Architecture

Host #01 owns the shared-core schema — property, room_type, rate_plan, inventory, booking, guest, guest_profile, behavior_event, media_asset, poi, property_content, review, notification — plus the coupling spine (the event log). Every app reads and writes through one typed adapter; in Stage-2 the in-memory adapter is swapped for real Drizzle/Postgres repositories behind the same method surface, so the component layer never changes.

Connections are real, not narrated: an in-process event bus (emit/subscribe), persisted to a durable event table, carries booking.created, payment.captured, loyalty.accrued, review.submitted and the rest to whichever apps consume them. The data invariant holds throughout — owner writes are canonical; a viewer's writes are credential-scoped, ephemeral, and reset-clearing, and can never mutate a canonical row.

The host's one metered stage is natural-language search parsing; it runs dual-mode (Cloud claude-haiku-4-5, cost-capped and fail-closed / OSS recorded on local hardware at $0) and writes a cost_ledger row. The structured-field search is the always-available deterministic fallback. All cost, mode and trace instrumentation is confined to the dark inspector.

Payments (no real PSP), email/SMS/push (in-app sent viewer), maps (illustrated), and external channel-manager sync are simulated and clearly labelled. No real imagery, no PII, no production prompts or proprietary metrics appear anywhere.