Architecture

The app owns demo_eco_promotion and reads the shared booking for its analytics. Coupon evaluation is a pure function — status gate → usage-limit gate → minimum-spend gate → price (percent / flat / package, clamped to the cart) — shared by the guest checkout and the owner console, so there is one enforcement path. The same rule code runs unchanged over real rows in Stage-2.

It emits promo.applied on the in-process event spine when a coupon is redeemed. The data invariant holds: owner deals are canonical (credential_id NULL); a viewer's created deals and usage ticks are credential-scoped, ephemeral, and reset-clearing, and can never mutate a canonical row.

The deal-copy draft is the one genuinely metered C7 stage and runs dual-mode: Cloud claude-haiku-4-5 (cost-capped, fail-closed) / OSS qwen3:8b recorded on local M4 hardware ($0). The output is deterministic-cacheable, keyed (slug · stage · prompt_version · input_hash), so an identical brief hits demo_cache and is $0 regardless of mode; on a cap or missing key it fails closed to the recorded $0 output — never a fabricated cloud cost. The discount applies to a sample cart, not a real PSP; coupon validation is deterministic $0. All instrumentation is inspector-only.