Architecture

The app owns demo_eco_ad_campaign and reads the shared property catalog to render slots. The auction filters to active campaigns with remaining 30-day budget over a known property, scores each by bid × target relevance (a luxury/business/budget/all relevance curve), sorts, and takes the top N — a pure ranking, not a random draw. New submissions start pending-review and only serve once approved. The same code ranks unchanged over real rows in Stage-2.

It emits ad.served (with impression ticks) and ad.clicked (with the charged bid) on the in-process event spine. The data invariant holds: owner campaigns and moderation are canonical (credential_id NULL); a viewer's submissions and impression/click ticks are credential-scoped, ephemeral, and reset-clearing, and can never mutate a canonical row.

The auction is deterministic ranking — $0 in both Cloud and OSS modes — and writes a single zero-cost cost_ledger row only so the inspector can record the stage executed; no model is called. Per-click bid charges and platform-revenue totals are simulated and labelled (no real ad exchange or billing). All cost/mode/trace instrumentation is confined to the dark inspector.