Architecture

From the shared core (guest, booking, loyalty, plus property for country) the app derives a per-guest record — tier, days since last booking, lifetime bookings, lifetime value, country — and scores segment rules as AND-ed predicates over it. A guest is in a segment only when every rule matches. It owns demo_eco_segment and demo_eco_campaign (with an ordered demo_eco_campaign_step table); it reads, never re-creates, the shared core.

It emits segment.computed and campaign.sent on the in-process event spine. The data invariant holds throughout: owner writes are canonical (credential_id NULL); a viewer's segments and journeys are credential-scoped, ephemeral, and reset-clearing, and can never mutate a canonical row.

Segment scoring is deterministic rule code — $0 in both Cloud and OSS modes — and writes a single zero-cost cost_ledger row only so the inspector can record that the stage executed. No model is called. Lifecycle sends are simulated and labelled (no real SMTP/push), delivered through the #35 comms shell; funnel rates are representative. All cost/mode/trace instrumentation is confined to the dark inspector.