feat(ai): a daily ceiling, so lean spend is enforced rather than remembered #5584

Measured first, because the fear and the numbers didn't match

All-time AI spend on this platform, to 2026-08-30:

ci_healer   175 calls   175¢   110,416 in / 48,994 out
ai_review     2 calls     2¢       773 in /    335 out

$1.77 total, ever — and 175 of those 177 calls produced nothing, because they were the billing-outage failures. The historical exposure is tiny and was almost entirely waste. What matters is that it stays bounded now that calls will start succeeding, since a successful repair does more work than a failed analysis.

The ceiling

Deliberately not per-repo or per-user. Those exist (assertAiQuota) and answer a different question — fairness between tenants. This answers the owner's: "what is the most this can cost me today, whatever goes wrong?" A runaway loop can exhaust a per-tenant quota and still empty the account, because there are many tenants and one card.

It reuses the provider-outage cache from fa41473: an exhausted budget reports through the same aiOutage() path as a dead provider, so every caller that already degrades gracefully degrades identically — no new stand-down path to write, and no subsystem discovers the ceiling by spending money to find it. The reason text differs because the remedy differs ("wait" vs "raise the ceiling or spend less"), and it states what is not affected so "AI paused" is never read as "the platform is down".

Fails open, in both directions that matter

• A cap of 0 or a fat-fingered env value means "no ceiling configured", never "spend nothing" — the latter is indistinguishable from an outage and would switch the AI tier off for a typo.
• An unreadable ledger returns 0 rather than inventing a number. That's our bug, and disabling every AI feature because a query broke is a worse outage than the overspend it guards against.

The model swap is not sold as a saving

MODEL_SONNET moves from claude-sonnet-4-6 to claude-sonnet-5, and the comment is explicit that this is not a cost cut: both are $3/$15 at list, and Sonnet 5's $2/$10 rate is introductory through 2026-08-31.

I nearly wrote "a third cheaper" into the code. The repo's own rate table — which records list precisely so aggregates don't dip then jump — is what corrected me. Selling a capability swap as a cost cut to an owner watching spend would have been the wrong kind of wrong.

The real levers, in order

1. Don't call the model at all — auto-repair-mechanical as tier 0 (shipped today, #5578), then the repair_flywheel signature cache once it has anything in it
2. This ceiling
3. MODEL_HAIKU at $1/$5 for work that doesn't need the mid tier