@stage5/lumine 0.2.52 → 0.2.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.2.52",
+  "version": "0.2.54",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {

package/sdk/BUILD_SDK_INDEX.md

@@ -1,8 +1,8 @@
 # Build SDK Index
 
-Version: 1.37.2
-Updated: 2026-08-26
-Generated: 2026-08-26T15:17:11.027Z
+Version: 1.38.2
+Updated: 2026-08-27
+Generated: 2026-08-27T12:11:09.595Z
 
 ## Notes
 - This SDK is injected into Build iframes via the Build preview/runtime.
@@ -26,9 +26,13 @@ Generated: 2026-08-26T15:17:11.027Z
 - Live web search is enabled by default for Twinkle.ai.chat and for Medium/High Twinkle.ai.generateObject and Twinkle.characters.chat requests. App authors can pass webSearch: false to disable it for their app. Search uses the provider's live web-search tool and is included in AI Energy usage; structured and character Lite Mode remains tool-free.
 - Interface text must not be selectable on touch devices: apply user-select: none plus -webkit-user-select: none and -webkit-touch-callout: none to interface text (HUD, buttons, labels, menus, scores, game controls) so mobile long-press does not highlight UI. Keep text inputs and genuinely user-copyable content selectable.
 - Build app tab mute is enforced by the host runtime automatically for standard media elements and Web Audio connections to AudioContext.destination. Apps with custom audio engines can also observe Twinkle.onAudioMuteChange and check Twinkle.isAudioMuted.
+- Use Twinkle.media for camera photos and camera-only two-second clips. Twinkle confirms each capture or paid processing action. Clips are processed to canonical 480p MP4 assets before they become visible; use sharedDb or privateDb to publish/store the returned asset metadata.
+- Static media published through sharedDb is app-owned feed data. A public user-generated feed must provide a visible report flow and owner removal, and must not claim that Twinkle globally moderates those posts.
+- Use Twinkle.live for one-way app livestreams and Twinkle.chat for the accompanying thread. Free livestreams require a verified host, end after at most 15 minutes, and issue at most 10 private viewer grants. Twinkle keeps platform-owned live-status/end controls above active hosts, so app code cannot hide or replace the broadcaster's Stop path.
+- Media Energy is separate from AI Energy. Replace Media Energy UI only from canonical mediaEnergy/getUsage responses; never decrement, reserve, or synthesize it in app code.
 
 ## Token Scopes
-files:read, user:read, users:read, dailyReflections:read, content:read, content:write, sharedDb:read, sharedDb:write, privateDb:read, privateDb:write, files:write, chat:read, chat:write, notifications:read, notifications:write, notifications:emit, reminders:read, reminders:write
+files:read, media:read, media:write, live:read, live:write, user:read, users:read, dailyReflections:read, content:read, content:write, sharedDb:read, sharedDb:write, privateDb:read, privateDb:write, files:write, chat:read, chat:write, notifications:read, notifications:write, notifications:emit, reminders:read, reminders:write
 
 ## Namespaces
 
@@ -282,7 +286,7 @@ console.log(analysis.bestMove, analysis.evaluation, analysis.mate);
   - Simple visible same-origin images can still use normal browser anchors with href and download.
   - Example: await Twinkle.files.saveAs({ fileName: 'fashion-guide.png', dataUrl: imageUrl, mimeType: 'image/png' });
 - async uploadGenerated({ fileName, url, dataUrl, data, text, json, bytes, blob, file, mimeType } = {}) | scopes: files:write
-  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, uploadedByUserId, createdAt }], failed?: [{ fileName, message }], canceled }
+  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, mediaKind, durationMs, uploadedByUserId, createdAt }], failed?: [{ fileName, message }], canceled }
   - Upload an app-generated file to Twinkle-hosted cloud storage without opening a picker, then store the returned asset refs in sharedDb/privateDb/userDb.
   - Signed-in viewers only.
