Browser adtech infrastructure — tracking, A/B, feature flags, sponsored slots

wal.sh runs a full client-side adtech stack — as parody, as research instrumentation, and as the ambient setting the site is written for. This note is the reference: what module owns what, where the boundaries sit, and where each piece of behaviour is implemented in the tree.

Two teams, one contract:

• Creative management — owns plate generation, prompts, versioning, labeling. Writes manifests to site/static/img/sponsored/.
• Render + serve — owns HTML/CLJS surfaces, tracker, interleave logic. Reads manifests.

The interface between them is manifest.json. Neither team calls into the other's implementation.

Two economic mechanics are demonstrated (not monetised):

• Implicit auction — bid × quality = price, priced against a stable bucket. Documented via Demo.explain on sponsored-research and the exp-104 "Auction Disclosure" experiment. The /go/ resolver's OnClick ledger entry is the analogue of click-based settlement, minus the money.
• Affiliate tracking — /go/:token in attribution-audit IS the affiliate-link infra, C1-safeguarded to same-origin only. Referral-program + affiliate-engine exist as raw JS; port pending.

The tracker is a single browser module (wal-sh.site.tracker.browser) that installs one document-level listener per event class. Envelope is built via wal-sh.adtech.beacon.core/build — same envelope shape as the adtech beacon module, so downstream consumers see one JSON schema.

Bucketing hash is djb2 seed 5381 over ${userId}:${expId}, _ab_uid in localStorage, exported as window._abTesting. The four sponsored-research experiments (exp-101..104) reuse this hash so a reader in variant-a for one experiment is in variant-a everywhere.

Source of truth: src/wal_sh/adtech/ab_engine/. The sponsored-research core copies djb2 verbatim (sponsored-research.core/djb2) to avoid a circular require. The attribution-audit holdout arm uses the same hash — same reader, same arm across the surface.

Current experiments:

Flags are Emacs defvar in publish.el sourced from environment. Each adtech module has a USE_<MODULE> flag; the postamble include is emitted only when the flag is truthy.

Registry: wal-sh/adtech-systems in publish.el — an ordered list of (name toggle-var include-file) tuples. Adding a module means:

1. New CLJS module + shadow-cljs build
2. New includes/adtech-<name>.html (one <script src> line)
3. New (defvar wal-sh/use-<name> ...)
4. Append to wal-sh/adtech-systems

Current tracked modules (post 2026-08-16): tracker, sponsored-research, sponsored-display, attribution-audit, intent-signals, exit-intent, stuffing-detectors, plus the round-1–4 adtech ports (ab-engine, attribution, beacon, bot-greeting, ceddl, clean-room, content-gate, influencer-links, metered-access, native-ads, prebid, pricing-engine, promo-engine, referral-program, search-ads, sponsored-products, tag-manager, affiliate-engine).

Load order (registry-enforced):

• sponsored-research before sponsored-display (Display attaches to the former's window._sponsoredResearch).
• attribution-audit before intent-signals (appends to its ledger) and before exit-intent (reads the arm).
• stuffing-detectors depends on attribution-audit's ledger at run time.

Two beacons: the adtech beacon module (explicit window._beacon.pageView()) and the passive-capture tracker (auto-firing on scroll/click). Both target beacon.termbox.org via the shared envelope; both are now pixel-transport (see 3.2).

Payload shape (verbatim from wal-sh.adtech.beacon.core/payload):

{
  "event":     "sponsored.impression",
  "ts":        1697000000000,
  "session":   "s-abc123",
  "url":       "https://wal.sh/search?q=dafny",
  "referrer":  "",
  "userAgent": "...",
  "screen":    "1920x1080",
  "timezone":  "America/New_York",
  "pageID":    "",
  "elId":      "sponsored-sr-001",
  "elKind":    "sponsored-product",
  "creativeId":"sr-001",
  "unit":      "product",
  "position":  3
}

Extra keys (elId, elKind, creativeId, unit, position, sponsor, pageIdx, poolIdx, isDup, dwellMs, depthPct, …) are merged by the tracker's element-payload builder before query-encoding.

Sits on top of wal-sh.adtech.attribution (six-model engine). Adds what the engine lacks:

• Touchpoint provenance — closed set #{observed asserted} (R18). Enforced at touchpoint constructor (C3).
• Credit-conservation — claimedCreditRatio; honest = 1.0, assertion inflates it (R19, R20).
• Incrementality holdout — holdout arm suppresses ads/overlays and measures the lift delta. The only falsifying measurement in the stack (R21, R22). Default 10 %.
• go:token resolver — same-origin only. DESTINATIONS allowlist in core (C1); merchant networks structurally unreachable. Every resolve appends an observed OnClick touchpoint (R23).
• Demo.stuff() — asserts a phantom touchpoint; ratio inflates while incrementality stays flat. The asymmetry IS the demonstration.

Public: window._srAttribution with {Ledger, Audit, Go, Demo}. Toggle: USE_ATTRIBUTION_AUDIT. Pure logic core.cljc is REPL-testable under :clj.

Chartbeat-style engagedTime — visible AND recently active, NOT wall-clock (R25). Every signal enters the v5 ledger as observed (R24).

Signals + weights (core/weights):

Score is a weighted convention reported alongside the raw signal vector — never instead of it (R26).

