gsd-pi 2.78.0 → 2.78.1-dev.9d08d820b

package/src/resources/extensions/gsd/commands-prefs-wizard.ts

@@ -1524,6 +1524,18 @@ async function configureAdvanced(ctx: ExtensionCommandContext, prefs: Record<str
   const tokenCost = await promptBoolean(ctx, "Show token cost in footer", prefs.show_token_cost, false);
   if (tokenCost !== undefined) prefs.show_token_cost = tokenCost;
 
+  const minRequestInterval = await promptInteger(
+    ctx,
+    "Minimum interval between auto-mode LLM requests (ms, 0 to disable)",
+    prefs.min_request_interval_ms,
+    "0",
+  );
+  if (minRequestInterval === "clear") {
+    delete prefs.min_request_interval_ms;
+  } else if (minRequestInterval !== undefined) {
+    prefs.min_request_interval_ms = minRequestInterval;
+  }
+
   const widget = await promptEnum(ctx, "Auto-mode widget display", prefs.widget_mode, ["full", "small", "min", "off"], "full");
   if (widget !== undefined) prefs.widget_mode = widget;
 
@@ -1715,8 +1727,10 @@ export function serializePreferencesToFrontmatter(prefs: Record<string, unknown>
     "budget_ceiling", "budget_enforcement", "context_pause_threshold",
     "notifications", "cmux", "remote_questions", "git",
     "stale_commit_threshold_minutes",
+    "min_request_interval_ms",
     "post_unit_hooks", "pre_dispatch_hooks",
-    "dynamic_routing", "uok", "token_profile", "service_tier", "flat_rate_providers",
+    "dynamic_routing", "disabled_model_providers", "uok", "token_profile",
+    "service_tier", "flat_rate_providers",
     "phases", "parallel", "slice_parallel",
     "reactive_execution", "gate_evaluation",
     "auto_visualize", "auto_report",

package/src/resources/extensions/gsd/dashboard-overlay.ts

@@ -21,7 +21,7 @@ import {
   type UnitMetrics,
 } from "./metrics.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { getActiveWorktreeName } from "./worktree-command.js";
+import { getActiveWorktreeName } from "./worktree-session-state.js";
 import { getWorkerBatches, hasActiveWorkers, type WorkerEntry } from "../subagent/worker-registry.js";
 import { formatDuration, padRight, joinColumns, centerLine, fitColumns, STATUS_GLYPH, STATUS_COLOR } from "../shared/mod.js";
 import { estimateTimeRemaining } from "./auto-dashboard.js";

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -126,6 +126,8 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `idle_timeout_minutes`: minutes of inactivity before the supervisor intervenes (default: 10).
   - `hard_timeout_minutes`: minutes before the supervisor forces termination (default: 30).
 
+- `min_request_interval_ms`: number — minimum integer milliseconds between auto-mode LLM request dispatches. Non-integer values are rounded down (e.g., `1000.9 → 1000`). Use this to proactively slow auto-mode on rate-limited providers and reduce 429 errors. Set to `0` to disable. Default: `0` (disabled).
+
 - `git`: configures GSD's git behavior. All fields are optional — omit any to use defaults. Keys:
   - `auto_push`: boolean — automatically push commits to the remote after committing. Default: `false`.
   - `push_branches`: boolean — push the milestone branch to the remote after commits. Default: `false`.
@@ -163,6 +165,12 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 
+- `reactive_execution`: controls automatic parallel task dispatch inside a slice. Reactive execution is enabled by default when omitted; set `enabled: false` to opt out. With default-on behavior, GSD only attempts a reactive batch when at least three ready tasks are available and the task-plan IO graph is non-ambiguous. If you set `enabled: true` explicitly, GSD uses the earlier opt-in threshold of two ready tasks. Keys:
+  - `enabled`: boolean — set `false` to force sequential task execution. Default: `true`.
+  - `max_parallel`: number — maximum tasks to dispatch in one batch, range `1`-`8`. Default: `2`.
+  - `isolation_mode`: `"same-tree"` — currently the only supported value.
+  - `subagent_model`: string — optional model override for reactive task subagents. Falls back to the `models.subagent` routing when omitted.
+
 - `remote_questions`: route interactive questions to Slack/Discord for headless auto-mode. Keys:
   - `channel`: `"slack"` or `"discord"` — channel type.
   - `channel_id`: string or number — channel ID.
@@ -193,6 +201,8 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
   - `hooks`: boolean — enable routing hooks. Default: `true`.
   - `capability_routing`: boolean — enable capability-profile scoring for model selection within a tier. Requires `enabled: true`. Default: `false`.
 