   - Uploads generated blobs, files, bytes, data URLs, or fetchable URLs to Twinkle-hosted cloud storage.
@@ -290,7 +294,7 @@ console.log(analysis.bestMove, analysis.evaluation, analysis.mate);
   - Store the returned asset metadata in sharedDb/privateDb/userDb instead of storing raw file bytes in a DB record.
   - Example: const { assets } = await Twinkle.files.uploadGenerated({ fileName: 'fashion-guide.png', dataUrl: generatedImageUrl, mimeType: 'image/png' });
 - async pickAndUpload({ accept, multiple } = {}) | scopes: files:write
-  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, uploadedByUserId, createdAt }], failed?: [{ fileName, message }], canceled }
+  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, mediaKind, durationMs, uploadedByUserId, createdAt }], failed?: [{ fileName, message }], canceled }
   - Pick supported local files and upload them to Twinkle-hosted cloud storage, then store the returned asset refs in sharedDb/privateDb/userDb.
   - Signed-in viewers only.
   - Uploads to Twinkle-hosted cloud storage and returns asset references.
@@ -299,7 +303,7 @@ console.log(analysis.bestMove, analysis.evaluation, analysis.mate);
   - Store the returned asset metadata in sharedDb/privateDb/userDb instead of storing raw file bytes in a DB record.
   - Example: const { assets, canceled } = await Twinkle.files.pickAndUpload({ accept: 'image/*,.pdf', multiple: true });
 - async list({ cursor, limit } = {}) | scopes: files:read
-  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, uploadedByUserId, createdAt }], nextCursor, usage: { totalBytes, fileCount, maxRuntimeFileStorageBytes, remainingBytes } | null }
+  - Returns: { assets: [{ id, buildId, fileName, originalFileName, mimeType, sizeBytes, filePath, url, thumbUrl, fileType, mediaKind, durationMs, uploadedByUserId, createdAt }], nextCursor, usage: { totalBytes, fileCount, maxRuntimeFileStorageBytes, remainingBytes } | null }
   - List the current viewer's uploaded runtime files for this build.
   - Signed-in viewers only.
   - Lists the current viewer's ready uploads for this build only.
@@ -311,6 +315,117 @@ console.log(analysis.bestMove, analysis.evaluation, analysis.mate);
   - Deletes one of the current viewer's uploaded runtime files and updates quota usage.
   - Example: await Twinkle.files.delete(assetId);
 
+### Twinkle.media
+- async capturePhoto({ facingMode?, maxWidth?, quality?, settleMs?, fileName? } = {}) | scopes: files:write
+  - Returns: { asset, assets, failed }
+  - Ask for camera permission, capture one JPEG photo, and upload it to the current viewer's Twinkle file storage.
+  - Signed-in viewers only. Call from an explicit viewer action; Twinkle shows its own one-action confirmation before the browser may show camera permission.
+  - The photo is saved in the viewer's Twinkle file storage. The returned asset is canonical server state and can be stored in sharedDb/privateDb/userDb.
+  - Example: const { asset } = await Twinkle.media.capturePhoto({ facingMode: 'user' });
+if (asset) await Twinkle.sharedDb.addEntry('photos', asset);
+- async recordClip({ previewElement?, facingMode?, fileName?, waitForReady?, timeoutMs? } = {}) | scopes: media:write
+  - Returns: { clip: { id, status, durationMs, failureCode, asset }, mediaEnergy }
+  - Record a camera-only short video, upload it, and by default wait for the canonical two-second 480p MP4 asset.
+  - Call from an explicit viewer action. Twinkle confirms each recording before requesting camera permission.
+  - The recording is camera-only; use Twinkle.live when audio is part of the experience.
+  - The server targets a two-second maximum input window and processes it to 480p MP4. Encoder frame boundaries can differ by one frame; app code cannot raise the limit.
