diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6c74c637..fde54e9fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,177 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [2.29.0] - 2026-03-18
+
+### Added
+- add searchExcludeDirs setting for @ file autocomplete blacklist (#1202)
+- **ci**: automate prod-release with version bump, changelog, and tag push (#1194)
+- auto-open HTML reports in default browser on manual export (#1164)
+- upgrade to Node.js 24 LTS across CI, Docker, and package config (#1165)
+- add /gsd logs command to browse activity, debug, and metrics logs (#1162)
+- **browser-tools**: configurable screenshot resolution, format, and quality (#1152)
+- add pre-commit secret scanner and CI secret detection (#1148)
+- **mcporter**: add .gsd/mcp.json per-project MCP config support (#1141)
+- **metrics**: add API request counter for copilot/subscription users (#1140)
+- per-milestone depth verification + queue-flow write-gate (#1116)
+- add OSC 8 clickable hyperlinks for file paths in export notifications (#1114)
+- park/discard actions for in-progress milestones (#1107)
+- **ci**: implement three-stage promotion pipeline (Dev → Test → Prod) (#1098)
+- cache-ordered prompt assembly and dashboard cache hit rate (#1094)
+- add comprehensive API key manager (/gsd keys) (#1089)
+- **ci**: add multi-stage Dockerfile for CI builder and runtime images
+- **gsd**: add directory safeguards for system/home paths (#1053)
+- enhance HTML report with derived metrics, visualizations, and interactivity (#1078)
+- auto-extract lessons to KNOWLEDGE.md on slice/milestone completion (#711) (#1081)
+- auto-create PR on milestone completion (#687) (#1084)
+- wire semantic chunking, add preferences, metrics, and docs
+- add token optimization suite for prompt caching, compression, and smart context selection
+- **autocomplete**: add /thinking completions, GSD subcommand descriptions, and test coverage (#1019)
+- add respectGitignoreInPicker setting for @ file picker (#979) (#1016)
+- **prefs**: add search_provider to preferences.md (#1001)
+- add `--events` flag for JSONL stream filtering (#1000)
+- add 10 bundled skills for UI, quality, and code optimization (#999)
+- **ux**: group model list by provider in /gsd prefs wizard (#993)
+- add `--answers` flag for headless answer injection (#982)
+- add project onboarding detection and init wizard
+
+### Fixed
+- **ci**: add npm publish to prod-release and prevent mid-deploy cancellation (#1208)
+- **ci**: use env var for Discord webhook secret in if-condition
+- complete shared barrel exports and add import-claude to help text (#1198)
+- broaden unit-runtime path sanitization to strip all unsafe characters
+- detect stale bundled resources via content fingerprint (#1193)
+- include promptGuidelines in customPrompt path of buildSystemPrompt (#1187)
+- prevent branch-mode merge fallback from firing in worktree isolation (#1183)
+- treat auto-discovered verification failures as advisory, not blocking (#1188)
+- **ci**: remove @latest npm promotion from pipeline
+- **ci**: skip GitHub release creation when tag already exists
+- handle Windows non-ASCII paths in cpSync with copyFileSync fallback (#1181)
+- non-blocking verification gate for auto-discovered commands (#1177)
+- add defensive guards against undefined .filter() in auto-mode dispatch/recovery (#1180)
+- sync living docs (DECISIONS/REQUIREMENTS/PROJECT/KNOWLEDGE) between worktree and project root (#1173)
+- route needs-discussion phase to interactive flow instead of stopping (#1175)
+- run resource-skew check before early TTY gate
+- move TTY check before heavy initialization to prevent process hang
+- **ci**: skip init smoke test in non-TTY CI environments (#1172)
+- **ci**: skip publish when version already exists on npm (#1166)
+- **ci**: use local binary for pipeline smoke test (#1163)