+- `disabled_model_providers`: string[] — provider IDs to hide from model selection and routing (for example `["google-gemini-cli"]`). This only affects model availability (`/model`, auto-model selection, routing); it does not disable tool auth flows like `google_search`.
+
 - `uok`: Unified Orchestration Kernel controls. Keys:
   - `enabled`: boolean — enable kernel wrappers and contract observers. Default: `true`.
   - `legacy_fallback.enabled`: boolean — emergency release fallback that forces legacy orchestration behavior even when `uok.enabled` is `true`. Default: `false`.

package/src/resources/extensions/gsd/doctor-providers.ts

@@ -17,6 +17,7 @@ import { AuthStorage } from "@gsd/pi-coding-agent";
 import { getEnvApiKey } from "@gsd/pi-ai";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { getAuthPath, PROVIDER_REGISTRY, type ProviderCategory } from "./key-manager.js";
+import { getHomeDir } from "./home-dir.js";
 
 // ── Types ──────────────────────────────────────────────────────────────────────
 
@@ -194,7 +195,7 @@ function isCliBinaryInPath(providerId: string): boolean {
 }
 
 function modelsJsonPaths(): string[] {
-  const home = process.env.HOME ?? "~";
+  const home = getHomeDir();
   return [
     join(home, ".gsd", "agent", "models.json"),
     // Keep parity with custom-provider discovery during auto bootstrap.

package/src/resources/extensions/gsd/doctor-runtime-checks.ts

@@ -4,7 +4,7 @@ import { basename, dirname, join } from "node:path";
 import type { DoctorIssue, DoctorIssueCode } from "./doctor-types.js";
 import { cleanNumberedGsdVariants } from "./repo-identity.js";
 import { milestonesDir, gsdRoot, resolveGsdRootFile } from "./paths.js";
-import { deriveState } from "./state.js";
+import { deriveState, isGhostMilestone, isReusableGhostMilestone } from "./state.js";
 import { saveFile } from "./files.js";
 import { nativeIsRepo, nativeForEachRef, nativeUpdateRef } from "./native-git-bridge.js";
 import { readCrashLock, isLockProcessAlive, clearLock } from "./crash-recovery.js";
@@ -12,6 +12,7 @@ import { ensureGitignore, isGsdGitignored } from "./gitignore.js";
 import { readAllSessionStatuses, isSessionStale, removeSessionStatus } from "./session-status-io.js";
 import { recoverFailedMigration } from "./migrate-external.js";
 import { splitCompletedKey } from "./forensics.js";
+import { findMilestoneIds } from "./milestone-ids.js";
 