+  - By default this method polls confirmed server state until ready. Pass waitForReady: false to receive the processing ID immediately, then call getClip().
+  - Example: const { clip } = await Twinkle.media.recordClip({ previewElement: '#cameraPreview' });
+await Twinkle.sharedDb.addEntry('clips', clip.asset);
+- async uploadClip({ file?, blob?, fileName?, mimeType?, requestId?, waitForReady?, timeoutMs? }) | scopes: media:write
+  - Returns: { clip: { id, status, durationMs, failureCode, asset }, mediaEnergy }
+  - Upload a generated or selected video through the same server-bounded two-second clip pipeline.
+  - Call from an explicit viewer action. Twinkle confirms each selected or generated video before upload and paid processing.
+  - Input is limited to 8 MB. The canonical output is a server-produced 480p MP4 targeting a two-second maximum, with at most a frame of encoder-boundary variance.
+  - Use a stable requestId when retrying the same user action.
+  - Example: const result = await Twinkle.media.uploadClip({ file: recordedFile });
+- async getClip(assetId) | scopes: media:read
+  - Returns: { clip: { id, status, durationMs, failureCode, asset }, mediaEnergy }
+  - Load and reconcile canonical processing state for one of the current viewer's clips.
+  - Example: const { clip } = await Twinkle.media.getClip(assetId);
+- async listClips({ cursor?, limit? } = {}) | scopes: media:read
+  - Returns: { assets, nextCursor, mediaEnergy }
+  - List the current viewer's ready short clips for this Build app.
+  - Example: const { assets } = await Twinkle.media.listClips({ limit: 20 });
+- async getUsage() | scopes: media:read
+  - Returns: { monthKey, resetsAt, global, user, build, energyPercent, energySegments, energySegmentsRemaining }
+  - Load canonical current Media Energy for this viewer and app.
+  - Replace displayed state only from this response or a newer mediaEnergy response. Never decrement or synthesize the battery locally.
+  - global.carryoverMicroUsd accounts for reservations that crossed the UTC month boundary so the global reset cannot double the budget.
+  - Example: const mediaEnergy = await Twinkle.media.getUsage();
+renderBattery(mediaEnergy.energyPercent);
+
+### Twinkle.live
+- async start({ previewElement?, facingMode?, audio?, durationSeconds?, maxViewers?, saveReplay?, requestId? } = {}) | scopes: live:write
+  - Returns: { session: { id, replayId, buildId, hostUserId, status, maxViewers, viewersGranted, durationSeconds, saveReplay, updatedAt, hardEndsAt }, mediaEnergy }
+  - Create an IVS channel, attach the camera/microphone, begin broadcasting, and optionally save a seven-day replay.
+  - Call from an explicit viewer action. Twinkle confirms each new broadcast before camera/microphone permission or paid channel creation.
+  - saveReplay defaults to false. When true, the same action confirmation says the stream will be saved, and Twinkle records it to private storage for seven days after it becomes ready.
+  - Replay storage is included in the live Media Energy reservation. Replay viewing has its own Media Energy reservation.
+  - previewElement must be a canvas element or selector because the IVS Broadcast SDK draws a composited preview.
+  - Free sessions broadcast at 854x480 and are capped server-side at 15 minutes and 10 private viewer grants. Lower durationSeconds/maxViewers values are allowed.
+  - Twinkle confirms that a platform-owned live indicator and End stream action are present before returning broadcast credentials to the app, and keeps the control until server cleanup is canonically terminal. Fullscreen and Picture-in-Picture are unavailable while hosting so that Stop control stays visible.
+  - The SDK does not include broadcast credentials in its returned value. Credentials are ephemeral, and the SDK stops local broadcasting at hardEndsAt while the API independently stops and deletes the IVS channel.
+  - Example: const { session } = await Twinkle.live.start({ previewElement: '#broadcastPreview', audio: true });
+await Twinkle.sharedDb.setKvItems('live', [{ key: 'current', value: session }]);
+- async list() | scopes: live:read
+  - Returns: Array<LiveSession>
+  - List currently available livestream sessions for this Build app.