+- prevent concurrent GSD sessions from overlapping on same project (#1154)
+- exclude completion-transition errors from health escalation at task level (#1157)
+- **ci**: skip git-diff guard in prepublishOnly during CI (#1160)
+- /gsd quick respects git isolation: none preference (#1156)
+- text-based fallbacks for RPC mode where TUI widgets produce empty turns (#1112)
+- **headless-query**: use jiti to load extension .ts modules (#1143)
+- pause auto-mode when env variables needed instead of blocking (#1147)
+- **ci**: fix dev-publish version stamp and platform sync (#1145)
+- **google-search**: add 30s timeout to Gemini API call (#1139)
+- **verification-gate**: sanitize preference commands with isLikelyCommand (#1138)
+- **auto-dashboard**: show trigger task label for hook units (#1136)
+- **auto-worktree**: detect worktree structurally when originalBase is null (#1135)
+- **model-resolver**: prefer provider's recommended variant over saved base model (#1131)
+- **auto-worktree**: auto-commit project root dirty state before milestone merge (#1130)
+- **guided-flow**: support re-discuss flow for already-discussed slices (#1129)
+- dispatch guard skips parked milestones — they no longer block later milestone dispatch (#1126)
+- worktree reassess-roadmap loop — existsSync fallback in checkNeedsReassessment (#1117)
+- **lsp**: use where.exe on Windows to resolve command paths (#1134)
+- **gsd-db**: auto-initialize database when tools are called (#1133)
+- inline preferences path to fix remote questions setup (#1110) (#1111)
+- **ci**: add safe.directory for containerized pipeline job (#1108)
+- remove .gsd/ from tracking, ignore entire directory
+- update tests for god-file decomposition
+- strip model variant suffix for API key auth (#1097) (#1099)
+- match both milestoneId and sliceId when filtering duplicate blocker cards
+- add dispatch stall guards to prevent auto-mode pause after slice completion (#1073) (#1076)
+- prevent summarizing phase stall by retrying dropped agent_end events (#1072) (#1074)
+- use atomic writes for completed-units.json and invalidate caches in db-writer (#1069)
+- reject prose Verify: fields from being executed as shell commands (#1066) (#1068)
+- restore session model on error instead of reading stale global prefs (#1065) (#1067)
+- prevent run-uat re-dispatch loop when roadmap checkbox update fails (#1063) (#1064)
+- inline compareSemver in gsd extension to fix broken relative import (#1058)
+- disable reasoning for MiniMax-M2.5 in alibaba-coding-plan provider (#1003) (#1055)
+- improve LSP diagnostics when no servers detected (#1082) (#1086)
+- prevent summarizing phase stall by retrying dropped agent_end events (#1072)
+- switch alibaba-coding-plan to OpenAI-compat endpoint with proper compat flags (#1003)
+- add barrel files for remote-questions, ttsr, and shared extensions (#1048)
+- consolidate frontmatter parsing into shared module (#1040)
+- always ensure tasks/ directory exists for slice units (#900) (#1050)
+- centralize GSD timeout and cache constants (#1038)
+- improve RemotePromptRecord.ref type safety (#1041)
+- document silent catch handlers in browser-tools (#1037)
+- use literal union types in RuntimeErrorJSON for type safety (#1034)
+- extract sanitizeError to shared module and apply to ask-user-questions (#1033)
+- deduplicate formatDateShort into shared/format-utils (#1032)
+- add error handlers to visualizer overlay promise chains (#1027)
+- **security**: use execFileSync in resolve-config-value to prevent shell operator bypass (#1025)
+- **security**: use execFile for browser URL opening to prevent shell injection (#1022)
+- prevent duplicate milestone IDs when generating multiple before persisting (#961) (#1018)
+- consolidate duplicate formatting functions (#1011)
+- **gsd**: delete orphaned complexity.ts (#1005)