 export async function checkRuntimeHealth(
   basePath: string,
@@ -593,6 +594,43 @@ export async function checkRuntimeHealth(
   } catch {
     // Non-fatal — snapshot ref check failed
   }
+
+  // ── Orphan milestone directories (#4996) ──────────────────────────────
+  // Walk every milestone ID on disk. Any dir that has no DB row, no worktree,
+  // and no content files is an orphaned stub — it skews nextMilestoneId and
+  // was likely created by ensurePreconditions or showHeadlessMilestoneCreation
+  // for a phantom forward-reference. Surface as a fixable warning.
+  try {
+    const milestoneIds = findMilestoneIds(basePath);
+    const hasDbFile = existsSync(join(root, "gsd.db"));
+    for (const mid of milestoneIds) {
+      const isOrphan = isReusableGhostMilestone(basePath, mid)
+        || (!hasDbFile && isGhostMilestone(basePath, mid));
+      if (isOrphan) {
+        issues.push({
+          severity: "warning",
+          code: "orphan_milestone_dir",
+          scope: "milestone",
+          unitId: mid,
+          message: `Orphan milestone directory: ${mid} — directory exists on disk with no DB row, no worktree, and no content files. This stub skews milestone ID generation and should be removed.`,
+          file: `.gsd/milestones/${mid}`,
+          fixable: true,
+        });
+
+        if (shouldFix("orphan_milestone_dir")) {
+          try {
+            const orphanPath = join(milestonesDir(basePath), mid);
+            rmSync(orphanPath, { recursive: true, force: true });
+            fixesApplied.push(`removed orphan milestone directory: ${mid}`);
+          } catch {
+            // Non-fatal — leave for manual cleanup
+          }
+        }
+      }
+    }
+  } catch {
+    // Non-fatal — orphan milestone directory check failed
+  }
 }
 
 /**

package/src/resources/extensions/gsd/doctor-types.ts

@@ -80,7 +80,9 @@ export type DoctorIssueCode =
   | "db_done_task_no_summary"
   | "db_duplicate_id"
   | "db_unavailable"
-  | "projection_drift";
+  | "projection_drift"
+  // Milestone filesystem/DB drift (#4996)
+  | "orphan_milestone_dir";
 
 /**
  * Issue codes that represent global or completion-critical state.

package/src/resources/extensions/gsd/error-classifier.ts

@@ -59,7 +59,7 @@ const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fet
 // Context overflow errors (context window/length exceeded) should be treated as server-class
 // transient errors so auto-mode can retry with reduced budget or fall back to a larger-context model.
 // See: https://github.com/gsd-build/gsd-2/issues/4528
-const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable|context (?:window|length) exceed|context window exceed/i;
+const SERVER_RE = /internal(?: server)?[ _-]?error|500|502|503|overloaded|server_error|api_error|service.?unavailable|context (?:window|length) exceed|context window exceed/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
 const CONNECTION_RE = /terminated|connection.?(?:refused|error)|other side closed|EPIPE|network.?(?:is\s+)?unavailable|stream_exhausted(?:_without_result)?/i;
 // Catch-all for V8 JSON.parse errors: all modern variants end with "in JSON at position \d+".

package/src/resources/extensions/gsd/forensics.ts

@@ -12,7 +12,7 @@ import type { ExtensionAPI, ExtensionCommandContext } from "@gsd/pi-coding-agent
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { join, dirname, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { homedir } from "node:os";
+import { getHomeDir } from "./home-dir.js";
 
 import { extractTrace, type ExecutionTrace } from "./session-forensics.js";
 import { nativeParseJsonlTail } from "./native-parser-bridge.js";
@@ -244,7 +244,7 @@ export async function handleForensics(
   // when import.meta.url resolves to the npm-global install path (Windows).
   let gsdSourceDir = dirname(fileURLToPath(import.meta.url));
   if (!existsSync(join(gsdSourceDir, "prompts"))) {
-    const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
+    const gsdHome = process.env.GSD_HOME || join(getHomeDir(), ".gsd");
     const fallback = join(gsdHome, "agent", "extensions", "gsd");
     if (existsSync(join(fallback, "prompts"))) gsdSourceDir = fallback;
   }
@@ -804,7 +804,7 @@ function detectMissingArtifacts(completedKeys: string[], basePath: string, activ
  * the forensics memory-bloat guard in forensics-journal.test.ts — per-event
  * detail stays in the journal itself where the LLM can query it on demand.
  */
-function detectWorktreeOrphans(
+export function detectWorktreeOrphans(
   summary: WorktreeTelemetrySummary,
   anomalies: ForensicAnomaly[],
 ): void {
@@ -822,7 +822,7 @@ function detectWorktreeOrphans(
         reason === "in-progress-unmerged"
           ? "Auto-mode exited without completing a milestone; live work sits on an unmerged milestone branch. Run `/gsd auto` to resume, or merge manually."
           : reason === "complete-unmerged"
-            ? "A completed milestone's branch was never merged back to main. Run `/gsd health --fix` to resolve."
+            ? "A completed milestone's branch was never merged back to main. Run `/gsd doctor fix` to resolve."
             : `Reason: ${reason}.`,
     });
   }
@@ -1299,10 +1299,15 @@ function formatReportForPrompt(report: ForensicReport): string {
 function redactForGitHub(text: string, basePath: string): string {
   let result = text;
 