+  - Only sessions canonically acknowledged as live are listed; channels still being prepared are never advertised to viewers.
+  - Example: const sessions = await Twinkle.live.list();
+- async get(sessionId) | scopes: live:read
+  - Returns: LiveSession | null
+  - Load canonical server status for a livestream in this Build app.
+  - Example: const session = await Twinkle.live.get(sessionId);
+- async watch(sessionId, { videoElement, requestId? }) | scopes: live:write
+  - Returns: { session, viewerGrantId, mediaEnergy, playbackStarted }
+  - Use a private single-use playback grant to attach a livestream to an HTML video element.
+  - Call from an explicit viewer action. Twinkle confirms admission before allocating the private viewer grant or using Media Energy.
+  - The first watch action consumes one of at most 10 grants for the session. Repeated watch() calls in the same page reuse the local grant until leave().
+  - Playback authorization is single-use and capped at SD. The watch() result omits the signed playback URL; bridge traffic is still app-visible and must be treated as ephemeral.
+  - playbackStarted becomes true only after IVS or the HTML video element confirms a playing state. If browser autoplay is blocked or no playing state is confirmed, it is false and the video controls remain available so the viewer can start playback explicitly.
+  - Viewers may use the video element's ordinary fullscreen and Picture-in-Picture controls.
+  - Example: await Twinkle.live.watch(session.id, { videoElement: '#liveVideo' });
+- async leave(sessionId) | scopes: live:write
+  - Returns: { success }
+  - Destroy the local player and revoke/settle its private viewer session.
+  - Example: await Twinkle.live.leave(sessionId);
+- async stop(sessionId) | scopes: live:write
+  - Returns: { session, cleanupInProgress, mediaEnergy }
+  - Stop local broadcasting and ask the server to stop and delete the host's ephemeral IVS channel.
+  - Use the returned canonical session state. Do not locally synthesize an ended status.
+  - Example: await Twinkle.live.stop(sessionId);
+- async listReplays({ limit? } = {}) | scopes: live:read
+  - Returns: Array<LiveReplay>
+  - List canonical saved replays for this Build app.
+  - Ready, unexpired replays are visible to viewers in the app. A creator can also see processing or failed state for their own opted-in stream.
+  - Replays expire seven days after becoming ready. Replace displayed state from this canonical response; do not synthesize processing or ready state locally.
+  - Example: const replays = await Twinkle.live.listReplays({ limit: 20 });
+- async getReplay(replayId) | scopes: live:read
+  - Returns: LiveReplay | null
+  - Load canonical processing, ready, or failed state for a visible replay.
+  - Only the creator can see a processing or failed replay; ready replays are visible to signed-in viewers in this app.
+  - Example: const replay = await Twinkle.live.getReplay(replayId);
+- async watchReplay(replayId, { videoElement, requestId? }) | scopes: live:write
+  - Returns: { replay, viewerGrantId, mediaEnergy, playbackStarted }
+  - Open a short-lived private playback grant and attach a saved replay to an HTML video element.
+  - Call from an explicit viewer action. Twinkle confirms each playback grant before using Media Energy.
+  - Admission reserves the replay's maximum delivery estimate; leave, page close, or playback end settles the canonical elapsed viewing window instead of charging unused playback time.
+  - The grant lasts at most 20 minutes and is settled automatically when playback ends, on leaveReplay(), when the page closes, or at server expiry.
+  - playbackStarted becomes true only after IVS or the HTML video element confirms a playing state. If browser autoplay is blocked or no playing state is confirmed, it is false and the video controls remain available so the viewer can start playback explicitly.
+  - Viewers may use the video element's ordinary fullscreen and Picture-in-Picture controls.
