Architecture

Messaging reads shared-core `booking`, `guest`, and `partner` (host), and writes the C2-owned `conversation` / `message` (guest-host kind), a `ticket` on convert, and `cost_ledger` rows for the metered stages. The data invariant holds: an owner's send + translation are canonical (durable mirror), while a viewer's smart-reply and translation are ephemeral (a credential-tagged cost row that resets; translation display-only). Guests act only within their own threads.

Two metered stages — `smart-reply` (shared with #16) and `translate` — both dual-mode by design (Cloud `claude-haiku-4-5`, cost-capped/fail-closed / OSS recorded $0 on local hardware; translate records an OSS NLLB-class model, smart-reply an OSS chat model). Both run OSS-only and are honestly labelled simulated — a deterministic draft and a bracketed "(simulated translation)" output — each writing a cost row. Out of scope and labelled: translation and message delivery are in-app only. Cost, mode, and trace are inspector-only.