+- **search**: consolidate duplicate Brave API helpers (#1010)
+- merge worktree to main when all milestones complete (#962) (#1007)
+- **gsd**: deduplicate resolveGitHeadPath function (#1015)
+- add missing package.json subpath exports and oauth stubs (#1014)
+- **gsd**: consolidate string-array normalizer functions into shared utility (#1009)
+- **browser-tools**: document intentional silent catches, add debug logging for others (#1013)
+- consolidate duplicate VerificationCheck/Result type definitions (#1008)
+- **gsd**: add GIT_NO_PROMPT_ENV to gitFileExec and deduplicate constant (#1006)
+- **remote-questions**: add null coalesce for optional threadUrl (#1004)
+- auto-resume on transient server errors, not just rate limits (#886) (#957)
+- replace ambiguous compound question in reflection step (#963) (#1002)
+- **gsd**: remove STATE.md update instructions from all prompts (#983)
+- **gsd**: clear all caches after discuss dispatch so picker sees new CONTEXT files (#981)
+- **auto**: dispatch retry after verification gate failure (#998)
+- enforce GSDError usage and activate unused error codes (#997)
+- unify extension discovery logic (#995)
+- deduplicate tierLabel/tierOrdinal exports (#988)
+- deduplicate getMainBranch implementations (#994)
+- add error handling for unhandled promise rejections (#992)
+- deduplicate formatTokenCount into shared format-utils (#987)
+- add debug logging to silent catch blocks in auto.ts (#986)
+- deduplicate formatDuration into shared format-utils (#989)
+- add exports fields to pi-tui and pi-agent-core packages (#991)
+- remove dead github-client.ts (never imported) (#990)
+- deduplicate parseJSONL and unify MAX_JSONL_BYTES constant (#985)
+- remove broken ./hooks export path from pi-coding-agent (#984)
+- inline bundled extension path parsing in subagent
+
+### Changed
+- extract numeric validation helpers in prefs wizard (#1205)
+- deduplicate projectRoot() and dispatchDoctorHeal() between commands.ts and commands-handlers.ts (#1203)
+- extract shared JSON persistence utility, migrate metrics + routing-history + unit-runtime (#1206)
+- remove unused preferences-hooks.ts re-export facade (#1207)
+- remove commands.ts re-exports, import directly from submodules (#1204)
+- extract frontmatter body extraction into shared helper (#1201)
+- deduplicate projectRoot() — single source in commands.ts (#1197)
+- extract PER_REQUEST_TIMEOUT_MS to shared types (#1196)
+- update state — S01 planned, ready for execution
+- **M001-1ya5a3/S01**: auto-commit after state-rebuild
+- **M001-1ya5a3/S01**: auto-commit after research-slice
+- decompose doctor.ts into types, format, and checks modules (#1096)
+- extract milestone-ids and guided-flow-queue from guided-flow.ts (#1095)
+- decompose preferences.ts, populate skills and models modules (#1091)
+- decompose auto.ts into 6 focused modules (#1088)
+- decompose commands.ts into 5 focused modules
+- remove redundant test file, identify consolidation targets (#1070)
+- batch 2 — consolidate preferences, convert 8 more files to node:test (#1061)
+- consolidate tests by area, standardize on node:test (#1059)
+- skip initResources when version matches, consolidate startup I/O (#1052)
+- centralize magic numbers into constants.ts (#1044)
+- **resource-loader**: extract syncResourceDir to eliminate triplicated sync logic (#1036)
+- **bg-shell**: split 1604-line god file into tool, command, and lifecycle modules (#1049)
+- **headless**: split 772-line god file into events, UI, and context modules (#1047)
+- **gsd**: extract safeCopy/safeMkdir helpers to replace repetitive try/catch FS patterns (#1043)
+- **gsd**: extract atomicWriteSync utility to replace 6 duplicate write-tmp-rename patterns (#1046)
+- **gsd**: unify duplicate padRight/truncate into shared format-utils (#1045)
+- **loader**: consolidate 5 duplicate package.json version reads into cached helper (#1042)