+  - Example: await Twinkle.live.watchReplay(replay.id, { videoElement: '#replayVideo' });
+- async leaveReplay(replayId) | scopes: live:write
+  - Returns: { success }
+  - Destroy the local replay player and canonically settle its private viewer grant.
+  - The returned canonical settlement charges the conservative elapsed playback estimate, capped by the replay duration.
+  - Example: await Twinkle.live.leaveReplay(replayId);
+- async deleteReplay(replayId, { requestId? } = {}) | scopes: live:write
+  - Returns: { replay, cleanupInProgress, mediaEnergy }
+  - Permanently remove an opted-in replay through the canonical private-storage cleanup path.
+  - Twinkle asks for an action-specific confirmation. Use the canonical returned state; cleanupInProgress means provider recording finalization or deletion is still being confirmed.
+  - Example: await Twinkle.live.deleteReplay(replayId);
+
 ### Twinkle.ai
 - async getUsagePolicy() | scopes: none
   - Returns: BuildAiUsagePolicy | null

package/sdk/LUMINE_ADMIN.md

@@ -636,6 +636,40 @@ type DailyRunComplete = Success<{
 type DailyRunFail = DailyRunComplete;
 ```
 
+### Build Workshop sponsor applications and integrity
+
+This is the approved Zero/Ciel Build Workshop sponsor role, not the ordinary
+AI Energy sponsor flow. Applications originate only from `lumine sponsor`.
+Website-management agents review them inside an active daily run:
+
+```bash
+lumine admin sponsor applications list --status pending --json
+lumine admin sponsor applications review 12 --decision approve \
+  --note "Approved for probationary duty" --json
+lumine admin sponsor status set 45 --status trusted \
+  --note "Cleared probationary handoffs" --json
+lumine admin sponsor integrity scan --json
+lumine admin sponsor integrity cases --status open --json
+lumine admin sponsor integrity get 34 --json
+lumine admin sponsor integrity review 34 --decision clear --json
+```
+
+Run `sponsor integrity scan` until its bounded snapshot reaches
+`awaiting_review` or `completed`. Every pending completed handoff receives the
+deterministic checks. Probationary work, hard-flagged evidence, and a stable
+random sample become review cases; clean trusted work outside the sample is
+cleared automatically. A case includes the approved structured relay, canonical
+artifact snapshot, branch-notice evidence, and requested/resolved provider,
+model, effort, service-tier, runtime, usage, and agent-tree records. It never
+includes raw Zero/Ciel chat.
+
+`clear` qualifies that unique handoff for its flat 50 KP award;
+`disqualify` makes it ineligible. `hold` and `flag` require an evidence note and
+remain open. The scan itself never changes sponsor status or applies a sanction.
+Use the separate, audited `sponsor status set` command for an explicit human
+decision. `daily-run complete` is rejected until the scan has covered its full
+snapshot and no pending, held, or flagged case remains.
+
 Record only qualifying escalations as they are confirmed. `daily-run report`
 then composes the active run's canonical audit events, successful mutations,
 completed queue scans, recorded escalations, and the most useful brief deltas
@@ -740,10 +774,7 @@ type AdminTodo = {
 
 type AdminTodoList = Success<{
   todos: AdminTodo[];
-  statusFilter:
-    | "pending"
-    | "all"
-    | AdminTodo["status"];
+  statusFilter: "pending" | "all" | AdminTodo["status"];
   truncated: boolean;
 }>;
 
@@ -1700,6 +1731,8 @@ A run report that skipped the conduct review is incomplete.
 ```bash
 lumine admin brief --json
 lumine admin brief --days 3 --json
+lumine admin ai-costs monthly --json
+lumine admin media-costs monthly --json
 lumine admin notable add 12647 --note "Top authored-activity kid of the window: 11 subjects, 61 comments." --json
 lumine admin notable add Minecrarft_guy --note "Helped three new builders debug their projects and gave detailed feedback on five posts." --json
 ```
@@ -1711,6 +1744,231 @@ end every run report with an **"Insights for Mikey"** section carrying only
 the deltas and anomalies worth his time, next to the escalation list. Never
 dump raw sections at him.
