,
+    });
+    loadMoreStateRef.current = {
+        commitsLength: state.commits.length,
+        filteredCommitsLength: state.filteredCommits.length,
+        historyFetchArgs: state.historyFetchArgs,
+        hasMoreCommits,
+        logArgv,
+    };
+    const loadMoreCommits = React.useCallback(async (options = {}) => {
+        const snap = loadMoreStateRef.current;
+        if (!snap.logArgv || snap.logArgv.limit || loadingMoreCommitsRef.current || !snap.hasMoreCommits) {
+            return { fired: false, addedCommits: 0 };
+        }
+        if (snap.filteredCommitsLength === 0) {
+            return { fired: false, addedCommits: 0 };
+        }
+        loadingMoreCommitsRef.current = true;
+        const requestId = loadMoreRequestRef.current + 1;
+        loadMoreRequestRef.current = requestId;
+        setLoadingMoreCommits(true);
+        dispatch({
+            type: 'setStatus',
+            value: options.statusMessage || 'loading older commits',
+            loading: true,
+        });
+        const fetchArgs = snap.historyFetchArgs;
+        const mergedArgv = {
+            ...snap.logArgv,
+            ...(fetchArgs?.author ? { author: fetchArgs.author } : {}),
+            ...(fetchArgs?.path ? { path: fetchArgs.path } : {}),
+        };
+        // Load-more paths a fresh page from git AFTER what's already
+        // loaded; pass the stash hashes again so the additional rows
+        // stay graph-consistent with the boot fetch (a window that
+        // dropped stashes mid-stream would render with broken junctions).
+        const stashHashes = await getStashCommitHashes(git).catch(() => []);
+        const nextRows = await safe(getLogRows(git, mergedArgv, {
+            limit: LOG_INTERACTIVE_DEFAULT_LIMIT,
+            skip: snap.commitsLength,
+            extraRefs: stashHashes,
+        }));
+        if (!mountedRef.current || loadMoreRequestRef.current !== requestId) {
+            return { fired: false, addedCommits: 0 };
+        }
+        loadingMoreCommitsRef.current = false;
+        setLoadingMoreCommits(false);
+        const nextCommitCount = nextRows ? getCommitRows(nextRows).length : 0;
+        if (!nextRows) {
+            dispatch({ type: 'setStatus', value: 'failed to load older commits', kind: 'error' });
+            return { fired: false, addedCommits: 0 };
+        }
+        if (nextRows?.length) {
+            dispatch({ type: 'appendRows', rows: nextRows });
+        }
+        setHasMoreCommits(nextCommitCount >= LOG_INTERACTIVE_DEFAULT_LIMIT);
+        return { fired: true, addedCommits: nextCommitCount };
+        // Empty deps — the function is intentionally stable. State is
+        // read via `loadMoreStateRef.current` at call time, and `dispatch`
+        // / `git` / `setLoadingMoreCommits` / `setHasMoreCommits` are
+        // already stable across renders by React's contract.
+    }, [dispatch, git]);
+    // Scroll-near-bottom auto-trigger. Fires when the user's cursor is
+    // within 20 rows of the last loaded commit so older history is
+    // already on its way by the time they reach the bottom.
     React.useEffect(() => {
         const remaining = state.filteredCommits.length - state.selectedIndex - 1;
-        async function loadMoreCommits() {
-            if (!logArgv || logArgv.limit || loadingMoreCommitsRef.current || !hasMoreCommits) {
-                return;
-            }
-            if (state.filteredCommits.length === 0 || remaining > 20) {
-                return;
-            }
-            loadingMoreCommitsRef.current = true;
-            const requestId = loadMoreRequestRef.current + 1;
-            loadMoreRequestRef.current = requestId;
-            setLoadingMoreCommits(true);
-            dispatch({ type: 'setStatus', value: 'loading older commits' });
-            const fetchArgs = state.historyFetchArgs;
-            const mergedArgv = {
-                ...logArgv,
-                ...(fetchArgs?.author ? { author: fetchArgs.author } : {}),
-                ...(fetchArgs?.path ? { path: fetchArgs.path } : {}),
-            };
-            const nextRows = await safe(getLogRows(git, mergedArgv, {
-                limit: LOG_INTERACTIVE_DEFAULT_LIMIT,
-                skip: state.commits.length,
-            }));
-            if (!mountedRef.current || loadMoreRequestRef.current !== requestId) {
-                return;
-            }
-            loadingMoreCommitsRef.current = false;
-            setLoadingMoreCommits(false);
-            const nextCommitCount = nextRows ? getCommitRows(nextRows).length : 0;
-            if (!nextRows) {
-                dispatch({ type: 'setStatus', value: 'failed to load older commits' });
-                return;
-            }
-            if (nextRows?.length) {
-                dispatch({ type: 'appendRows', rows: nextRows });
+        if (remaining > 20)
+            return;
+        void loadMoreCommits().then((result) => {
+            if (result.fired) {
+                dispatch({
+                    type: 'setStatus',
+                    value: result.addedCommits
+                        ? `loaded ${result.addedCommits} older commits`
+                        : 'end of history',
+                });
             }
-            setHasMoreCommits(nextCommitCount >= LOG_INTERACTIVE_DEFAULT_LIMIT);
-            dispatch({
-                type: 'setStatus',
-                value: nextCommitCount
-                    ? `loaded ${nextCommitCount} older commits`
-                    : 'end of history',
-            });
-        }
-        void loadMoreCommits();
+        });
     }, [
         dispatch,
-        git,
-        hasMoreCommits,
-        loadingMoreCommits,
-        logArgv,
-        state.commits.length,
+        loadMoreCommits,
         state.filteredCommits.length,
-        state.historyFetchArgs,
         state.selectedIndex,
     ]);
+    /**
+     * Targeted-context loader for the cursor-syncs-history effect. Called
+     * when the resolver returns `load-context` — the user cursored a
+     * branch / tag / stash whose target commit isn't in the loaded
+     * window, so we run a `git log` anchored on that commit (guaranteed
+     * to include it) and merge the result via `appendRows` (which
+     * already deduplicates by hash).