+  // Build regex that matches both / and \ separator variants (Windows)
+  // Normalize to / first, escape for regex, then replace each / with [/\\]
+  const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pathRe = (p: string) =>
+    new RegExp(esc(p.replace(/\\/g, "/")).replace(/\//g, "[/\\\\]"), "gi");
+
   // Replace absolute paths
-  result = result.replaceAll(basePath, ".");
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  if (home) result = result.replaceAll(home, "~");
+  result = result.replace(pathRe(basePath), ".");
+  result = result.replace(pathRe(getHomeDir()), "~");
 
   // Strip API key patterns
   result = result.replace(/sk-[a-zA-Z0-9]{20,}/g, "sk-***");

package/src/resources/extensions/gsd/git-service.ts

@@ -38,6 +38,7 @@ import {
 } from "./native-git-bridge.js";
 import { GSDError, GSD_MERGE_CONFLICT, GSD_GIT_ERROR } from "./errors.js";
 import { getErrorMessage } from "./error-utils.js";
+import { isInfrastructureError } from "./auto/infra-errors.js";
 
 // ─── Types ─────────────────────────────────────────────────────────────────
 
@@ -991,6 +992,17 @@ function buildTurnSnapshotLabel(unitType: string, unitId: string): string {
     .replace(/^[-/]+|[-/]+$/g, "") || "turn";
 }
 
+export function handleTurnGitActionError(action: TurnGitActionMode, err: unknown): TurnGitActionResult {
+  if (isInfrastructureError(err)) {
+    throw err;
+  }
+  return {
+    action,
+    status: "failed",
+    error: getErrorMessage(err),
+  };
+}
+
 export function runTurnGitAction(args: {
   basePath: string;
   action: TurnGitActionMode;
@@ -1029,11 +1041,7 @@ export function runTurnGitAction(args: {
       dirty: nativeHasChanges(args.basePath),
     };
   } catch (err) {
-    return {
-      action: args.action,
-      status: "failed",
-      error: getErrorMessage(err),
-    };
+    return handleTurnGitActionError(args.action, err);
   }
 }
 

package/src/resources/extensions/gsd/gsd-db.ts

@@ -1405,6 +1405,16 @@ export function checkpointDatabase(): void {
 
 let _txDepth = 0;
 
+/**
+ * Whether the current call is running inside an active SQLite transaction.
+ * Statement-time recovery paths (e.g. VACUUM retry on a malformed memory
+ * store) MUST gate on this — SQLite refuses VACUUM inside a transaction
+ * and would mask the original error with a secondary "cannot VACUUM" throw.
+ */
+export function isInTransaction(): boolean {
+  return _txDepth > 0;
+}
+
 export function transaction<T>(fn: () => T): T {
   if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
 
@@ -1419,8 +1429,8 @@ export function transaction<T>(fn: () => T): T {
     }
   }
 
-  _txDepth++;
   currentDb.exec("BEGIN");
+  _txDepth++;
   try {
     const result = fn();
     currentDb.exec("COMMIT");
@@ -1452,8 +1462,8 @@ export function readTransaction<T>(fn: () => T): T {
     }
   }
 
