Architecture

The app owns `demo_eco_ancillary_offer` (the catalog) and `demo_eco_offer_acceptance` (accepted lines, attributed to a booking), written through the one typed C1 adapter. It reads shared-core `booking` / `guest_profile` and the loyalty account (#12). It emits `offer.accepted` and feeds #23. The data invariant holds: owner writes canonical; a viewer's acceptances are credential-scoped, ephemeral, and reset-clearing.

The profile/tier ranking is deterministic ($0). One metered stage — `personalize-offers` (the pitch rationale) — runs dual-mode: Cloud `claude-haiku-4-5`, cost-capped and fail-closed; OSS recorded as `qwen3:8b (recorded · M4)` at $0; it writes a `cost_ledger` row. Simulated + labelled: acceptance is a folio post with no real settlement. No real imagery, no PII; the default catalog is synthetic and owner-editable.