Native ads select a grid of recommendation items from an inventory pool: validate, score, dedupe by id and by domain, rank, and take the top n with positions. The core is total (never throws) and deterministic; the browser layer owns viewability and output encoding. Core: wal-sh.adtech.native-ads.core (pure, cross-host).

ORACLE: src/wal_sh/adtech/native_ads/core.cljc (pure), browser.cljs (window._nativeAds).

Behavioral guarantees:

• Totality: select-grid and select-top-n never throw; for any input (incl. nil, malformed items, NaN/Inf) they return a vector (possibly empty).
• Determinism: no rand, no clock, no I/O in core. Same input ⇒ byte-identical output on JVM and CLJS.
• Idempotency: dedupe ops are idempotent; escape-html is idempotent on already-escaped output (modulo &).
• Monotonicity in slots: (count (select-grid p {:slots n})) ≤ (count (select-grid p {:slots (inc n)})).

I/O domains (browser):

• IntersectionObserver for viewability. Fallback to synchronous fire-all when unavailable.
• window._beacon.send(event, payload): optional telemetry sink.
• window._nativeAds: public surface (set on init).

Core (wal-sh.adtech.native-ads.core, pure, cross-host):

Browser surface (window._nativeAds):

window._nativeAds = {
  inventory: Array<Item>,
  engine: { recommend: (count?, category?) => Array<Item>,
            render:    (recs, containerId?) => void },
  show:    (count?, category?) => Array<Item>,   // full flow + viewability
  metrics: () => { viewableImpressions, clicks, verdict }
};

• ∀ pool p, ∀ n: |select-top-n n p| ≤ min(n, |p|)
• ∀ pool p: dedupe-by-domain is idempotent
• ∀ pool p: dedupe-by-id is idempotent
• ∀ pool p: non-sticky items in (dedupe-by-domain p) have pairwise-distinct :domain
• ∀ valid item i: (score i) ≥ 0
• ∀ pool p: (select-grid p opts) = (select-grid (shuffle p) opts) (permutation-stable)

Every row pairs a bad input with the expected rejection behavior and a property test that asserts it. All properties run on JVM and CLJS.

Design decisions (called out in code):

• Negative scores: deferred. ctr-proxy, revenue, dwell are documented non-negative in the contract. Generator stays in [0, ∞). If a future bid model wants signed terms, revisit the score-non-negative property.
• HTML escaping: enforced at render boundary, not in core. Rationale: score is pure on raw strings; the browser layer owns output-encoding hygiene. Same separation Sponsored Products uses.
• Duplicate-id dedup runs BEFORE domain dedup so two copies of the same item can't accidentally outrank a competitor on a tied domain.
• select-grid is total: it absorbs every bad input shape (nil, non-map, missing fields, NaN) silently. Callers wanting strict validation can (filter valid-item? pool) themselves and compare counts.

• The content-recommendation widget format this module reproduces is the Taboola / Outbrain "around the web" unit; their publisher documentation (Taboola, n.d.; Outbrain, n.d.) defines the grid-of-cards shape and the sponsored-bypass on domain dedupe.
• Viewability is measured with IntersectionObserver (MDN Web Docs, n.d.); the synchronous fire-all fallback is the pre-observer posture.
• rel"sponsored"= on rendered links follows the WHATWG link-type definition (WHATWG, n.d.).

• sponsored-display/spec.org: the sibling format whose render-boundary escaping this module copies.
• sponsored-formats/spec.org: the unit taxonomy the native grid sits in.
• beacon/spec.org: the optional telemetry sink (window._beacon.send).
• ORACLE:
  • src/wal_sh/adtech/native_ads/core.cljc (pure)
  • src/wal_sh/adtech/native_ads/browser.cljs (window._nativeAds)
  • test/wal_sh/adtech/native_ads/core_prop_test.cljc (properties)

• Signed scoring terms. The score-non-negative property holds because every scoring key is documented non-negative; a future bid model with signed terms would need the property revisited.