-  _txDepth++;
   currentDb.exec("BEGIN DEFERRED");
+  _txDepth++;
   try {
     const result = fn();
     currentDb.exec("COMMIT");

package/src/resources/extensions/gsd/guided-flow.ts

@@ -25,6 +25,7 @@ import {
 } from "./interrupted-session.js";
 import { listUnitRuntimeRecords, clearUnitRuntimeRecord } from "./unit-runtime.js";
 import { resolveExpectedArtifactPath } from "./auto.js";
+import { getHomeDir } from "./home-dir.js";
 import {
   gsdRoot, milestonesDir, resolveMilestoneFile, resolveMilestonePath,
   resolveSliceFile, resolveSlicePath, resolveGsdRootFile, relGsdRootFile,
@@ -44,7 +45,9 @@ import { showProjectInit, offerMigration } from "./init-wizard.js";
 import { validateDirectory } from "./validate-directory.js";
 import { showConfirm } from "../shared/tui.js";
 import { debugLog } from "./debug-logger.js";
-import { findMilestoneIds, nextMilestoneId, reserveMilestoneId, getReservedMilestoneIds, clearReservedMilestoneIds } from "./milestone-ids.js";
+import { findMilestoneIds, clearReservedMilestoneIds } from "./milestone-ids.js";
+import { nextMilestoneIdReserved } from "./milestone-id-reservation.js";
+export { nextMilestoneIdReserved } from "./milestone-id-reservation.js";
 import { parkMilestone, discardMilestone } from "./milestone-actions.js";
 import { selectAndApplyModel } from "./auto-model-selection.js";
 import { DISCUSS_TOOLS_ALLOWLIST } from "./constants.js";
@@ -72,20 +75,6 @@ export {
 } from "./guided-flow-queue.js";
 import { logWarning } from "./workflow-logger.js";
 
-// ─── ID Generation with Reservation ─────────────────────────────────────────
-
-/**
- * Generate the next milestone ID, accounting for reserved IDs, and reserve it.
- * Ensures any preview ID shown in the UI matches what `gsd_milestone_generate_id`
- * will later return.
- */
-function nextMilestoneIdReserved(existingIds: string[], uniqueEnabled: boolean): string {
-  const allIds = [...new Set([...existingIds, ...getReservedMilestoneIds()])];
-  const id = nextMilestoneId(allIds, uniqueEnabled);
-  reserveMilestoneId(id);
-  return id;
-}
-
 function needsPlanV2Gate(state: GSDState): boolean {
   return state.phase === "executing"
     || state.phase === "summarizing"
@@ -619,7 +608,7 @@ async function dispatchWorkflow(
     });
   }
 
-  const workflowPath = process.env.GSD_WORKFLOW_PATH ?? join(process.env.HOME ?? "~", ".gsd", "agent", "GSD-WORKFLOW.md");
+  const workflowPath = process.env.GSD_WORKFLOW_PATH ?? join(getHomeDir(), ".gsd", "agent", "GSD-WORKFLOW.md");
   const workflow = readFileSync(workflowPath, "utf-8");
 
   pi.sendMessage(
@@ -832,14 +821,19 @@ export async function showHeadlessMilestoneCreation(
   // Ensure .gsd/ is bootstrapped
   bootstrapGsdProject(basePath);
 
+  const { ensureDbOpen } = await import("./bootstrap/dynamic-tools.js");
+  await ensureDbOpen(basePath);
+
   // Generate next milestone ID
   const existingIds = findMilestoneIds(basePath);
   const prefs = loadEffectiveGSDPreferences();
-  const nextId = nextMilestoneIdReserved(existingIds, prefs?.preferences?.unique_milestone_ids ?? false);
+  const nextId = nextMilestoneIdReserved(existingIds, prefs?.preferences?.unique_milestone_ids ?? false, basePath);
 