+- **headless**: remove duplicate jsonLine, use serializeJsonLine from pi-coding-agent (#1039)
+- fix unicode regex discrepancy and standardize function naming (#1031)
+- fix chalk version mismatch and document pinned dependency rationale (#1030)
+- add concurrency limits to unbounded Promise.all operations (#1029)
+- optimize SSE streaming buffer to avoid quadratic string growth (#1024)
+- reduce makeTreeWritable calls from 6 to 2 on startup (#1023)
+- add domain-grouped re-exports for preferences module (#996)
+
 ## [2.28.0] - 2026-03-17
 
 ### Added
@@ -1041,7 +1212,8 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - License updated to MIT
 
-[Unreleased]: https://github.com/gsd-build/gsd-2/compare/v2.28.0...HEAD
+[Unreleased]: https://github.com/gsd-build/gsd-2/compare/v2.29.0...HEAD
+[2.29.0]: https://github.com/gsd-build/gsd-2/compare/v2.28.0...v2.29.0
 [2.28.0]: https://github.com/gsd-build/gsd-2/compare/v2.27.0...v2.28.0
 [2.27.0]: https://github.com/gsd-build/gsd-2/compare/v2.26.0...v2.27.0
 [2.26.0]: https://github.com/gsd-build/gsd-2/compare/v2.25.0...v2.26.0
diff --git a/native/npm/darwin-arm64/package.json b/native/npm/darwin-arm64/package.json
index 03fdc1154..8122e66c1 100644
--- a/native/npm/darwin-arm64/package.json
+++ b/native/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd-build/engine-darwin-arm64",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD native engine binary for macOS ARM64",
   "os": [
     "darwin"
diff --git a/native/npm/darwin-x64/package.json b/native/npm/darwin-x64/package.json
index 2e5012e32..274088fce 100644
--- a/native/npm/darwin-x64/package.json
+++ b/native/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd-build/engine-darwin-x64",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD native engine binary for macOS Intel",
   "os": [
     "darwin"
diff --git a/native/npm/linux-arm64-gnu/package.json b/native/npm/linux-arm64-gnu/package.json
index 49420b616..5736d51b6 100644
--- a/native/npm/linux-arm64-gnu/package.json
+++ b/native/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd-build/engine-linux-arm64-gnu",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD native engine binary for Linux ARM64 (glibc)",
   "os": [
     "linux"
diff --git a/native/npm/linux-x64-gnu/package.json b/native/npm/linux-x64-gnu/package.json
index f7ad08d31..9cb976ee7 100644
--- a/native/npm/linux-x64-gnu/package.json
+++ b/native/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd-build/engine-linux-x64-gnu",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD native engine binary for Linux x64 (glibc)",
   "os": [
     "linux"
diff --git a/native/npm/win32-x64-msvc/package.json b/native/npm/win32-x64-msvc/package.json
index 1d1d6b10e..319d4251c 100644
--- a/native/npm/win32-x64-msvc/package.json
+++ b/native/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd-build/engine-win32-x64-msvc",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD native engine binary for Windows x64 (MSVC)",
   "os": [
     "win32"
diff --git a/package.json b/package.json
index 3d2b5b697..fd317ddb5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {
diff --git a/packages/pi-coding-agent/package.json b/packages/pi-coding-agent/package.json
index 32e53eabb..c30f15826 100644
--- a/packages/pi-coding-agent/package.json
+++ b/packages/pi-coding-agent/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-coding-agent",
-  "version": "0.57.1",
+  "version": "2.29.0",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "piConfig": {
diff --git a/pkg/package.json b/pkg/package.json
index 815c69232..091d4f267 100644
--- a/pkg/package.json
+++ b/pkg/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@glittercowboy/gsd",
-  "version": "0.57.1",
+  "version": "2.29.0",
   "piConfig": {
     "name": "gsd",
     "configDir": ".gsd"