v3.1.0

Added

• feat(routing): one routing matrix (role -> primary -> secondary) in scoring/routing.py, rendered into lanes.yaml under routing:; Claude Code (Max) and Antigravity (AI Pro) are primary routes, chat agents use Anthropic credits and light work uses Gemini credits (ADR-0018).
• feat(routing): consumption-balancing policy (routing.choose_pool, spill at 85%) so Balanced distributes work across the four pools.
• feat(doctor): pool_usage.py and doctor sub-check 4g2 show usage per pool and where each class of work runs now; read-only, unknown instead of zero, never prints a key.
• feat(setup): the recommended run turns the Antigravity lane on by default when agy is installed and records the Google acknowledgement under the operator waiver of gates G0-G7; --no-lanes-antigravity still opts out.
• docs: ADR-0018; ADR-0007 section 11, ADR-0009 decision 8, ADR-0016 and ADR-0017 marked superseded where it applies; docs/routing.md.
• fix(openclaw): the drained window (doctor, apply-pending, setup's restart) turns SIGTERM and SIGINT into exits, so watchdog.off is removed and the gateway started again on every exit path, a signal mid-action included; the create-to-try gap is closed by holding the signals from the marker create until the try is entered.
• feat(openclaw): ai-resources openclaw reconcile [--dry-run], run at the end of ai-resources setup: ONE drained restart (lock, marker guard, busy probe, T29 refusal) when the gateway runs older kit plugin code than the disk (new version rule next to path and time) or its cgroup holds more than 24 MCP children; a refusal is recorded as pending; a clean gateway and a second run are no-ops.
• feat(verify): ai-resources verify --live reads the RUNNING system: gateway health, plugin version against the disk, kit hooks (StopFailure quota signal, narration hook), lane agents and backend, MCP children, off-box credential file mode.
• fix(openclaw): the reload rules are read through the ~/.openclaw/tmp/agent-cli/openclaw shim (followed to its package, then other PATH hits, then the Homebrew node_modules); units are rendered with the real binary, never the shim; if nothing is readable the reason names the shim.
• fix(setup): the off-box uploader credential is regenerated (0600) from the host federation and openclaw-backup-uploader.service is started (--no-block) and its report read.
• feat(setup): stdio MCP servers are denied (fill-only, recorded) to agents matching OPENCLAW_MCP_DENY_AGENTS (default kit-role-*) in the same run that creates them.
• feat(openclaw): MemoryHigh is sized to the host (55 % of RAM, 12G..24G; OPENCLAW_MEMORY_HIGH overrides) instead of a fixed 12G.
• feat(hooks): kit_sleep_guard also refuses sleeps that add up above 30 s in one command and while/until wait loops; the OpenClaw AGENTS.md polling rules say one blocking wait per job (awaitResults).
• feat(setup): --dry-run shows the hooks to register, the off-box credential, MemoryHigh and the owed restart.
• feat(credits): credit ledger in ~/.config/ai-resources/credits.json (0600, atomic): per prepaid pool (anthropic-api, gemini-api) the declared opening credit and date (recorded once by setup from --credit-anthropic-usd / --credit-gemini-usd, AI_RESOURCES_CREDIT_ANTHROPIC_USD / _GEMINI_USD or the amount already in the file; the recommended run never asks and leaves declared: unknown; ai-resources credits set <pool> <usd>), the measured spend (OpenClaw per-agent transcripts for provider anthropic / google, priced with the audit's list prices, an estimate) and remaining = declared - measured. The Max pool is tokens only, no USD. Neither provider exposes a balance API; the ledger says so. ai-resources credits [show|collect|set]; doctor refreshes it; the daily verify timer runs credits collect --check; an 80 % alert reaches doctor, verify and the verify timer.
• feat(keys): ai-resources keys and doctor sub-check 4k probe the Gemini and Anthropic keys in gateway.systemd.env AND in the OpenClaw auth profile with one free models.list call each and report gemini key: env ok / profile ok / mismatch fixed, never a value. A rejected env key beside a working profile key is rewritten from the profile (backup first, 0600, atomic); the restart that applies it is the existing drained reconcile, which now also owes a restart whenever gateway.systemd.env is newer than the running gateway (env-changed). verify --live reports a rejected key.
• fix(setup): gateway.systemd.env is not rewritten (mtime kept) when its content is unchanged.
• test: the stale-plugin doctor tests ignore the new pool-usage lines; the sizing golden no longer depends on the CPython wording of a TypeError; the setup-idempotence run allows the read-only live probes; the recommended-run Google acknowledgement test follows ADR-0018.
• chore: remove unused locate_reload_plan_dist, utc_iso, apply_defaults.

Removed

• Unused locate_reload_plan_dist, utc_iso, apply_defaults; ADR-0007 section 11, ADR-0009 decision 8, ADR-0016 and ADR-0017 routing text marked superseded by ADR-0018.

Operator notes

• Run ai-resources setup yourself after brew upgrade; it performs one drained restart for the stale plugin code and the MCP-children overflow.
• GEMINI_API_KEY in gateway.systemd.env was rejected by Google (HTTP 401) while the google:default profile key works: ai-resources keys (also doctor and setup) rewrites the env entry from the profile key, keeping a backup, and the next idle ai-resources openclaw reconcile restarts the gateway to load it.
• Declare the opening credit once per pool: ai-resources credits set anthropic-api <usd> and ... gemini-api <usd>; until then the ledger shows declared: unknown and measured spend only.