-  // Create milestone directory
-  const milestoneDir = join(gsdRoot(basePath), "milestones", nextId, "slices");
-  mkdirSync(milestoneDir, { recursive: true });
+  // Fix #4996: Do NOT pre-create the milestone directory here.
+  // atomicWriteAsync (used by all artifact writers) calls mkdir lazily before
+  // each write, so every path through saveArtifactToDb / saveFile is already
+  // lazy-mkdir-safe. Pre-creating the dir before the discuss flow runs leaves
+  // an orphan stub if discuss is abandoned — that stub later skews nextMilestoneId.
 
   // Build and dispatch the headless discuss prompt
   const prompt = buildHeadlessDiscussPrompt(nextId, seedContext, basePath);
@@ -1054,9 +1048,11 @@ export async function showDiscuss(
         fastPathInstruction: "",
       }), "gsd-discuss", ctx, "discuss-milestone");
     } else if (choice === "skip_milestone") {
+      const { ensureDbOpen } = await import("./bootstrap/dynamic-tools.js");
+      await ensureDbOpen(basePath);
       const milestoneIds = findMilestoneIds(basePath);
       const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
       pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, step: false, createdAt: Date.now() });
       await dispatchWorkflow(pi, await prepareAndBuildDiscussPrompt(ctx, pi, nextId, `New milestone ${nextId}.`, basePath), "gsd-run", ctx, "discuss-milestone");
     }
@@ -1461,7 +1457,7 @@ async function handleMilestoneActions(
   if (choice === "skip") {
     const milestoneIds = findMilestoneIds(basePath);
     const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-    const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+    const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
     pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, step: stepMode, createdAt: Date.now() });
     await dispatchWorkflow(pi, await prepareAndBuildDiscussPrompt(ctx, pi, nextId,
       `New milestone ${nextId}.`,
@@ -1546,6 +1542,11 @@ export async function showSmartEntry(
   ensureGitignore(basePath);
   untrackRuntimeFiles(basePath);
 
+  {
+    const { ensureDbOpen } = await import("./bootstrap/dynamic-tools.js");
+    await ensureDbOpen(basePath);
+  }
+
   // ── Self-heal stale runtime records from crashed auto-mode sessions ──
   selfHealRuntimeRecords(basePath, ctx);
 
@@ -1648,7 +1649,7 @@ export async function showSmartEntry(
     }
 
     const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-    const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+    const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
     const isFirst = milestoneIds.length === 0;
 
     if (isFirst) {
@@ -1728,7 +1729,7 @@ export async function showSmartEntry(
     if (choice === "new_milestone") {
       const milestoneIds = findMilestoneIds(basePath);
       const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
 
       pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, step: stepMode, createdAt: Date.now() });
       await dispatchWorkflow(pi, await prepareAndBuildDiscussPrompt(ctx, pi, nextId,
@@ -1796,7 +1797,7 @@ export async function showSmartEntry(
     } else if (choice === "skip_milestone") {
       const milestoneIds = findMilestoneIds(basePath);
       const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+      const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
       pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, step: stepMode, createdAt: Date.now() });
       await dispatchWorkflow(pi, await prepareAndBuildDiscussPrompt(ctx, pi, nextId,
         `New milestone ${nextId}.`,
@@ -1893,7 +1894,7 @@ export async function showSmartEntry(
       } else if (choice === "skip_milestone") {
         const milestoneIds = findMilestoneIds(basePath);
         const uniqueMilestoneIds = !!loadEffectiveGSDPreferences()?.preferences?.unique_milestone_ids;
-        const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds);
+        const nextId = nextMilestoneIdReserved(milestoneIds, uniqueMilestoneIds, basePath);
         pendingAutoStartMap.set(basePath, { ctx, pi, basePath, milestoneId: nextId, step: stepMode, createdAt: Date.now() });
         await dispatchWorkflow(pi, await prepareAndBuildDiscussPrompt(ctx, pi, nextId,
           `New milestone ${nextId}.`,