Public: window._srIntent. Toggle: USE_INTENT_SIGNALS. No-ops if attribution-audit's Ledger is missing.

Fortune-inspired "Before you leave" blended-grid overlay. Owned + paid units in one grid.

Gating (all must hold):

• intent.eligible? — engagedTime ≥ 15 s AND scrollDepth ≥ 50 % (R29)
• arm ! holdout= (R31)
• Not already shown this session; not in 7-day dismiss window (R30)

Triggers: desktop cursor within 20 px of viewport top; mobile upward scroll velocity ≥ 1.5 px/ms.

Divergences from source (deliberate):

• Every card carries its own provenance label (R32) — source hides disclosure behind a container-level ad-choices icon.
• Dismissible via Escape / backdrop / close button with focus return (R33).
• Never traps the back button. R28 is permanent.

Public: window._srExitIntent. Toggle: USE_EXIT_INTENT.

Four distributional detectors on the v5 ledger. Every detector returns {:baseline :rows} (R35) — a verdict without a baseline is an assertion. R34: NEVER reads :provenance during detection; reading :provenance is validation (ground truth), never detection.

D2 is the strongest single indicator. R36: validate() checks recall against :provenance — the demonstration is precisely that post-hoc detection cannot substitute for a boolean recorded at write time.

Public: window._srDetectors with {Suite: {run, validate, report}, Detectors}. Toggle: USE_STUFFING_DETECTORS.

Two formats coexist. Both keyed on the same ab-engine bucket, both non-displacing (organic order is never permuted).

Owned by the creative team. Runbook lives at docs/plate-generation-workflow.md.

Not implemented, spec captured. Grammar is ours to name — the observed source (ScienceAlert's Purch_{D|Y}_{L|C|R}_{tier}_{n}) is one convention; ours can be any stable, greppable pattern. The essentials:

• R10 — stable slot IDs (naming is our choice)
• R11 — container + mount pair, ID triplicated on class + class + id
• R12 — reserved dimensions on the container (CLS=0 on fill)
• R13 — in-content and search slots server-rendered by the org exporter, not client-injected
• R14 — call sites push to window._sr.cmd, typeof-guarded
• R15 — placement names come from a registry, not string literals
• R16 — segment targeting set-once, guarded on current value
• R17 — slot density is a build parameter; default 3, ceiling 14

Observed ScienceAlert density: 14 slots against ~15 paragraphs. The observed ceiling, not a target — wal.sh's default should be far lower.

Pocket-es is the ClojureScript BM25 search UI at /search.

MutationObserver adapter that INVERTS the pocket-es→sponsored dependency: sponsored WATCHES pocket-es and injects after render.

• R37 — per-query page-uid (one observer run per query)
• R38 — clean teardown between queries (disconnect, remove DOM, clear listeners)
• R39 — view-dedup: no duplicate impressions for the same (page-uid, slot) pair on rerender
• R40 — non-permutation of organic (invariant from v6)

• [ ] Search-mount v7 adapter (spec captured, not landed)
• [ ] Cut over the 21 remaining raw-JS adtech includes (mostly compiled outputs missing + include paths pointing at raw)
• [ ] Hiccup / hiccups-lite for the accumulated inline HTML strings
• [ ] Batching for the tracker transport (1 s debounce, flush on visibility change or ≥8 KB) — pixel switch made this less urgent but not moot
• [ ] Bare-/search default → recent changes
• [ ] Chumbox infinite feed (spec in hand, not tangled)
• [ ] Slot placement contract v4 (grammar + registry + org emitter)
• [ ] Manifest schema v2: per-plate sidecar JSON, thin index, rollback, A/B on plates
• [ ] Archetype table v2: numeric-keyed, bidirectional dir index, :archetype/source provenance, :archetype/grayscale-risk for regen priority
• [ ] REPL-driven tests for the pure fns in tracker/core.cljc, sponsored-research/core.cljc, plates/prompts.cljc, attribution_audit/core.cljc, intent_signals/core.cljc, stuffing_detectors/core.cljc
• [ ] Port referral-program + affiliate-engine from raw JS to CLJS

• src/wal_sh/site/tracker/ — tracker (v6 pixel transport)
• src/wal_sh/adtech/sponsored_research/ — native format + interleave + sample-mixed
• src/wal_sh/adtech/sponsored_display/ — banner format
• src/wal_sh/adtech/attribution_audit/ — v5 provenance ledger + /go/ resolver + holdout
• src/wal_sh/adtech/intent_signals/ — v6 engagedTime + score + ledger emit
• src/wal_sh/adtech/exit_intent/ — v6 blended-grid overlay
• src/wal_sh/adtech/stuffing_detectors/ — v5 addendum, four distributional detectors
• src/wal_sh/adtech/plates/ — prompts + generation (v3)
• src/wal_sh/adtech/beacon/ — envelope
• src/pocket_es/ui.cljs — search UI + sponsored integration (runtime aget)
• src/pocket_es/indexer.clj — search index + :thumb emission
• publish.el — feature-flag registry + postamble injection
• shadow-cljs.edn — module build definitions
• docs/plate-generation-workflow.md — creative-team runbook
• docs/beacon-termbox-spec.json — pixel-transport OpenAPI spec