v0.21.5

Fixed

• ag empty responses name the cause: agy headless auto-denies tools that need the command permission and returns an empty response; the ask result now carries denied_actions and the CLI prints a one-line note (#195).
• Monitor: a tiny non-zero quota remainder shows <1% (0% always means exhausted) and cx reset credits uses relative time (#189).

v0.21.4

Added

• Complete the ag exact model/pool registry for flash, argon, Claude opus/sonnet and GPT OSS slugs; add ag.argon (gemini-4-argon-medium, A-7D) as the tenth profile. Existing tiers remain unchanged; arbitrary-model monitor/readiness integration remains out of scope (#194).
• peerhub profile list shows Known models (pool), with additive known_models JSON; the bounded guide includes argon and slug discovery (#194).

Fixed

• Find quota reset evidence across all error lines, recognize cc You've hit your 5-hour limit and preserve hour-only resets such as 3pm raw. Advice keeps uncertain-stream recovery requirements because a stream may remain quota-blocked after reset (#194).
• Apply PEERHUB_LIVE_AG_MODEL to public ask measurements, annotate only cases applying it, and reject unknown registry slugs with a stale metadata hint (#194).
• Monitor headers and EXHAUST-IN cells show past forecast when quota remains after a forecast passes, reserving exhausted for zero remaining quota; INSUFFICIENT means insufficient projection data (#194).

v0.21.3

Fixed

• Uncertain asks whose provider error is a quota/usage limit (ag exit 3, stderr-only errors) now report provider_limit and a one-line wait-for-reset note; status stays uncertain because edits cannot be excluded (#186).
• Refusal classifier recognises cc limit phrasings such as You've hit your limit, Claude AI usage limit reached and 5-hour limit reached (#186).
• Live gate: PEERHUB_LIVE_AG_MODEL may replace the ag model when its default pool is exhausted; every JUnit case then records live_ag_model_override. For v0.21.3 the ag canary ran on gemini-4-argon-low (A-7D) because G-7D was exhausted: the packaged ag.standard model was NOT exercised (#191).
• Live-gate quota canary waits 60s instead of 30s for slow cc usage probes (#183).

Changed

• Monitor: the soonest-exhaust header says exhausted for an empty pool, probe age uses 2h57m-style durations, and the INSUFFICIENT legend reads window just started (#189).

v0.21.2

Changed

• Share session receipt validation between session inspection and monitor, and use one profile layer loader for CLI configuration and runtime resolution (#177).
• Remove the unused format_dashboard renderer and rename its regression test to identify the active format_frame renderer (#177, #178).

Fixed

• Fence open stores on changes to either lineage marker (workspace.generation or restore.epoch), while allowing first-generation adoption without fencing existing connections (#177, #178).
• Resolve monitor profiles from the selected store's workspace root (#177).
• Bound context benchmark subprocess time and output, and resolve Windows .cmd/.bat shims through the shared binary resolver (#177, #178).

Docs

• Document in-flight ask behavior across upgrades and restarts; wait for running asks (they lock dependency files), inspect results before re-sending, and recover from a broken upgrade (#175, #180, #181).
• Align ag adapter documentation with its explicit --writable requirement and place deferred backlog start triggers and deliberate probe/response-field deferrals under docs/STATUS.md ownership (#167, #173, #177).

v0.21.1

Changed

• Uncertain ask guidance and guide now direct default-timeout asks to a new stream with explicit --timeout-seconds (long reviews: 1800 or more), preserving retry cautions (#169, PR #171).

v0.21.0

Added

• Cached-only peerhub diag readiness [--json]: configured profile readiness from stored quota and matching delivery evidence, with shared pools and contextual diagnostic actions; no provider calls or writes (#145, part 1).

Changed

• Monitor QUOTA visual refresh S2 adds semantic colors, precise remaining bars, compact per-peer probe notes, a space-permitting state legend, and the soonest exhaustion summary (#147 S2).

