Architecture

The desk reads shared-core `property`, `room_type`, `rate_plan`, `inventory`, `guest`, and loyalty, and writes the canonical shared `booking` through the same adapter path as the rest of the booking apps. The only owned write is the `cost_ledger` row for the metered upsell. The data invariant holds: owner confirms/cancels are canonical, while a viewer can search and run the upsell ephemerally (credential-tagged cost that resets) but cannot create or cancel a canonical booking.

One metered stage — `upsell-suggest` — dual-mode by design (Cloud `claude-haiku-4-5`, cost-capped/fail-closed / OSS recorded $0 on local hardware), running OSS-only and honestly labelled simulated (deterministic ranking of three suggestions). Out of scope and labelled: payment and the confirmation email are simulated (no PSP; the confirmation lands in #35's in-app sent viewer). Cost, mode, and trace are inspector-only.