package/src/resources/extensions/gsd/home-dir.ts

@@ -0,0 +1,19 @@
+/**
+ * Cross-platform home directory resolution.
+ *
+ * `process.env.HOME` is not set on Windows (CMD/PowerShell).
+ * Falls back to USERPROFILE, then os.homedir(), then throws.
+ *
+ * @see https://github.com/gsd-build/gsd-2/issues/5015
+ */
+import { homedir } from "node:os";
+
+export function getHomeDir(): string {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  if (!home) {
+    throw new Error(
+      "Cannot resolve home directory. Set HOME or USERPROFILE environment variable.",
+    );
+  }
+  return home;
+}

package/src/resources/extensions/gsd/journal.ts

@@ -60,7 +60,10 @@ export type JournalEventType =
   | "canonical-root-redirect"
   // #4765 — slice-cadence collapse
   | "slice-merged"
-  | "milestone-resquash";
+  | "milestone-resquash"
+  // dispatch telemetry — measure agent/subagent invocation frequency and shape
+  | "subagent-invoked"
+  | "subagent-completed";
 
 /** A single structured event in the journal. */
 export interface JournalEntry {

package/src/resources/extensions/gsd/key-manager.ts

@@ -17,6 +17,7 @@ import { existsSync, statSync, chmodSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { mkdirSync } from "node:fs";
 import { getErrorMessage } from "./error-utils.js";
+import { getHomeDir } from "./home-dir.js";
 
 // ─── Provider Registry ─────────────────────────────────────────────────────────
 
@@ -122,7 +123,7 @@ export function describeCredential(cred: AuthCredential): string {
  * Get the auth.json path.
  */
 export function getAuthPath(): string {
-  return join(process.env.HOME ?? "~", ".gsd", "agent", "auth.json");
+  return join(getHomeDir(), ".gsd", "agent", "auth.json");
 }
 
 /**

package/src/resources/extensions/gsd/memory-store.ts

@@ -7,6 +7,7 @@ import {
   isDbAvailable,
   _getAdapter,
   transaction,
+  isInTransaction,
   insertMemoryRow,
   rewriteMemoryId,
   updateMemoryContentRow,
@@ -19,6 +20,7 @@ import {
   deleteMemoryRelationsFor,
 } from './gsd-db.js';
 import { createMemoryRelation, isValidRelation } from './memory-relations.js';
+import { logWarning } from './workflow-logger.js';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 
@@ -487,7 +489,13 @@ export function nextMemoryId(): string {
  * Insert a new memory with a race-safe auto-assigned ID.
  * Uses AUTOINCREMENT seq to derive the ID after insert, avoiding
  * the read-then-write race in concurrent scenarios (e.g. worktrees).
- * Returns the assigned ID, or null on failure.
+ * Returns the assigned ID, or null when the DB is unavailable.
+ *
+ * Throws on genuine SQL errors (corruption, missing tables, constraint
+ * violations) so callers can surface the underlying message instead of
+ * collapsing the failure to a generic "create_failed". See issue #4967 —
+ * the previous bare-catch swallowed "database disk image is malformed"
+ * errors, leaving the memory subsystem broken without any signal.
  */
 export function createMemory(fields: {
   category: string;
@@ -504,34 +512,70 @@ export function createMemory(fields: {
   if (!adapter) return null;
 