Fixed

• Skip oversized cx events when a later intact answer and completion establish delivery; preserve uncertainty for lost terminal evidence (#164, part A).

v0.20.0

Breaking

• Bare peerhub exit 2 -> 0: Invoking peerhub without arguments now prints the offline peerhub guide and exits successfully (#121, #153).
• Native ag requires explicit --writable: Because agy does not enforce a read-only sandbox when --mode accept-edits is omitted, native ag execution fails closed before spawn (PrespawnError / failed_not_started) unless --writable is set. Cached replay of acknowledged requests still returns before policy validation (#140).
• Single-peer ask stream fencing: peerhub ask rejects targeting a different peer on a stream with established ask: prompt records (StreamPeerMismatchError, exit 2, guidance ask_stream_peer_mismatch) (#125).
• The deprecated monitor --legacy alias reaches its scheduled sunset and is no longer accepted in v0.20.0. Use peerhub monitor --json --schema-version 1.1 for the frozen machine contract; grouped human output remains the default.

Added

• Guidance registry (peerhub/cli/recovery.py) maps ask outcomes to meanings, causes, recovery argv, cautions, documentation, and contextual exit codes. Offline peerhub explain CODE [--json] exposes exact-code recovery guidance (#117, #150).
• Offline AND-token lessons lookup through peerhub explain <free words>, packaged lessons.toml, generated docs/lessons.md with drift checks, and a compact guide pointer (#117, #150).
• Factual tool-only turn completion metadata (empty_response: true, task_effects: "unverified") when a provider completes tool actions without a final text message (#126, #150).
• Argon A-7D quota pool: group-derived Antigravity pool labels (G-*, 3P-*, A-*), gemini-argon-wtu-weekly mapping to A-7D, and exact gemini-4-argon-{low,medium,high} model mappings in both model-profile artifacts (defaults revision 2026-10-18.1), backed by raw usage fixtures and parser tests (#149).
• Weekly Dependabot updates for pip and GitHub Actions, plus SECURITY.md with vulnerability reporting guidance and supported-version scope (#151).

Changed

• Monitor quota-first dashboard: one-line status header with UTC timestamps and database source, followed by a deterministic QUOTA table (PEER POOL REM [bar] RESET-IN PACE STATE AGE; EXHAUST-IN at widths of at least 100 columns). Quota rows precede PEERS, EXECUTION, SESSIONS, USAGE, and CONTEXT; short viewports disclose omitted rows with peerhub monitor --snapshot --group capacity --expand. Stale and unknown rows preserve identity and reasons; snapshot rendering does not synthesize a refresh (#146).
• Remaining-quota bars fill consistently, all capacity rows stay together, and reset countdowns are separated from burn forecasts. USAGE falls back to input plus output tokens and shows cache hit percentage when provider total tokens are absent (#146, #147).
• Missing-store errors include the selection source, a quoted creation command using global --db, and Learn: peerhub guide (#121).
• pending_earlier_record guidance describes processed-status-dependent outcomes (delivered, not_executed, failed_not_started, uncertain); explain JSON represents context-dependent exit codes as lists (#135).

Fixed

• Monitor QUOTA RESET-IN counts down from measured provider resets_at timestamps; stale and unknown observations retain - (#146).
• Monitor displays cx reset credits and soonest expiry from existing read-only evidence; fixture coverage verifies cc last-good quota and AGE survive a /usage timeout (#157).
• Windows stderr decoding consults console output and OEM code pages (GetConsoleOutputCP / GetOEMCP) before UTF-8 replacement, preserving localized launcher errors including cp949 messages; launch failures receive ask_launch_failed guidance (#120).
• Bounded terminal provider error summaries survive verbose startup stderr; aggregate cx response text is retained unless explicit phase metadata distinguishes final text from commentary (#127).
• Review follow-ups add an empty-response stderr note, restrict selector guidance to actual selector argument errors, and provide specific guidance for unsupported store schemas, compare-and-swap conflicts, and idempotency conflicts (#153).