 
+### Application AI calendar-month cost (standing duty, every run)
+
+Run `lumine admin ai-costs monthly --json` during every website-management
+run. This read-only command requires the active delegated run and returns one
+server-owned calendar summary from the canonical deduplicated application AI-
+cost ledger. It deliberately takes no `--days`: all boundaries are UTC calendar
+months, so the result is directly comparable from one run to the next.
+
+The previous month is a closed-calendar-month estimated total. Current-month
+MTD contains only completed UTC days and names its inclusive `throughDayKey`.
+The current UTC day's still-filling bucket is returned separately as
+`inProgressDay`; **never add it to MTD or either projection**. A missing daily
+aggregate inside the covered calendar is a recorded zero-cost day, not a
+reason to shrink the denominator.
+
+Two clearly different full-month projections are returned:
+
+- `allCompletedDaysPace` retains completed-day spend, then applies the average
+  across every completed calendar day (including recorded zero days) to the
+  current and remaining UTC days;
+- `recentSevenCompletedDaysPace` retains completed-day spend, then applies the
+  average of the latest seven completed UTC days to the current and remaining
+  days. It is `null` until seven days have completed.
+
+Both projections exclude the partial day's actual cost, replace every not-yet-
+completed day with their stated daily pace, and compare their projected total
+with the previous closed month. They are run-rate scenarios, not forecasts
+from a billing provider. All ledger values are pricing-based estimates rather
+than invoices and can change if canonical usage attribution or pricing is
+corrected.
+
+The stable JSON payload is `data.monthlyAiCosts`:
+
+```ts
+type MonthlyAiCosts = {
+  schemaVersion: 1;
+  generatedAt: number; // Unix seconds
+  timezone: "UTC";
+  currency: "USD";
+  source: {
+    basis: "canonical_deduplicated_ai_cost_report";
+    reportDays: number;
+    reportStartDayIndex: number;
+    reportEndDayIndex: number;
+    mtdIncludesInProgressDay: false;
+    projectionsIncludeInProgressDayActual: false;
+  };
+  previousMonth: {
+    status: "closed";
+    monthKey: string; // YYYY-MM
+    startDayKey: string;
+    endDayKeyExclusive: string;
+    calendarDayCount: number;
+    estimatedCostUsd: number;
+  };
+  currentMonth: {
+    status: "in_progress";
+    monthKey: string;
+    startDayKey: string;
+    endDayKeyExclusive: string;
+    calendarDayCount: number;
+    completed: {
+      dayCount: number;
+      throughDayKey: string | null;
+      estimatedCostUsd: number;
+      dailyAverageUsd: number | null;
+    };
+    inProgressDay: {
+      dayIndex: number;
+      dayKey: string;
+      estimatedCostUsd: number;
+      eventCount: number;
+      requestCount: number;
+    };
+    daysToEstimate: number;
+    projections: {
+      allCompletedDaysPace: MonthlyAiCostProjection | null;
+      recentSevenCompletedDaysPace: MonthlyAiCostProjection | null;
+    };
+  };
+};
+
+type MonthlyAiCostProjection = {
+  basis: "all_completed_days" | "recent_7_completed_days";
+  basisStartDayKey: string;
+  basisEndDayKey: string;
+  basisDayCount: number;
+  dailyAverageUsd: number;
+  remainingDayCount: number;
+  estimatedMonthTotalUsd: number;
+  comparisonToPreviousMonth: {
+    estimatedCostDeltaUsd: number;
+    percentChange: number | null; // null when the prior total is zero
+  };
+};
+```
+
+Release boundary: `/cli/admin/ai-costs/monthly` and all calendar math are API-
+owned. Deploy and verify the compatible `twinkle-api` route before publishing
+or installing the Lumine CLI release that invokes it; an older API will reject
+the new command instead of synthesizing figures locally.
