How can ads subsidize LLM tokens?

Keep three ledgers conceptually separate

Campaign spend, user rewards, and gateway usage answer different questions. Combining them into one mutable balance makes retries dangerous and hides whether the business is solvent.

• Campaign spend: what verified delivery costs the advertiser.
• Reward ledger: immutable points earned by the user.
• Gateway quota: a projection of the reward ledger minus model usage.

Verification happens before reward and billing

The server signs an impression token, checks continuous dwell time, rejects replay, and applies user and campaign caps. Only then should it credit the user and charge the campaign. Reservations prevent concurrent requests from overspending a daily budget.

Exactly-once is an outcome, not a network promise

External gateways can succeed while the caller times out. Lullad keeps the reward ledger as the source of truth, projects an absolute quota target, and acknowledges only the ledger IDs in the snapshot it reconciled. Retrying converges instead of adding the same reward twice.

What still needs real data

Affiliate commission and upstream token cost must be attributed from their own systems. Until both are stored, “revenue covers token cost” is an unmeasured goal—not a conclusion. A trustworthy dashboard labels the evidence gap.