Docs

• Peer sandbox limits and an installed-CLI profile smoke recipe, linked from the documentation index (#134, #148).
• ag silence-timeout guidance: leave it unset or set it at least as high as --timeout-seconds; long-task examples use --timeout-seconds 7200 (#118).
• Windows upgrade instructions: stop monitor, upgrade, then restart; explain temporary PyPI index lag (#123).
• Generated guidance and session lifecycle reference with registry parity checks, qualified session-state definitions, safe actions, and contextual exit codes (#135).
• Windows PowerShell operations guide covering parallel asks, $using:, quoting, --query-file, non-ASCII paths, and parser-verified examples (#136).
• Aligned guide, README, remote-ask, and migration documentation with current store selection, write-policy, and recovery rules (#130, #134, #148).

v0.19.0

Breaking

• Implicit ./peerhub store discovery removed: Removed implicit <cwd>/peerhub subfolder walk during store discovery (owner-approved O-1 in October 2026 audit). Store discovery now searches .peerhub/core.db in the current directory and parent directories only. Explicit --db PATH, PEERHUB_DB, and --workspace selection are unchanged. When no store is selected and a legacy <cwd>/peerhub store exists, missing-store error emits a hint to use --db pointing to it; stores of other schema versions remain refused as usual.
• Bare monitor changes: Default monitor viewport prioritization now ranks capacity and peers ahead of other low-priority groups in short viewports (default behaviour change), dropping other groups before clipping quota rows. Loaded quota rows (capacity and peers quota) are shown in full by default across all pools and windows without --expand; in short terminals rows beyond the viewport are disclosed as +N rows hidden by terminal height (distinguishing loaded data from displayed rows). When a detail loop stops early due to viewport height, one line +N rows hidden by terminal height is emitted with reserved space.

Added

• peerhub monitor --expand: human dashboard option (supporting watch and --snapshot) rendering all loaded rows of detail groups (sessions, usage, context, runtime) instead of capping at 2 rows (quota is always fully shown; --expand applies to other groups). Expanded session rows include the stable session handle. Bounded by existing DB read caps (100) with truncation disclosure; rejects --expand with --json (Slice 1).
• Quota displayed by default: loaded quota rows (capacity and peers quota) are shown in full by default across all pools and windows without --expand; in short terminals rows beyond the viewport are disclosed as +N rows hidden by terminal height (distinguishing loaded data from displayed rows).
• Peers pools: model pools and observed versions metadata in docs/model-profiles/model-profiles.json and packaged model-defaults.toml with cross-artifact parity verification (S1); multi-pool selection in monitor peers view selecting minimum remaining quota across fresh measured pools for mapped profile models; explicit incomplete and account-wide/unmapped status handling (S2).
• Drift report persistence inside quota observation payload, retaining unknown bucket IDs and comparing installed CLI versions against packaged baselines (S3).
• Monitor model facts drift line (Facts: needs_recheck (...) - refresh-model-profiles) and detailed JSON output without extra probes (S4).
• Offline peerhub guide subcommand (<=60 lines, ~900 tokens) providing .standard-first profile table, session reuse examples, delivery safety guidance, discovery commands, and drift recovery (S5).
• Compact Safety section in peerhub guide detailing per-peer write boundaries (cx sandbox enforced, cc enforced, ag NOT enforced per issue #140), uncertain/pending_earlier_record recovery rules, core.db store hazards, cost side effects, and secrets persistence.
• Knowledge Placement Policy in docs/knowledge-placement.md (13-point policy) governing installed-release essentials, evidence-dependent lessons, and safety guidance placement; linked in CONTRIBUTING.md and .github/PULL_REQUEST_TEMPLATE.md.
• Efficiency section in peerhub guide (<=3 lines) covering role-based stream reuse, .standard-first economical baseline, and --query-file/--json transport choices.
• Report Issues section in peerhub guide (<=3 lines) detailing repository issue submission, gh issue list --search triage, environment details, and privacy redaction.
• Guide impact policy in CONTRIBUTING.md, PR verification checklist in .github/PULL_REQUEST_TEMPLATE.md, and guide-impact issue label for tracking safety-fact updates across PRs.
• Bounded delta reads in Session Bridge for native, local history, and redirect-candidate delta queries, paging reads and stopping before the current record.