+
+### Lumine media feature cost and cleanup watch (standing duty, every run)
+
+Run `lumine admin media-costs monthly --json` during every website-management
+run. This read-only, delegated-run-gated command reports the canonical Media
+Energy ledger for short clips, livestream input/viewer usage, and replay
+storage/viewing. Include in
+**"Insights for Mikey"** on every run:
+
+- current-month settled estimated cost, active reservations, cross-month
+  carryover, guarded total, global limit, remaining headroom, and percent used;
+- the current UTC day's reservations, settlements, cancellations, and settled
+  estimated cost;
+- the current UTC day's privacy-safe stream-attempt cohort: attempted,
+  reached-live, ended-after-live, failed, cancelled-before-live, still in
+  progress, and grouped server failure-code counts;
+- clip, live-input, live-viewer, and replay-viewer action/cost breakdowns;
+- whether the global usage row reconciles exactly with reservation rows;
+- every returned alert, plus incomplete clip jobs, cost-bearing IVS channels,
+  active-or-cleanup-pending sessions, possible orphaned sessions, overdue
+  cleanup, replay finalization/deletion state, retained replay bytes/objects,
+  and expired-active live or replay viewer grants;
+- ready image/clip storage counts and bytes as scale context.
+
+Treat `status: "critical"`, any reconciliation mismatch, overdue IVS cleanup,
+or overdue replay finalization/deletion as an operational incident to
+investigate in the same run. Treat
+`status: "attention"` as a required finding, not a decorative warning. The
+server's request-time global Media Energy guardrail defaults to **$40/month**;
+the separate AWS Budget is **$50/month**, leaving provider-billing and shared-
+infrastructure headroom. Never infer or locally decrement either value.
+
+The ledger is the immediate application source of truth and deliberately uses
+conservative provider-cost estimates. It is not an AWS invoice. Photo capture
+uses existing Build runtime file storage rather than the paid Media Energy
+ledger; `operations.runtimeStorage.readyImages` therefore reports all ready
+Build runtime images, not camera captures alone. Reconcile delayed AWS
+MediaConvert and IVS service charges every run as described below. S3 is shared
+with other Twinkle uploads, so report its service-level cost as shared context,
+not as photo-only spend.
+
+Release boundary: `/cli/admin/media-costs/monthly` owns the canonical ledger,
+reconciliation, resource-state checks, and alerts. Deploy and verify that API
+route before publishing or installing the Lumine CLI release that invokes it.
+
+`currentUtcDay.streamAttempts` is a `createdAt` cohort for that UTC day. Its
+outcomes partition every attempt into `endedCount` (reached live, then ended),
+`failedCount` (failed or cleanup-failed), `cancelledCount` (ended before ever
+reaching live), or `inProgressCount`; `reachedLiveCount` is the overlapping
+milestone count. `failureCodeCounts` contains only server-defined codes and
+counts—never usernames, Build ids, titles, viewer identities, or report
+identities. `operations.live.stillActiveOrCleanupPendingCount` and
+`possibleOrphanedCount` are current global counts, not members of the daily
+cohort.
+
+Replay storage and write cost is conservatively embedded in an opted-in
+`live-input` reservation; `replay-viewer` is a separate kind. Report
+`operations.replays` (pending, processing, ready, failed, deleting,
+delete-failed, overdue finalization/deletion, expired-ready, bytes, and object
+count) and `operations.replayViewers` on every run. A replay finalization or
+deletion alert is an operational incident because private recording cleanup is
+part of the feature contract.
+
+### AWS monthly bill expectation (standing duty, every run)
+
+Starting 2026-08-27, every website-management run must also check AWS Cost
+Explorer and include the current calendar month's expected AWS bill in
+**"Insights for Mikey"**. This is an account-level infrastructure cost check,
+not the `aiSpending` application-cost section above; never substitute one for
+the other or combine their totals.