+     *
+     * Stable identity (empty deps) for the same reason as
+     * `loadMoreCommits` — the cursor-sync effect calls this through a
+     * forward-reference ref, and a regenerating callback would
+     * reintroduce the render-order race that bit the previous chain.
+     * All volatile state (logArgv, mostly) is read via refs.
+     */
+    const loadCommitContextStateRef = React.useRef({ logArgv });
+    loadCommitContextStateRef.current = { logArgv };
+    const loadCommitContext = React.useCallback(async (target) => {
+        const snap = loadCommitContextStateRef.current;
+        if (!snap.logArgv)
+            return;
+        dispatch({
+            type: 'setStatus',
+            value: `Loading commits around ${target.label}…`,
+            loading: true,
+        });
+        try {
+            // No stashHashes here — `getLogRowsAnchoredOn` walks only from
+            // the target so it can guarantee the target's inclusion.
+            // Stashes are already in the loaded graph from boot's
+            // `loadRowsWithStashes`; `appendRows` deduplicates by hash so
+            // the merged result keeps both views without double-counting.
+            const rows = await getLogRowsAnchoredOn(git, snap.logArgv, target.hash, {});
+            if (!mountedRef.current)
+                return;
+            if (rows.length > 0) {
+                dispatch({ type: 'appendRows', rows });
+                // Don't dispatch a setStatus here — the cursor-sync effect
+                // will re-fire on the appendRows-driven filteredCommits
+                // change and either jump (success) or report unreachable
+                // (failure), surfacing the right message.
+            }
+            else {
+                dispatch({
+                    type: 'setStatus',
+                    value: `${target.label} target commit returned no rows — orphan ref?`,
+                    kind: 'warning',
+                });
+            }
+        }
+        catch (error) {
+            if (mountedRef.current) {
+                dispatch({
+                    type: 'setStatus',
+                    value: `Failed to load context for ${target.label}: ${error instanceof Error ? error.message : String(error)}`,
+                    kind: 'error',
+                });
+            }
+        }
+    }, [dispatch, git]);
+    React.useEffect(() => {
+        loadCommitContextRef.current = loadCommitContext;
+    }, [loadCommitContext]);
     // Server-side history filter (#776). When the user submits `path:foo`
     // or `author:foo`, the filter parser dispatches setHistoryFetchArgs;
     // this effect picks up the change, re-runs `getLogRows` with merged
@@ -39321,12 +40491,16 @@ function LogInkApp(deps) {
             value: description ? `Refetching with ${description}` : 'Restoring full log',
         });
         void (async () => {
-            const nextRows = await safe(getLogRows(git, merged, { limit: LOG_INTERACTIVE_DEFAULT_LIMIT }));
+            const stashHashes = await getStashCommitHashes(git).catch(() => []);
+            const nextRows = await safe(getLogRows(git, merged, {
+                limit: LOG_INTERACTIVE_DEFAULT_LIMIT,
+                extraRefs: stashHashes,
+            }));
             if (!mountedRef.current || historyFetchRequestRef.current !== requestId) {
                 return;
             }
             if (!nextRows) {
-                dispatch({ type: 'setStatus', value: 'Failed to refetch with active filter' });
+                dispatch({ type: 'setStatus', value: 'Failed to refetch with active filter', kind: 'error' });
                 return;
             }
             dispatch({ type: 'replaceRows', rows: nextRows });
@@ -39337,6 +40511,7 @@ function LogInkApp(deps) {
                 value: description
                     ? `Showing ${matched} commits matching ${description}`
                     : 'Showing full log',
+                kind: 'success',
             });
         })();
     }, [dispatch, git, logArgv, state.historyFetchArgs]);
@@ -39366,12 +40541,20 @@ function LogInkApp(deps) {
                 : 'Loading compact history…',
         });
         void (async () => {
-            const nextRows = await safe(getLogRows(git, merged, { limit: LOG_INTERACTIVE_DEFAULT_LIMIT }));
+            // Include stash commits as graph roots so the toggle's re-fetch
+            // sees the same rich graph the boot loader assembles. Without
+            // this, flipping `\` into full mode and back loses the stash
+            // anchors that loadRowsWithStashes seeded on boot.