Changed

• Documentation diet: archived obsolete 10,368-line call map (peerhub-production-call-map-R1.json) and 4 historical debate documents (4,777 lines across session monitoring/reuse/usage review) to Git history, backed by a comprehensive archival ledger (docs/history/ledger-2026-10-17.md) preserving retrieval commands, SHA-256 hashes, and accepted/rejected/deferred decisions. Shrunk docs/design/README.md to active/deferred/history links and unified status ownership under docs/STATUS.md.
• Monitor --legacy sunset extended to 0.20.0: explicitly extended the sunset of the hidden deprecated --legacy alias (and frozen schema 1.1 watch) through 0.19.x to 0.20.0; removal deferred as no removal evidence is needed and existing callers remain supported.

Fixed

• Preserved write access on resumed Codex (cx) sessions when --writable is enabled by passing -c sandbox_mode="workspace-write" on exec resume (resumed sessions previously defaulted to read-only sandbox mode, dropping write permissions even when the session was created writable). Safe read-only (-c sandbox_mode="read-only") is maintained when --writable is not set. Scoped guaranteed read-only sandbox enforcement to cx only; documented cc read-only enforcement via headless permission denial and ag read-only as provider-controlled without sandbox enforcement (known limitation: headless agy does not enforce a read-only boundary when --mode accept-edits is omitted). Added opt-in live canary tests for read-only sentinel creation.
• ASCII and plain monitor separators: replaced Unicode middle dot (·) with ASCII pipe (|) in --view plain and non-Unicode outputs, avoiding ? replacement artifacts in ASCII terminal environments (#114).
• Redirected --format auto JSON: --format auto emits JSON when standard output is not a TTY (redirected or piped) (#114).
• Missing-store JSON error parity: core read commands emit structured JSON ({"status": "UNAVAILABLE", ...}) when a database is not found and JSON output is requested (or under redirected --format auto), matching the machine error contract (#114).

v0.18.2

Added

• Monitor peers group (default set): per peer quota -> profile/model [config layer] -> latest session (fresh/reused, generation) -> context; unknown stays unknown, stale quota is shown as STALE, no model-specific quota-pool inference, sample truncation disclosed.
• Model-fact provenance: footer with revision, checked date/age and source commands; per-profile source in docs/model-profiles/model-profiles.json; 2026-10-16 CLI observations (cc 2.1.301, codex 0.163.0, agy 1.4.0). Profiles unchanged; agy gemini-4-argon-* noted as available, not selected.

Changed

• Breaking - store schema: schema version 4. Stores written by this version cannot be opened by earlier releases (they refuse with their existing future-schema error); back up .peerhub/core.db before first use. Core runtime connections come from one factory (WAL, busy_timeout, foreign_keys, recursive_triggers).

Notes

• Extension DDL ownership, trigger-definition verification and the rest of the schema-v2 proposal are intentionally deferred (see docs/design/monitor-peers-view-2026-10-16.md).

v0.18.0

Changed

• Breaking — monitor output defaults: bare peerhub monitor now renders a group-aware
  visual dashboard on TTYs and aligned plain sections when redirected. JSON is
  explicitly machine-oriented (--json, schema 2.0 by default); the captured
  schema 1.1 contract remains available with --schema-version 1.1. The hidden
  --legacy alias is deprecated through 0.18.x and will be removed in 0.19.0.
  Existing schema 1.1 scripts should use --json --schema-version 1.1 explicitly.
• Monitor group selection, catalog, defaults, snapshot behavior, and provider
  collection cadence are unchanged.