Record Attribution

Store the ad click ids the workspace arrived with.

Called by the app once a session resolves, because the values live in first-party cookies the browser holds and the webhook that later confirms a subscription has no browser to read them from.

Written once and never overwritten. Any member of the workspace may call it — this is not privileged data and the first user through the door is usually the one who clicked the ad. A call carrying nothing is a no-op rather than an error: most sessions have no click ids to report.

Beside the click ids it keeps what an ad platform needs to match a conversion the server reports (ZEISO-526 §2.5): the browser's user agent and IP, read from the request itself and never from the body, so the browser cannot claim them; the consent the site recorded; and who captured it. A sign_up still waiting for these is completed and sent.