+            const stashHashes = await getStashCommitHashes(git).catch(() => []);
+            const nextRows = await safe(getLogRows(git, merged, {
+                limit: LOG_INTERACTIVE_DEFAULT_LIMIT,
+                extraRefs: stashHashes,
+            }));
             if (!mountedRef.current || toggleGraphRequestRef.current !== requestId) {
                 return;
             }
             if (!nextRows) {
-                dispatch({ type: 'setStatus', value: 'Failed to refetch graph rows' });
+                dispatch({ type: 'setStatus', value: 'Failed to refetch graph rows', kind: 'error' });
                 return;
             }
             dispatch({ type: 'replaceRows', rows: nextRows });
@@ -39382,6 +40565,7 @@ function LogInkApp(deps) {
                 value: state.fullGraph
                     ? `Showing ${matched} commits across all branches`
                     : `Showing ${matched} commits (compact)`,
+                kind: 'success',
             });
         })();
     }, [dispatch, git, logArgv, state.fullGraph]);
@@ -40076,6 +41260,17 @@ function createLogArgvFromUiArgv(argv) {
     return {
         $0: argv.$0,
         _: ['log'],
+        // Pass `--all` through from the CLI. The yargs default is `true`
+        // since 0.54.x — user feedback consistently asked for the
+        // GitKraken-style "see all branches, tags, stashes" view as the
+        // starting state. `coco ui --no-all` opts back to
+        // current-branch-only.
+        //
+        // Note: passing `--branch foo` does NOT automatically scope away
+        // from --all. If the user wants strictly that branch, they pass
+        // `coco ui --branch foo --no-all`. We considered the implicit
+        // scope-narrowing but it surprises users who pass `--branch` as
+        // a "highlight this branch in the all-refs view" hint.
         all: argv.all,
         branch: argv.branch,
         format: 'table',
@@ -40112,6 +41307,26 @@ function withCacheWrite(repoPath, loader) {
         return rows;
     };
 }
+/**
+ * Workstation-aware log loader (#1034 follow-up). Calls `git stash
+ * list` first to collect every stash's commit hash, then passes them
+ * as extra refs to `getLogRows` so the graph includes every stash as
+ * a node — not just the latest (which is the only one `refs/stash`
+ * points at and the only one `git log --all` walks).
+ *
+ * Without this, the stash → history cursor sync added in #1034 only
+ * worked for `stash@{0}`; cursoring any older stash row reported
+ * "tip not in loaded window" because that stash's commit hash was
+ * never in the loaded graph window in the first place.
+ *
+ * The extra git call is cheap (one `git stash list --format=%H`,
+ * usually sub-50ms). It's only an additive cost when stashes exist;
+ * users on stash-free repos pay nothing.
+ */
+async function loadRowsWithStashes(git, logArgv) {
+    const stashHashes = await getStashCommitHashes(git).catch(() => []);
+    return getLogRows(git, logArgv, { extraRefs: stashHashes });
+}
 async function startCocoUiFromLogArgv(logArgv, options = {}) {
     const config = options.config || loadConfig(logArgv);
     const git = options.git || getRepo();
@@ -40130,7 +41345,7 @@ async function startCocoUiFromLogArgv(logArgv, options = {}) {
     const initialRows = options.rows || cachedRows || [];
     const loadRows = options.rows
         ? undefined
-        : withCacheWrite(repoPath, () => getLogRows(git, logArgv));
+        : withCacheWrite(repoPath, () => loadRowsWithStashes(git, logArgv));
     await startInkInteractiveLog(git, initialRows, {}, {
         appLabel: 'coco',
         idleTips: config.logTui?.idleTips,
@@ -40158,7 +41373,7 @@ async function startCocoUi(argv) {
         idleTips: config.logTui?.idleTips,
         dateBucketing: config.logTui?.dateBucketing,
         initialView: argv.view || 'history',
-        loadRows: withCacheWrite(repoPath, () => getLogRows(git, logArgv)),
+        loadRows: withCacheWrite(repoPath, () => loadRowsWithStashes(git, logArgv)),
         logArgv,
         theme: createUiTheme(config, argv),
     });
@@ -41361,9 +42576,9 @@ const options = {
         default: 'history',
     },
     all: {
-        description: 'Load commits from all local and remote refs in history mode',
+        description: 'Load commits from all local and remote refs in history mode. Defaults to true so the history view shows the full multi-ref graph (branches, tags, stashes) out of the box; pass `--no-all` to scope to the current branch only.',
         type: 'boolean',
-        default: false,
+        default: true,
     },
     branch: {
         description: 'Load history reachable from a branch or ref',