nx_adnet_reconcile.nx

nx_adnet_reconcile.nx -- LIB: the BEAT that owns campaign field 7 (spent_milli). WHY IT EXISTS: camp_may_serve enforces a budget ceiling by reading spend from the campaign ROW, so the serve path stays O(1) and never scans a journal. Something has to WRITE that field, and it must not be the serve path -- ainv_spent_milli walks three journals, which with 158k served rows is a per-request table scan on the hot path. Putting that behind an ad impression is how an ad network takes its own site down. So: a beat reconciles, serving reads. ★ PURE TRANSFORM, no IO. Takes the confs as buffers and emits the NEW conf into out. The caller owns reading and the atomic write, which keeps this gateable with fixtures and keeps the dangerous part (overwriting a live conf) in one reviewable place. ★ PRESERVES EVERYTHING IT DOES NOT UNDERSTAND. Comment rows, blank lines and rows whose spend cannot be computed pass through BYTE-IDENTICAL. A reconciler that drops what it cannot parse is a data-loss bug wearing a maintenance-task costume. ★ AN UNMEASURABLE SPEND IS LEFT ALONE, NEVER ZEROED. ainv_spent_milli returns -1 when a campaign is unpriced, its id is malformed, or viewable > served (a forged beacon). Writing 0 there would silently REVIVE an exhausted campaign -- the exact failure the ceiling exists to prevent. The old value stands and camp_may_serve keeps refusing. license_tier: ORIGINAL