+
+First verify the Twinkle AWS principal exactly as required by the repository
+agent guide. Use profile `mikey-iam`, pass an explicit region on every command,
+and stop rather than reading another account if the ARN is not
+`arn:aws:iam::019490893667:user/twinkle-admin`:
+
+```bash
+aws sts get-caller-identity --profile mikey-iam --region us-east-1
+```
+
+Then use UTC calendar boundaries and Cost Explorer's unblended-cost metric.
+`End` is exclusive: the month-to-date query below covers completed dates before
+`<today-UTC>`. On the first UTC day of a month, report that no completed-day MTD
+period exists instead of sending an empty interval.
+
+```bash
+aws ce get-cost-and-usage --profile mikey-iam --region us-east-1 \
+  --time-period Start=<month-start-YYYY-MM-01>,End=<today-UTC> \
+  --granularity MONTHLY --metrics UnblendedCost
+
+aws ce get-cost-and-usage --profile mikey-iam --region us-east-1 \
+  --time-period Start=<month-start-YYYY-MM-01>,End=<today-UTC> \
+  --granularity MONTHLY --metrics UnblendedCost \
+  --group-by Type=DIMENSION,Key=SERVICE
+
+aws ce get-cost-forecast --profile mikey-iam --region us-east-1 \
+  --time-period Start=<today-UTC>,End=<next-month-YYYY-MM-01> \
+  --metric UNBLENDED_COST --granularity DAILY \
+  --prediction-interval-level 80
+```
+
+Report the Cost Explorer snapshot date, currency, estimated MTD amount and its
+through-date, plus the returned **remaining-period** forecast mean and 80%
+lower/upper bounds. Verify that the first and last returned daily periods cover
+exactly the requested `Start`-inclusive, `End`-exclusive interval before doing
+any arithmetic; reject or separately explain a response with expanded or
+missing dates. Calculate the expected full-calendar-month mean and bounds by
+adding completed-day MTD to the sums of the returned daily mean, lower, and
+upper values. Do not use monthly granularity for this mid-month remainder:
+Cost Explorer can return the whole calendar month even when the requested
+start is mid-month, and adding MTD to that result would double-count. This
+split deliberately forecasts the current UTC day instead of mixing its
+incomplete actual into MTD. Label current-month actuals
+when `Estimated` is true, and describe the result as a Cost Explorer expectation
+rather than a final invoice because reporting lags and later credits, refunds,
+taxes, or adjustments can change the bill. If either the forecast or MTD query
+is unavailable, report the available component and say why a complete
+full-month expectation is unavailable instead of extrapolating it locally. A
+previous closed month may be quoted for context when the difference is
+material, but it is not a replacement for the current-month expectation.
+For the media watch, separately identify AWS Elemental MediaConvert and Amazon
+Interactive Video Service rows when present. Also report Amazon S3 as shared
+storage context, without attributing the whole S3 row to Lumine media.
+
 Ten sections (Mikey's chosen cut 2026-08-10; behavioral-insight and
 farm-signal sections added that day; AI Card summon watch added 2026-08-24):
 
@@ -1762,8 +2020,8 @@ farm-signal sections added that day; AI Card summon watch added 2026-08-24):
   every individual summon. Each group reports its maximum same-day account and
   charged-summon totals, the multi-account days, and days above the shared
   three-card limit. Review every `requiresIdentityInspection` group,
-  prioritizing `daysAboveSharedLimit > 0`, with reason-required `identity
-  inspect`. If
+  prioritizing `daysAboveSharedLimit > 0`, with reason-required
+  `identity inspect`. If
   `riskGroupsTruncated` is true, report that the bounded watch has more groups
   than it returned rather than calling the review exhaustive. Add only
   operator-confirmed exact accounts to an unbanned quota bucket with