Architecture

The generation pipeline is: gather property context (deterministic), build brief (deterministic), Generate — the one metered stage — then QC + brand guardrails (deterministic, run after generation). Editing a draft re-runs the deterministic QC with no model call. Publish is a separate, owner-gated action that is blocked unless QC passed.

The app owns property_content drafts in its demo_eco_c3_content table and reads the shared host #01 property catalog. On publish (owner-gated → credential_id NULL → canonical) it performs the campsite-canon upsert into the core demo_eco_property_content store, keyed propertyId:language, writing only the published field (tagline / description / highlights) so other languages are preserved. The data invariant holds: owner canonical; viewer credential-scoped, ephemeral, reset-clearing; the DO-UPDATE scope guard blocks a viewer write from clobbering canonical.

Publishing emits content.published on the in-process event bus (persisted to the durable event log), carrying the content id and property. Downstream, the marketplace detail page and any property-content reader consume the published field through the shared core store. The studio pairs naturally with #19 (photo verification) on the same listing surface.

The one metered stage (generateContent) runs dual-mode: Cloud claude-haiku-4-5, cost-capped at $0.05 per session and fail-closed — over the cap it falls back to recorded OSS (qwen2.5-7b-instruct) at $0, recorded on local hardware and never fabricated. Each run writes a cost_ledger row and a demo_cache replay key (slug · stage · prompt-version · input-hash). Out of scope and clearly labelled: generation is a deterministic, voice-templated simulation in the prototype; copy describes synthetic illustrated placeholders, never real imagery; no production prompts or proprietary style guides appear. Honesty is inspector-only.