nx_adnet_campaign.nx

nx_adnet_campaign.nx -- LIB: the CAMPAIGN, i.e. the decision "may this creative serve right now". WHAT IT CLOSES: an advertiser record says WHO is buying and a rate card says AT WHAT PRICE, but nothing in the plane says WHEN or HOW MUCH. Today an inventory row serves forever the moment it exists. THE GAP THAT MOTIVATED THIS, MEASURED: anb_capped clamps the BILL at cap_milli but nothing stops the SERVING. So an advertiser past budget keeps receiving impressions that can never be invoiced -- we give away inventory and call it a cap. A budget ceiling that stops billing but not delivery is not a ceiling, it is a discount that grows without limit. ★ THE DECISION IS A PURE FUNCTION OF (row, now, spent). No clock read, no file read, no global state -- so the gate can drive every branch deterministically and the edge can call it per request without IO. ★ FAIL-CLOSED ON MALFORMED: a row that cannot be EVALUATED is NOT servable. Never serve what you cannot reason about; an unparseable campaign is exactly when you are least entitled to spend someone's money. ★ SEALED VERDICTS, never a bare boolean. "did not serve" and "did not serve BECAUSE the flight ended" are different facts to an advertiser asking why their spend stopped, and a support answer needs the second one. Row contract (TAB-separated, same shape discipline as nx_adnet inventory): <campaign_bk> <advertiser_bk> <creative_url> <start_epoch> <end_epoch> <budget_milli> <status> status: live | paused end_epoch = -1 means OPEN-ENDED (an explicit fact, not a missing one) budget_milli = -1 means NO BUDGET CEILING (again explicit; absent and unlimited must not look alike) license_tier: ORIGINAL