🟡 Important

Persistence errors aren't isolated from the triage response — breaks batch per-item isolation (api_routes.py:157-168, 1475-1505)

_persist_triage_tasks runs after the response is built, but the routes only catch LLMTriageError / EmailSummarizeError. Any exception from the task write therefore escapes as an unhandled 500:

• Single /triage: a successful analysis is lost — caller gets a 500 instead of the result the PR says is "byte-for-byte unchanged."
• Batch /triage/batch: _triage_batch_and_persist loops persisting each item; one write raising throws out of the whole handler → 500, discarding every other item's result. This directly violates the endpoint's documented guarantee that "per-item failures surface as BatchItemResult.error (HTTP 200 …)".

The most realistic trigger is a race, not disk failure: DatabaseMixin opens the connection with check_same_thread=False and no lock (src/gaia/database/mixin.py:63), triage runs in asyncio.to_thread, and record_action_items does read-existing-then-insert. Two overlapping triages of the same message_id both read an empty set and both insert — the second hits idx_email_tasks_msg_desc and raises sqlite3.IntegrityError. The module comment even claims "A UNIQUE index backs the invariant at the schema level," but the insert path never handles the constraint firing, so instead of silently de-duplicating it 500s.

Cleanest targeted fix — treat the UNIQUE hit as the dedup path it's meant to be (needs import sqlite3 at the top of task_store.py):

        existing.add(norm)
        task_id = uuid.uuid4().hex
        try:
            db.insert(
                "email_tasks",
                {
                    "task_id": task_id,
                    "message_id": message_id,
                    "description": item.description,
                    "description_norm": norm,
                    "due_hint": item.due_hint,
                    "item_type": item.type,
                    "url": item.url,
                    "status": "open",
                    "created_at": time.time(),
                    "completed_at": None,
                },
            )
        except sqlite3.IntegrityError:
            # A concurrent triage of the same message already recorded this
            # item — the UNIQUE(message_id, description_norm) index firing IS
            # the dedup invariant, not an error to surface.
            continue
        created.append(task_id)

That handles the race for both endpoints. Separately, the batch loop should keep a single item's persistence failure from sinking the whole response — the batch already isolates per-item triage failures, and the side-effect should match that (e.g. persist per-item under a narrow guard that logs and continues, rather than letting it propagate past _triage_batch_and_persist). This isn't a "silent fallback" — the caller's requested operation (triage) succeeded and should be returned; the task write is a genuine secondary side effect.

🟢 Minor

• list_tasks / mark_task_done are only exercised by tests today (no read/complete endpoint yet). That's fine as the documented EPIC: L8 Task & To-Do Store (cross-agent, core) #1521 seam — just flagging so it isn't mistaken for wired-up read surface.

Strengths

• Doc sync is exemplary — README, SPEC, SKILL, CHANGELOG, openapi.email.json, spec_html.py, specification.html, and docs/guides/email.mdx all updated together, plus the capability-14 status moved Planned→Wired. Exactly what CLAUDE.md's "update EVERY doc" rule asks for.
• Clean seam design — record_action_items as the single write entry point, pure functions over a DatabaseMixin first arg mirroring action_store, so the EPIC: L8 Task & To-Do Store (cross-agent, core) #1521 adapter swap is localized.
• Solid test coverage — normalized-dedup key, same-item-different-message distinctness, fail-loud on empty message_id, idempotent completion, and the REST surface (persist / re-triage no-dup / batch per-message dedup) via the existing resolve_action_db seam with an in-memory DB.

• The one red check ("API Tests") is pre-existing on main: main's latest run of the same workflow (50c17de, feat(ui): Node-free email-agent sidecar with user/dev modes #1884) fails with the identical email-route 404 list — CI infra, not this PR. All PR-specific checks are green.
• Local suite: 803 passed (email agent + email unit + OpenAPI conformance); util/lint.py --all fully green.
• openapi.email.json regenerated via export_openapi.py --check (byte-identical); specification.html has no generator — hand-verified both sides of the merge survived.
• Scope note: there is no REST read surface for tasks yet (verified against the branch OpenAPI) — persistence was proven by direct DB query, matching how the PR's own tests verify it. REST read-back is EPIC: L8 Task & To-Do Store (cross-agent, core) #1521 territory.