   try {
-    const now = new Date().toISOString();
-    // Insert with a temporary placeholder ID — seq is auto-assigned
-    const placeholder = `_TMP_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-    insertMemoryRow({
-      id: placeholder,
-      category: fields.category,
-      content: fields.content,
-      confidence: fields.confidence ?? 0.8,
-      sourceUnitType: fields.source_unit_type ?? null,
-      sourceUnitId: fields.source_unit_id ?? null,
-      createdAt: now,
-      updatedAt: now,
-      scope: fields.scope ?? 'project',
-      tags: fields.tags ?? [],
-      structuredFields: fields.structuredFields ?? null,
-    });
-    // Derive the real ID from the assigned seq (SELECT is still fine via adapter)
-    const row = adapter.prepare('SELECT seq FROM memories WHERE id = :id').get({ ':id': placeholder });
-    if (!row) return placeholder; // fallback — should not happen
-    const seq = row['seq'] as number;
-    const realId = `MEM${String(seq).padStart(3, '0')}`;
-    rewriteMemoryId(placeholder, realId);
-    return realId;
-  } catch {
-    return null;
+    return transaction(() => doCreateMemory(adapter, fields));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+
+    // Targeted recovery: a malformed memory store can sometimes be rebuilt
+    // by VACUUM. Skip when inside a transaction — SQLite refuses VACUUM
+    // there and a secondary throw would mask the real fault.
+    if (message.toLowerCase().includes('malformed') && !isInTransaction()) {
+      try {
+        adapter.prepare('VACUUM').run();
+        const recoveryMessage = 'recovered malformed memory store via VACUUM';
+        process.stderr.write(`memory-store: ${recoveryMessage}\n`);
+        logWarning('memory-store', recoveryMessage);
+        return transaction(() => doCreateMemory(adapter, fields));
+      } catch (retryErr) {
+        const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+        logWarning('memory-store', `VACUUM recovery for memory store failed: ${retryMsg}`);
+        // Surface the *original* malformed error — it's the actionable signal.
+        throw err;
+      }
+    }
+
+    throw err;
   }
 }
 
+function doCreateMemory(
+  adapter: NonNullable<ReturnType<typeof _getAdapter>>,
+  fields: {
+    category: string;
+    content: string;
+    confidence?: number;
+    source_unit_type?: string;
+    source_unit_id?: string;
+    scope?: string;
+    tags?: string[];
+    structuredFields?: Record<string, unknown> | null;
+  },
+): string {
+  const now = new Date().toISOString();
+  // Insert with a temporary placeholder ID — seq is auto-assigned
+  const placeholder = `_TMP_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  insertMemoryRow({
+    id: placeholder,
+    category: fields.category,
+    content: fields.content,
+    confidence: fields.confidence ?? 0.8,
+    sourceUnitType: fields.source_unit_type ?? null,
+    sourceUnitId: fields.source_unit_id ?? null,
+    createdAt: now,
+    updatedAt: now,
+    scope: fields.scope ?? 'project',
+    tags: fields.tags ?? [],
+    structuredFields: fields.structuredFields ?? null,
+  });
+  // Derive the real ID from the assigned seq (SELECT is still fine via adapter)
+  const row = adapter.prepare('SELECT seq FROM memories WHERE id = :id').get({ ':id': placeholder });
+  if (!row) return placeholder; // fallback — should not happen
+  const seq = row['seq'] as number;
+  const realId = `MEM${String(seq).padStart(3, '0')}`;
+  rewriteMemoryId(placeholder, realId);
+  return realId;
+}
+
 /**
  * Update a memory's content and optionally its confidence.
  */
@@ -728,8 +772,17 @@ export function applyMemoryActions(
       }
       enforceMemoryCap();
     });
-  } catch {
-    // non-fatal — transaction will have rolled back
+  } catch (err) {
+    // Non-fatal — the transaction has rolled back. We log a warning so a
+    // degraded memory subsystem (e.g. malformed store, missing tables) is
+    // visible to forensics instead of silently dropping every CREATE — see
+    // issue #4967, where this swallow combined with createMemory's bare
+    // catch hid SQLite corruption from the auto-mode flow entirely.
+    const message = err instanceof Error ? err.message : String(err);
+    logWarning(
+      'memory-store',
+      `applyMemoryActions failed (memory subsystem degraded): ${message}`,
+    );
   }
 }